UEFI Capsule Update Payload Verification Standards

UEFI capsule updates rely on asymmetric digital signatures and cryptographic hashing rather than symmetric encryption to ensure payload authenticity and integrity prior to flashing. Defined within the UEFI Specification and aligned with industry guidelines like NIST SP 800-147, these standards use public key cryptography packaged in standard formats to verify that a firmware payload originates from an authorized vendor and has not been altered in transit.

Digital Signature Schemes

Payload verification primarily utilizes asymmetric key cryptography to validate digital signatures against a root certificate or public key embedded in the existing trusted firmware image:

  • RSA (Rivest–Shamir–Adleman): RSA is the most widely adopted standard across hardware vendors. Typical implementations use RSA-2048, RSA-3072, or RSA-4096. The signature schemes usually follow PKCS #1 v1.5 or the more modern RSA-PSS (Probabilistic Signature Scheme).
  • ECDSA (Elliptic Curve Digital Signature Algorithm): Supported in modern UEFI implementations to offer equivalent security to high-bit RSA keys with smaller key sizes and faster compute times. Common elliptic curves utilized include NIST P-256, P-384, and P-521.

Cryptographic Hash Algorithms

Signatures are computed over a secure cryptographic hash of the update payload. The UEFI specification deprecates legacy algorithms in favor of the Secure Hash Algorithm 2 (SHA-2) family:

  • SHA-256: The baseline standard mandated by most hardware and operating system platforms.
  • SHA-384 & SHA-512: Frequently used in enterprise, server, and high-security environments to pair with higher-grade keys such as RSA-3072/4096 or ECDSA P-384/P-521.
  • SHA-1 and MD5: Historically supported in older firmware implementations, but now strictly deprecated and rejected by modern UEFI secure boot and capsule verification engines due to collision vulnerabilities.

Container and Certificate Packaging Formats

Firmware binaries are packaged with their verification metadata using standardized message formats:

  • PKCS #7 / CMS (Cryptographic Message Syntax): Capsule payloads typically wrap the signed binary along with the vendor signature inside a PKCS #7 SignedData structure (RFC 5652).
  • X.509 v3 Certificates: Public key infrastructure (PKI) inside the firmware relies on X.509 format certificates to establish the trust chain. A pre-enrolled root or intermediate certificate stored in non-volatile, write-protected system memory validates the signer's certificate.

Industry and Ecosystem Mandates

While the core UEFI specification permits multiple cryptographic primitives, commercial implementations follow stricter platform guidelines:

  • Microsoft Windows Secure Boot and Update Requirements: Mandate a minimum of RSA-2048 with SHA-256 or ECDSA with SHA-256 for firmware updates.
  • NIST SP 800-147 (BIOS Protection Guidelines): Recommends cryptographic mechanisms using minimum 112-bit security strength (equivalent to RSA-2048 / SHA-256) for system firmware authenticity verification.