Open Source Summit Europe 2024

MCUboot enables secure booting of Zephyr RTOS using asymmetric cryptographic signature verification with a public key. The hash of the public key is embedded or compiled with the MCUboot binary by default, which is used for checking the integrity of the public key. To tamper-proof, as an alternate secure boot option, the hash of the public key can be stored securely and retrieved when hardware keys are enabled. Security of embedded SoC's (e.g., i.MX RT) offers more capabilities, such as High Assurance Boot (HAB), Data Co-Processor (DCP), or Trusted Firmware-M (TF-M) implementing the Trustzone for SoC's (e.g., nRF91) to enable secure storage with hardware crypto acceleration or external security modules (e.g., TPM, EdegeLock) to store keys in hardware vaults.

This talk will detail MCUboot secure booting with hardware keys. NXP i.MX RT as an example using HAB for booting singed and encrypted bootloader MCUboot, enabling hardware root of trust, and booting Zephyr RTOS using keys from OTP for verification. We will also see about using the TF-M backend and OTP for secure booting Trustzone-enabled SoCs.