Blueprint for Secure Boot and Data Integrity Using rustBoot...
summary
Blueprint provides a concrete implementation: use rustBoot or U-Boot signed FIT images to authenticate kernel/initramfs, compute a dm-verity hash tree for the rootfs and store the root hash in the signed initramfs, then mount the verified read-only root and enable writeability with OverlayFS. The project supplies scripts to compute/sign hashes and initramfs hooks that set up dm-verity and error handling; the U-Boot → signed FIT → initramfs → dm-verity path works in practice, while rustBoot shows a performance bug and kernel-modification constraints limit some variants.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:57Security experiences in automotive
- 5:21Secure boot for IoT devices
- 8:11Bootloader options
- 9:55Root filesystem integrity
- 12:47Transferring root hash
- 16:41Secure boot and data integrity options
- 18:45Future plans and open-sourcing
- 20:36Q&A
related talks
49mSecure Boot from A to Z
42mPractical Application of Verified Boot
48mVerified Boot on Chrome OS and How to do it yourself
48mVerified Boot on ARM
55mVerified Boot: From ROM to Userspace
42mBecoming a tyrant: Implementing secure boot in embedded devices- 42mPractical Application of Verified Boot
45mUsing Secure Boot for the powers of good