Revised Secure Boot in Getting Started.

Change-Id: I4bf4cc5f765aa3cebf7d227cf758963e44f796a0

1 files changed, 35 insertions, 47 deletions

diff --git a/doc/book-enea-nfv-access-getting-started/doc/secure_boot.xml b/doc/book-enea-nfv-access-getting-started/doc/secure_boot.xml
index cf2e935..7b07086 100644
--- a/doc/book-enea-nfv-access-getting-started/doc/secure_boot.xml
+++ b/doc/book-enea-nfv-access-getting-started/doc/secure_boot.xml
@@ -18,10 +18,10 @@
 
     <para>The basic principle of UEFI Secure Boot is that it requires all
     artifacts involved in the boot process (bootloaders, kernel, initramfs) to
-    be signed using a set of private keys. On a Secure Boot enabled uCPE device
-    these artifacts are checked against a set of public certificates which
-    correspond to these keys. If there are any mismatches the boot process
-    will fail at various stages.</para>
+    be signed using a set of private keys. On a Secure Boot enabled uCPE
+    device these artifacts are checked against a set of public certificates
+    which correspond to these keys. If there are any mismatches the boot
+    process will fail at various stages.</para>
 
     <para>For more information about Secure Boot please refer to <ulink
     url="https://www.uefi.org/sites/default/files/resources/UEFI_Secure_Boot_in_Modern_Computer_Security_Solutions_2013.pdf">Secure
@@ -35,8 +35,8 @@
     signed using the Enea UEFI Secure boot private keys. These artifacts can
     be used on a uCPE device that doesn't have Secure Boot enabled. To use the
     Secure Boot feature, however, the user must make the Enea UEFI Secure Boot
-    public certificates available on the uCPE device before enabling the feature
-    in BIOS. This process is called "Provisioning".</para>
+    public certificates available on the uCPE device before enabling the
+    feature in BIOS. This process is called "Provisioning".</para>
 
     <section id="manual_key_provisioning">
       <title>Provisioning the Enea UEFI Secure Boot Certificates</title>
@@ -51,18 +51,17 @@
 
       <itemizedlist>
         <listitem>
-          <para><literal>Platform Key (PK)</literal>: the purpose of this key
-          is to protect the next key from uncontrolled modification. Once this
-          key is enrolled, Secure Boot enters into <literal>User
-          Mode</literal>. The drivers and loaders signed with the
-          <literal>platform key</literal> can then be loaded by the
-          firmware.</para>
+          <para><literal>Platform Key (PK)</literal>: this key protects the
+          next key from uncontrolled modification. Once this key is enrolled,
+          Secure Boot enters into <literal>User Mode</literal>. The drivers
+          and loaders signed with the <literal>Platform Key</literal> can then
+          be loaded by the firmware.</para>
         </listitem>
 
         <listitem>
           <para><literal>Key Exchange key (KEK)</literal>: this key allows
           other certificates which have a connection to the private portion of
-          the <literal>platform key</literal> to be used.</para>
+          the <literal>Platform Key</literal> to be used.</para>
         </listitem>
 
         <listitem>
@@ -75,7 +74,7 @@
       <para>The Enea UEFI Secure Boot certificates are installed together with
       the Enea NFV Access Run Time Platform onto the hard drive. They can be
       found on the EFI partition (usually the first partition of the drive)
-      under /uefi_sb_keys.</para>
+      under <literal>/uefi_sb_keys</literal>.</para>
 
       <para><emphasis role="bold">How to manually enroll Enea
       Certificates</emphasis></para>
@@ -83,11 +82,12 @@
       <orderedlist>
         <listitem>
           <para>Reboot the uCPE device and press <literal>DEL</literal> to
-          enter into the BIOS.</para>
+          enter into BIOS.</para>
         </listitem>
 
         <listitem>
-          <para>Select "Secure Booot Mode" -&gt; "Custom".</para>
+          <para>Select <literal>Secure Boot Mode</literal> -&gt;
+          <literal>Custom</literal>.</para>
         </listitem>
 
