What Is the UEFI Secure Boot Authorized Database?

The Authorized Database, commonly referred to as db, is a critical security store within UEFI Secure Boot firmware configurations. Its primary function is to maintain a repository of trusted cryptographic certificates, public keys, and binary hashes used to authenticate bootloaders, kernel images, and hardware option ROMs. By allowing only verified software to execute during the pre-boot phase, the database ensures the integrity of the operating system and defends the system against low-level persistent threats like bootkits and rootkits.

Definition and Purpose of the Authorized Database

In a UEFI (Unified Extensible Firmware Interface) environment, Secure Boot relies on a public-key infrastructure to create a hardware-rooted chain of trust. The Authorized Database (db) is stored in non-volatile, secure NVRAM on the motherboard.

When a computer initializes, the UEFI firmware queries the db to determine if the next-stage firmware or software components are permitted to run. If an executed binary matches a valid signature or cryptographic hash within the database, the firmware executes it; if the binary fails verification, the boot process halts immediately to prevent untrusted code execution.

Components Stored in the Database

The Authorized Database typically contains two forms of trust anchors:

1. Cryptographic Certificates and Public Keys: Most commonly, db holds X.509 certificates. Any EFI executable digitally signed by a private key corresponding to one of these stored public certificates is automatically trusted. In mainstream consumer hardware, the database typically contains certificates issued by Microsoft (such as the Microsoft Windows Production PCA and the Microsoft Corporation UEFI CA) to enable out-of-the-box compatibility with Windows and various Linux distributions.
2. Cryptographic Hashes: Individual EFI binaries can be whitelisted by their SHA-256 hash. This allows specific, unsigned or custom binaries to boot without requiring a broader corporate signing authority.

Position in the Secure Boot Trust Hierarchy

The Authorized Database operates within a strict hierarchy of keys governed by UEFI standards:

• Platform Key (PK): The root of trust, usually held by the device manufacturer (OEM), which controls access to the Key Exchange Key.
• Key Exchange Key (KEK): Controls updates to both the Authorized Database (db) and the Forbidden Database (dbx).
• Authorized Database (db): Authorizes system components, bootloaders, and Option ROMs.

Because the db resides beneath the KEK in the trust hierarchy, any addition, deletion, or modification of entries in the db must be cryptographically signed by a valid KEK private key. This prevents unauthorized applications from adding their own signatures to the trust list once inside the operating system.

Interplay with the Forbidden Database (dbx)

The Authorized Database does not operate in isolation; it works directly alongside the Forbidden Signatures Database (dbx). While the db explicitly defines what is allowed to run, the dbx maintains a revocation list of known vulnerable, compromised, or revoked keys and hashes.

During the validation process, the UEFI firmware checks the binary against the dbx before checking the db. If a binary matches a certificate in the Authorized Database but its specific hash has been added to the dbx due to a discovered vulnerability, the system will reject the file, ensuring that revoked software cannot bypass security.