Secure Boot from A to Z
summary
Implemented a full chain‑of‑trust on an i.MX6 custom board with ROM-stored root hashes, OTP fuses to lock verification, and U-Boot FIT images embedding public keys; keys and certificates are created with CST, mkimage and U-Boot tooling and kernels are signed and verified by U-Boot. Rootfs is read‑only squashfs, authenticated with dm-verity with squashfs and switch_root using veritysetup; Yocto required a custom image class to break a build-order loop. Work takes ~6 months part‑time and no boards are bricked in deployment.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 5:00Encryption vs Signature
- 7:36Consequences
- 8:51Root of Trust
- 14:49Bootloader
- 18:21Creating keys
- 19:14Device tree
- 20:13Container
- 21:09Image
- 22:58Configuration
- 23:27Verification
- 25:05Root filesystem
- 28:48Verity Setup
- 29:49Ash Tree Setup
- 31:13Ash Offset
- 32:55Devicemapper
- 35:22Boot Environment Script
- 38:17Summary
- 38:52Yocto
- 40:23Conclusion
- 42:17Questions
related talks
48mVerified Boot on ARM
55mVerified Boot: From ROM to Userspace
42mPractical Application of Verified Boot
24mSecure and Encrypted Boot in Zephyr RTOS
21mSecure and Encrypted Boot in Zephyr RTOS- 42mPractical Application of Verified Boot
42mBecoming a tyrant: Implementing secure boot in embedded devices
48mVerified Boot on Chrome OS and How to do it yourself