Secure and Encrypted Boot in Zephyr RTOS
summary
Demonstrates how MCUboot verifies Zephyr images using signed (and optionally encrypted) bootloaders, with an NXP i.MX RT example that uses HAB to boot a signed/encrypted MCUboot and stores the public‑key hash in OTP so ROM can enforce a hardware root of trust. Shows the MCUboot hook that retrieves the key hash from OTP/TPM/HSM instead of the TLV, discusses RSA/ECDSA signature sizes and the OC RAM size limit needed to copy images, and outlines a TF-M backend for TrustZone-enabled SoCs.
AI-written summary · about
chapters (8)
- 0:00Introduction to secure boot
- 1:25MCUboot overview
- 2:55Memory layout and chain
- 4:14Implementing secure boot
- 13:50Hardware key integration
- 14:29Updatability and security
- 14:47TrustZone and future work
- 19:05Q&A and concluding remarks
related talks
24mSecure and Encrypted Boot in Zephyr RTOS
46mEnhancing System Security by Integrating Zephyr Bootloader and MCUboot
49mSecure Boot from A to Z
38mBoot to Cloud Security Considerations with IoT
48mVerified Boot on ARM
39mMCUboot: Multi-Image Support
55mVerified Boot: From ROM to Userspace
42mPractical Application of Verified Boot