---
title: Plugin: UEFI KEK
---

## Introduction

The EFI Key Exchange Key (also known as `KEK`) contains multiple certificates used to update the
`db`, all signed by the `PK`.

This plugin allows updating the `KEK` with new certificates signed by the OEM vendor.

## Firmware Format

The daemon will decompress the cabinet archive and extract a firmware blob in `EFI_SIGNATURE_LIST`
format.
See <https://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf> for details.

This plugin supports the following protocol ID:

* `org.uefi.dbx2`

## GUID Generation

These devices use the GUID constructed of the uppercase SHA256 of the X.509 certificate. e.g.

* `UEFI\CRT_{sha256}`

Additionally, the subject vendor and name are used if provided.

* `UEFI\VENDOR_{vendor}&NAME_{name}`

## Update Behavior

The firmware is deployed when the machine is in normal runtime mode, but it is only activated when
the system is restarted.

## Vendor ID Security

The vendor ID is set from the certificate vendor, e.g. `UEFI:Microsoft`.

## External Interface Access

This plugin requires:

* Read and write access to `/sys/firmware/efi/efivars`

## Version Considerations

This plugin has been available since fwupd version `2.0.8`.
