Skip to content

update secureboot tutorial #227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 16, 2022
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ In other words, secure boot ensures that the boot technology and operating syste
## Hardware & Software Required
- [Portenta H7](https://store.arduino.cc/portenta-h7)
- Arduino IDE 1.8.19+ or Arduino IDE 2.0.0-rc5+ (https://www.arduino.cc/en/software)
- [Arduino Core for mbed enabled devices](https://github.com/arduino/ArduinoCore-mbed) version 3.0.0+
- [Arduino Core for mbed enabled devices](https://github.com/arduino/ArduinoCore-mbed) version 3.1.0+
- [imgtool](https://github.com/arduino/imgtool-packing/releases/latest) (optional)

## Instructions
Expand All @@ -34,7 +34,7 @@ In order to have secure boot enabled you must update the bootloader on your Port
Once The bootloader has been updated to MCUboot, it's possible to use [secure boot](https://www.keyfactor.com/blog/what-is-secure-boot-its-where-iot-security-starts/) to have an additional layer of security. From that point on it is required to upload a compiled sketch with the Custom Board Option **"Security settings"** set to **"Signature + Encryption"** (the option can be found under **Tools > Security settings** in the IDE when selecting Portenta H7 as board, or you can use `--board-options security=sien` if using the Arduino CLI). Failing to provide such option will cause the bootloader not to run the compiled sketch because it is not trusted.

If the security keys are not overridden, the default ones are used.
Two keys are embedded in the example sketch `STM32H747_updateBootloader` which can be found in **Files > Examples > STM32H747_System > STM32H747_updateBootloader** and used by the bootloader.
Two keys are embedded in the example sketch `STM32H747_manageBootloader` which can be found in **Files > Examples > STM32H747_System > STM32H747_manageBootloader** and used by the bootloader.
A private 256bit [ECDSA](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) key is used to extract the encryption key and decrypt the binary update (`ecdsa-p256-encrypt-priv-key.h`), while a public key is used for image verification (`ecdsa-p256-signing-pub-key.h`).

As counterpart, when building the image update, imgtool uses this private [key](https://github.com/arduino/ArduinoCore-mbed/pull/447/files#diff-f43e4850d60c61854678f6f80c6ddc4b59e3e68ca7e71b02e5ed15288c9aadb4) to sign the image and this public [key](https://github.com/arduino/ArduinoCore-mbed/pull/447/files#diff-95bb7b27de14276896a2bec099dc5a498d5332616458c04263efc8d24810e6a6) for image encryption with elliptic curve integrated encryption scheme.
Expand All @@ -61,7 +61,7 @@ imgtool getpriv -k my-encrypt-keyfile.pem > ecsda-p256-encrypt-priv-key.h
imgtool getpub -k my-sign-keyfile.pem > ecsda-p256-signing-pub-key.h
```

Now you have to replace the keys inside the Sketch to update the bootloader(**STM32H747_updateBootloader**).
Now you have to replace the keys inside the Sketch to update the bootloader(**STM32H747_manageBootloader**).
To do so just save the sketch to another location and replace the `ecsda-p256-encrypt-priv-key.h` and `ecsda-p256-signing-pub-key.h` files with the newly generated ones and then [update the bootloader](https://docs.arduino.cc/tutorials/portenta-h7/updating-the-bootloader) again.

***NOTE: In case the keys are compromised, this process can be performed again with a new set of keys, but any firmware signed with the previous pair will no longer work.***
Expand Down