Precision 7920 - Issue Deleting Platform Key (PK) for Secure Boot

Question

I am experiencing an issue with managing the Platform Key (PK) in the BIOS of my Dell Precision 7920 desktop. My system has TPM (Trusted Platform Module) enabled.

I previously enrolled custom keys in the BIOS to enable Secure Boot with a Linux distribution. I have now installed a new Linux distribution and need to enroll a new set of custom keys to be able to enable Secure Boot.

However, I am unable to delete the existing Platform Key. I have attempted the following actions within the BIOS Custom Key Management settings:

Reset All Keys: This action cleared the other key databases (like KEK, db, dbx), but the original Platform Key remains.
Factory Reset: Performing a factory reset of the BIOS also did not remove the existing Platform Key nor revert it to the default Dell PK (PKDefault).
Delete All Keys: I have tried the option to delete all keys within the Custom Key Management section, but the Platform Key persists.
Deleting Individual Keys: I also attempted to delete the individual Platform Key, but it did not result in the key being removed.

The screenshot below shows the efi variables and the PK is different even after a factory reset

It appears that only the forbidden signature database (dbx) was successfully cleared through these attempts.

My goal is to either delete the current Platform Key so I trigger setup mode and enroll new custom keys for my current Linux installation or force the system to use the Dell PKDefault key so that I can install windows 11 with secure boot enabled and sell my computer. Unfortunately, I no longer have access to the signing key that was used to enroll the initial custom Platform Key.

Could you please provide guidance on how to completely remove the existing Platform Key from my Precision 7920 BIOS or how to force it to utilize the PKDefault key? I need to do this to successfully configure Secure Boot with my new Linux distribution.

Thank you for your time and assistance.

Sincerely,

devshah

Chino de Oro · Answer

Clear your TPM to see if it may help.

Devshah · Answer

Thank you for the suggestion. After attempting to clear the TPM, the issue persists. Based on the UEFI specification version 2.7, section 31.3.2, clearing the Platform Key (PK) should be possible through either:

Signing a new PK with the existing PK, which is not feasible in my case due to the absence of the current PK's private key.
A secure, platform-specific method, which I believe the 'delete all keys' option is intended to execute.

Therefore, my question is: If the 'delete all keys' method is failing to clear the PK, is this a BIOS bug, and who should I contact to report it?

Chino de Oro · Answer

For warranty and technical support, click on Get Help Now button on lower right of this screen.

user9486 · Answer

I would suggest looking into this Cybersecurity Technical Report published by the National Security Agency in 2023:

UEFI Secure Boot Customization

The authors of this technical report recommend using Keytool. I know it is not the answer you are looking for—as me, you would prefer this ability being implemented in firmware but at least we have a workaround to remove the dangerous platform key from our workstations:

Keytool may or may not have the ability to replace or delete the existing keys and start fresh depending on UEFI implementation. Keytool is usually a reliable way to replace the PK even when UEFI configuration or command line calls fail.

Let us know if it works for you.

Precision Fixed Workstations

Precision 7920 - Issue Deleting Platform Key (PK) for Secure Boot

Was this post helpful?