Practical Application of Verified Boot
summary
Practical guide to building a verified-boot chain using Yocto recipes, NXP tools and on-device attestation: demonstrates using signing.bbclass in Yocto with NXP CST to sign bootloaders, an upstreaming fitimage class for kernel+DT validation, and a dm-verity class for filesystem integrity, with build-time signing tied to a Nitrokey HSM. Describes a working imx6 project, explains irreversible risk of burned fuses irreversible for provisioning, CI dangers of release-key leakage, and GPLv3 workarounds via an unlock mode.
AI-written summary · about
chapters (13)
- 0:00Verified boot concepts
- 1:06Verified boot complexity
- 3:54ARM verified boot implementations
- 5:58Verified boot case study
- 8:30PKCS#1 and HSMs for secure boot
- 12:23Project knowledge handover
- 15:51Key management challenges
- 18:45Bootloader security trade-offs
- 21:54Documentation for verified boot
- 24:49Field return device handling
- 26:54Yocto HSM signing
- 28:20Conclusion and recommendations
- 29:25Q&A
related talks
42mPractical Application of Verified Boot
49mSecure Boot from A to Z
48mVerified Boot on ARM
42mBecoming a tyrant: Implementing secure boot in embedded devices
55mVerified Boot: From ROM to Userspace
21mSecure and Encrypted Boot in Zephyr RTOS
48mVerified Boot on Chrome OS and How to do it yourself
46mEnhancing System Security by Integrating Zephyr Bootloader and MCUboot