trusted firmware m - amazon web...

Confidential©2017ArmLimited

TrustedFirmwareM

TrustedBoot

TamasBan

Linaro2018�

Arm

Non-Confidential©Arm20182

Agenda

•  Conceptoftrustedboot•  BootloaderinTF-M

•  Firmwareupgrade•  Alternativesforupgrade

•  Alternativesforcrypto•  Plans

•  Q&A


Whatistrustedenvironment?

Anintegratedexecutionenvironment(HW+SW)whichcanprotectvaluableassetsagainstextraction:

•  Sensitiveuserdata

•  Cryptokeys

•  Firmwareitself,etc.

Boot

Hardware

Exec.Env.

TrustedEnv.


Introductiontotrustedbootloaderconcept

What? Why? How?

SWwhoseaimistoverifytheoriginandintegrityofotherSWcomponentswhichrunonthetargetsystem.

•  BootloaderrunsassoonassystemisreleasedfromresetprioranyotherSW.Incaseofsuccessfulauthenticationitpassesexecutiontotheruntimefirmware.

OnewantstoensurethatonlyacertainsetofSW,withoutanyexternalmodification,canrunonaparticulardevice.

•  DevicecontainssensitiveassetswhichcouldbeextractedwiththeusageofmaliciousSW.

DevicecontainsimmutableSWanddata,whichcanbeusedforauthentication:

•  IntegrityofSW:

– Checkinghashvalue

•  OriginofSW:

– Checkingdigitalsignature


Considerationsatselectionofbootloader

Securebootrequirements

PSAspecdefinesbootandfirmwareupdaterequirements:

•  Supportforfirmwareupgrade

•  Supportforchain-of-trust

•  SupportforNISTorNSAapprovedcryptographicalgorithm:SHA2,RSA,ECDSA,HMAC,KDF

•  Etc.

Deviceconstraints

Deviceconstraintsmandate`yet-another`bootloader:

•  Usuallylessthan1MBflashmemoryforcode

•  Usuallylessthan256KBRAMfordata

•  UsageofcryptographicacceleratorHWcomponent

•  Computingpower

•  NoMMU,nomemoryvirtualization

•  Powerfailureawareness

•  Etc.


BootloaderinTF-MMCUBootisutilizedtoactasBL2inTF-M:

• OpensourceprojectwithApache2.0licensing

•  Lowmemoryfootprint;designedfor32bitmicrocontrollers

• Runningfromflash(currentlyXIP)

•  Severalsecurebootfeaturesaresupportedforfirmwareauthentication:SHA256,RSA-2048,(ECDSA)

• Usageof3rdpartylibrariesforcryptographicoperations:mbedTLS,(TinyCrypt)

•  Firmwareupdatewithimageswapping

•  Powerfailureresistantupgrade

•  Fallbackmechanismtostableversion


Firstbootloaderrelease

MCUBootintegratedwithinTF-Mrepository:

CustomizedtobeOSagnostic

CurrentlySHA256andRSA-2048aresupported

SPEandNSPEareconcatenatedtoasinglebinaryblob

Hashanddigitalsignaturetoolingandruntimecheck

SoftwareUpgradeprototypeasproofofconcept:

•  EmulatingflashinterfaceandbehaviourovercodeSRAM

Systemconstraints:

• NosupportforimagesizethatdoesnotfitinavailableRAM

• CoTreducedtoverifySPEandNSPEinthesamego


ImmutableBL1code

Chainoftrust

HashBL2image

SIP/OEMRootofTrustPublicKey

(ROTPK)

OEM/DeveloperPublicKey(s)

UseCApublickeyifsupportingcertificate

revocation

Checksignature

Publicimagesigningkeys

canberotated

Checkintegrity

NSPEimage

SPEimage

Checksignature

PublickeyPublickey(s)

Checksignature


RTOS&Application

Bootprocess

Stage

PSA

(notmandatory)

