[U-Boot] How to perform a secure boot on ARM Linux

[U-Boot] How to perform a secure boot on ARM Linux

[rakesh ranjan]

Hi,

I have a beagle board and want to create a u-boot that verifies the kernel
and rootfs before booting it. Any pointers on how it can be achieved will
be appreciated.

Rakesh

[U-Boot] How to perform a secure boot on ARM Linux

[Detlev Zundel]

Hi Rakesh,

> I have a beagle board and want to create a u-boot that verifies the kernel
> and rootfs before booting it. Any pointers on how it can be achieved will
> be appreciated.

You can start here by reading the provided documentation:

http://git.denx.de/?p=u-boot.git;a=blob;f=doc/uImage.FIT/signature.txt;hb=HEAD

There's also a ELCE 2013 presentation by Simon Glass:

http://events.linuxfoundation.org/sites/events/files/slides/chromeos_and_diy_vboot_0.pdf

And a paper by Jagan Teki from the U-Boot Mini Summit

http://www.denx.de/wiki/pub/U-Boot/MiniSummitELCE2013/U-Boot_verified_RSA_boot_flow_on_arm_target.pdf

The mailing list is surely the right place for further questions ;)

Cheers
  Detlev

-- 
There are two hard things in computer science: cache invalidation,
naming things, and off-by-one errors.
--
DENX Software Engineering GmbH,      MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich,  Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-40 Fax: (+49)-8142-66989-80 Email: dzu at denx.de

[U-Boot] How to perform a secure boot on ARM Linux

[Jagan Teki]

On Mon, Jan 20, 2014 at 8:46 PM, Detlev Zundel <dzu@denx.de> wrote:
> Hi Rakesh,
>
>> I have a beagle board and want to create a u-boot that verifies the kernel
>> and rootfs before booting it. Any pointers on how it can be achieved will
>> be appreciated.
>
> You can start here by reading the provided documentation:
>
> http://git.denx.de/?p=u-boot.git;a=blob;f=doc/uImage.FIT/signature.txt;hb=HEAD
>
> There's also a ELCE 2013 presentation by Simon Glass:
>
> http://events.linuxfoundation.org/sites/events/files/slides/chromeos_and_diy_vboot_0.pdf
>
> And a paper by Jagan Teki from the U-Boot Mini Summit
>
> http://www.denx.de/wiki/pub/U-Boot/MiniSummitELCE2013/U-Boot_verified_RSA_boot_flow_on_arm_target.pdf
>
> The mailing list is surely the right place for further questions ;)

One more paper to Detlev pointers!
http://www.denx.de/wiki/pub/U-Boot/OpenSourceIndia2013/Multi_image_booting_scenarios.pdf

-- 
Jagan.

[U-Boot] How to perform a secure boot on ARM Linux

[Marek Vasut]

On Monday, January 20, 2014 at 01:40:52 PM, rakesh ranjan wrote:
> Hi,
> 
> I have a beagle board and want to create a u-boot that verifies the kernel
> and rootfs before booting it. Any pointers on how it can be achieved will
> be appreciated.
> 
> Rakesh

See doc/uImage.FIT/verified-boot.txt and doc/uImage.FIT/signature.txt in the 
source tree .

Best regards,
Marek Vasut

[U-Boot] How to perform a secure boot on ARM Linux

[Simon Glass]

+Tom

Hi,

On 20 January 2014 11:47, Marek Vasut <marex@denx.de> wrote:

> On Monday, January 20, 2014 at 01:40:52 PM, rakesh ranjan wrote:
> > Hi,
> >
> > I have a beagle board and want to create a u-boot that verifies the
> kernel
> > and rootfs before booting it. Any pointers on how it can be achieved will
> > be appreciated.
> >
> > Rakesh
>
> See doc/uImage.FIT/verified-boot.txt and doc/uImage.FIT/signature.txt in
> the
> source tree .
>

Final suggestion - also see this post:

https://plus.google.com/103658573279088224166/posts/NDgYtMnmAge

The actual patches did not make it into the release, but hopefully next
time.

Regards,
Simon