Secure and Encrypted Boot in Zephyr RTOS
summary
MCUboot with HAB on i.MX RT verifies a CSF-signed MCUboot using a public-key hash fused into OTP via goSign/CST, then chain-loads Zephyr from slot0/slot1; MCUboot’s minimal stripped image fits ~32 KB OC RAM for on-chip verification. Hardware roots use DCP crypto or external vaults (TPM/EdgeLock) and TF‑M on nRF91 to retrieve public-key hash from OTP and enable encrypted boot and key vaulting while West+imgtool produce the signed images.
AI-written summary · about
chapters (15)
- 0:00Introduction to speaker
- 1:32MCUboot overview
- 3:38Memory layout
- 6:06Chain of trust
- 7:44Hardware secure boot
- 10:32Secure boot constraints
- 12:03MCUboot image signing
- 12:52Image verification flow
- 16:42Hardware key utilization
- 17:25Implementing key retrieval
- 18:24nRF91 hardware key example
- 19:17Secure boot summary
- 19:46Advanced security topics
- 21:11TF-M and Secure World
- 21:56Future work and Q&A
related talks
21mSecure and Encrypted Boot in Zephyr RTOS
46mEnhancing System Security by Integrating Zephyr Bootloader and MCUboot
49mSecure Boot from A to Z
38mBoot to Cloud Security Considerations with IoT
48mVerified Boot on ARM
39mMCUboot: Multi-Image Support
55mVerified Boot: From ROM to Userspace
24mIntroduction to MCUboot: Secure Bootloader and Easy Firmware Updates