Verified Boot on ARM
summary
An implementation of a verified boot chain on ARM i.MX6/i.MX28 is described using mask ROM and one‑time‑programmable fuses that store the public‑key hash, with RSA verification chaining ROM → U‑Boot → kernel → initramfs. File integrity is enforced via Linux IMA/EVM using an HMAC keyed by a hardware‑unique key (Unik) to protect writable filesystems; RSA verification speed is a few hundred files/sec and Freescale specifies 96‑bit entropy for the Unik. A live demo shows a successful secure boot and refusal to permit access to a file that was tampered with after boot.
AI-written summary · about
chapters (8)
- 0:00Verified Boot on ARM
- 4:05Verified Boot importance
- 10:59Hardware security basics
- 18:50Bootloader and kernel signing
- 26:17Linux IMA/EVM verification
- 34:14Security updates and key management
- 40:38Implementation and hardware
- 46:23Q&A
related talks
49mSecure Boot from A to Z
55mVerified Boot: From ROM to Userspace
42mPractical Application of Verified Boot
21mSecure and Encrypted Boot in Zephyr RTOS
48mVerified Boot on Chrome OS and How to do it yourself- 42mPractical Application of Verified Boot
24mSecure and Encrypted Boot in Zephyr RTOS
39mSecuring firmware: Secure and Trusted boot in OpenBMC