TF-M

BL1

Immutablebootcodein

ROM

Bootcode

ineFlash

BL2 NSPESPE

Secureruntimefirmware

VerifyLoadStart

CoreSPMSecureservices

TBD

VerifyLoadStart

VerifyLoadStart

RTOS&Application

BL2MCUBoot Start Start

Verify

combinedhashandsignature


Basicoperationandmemorylayout


6.)CopyscratchtoSlot_0

3.)EreaseSlot_1

Imageswapping

•  CodelinkedtoSlot_0memoryspace

•  Dividedintorounds

•  Scratch-sizeddataismovedinonego

•  Statusinfosavedaftereachround

•  Powerfailuresafe

Slot_1_Sector_2

Slot_1_Sector_N

Slot_1_Sector_3

ActiveimageSlot_0

NewimageSlot_1

Slot_0_Sector_2

Slot_0_Sector_N

Slot_0_Sector_3

Scratcharea

1.)Ereasescratch

Sector_0Sector_1

Slot_0_Sector_0Slot_0_Sector_1


2.)CopySlot_1toscratch

4.)CopySlot_1toscratch

5.)EreaseSlot_0


Saveswapstatusinfo





Firmwareupgrade

•  UpgradeisataskofruntimeFW

•  PotentiallysplitbetweenNSPEandSPE

•  XIPimages


Imagefallback

•  Storepreviousimage

•  Health-checknewimagewithBIST

•  Selfconfirmation

•  Rebootincaseoffailure

•  Revertbackstableimage

•  Setrollbackafterconfirmation


DesignconstraintsHeadersize-VTORalignment:

•  Devicedependent512-1024bytes

Imageslot’slayoutmustbealigned

Scratchareasize:•  Flashmemorywear-out

•  Atleastasthelargestblocksize

Realimagesizesmallerthanimageslot:•  Imageheader,TLV,swapstatusinfo,etc.

Norecoveryoption,ifbothimagesarefaulty


Commonthreats

Threat Mitigation ImplementedMaliciousfirmwaresentto

device Signedfirmwareimages Yes

Downgradetooldvulnerableversion

Versionorfallbackcounterscheck Notyet*

Persistentmalware(rootkits) Immutablebootcodeanddata(BL1) Notyet

Remotebrickingofthedevice Backupimage Yes

Attackergetssigningkey Keyrevocationsupport Notyet*

*:Plannedtobeaddressedin2018


Alternativestoimageswapping

PositionindependentcodePros:

•  ReducedP/Ecycleleadstolongerlifetime•  ReducedBLcomplexityandcodefootprint•  Reducedboot-uptime(noswapping)

Cons:•  Mightleadbiggerfirmwarecodefootprint•  Somecompilerswitchesarenotcompatible

withPICcode•  SomeClib(Microlib)cannotbecompiledto

bePIC

•  OtherconstraintswhencompilingcodetobePIC

DualimagebuildPros:

•  ReducedP/Ecycleleadstolongerlifetime•  ReducedBLcomplexityandcodefootprint•  Reducedboot-uptime(noswapping)

Cons:•  Morecomplexbuildprocess•  Extralogicinupdateclient



ExecutefromRAMPros:

•  ReducedP/Ecycleleadstolongerlifetime

•  Fasterfirmwareexecution•  ReducedBLcomplexityandcodefootprint

Cons:•  Usuallyinfeasible:lessRAMthanROM

Off-chipstoragePros:


•  ReducedBLcomplexityandcodefootprint

Cons:•  Mightbeasecurityrisk:whentoverify

signature?•  Mightrequireimageencryption,increased

codefootprint(includeAES)andboot-uptime



OverwritePros:


•  Noneedforscratchspace•  ReducedBLcomplexityandcodefootprint

Cons:•  Riskofbrickingthedevicebecausenorevert

possible


MCUBootasPICcode

ExperimenttocompilePICcode:

•  ROandRWpositionindependent(--ropi,--rwpi)

•  VectortableandIRQhandlersmustbeinRAM

•  IRQhandlingunavailableuntilvectorsandhandlersrelocatedtoRAM

•  Imagesizeincreased:•  29KB->38KB;Morestd.Clibwascompiled-in

•  Limitationsonsourcecode:•  Constantpointercannotbeused

•  CMSEarmclangflagisnotcompatiblewithROPI

•  Microlibcannotbecompiledtobepositionindependent


Comparisonofcryptoalgorithms

RSA

•  Bigkeysize:upto15KB

•  128bitlevelofsecurity:RSA-3072

•  ROMsize(mbedTLS):~14KB

•  RAMusage(mbedTLS):~7KB

•  Keygeneration:slower

•  Signaturegeneration:slower

•  Signatureverificationtime:faster

ECC

•  Smallkeysize:upto512bits

•  128bitlevelofsecurity:ECC-256

•  ROMsize(mbedTLS):

