Are there any examples out there of silicon vendors who do a great job at explaining how to properly setup, configure, and use their secure boot implementation?
I’ve now worked with 3 different silicon vendors’ secure boot implementations and so far I’m greatly underwhelmed at the quality of documentation and tooling provided. Maybe I’ve just not yet worked with a good one?
Some examples of what frustrates me:
- Documentation recommends using an HSM to store signing keys but provides no actual tools to leverage an HSM with their other boot-assembly tools.
- Documentation only gives examples or exact steps but these only work on unfused/unsecured SoCs on the devkit, using modes which are meant to be used in development, not in production shipping units on custom hardware.
- Documentation uses many different names to refer to the same thing, either across documents or even within the same document. For example, fuse names, bitslice names in binary headers, etc.
- Secure boot assembly and inspection tools incorrectly or incompletely perform verification checks. So when you have a secure-boot-enabled binary which doesn’t boot, the tools aren’t helpful to explain why it won’t boot.
- Secure boot tools don’t compile on modern Linux. I don’t even mean modern-modern, I mean like Debian stable or even oldstable.
- NDAs are required to get critical documentation and tools. Secure boot authentication and encryption security relies entirely on the algorithms chosen and their proper implementation. Gating documentation on how to use the tooling does not make anything more secure, it just frustrates engineers.
- Real world field key revocation schemes are not documented, at all. Often times it is critical to coordinate a software update with blowing of fuses in order to revoke a key and continue to have a functional board. Giving examples of the proper order to do this in, with advice on gotchas, is critical, but so far never provided by any silicon vendor I’ve worked with.
I will at least call out NVIDIA for trying with Jetson, they have been slowly improving their documentation around secure boot and I don’t think you need an NDA to read their docs. And NVIDIA’s FSKP mechanism such that you can give a less-than-trusted contract manufacturer a secured way to blow secure boot fuses for you is indeed a very helpful thing. But their docs and tools are still riddled with issues, some of which are listed above.