         <listitem>
@@ -98,19 +98,15 @@
         <listitem>
           <para>Enroll the <literal>Platform Key (PK)</literal>: <itemizedlist>
               <listitem>
-                Select "Set New Key" -&gt; "File from a file system".
+                 Select <literal>Set New Key</literal> -&gt; <literal>File from a file system</literal>. 
               </listitem>
 
               <listitem>
-                Specify the folder:
-
-                <literal>&lt;user-keys&gt;/&lt;uefi_sb_keys&gt;/PK.esl</literal>
-
-                .
-              </listitem>
+                 Specify the folder: 
+                <literal>&lt;user-keys&gt;/&lt;uefi_sb_keys&gt;/PK.esl</literal>.</listitem>
 
               <listitem>
-                Select "Public Key Certificate" and then "Ok".
+                 Select <literal>Public Key Certificate</literal> and then <literal>Ok</literal>. 
               </listitem>
             </itemizedlist></para>
         </listitem>
@@ -119,40 +115,35 @@
           <para>Enroll the <literal>Key Exchange key (KEK)</literal>:
           <itemizedlist>
               <listitem>
-                Select "Set New Key" -&gt; "File from a file system".
+                 Select <literal>Set New Key</literal> -&gt; <literal>File from a file system</literal>. 
               </listitem>
 
               <listitem>
-                Specify the folder:
-
-                <literal>&lt;user-keys&gt;/&lt;uefi_sb_keys&gt;/KEK.esl</literal>
-
-                .
+                 Specify the folder: 
+                <literal>&lt;user-keys&gt;/&lt;uefi_sb_keys&gt;/KEK.esl</literal>.
               </listitem>
 
               <listitem>
-                Select "Public Key Certificate" and then "ok".
+                 Select <literal>Public Key Certificate</literal> and then <literal>Ok</literal>. 
               </listitem>
-            </itemizedlist></para>
+            </itemizedlist>
+                  </para>
         </listitem>
 
         <listitem>
           <para>Enroll the <literal>Authorized Signature (DB)</literal>:
           <itemizedlist>
               <listitem>
-                Select "Set New Key" -&gt; "File from a file system".
+                 Select <literal>Set New Key</literal> -&gt; <literal>File from a file system</literal>. 
               </listitem>
 
               <listitem>
-                Specify the folder:
-
-                <literal>&lt;user-keys&gt;/&lt;uefi_sb_keys&gt;/DB.esl</literal>
-
-                .
+                 Specify the folder: 
+                <literal>&lt;user-keys&gt;/&lt;uefi_sb_keys&gt;/DB.esl</literal>.                 . 
               </listitem>
 
               <listitem>
-                Select "Public Key Certificate" and then "ok".
+                 Select <literal>Public Key Certificate</literal> and then <literal>Ok</literal>.
               </listitem>
             </itemizedlist></para>
         </listitem>
@@ -165,22 +156,19 @@
     </section>
 
     <section id="enable_secure_boot">
-      <title>Turn on Secure Boot in BIOS</title>
+      <title>Turning on Secure Boot in BIOS</title>
 
-      <para>Finally, once the certificates are provisioned we can enable the
-      Secure Boot feature:</para>
+      <para>Once the certificates are provisioned we can enable the Secure Boot feature:</para>
 
       <orderedlist>
         <listitem>
-          <para>Select <literal>Security option</literal> from the top
-          menu.</para>
+          <para>Select <literal>Security option</literal> from the top menu.</para>
         </listitem>
 
         <listitem>
-          <para>Set the <literal>Boot Menu</literal> -&gt;
-          <literal>Enabled.</literal></para>
+          <para>Set the <literal>Boot Menu</literal> -&gt; <literal>Enabled.</literal></para>
         </listitem>
       </orderedlist>
     </section>
   </section>
-</chapter>
+</chapter>
\ No newline at end of file