•  RAMusage(mbedTLS):~13KB

•  Keygeneration:faster

•  Signaturegeneration:faster

•  Signatureverification:slower

MovingfromRSA toECC


„Speedupasymmetriccrypto”SignatureverificationwithRSAorECCistimeconsumingSymmetriccryptocanspareclockcyclesReplaceasym.cryptowithsymmetric:HMAC,CMAC,etc:

•  Previouslyverifiedimages(upgradetime)cangetaMAC,generatedbasedonHardwareUniqueKey(HUK)

•  AtboottimethisMACisverifiedinsteadoforiginalsignature

•  Boottimecanbesignificantlyreduced

Downloadnew

firmwareVerify

signatureDeployinflash

GenerateMAC

SavetoflashResetdevice Bootloader

checksMAC


Alternativesforcryptolibraries

HWaccelerator:•  Improvedperformance/reducedcodefootprint

CryptoCell-312:•  Symmetricandasymmetriccrypto•  Runtimelibrary:usembedTLSAPI•  Bootlibrary:

–  Signatureverification

–  X509certificateparsing–  Imageverificationandoptional

decryption•  AssetprovisioningtoOTPmemory•  Rollbackcounters


BootloaderplansPSAcompliance:

•  Anti-rollbackprotection

•  CreateinterfacebetweenSPEandbootloaders

•  Addsupportofmultiplechainsoftrustandmightbecertificates

ExplorepossibilitiestomakeBL2updatableIntegratecryptoHWaccelerator(CC312)withBL2


HowtogetinvolvedTF-AandTF-Mmastercodebases•  https://git.trustedfirmware.org/

TF-MTeam@ConnectHKG18•  AbhishekPandit

•  AshutoshSingh

•  TamasBan

•  MiklosBalint

Getintouch•  ComeroundLITEhackingroombetween3-4pmWednesday

•  Scheduleameetingviahkg18.pathable.com

Moreinfoondeveloper.arm.com


Supportedplatforms

MCUBootwithTF-Mcanrunon:•  Insimulatorenvironment(FVP)onPC.

• MPS2developmentboardwithAN521(Castor)FPGAimage

• MPS2developmentboardwithAN519(M23)FPGAimage

• Musca_Aportingisinprogress


Trailer(Swapstatus)

BL2-Bootloader

Securefirmware

Non-securefirmware

Header

TLV(SHA,DS)

Securefirmware

Non-securefirmware

Header

TLV(SHA,DS)

SLOT_1Placeholderfornewimage

SLOT_0Activeimage

Scratcharea

Currentlynotupdatable0x0000...

0xXXXX...Usedduringimageswapping


BL2-Bootloaderstarted

EraseSLOT_1

Finalizeabortedswap

Initializephase

AuthenticateSWinSLOT_1

SwapimagesbetweenSLOT_0and

SLOT_1

Finalizeimagestatusinfo

PassexecutiontoSPEinSLOT_0

CPUreleasedfromreset

IsnewSWinSLOT_1

Isthereabortedswap?

yes

no

yes

ValidSW?

no

no


SPENSPE

UpdateClient

TrustedUpdateFunction

FirmwareStorageServer

Runtimefirmware

BL2-Bootloader Slot_0–ActiveImage Slot_1–NewimageLocalStorage

1.Download:-firmware-manifest

2.Authentication:-sendmanifest

KeysNVcounters

3.Provisonnewimage

4.Reboot

5.Authenticateandswapimages,startimageinslot_0

Remoteserver


Oldimage

NewimageReboot

Newimage

Oldimage

TestNOK

Newimage

Oldimage

Newimage

Oldimage

TestOK ConfirmNewimage

Oldimage

RebootOldimage

Newimage

Setrollback

trusted firmware m - amazon web...

Documents