The Cost of Security: Measuring and Reducing Boot-Time Impact

on YouTube ↗48m

" summary

On an i.MX8M Plus eval board with Barebox and eMMC, secure boot using a signed FIT image plus dm-verity raises boot from 5.23s to 6.12s — about 205 ms overhead — largely from larger FIT/unpack and initramfs work. Replacing a bulky 7 MB BusyBox initramfs with a Rust initramfs binary (130 KB uncompressed, 57 KB compressed) drops kernel load back toward nonsecure times (kernel load ~490 ms, kernel startup ~1.9 s) and the change proves effective. Using ARMv8 crypto extensions instead of the SoC crypto engine trims ~40 ms in userspace verification.

AI-written summary · about

" chapters (9)

1. 0:00Motivation for boot time security
2. 3:37Boot process components
3. 7:27Measuring boot time
4. 11:48Secure boot chain of trust
5. 16:26Secure boot impact on boot time
6. 21:11Rust initramfs replacement
7. 27:14Optimizing kernel cryptography
8. 31:57Measured overhead summary
9. 38:50Q&A

" related talks

• 55mVerified Boot: From ROM to UserspaceMarc Kleine-Budde · Embedded Linux Conference + OpenIoT Summit Europe 2016
• 24mSoftware Optimization for Early Linux Boot for Time Critical...Soumya Tripathy, Aashvij Shenai · Embedded Linux Conference @ EOSS NA 2024
• 49mSecure Boot from A to ZMylène Josserand, Quentin Schulz · Embedded Linux Conference + OpenIoT Summit North America 2018
• 48mVerified Boot on ARMJan Lübbe · FrOSCon 2015
• 23mBlueprint for Secure Boot and Data Integrity Using rustBoot...Philipp Ahmann, Ulrich Matejek · Linux Security Summit Europe 2023
• 42mBecoming a tyrant: Implementing secure boot in embedded devicesIrving Tjiptowarsono · linux.conf.au 2022
• 53mSecure Embedded Linux Product - A Success StoryMartin Bis · Embedded Linux Conference Europe 2013
• 44mImproving kexec boot timeUsama Arif · Linux Plumbers Conference 2023