Queries Regarding Secure Boot

RE: Queries Regarding Secure Boot

Hung Bui — Tue, 21 Jan 2020 12:43:20 GMT

Hi Devang,

- The init packet is always signed. It's part of the Secure DFU bootloader. Unless you use Open Bootloader the signing of the init packet is obligated. Inside the init packet is the hash of the images so this mean the image is also signed. Only the signature of the init packet is transferred. It's also used to verify the image on each boot (if boot validation with signature enabled)

- Correct, the bootloader validate the app and/or the softdevice on every boot using the signature.

- MBR will not validate the bootloader. The assumption here is that the MBR and the bootloader, which is the foundation of the secure boot won't be modified or compromised. If the system work correctly, the application won't be able to modify the bootloader, it's protected by the BPROT or ACL in the hardware. The bootloader when being updated, will be verified by the original bootloader with a signature before it update itself. In short, the bootloader is only verified only once. But there shouldn't be any easy way to compromise the bootloader, as far as we know until now.

RE: Queries Regarding Secure Boot

devang r dixit — Mon, 20 Jan 2020 17:40:15 GMT

Hi Hung,

Thanks for the information but still some confusion. Please clarify. You mean to say if I use the SDkv16.0 and enable the option NRF_BL_APP_SIGNATURE_CHECK_REQUIRED my images are signed and the bootloader verifies whenever it boots? the signature of the images is transferred as part of the Init packet? Is the Init packet signed?

Form the link whatever you have shared what does the following statement mean

“Only the SoftDevice and the application can be validated because the bootloader performs the validation. Note that bootloaders are always checked when they are updated.”

Does this mean that Bootloader will validate the application and SoftDevice using the signature whenever the bootloader is executed by MBR?

Does this mean that MBR will not validate the bootloader signature whenever it tries to invoke it?

“Note that bootloaders are always checked when they are updated” does this statement mean when the bootloader is updated using the DFU the bootloader signature is validated? (only once)

RE: Queries Regarding Secure Boot

Hung Bui — Mon, 13 Jan 2020 15:53:11 GMT

Hi,

Secure Boot is implemented in our bootloader from nRF SDK v16.0. You can read about the Secure Boot here.

The init packet contain the hash of the actual image. So when you sign the content of the init packet it also verify that the hash value of the DFU image.

What do you mean by "store the public key in flash instead of compiling it with bootloader" ? The public key will still be in flash regardless how you store it. The public key is protected from the application the same way as the bootloader is protected from the application when booting up with Secure Boot.

RE: Queries Regarding Secure Boot

devang r dixit — Mon, 13 Jan 2020 06:45:39 GMT

Also please provide the Penetration test result for nrf52840.