Upon installing Nvidia drivers I was promoted to set up a MOK password or third party drivers may not work properly, so I created one. After reboot I was presented with a blue MOK management screen with a few options in it, the first one being continue boot. So I chose this and when boot was finished, my second monitor wasn't being recognized. Remembering reading something about secure boot when initially prompted about MOK, I booted into the BIOS and turned secure boot off. Now I have my second screen back. Several questions come to mind.

  1. First, what is MOK?
  2. Do I need it, and if not, how do I get rid of it?
  3. Was losing recognition of my second screen due to installing Nvidia drivers, or setting up MOK?
  4. Can I just keep secure boot off?

Thanks for any help!


ad 1)

MOK (Machine Owner Key) is about securing the boot process by only allowing approved OS components and drivers to run. MOK must be implemented by the "BIOS" - or some startup code inside the computer, anyway.

The main idea is that only code which is signed is allowed to run while loading the operating system (OS). Once that is booted, the OS can take over responsibility for securing the system from the BIOS.

The MOK system uses public key cryptography, which means that you can create a key pair, then sign, with your private/secret key, all components that are allowed to run. This includes the GRUB boot loader itself. Then the BIOS uses your public key (you need to install it) to check signatures before running the code.

Here are some docs on Secure Boot and MOK

The beauty of MOK, in my personal opinion, is that you can create the keys yourself and sign those components that you trust. In the past, the EFI BIOS had only Microsoft' public key installed and they were hesitant to sign Linux boot loaders :-) That's why you needed SHIM in the past (a go-between between EFI BIOS and GRUB).

All Secure Boot methods hope to secure the system from hackers and viruses by guaranteeing a cleanly booted system which is not tampered by malware. If startup code or drivers have been tampered with, it is detected so that you can act accordingly.

Kyle Rankin has done a lot of work on securing the boot process for the Librem range of Laptops, and here is a good article on his work. I believe it is well worth reading even if it is not directly applicable to your system - the idea is just the same.

ad 2) and 4)

Do you need MOK and Secure Boot? Not if you will never be successfully attacked by a hacker, especially one who might have physical access to your laptop or gains root access from the Internet through browser/office/Linux bugs.

  • Thank you for responding so quickly, I'll read up on the docs. – VernonB Aug 13 at 19:59
  • Most firmware still "only" have microsoft public key (I mean, unless you buy a Librem laptop, everybody else cares to make Windows fully happy). Be it in the past or today, you could always customize them to add or remove keys then. Shim is only needed if you don't want users having to bother with the system's own messy utilities. – mirh Aug 13 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.