Skip to content

Commit a715634

Browse files
authored
Merge pull request #227 from umbynos/umbynos/fix-secureboot-docs
update secureboot tutorial
2 parents 9f1082e + c5c06b2 commit a715634

File tree

1 file changed

+3
-3
lines changed
  • content/hardware/04.pro/boards/portenta-h7/tutorials/secure-boot

1 file changed

+3
-3
lines changed

content/hardware/04.pro/boards/portenta-h7/tutorials/secure-boot/secure-boot.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ In other words, secure boot ensures that the boot technology and operating syste
2222
## Hardware & Software Required
2323
- [Portenta H7](https://store.arduino.cc/portenta-h7)
2424
- Arduino IDE 1.8.19+ or Arduino IDE 2.0.0-rc5+ (https://www.arduino.cc/en/software)
25-
- [Arduino Core for mbed enabled devices](https://github.com/arduino/ArduinoCore-mbed) version 3.0.0+
25+
- [Arduino Core for mbed enabled devices](https://github.com/arduino/ArduinoCore-mbed) version 3.1.0+
2626
- [imgtool](https://github.com/arduino/imgtool-packing/releases/latest) (optional)
2727

2828
## Instructions
@@ -34,7 +34,7 @@ In order to have secure boot enabled you must update the bootloader on your Port
3434
Once The bootloader has been updated to MCUboot, it's possible to use [secure boot](https://www.keyfactor.com/blog/what-is-secure-boot-its-where-iot-security-starts/) to have an additional layer of security. From that point on it is required to upload a compiled sketch with the Custom Board Option **"Security settings"** set to **"Signature + Encryption"** (the option can be found under **Tools > Security settings** in the IDE when selecting Portenta H7 as board, or you can use `--board-options security=sien` if using the Arduino CLI). Failing to provide such option will cause the bootloader not to run the compiled sketch because it is not trusted.
3535

3636
If the security keys are not overridden, the default ones are used.
37-
Two keys are embedded in the example sketch `STM32H747_updateBootloader` which can be found in **Files > Examples > STM32H747_System > STM32H747_updateBootloader** and used by the bootloader.
37+
Two keys are embedded in the example sketch `STM32H747_manageBootloader` which can be found in **Files > Examples > STM32H747_System > STM32H747_manageBootloader** and used by the bootloader.
3838
A private 256bit [ECDSA](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) key is used to extract the encryption key and decrypt the binary update (`ecdsa-p256-encrypt-priv-key.h`), while a public key is used for image verification (`ecdsa-p256-signing-pub-key.h`).
3939

4040
As counterpart, when building the image update, imgtool uses this private [key](https://github.com/arduino/ArduinoCore-mbed/pull/447/files#diff-f43e4850d60c61854678f6f80c6ddc4b59e3e68ca7e71b02e5ed15288c9aadb4) to sign the image and this public [key](https://github.com/arduino/ArduinoCore-mbed/pull/447/files#diff-95bb7b27de14276896a2bec099dc5a498d5332616458c04263efc8d24810e6a6) for image encryption with elliptic curve integrated encryption scheme.
@@ -61,7 +61,7 @@ imgtool getpriv -k my-encrypt-keyfile.pem > ecsda-p256-encrypt-priv-key.h
6161
imgtool getpub -k my-sign-keyfile.pem > ecsda-p256-signing-pub-key.h
6262
```
6363

64-
Now you have to replace the keys inside the Sketch to update the bootloader(**STM32H747_updateBootloader**).
64+
Now you have to replace the keys inside the Sketch to update the bootloader(**STM32H747_manageBootloader**).
6565
To do so just save the sketch to another location and replace the `ecsda-p256-encrypt-priv-key.h` and `ecsda-p256-signing-pub-key.h` files with the newly generated ones and then [update the bootloader](https://docs.arduino.cc/tutorials/portenta-h7/updating-the-bootloader) again.
6666

6767
***NOTE: In case the keys are compromised, this process can be performed again with a new set of keys, but any firmware signed with the previous pair will no longer work.***

0 commit comments

Comments
 (0)