Product of the Week: wolfBoot Secure Bootloader

February 16, 2021

Blog

One of the biggest advantages of IoT devices is that they can be updated remotely post-deployment. Of course, those update mechanisms have to be secure.

wolfSSL’s wolfBoot Secure Bootloader is a secure over-the-air (OTA) firmware management solution designed for firmware update and authentication use cases. The bootloader executes at boot time to prevent malicious and/or unauthorized firmware from running on devices, and leverages the lightweight wolfCrypt crypto engine to secure the boot process using popular modern algorithms and ciphers.

The wolfBoot Secure Bootloader was architected to help reduce the time required for development and validation of OTA update mechanisms, offering a HAL API that allows it to be integrated into existing projects easily. The portable bootloader can be integrated with any key provisioning system or application regardlesss of operating system (including RTOS, Linux, or bare-metal), and supports a range of 32-bit microcontrollers from Arm (TrustZone and normal world), RISC-V, and others, as well as MIPI boot mechanisms.

The wolfBoot Secure Bootloader in Action:

The wolfBoot bootloader is written entirely in C and Arm assembly, and intended to run on basic microcontrollers with no dynamic memory allocation or linkage to standard C libraries outside of the wolfCrypt encryption engine mentioned previously. And the wolfCrypt library is only necessary as a means of verifying image signatures for authenticity and integrity.

For flexibility, wolfBoot features multi-slot partitioning of flash devices, allowing:

• One 10-32 KB partition for the bootloader 
• One boot partition with the current executing firmware
• One update partition of the same size that receives updates to be validated and installed by the bootloader
• One swap partition that can be used to fall-back to the previous firmware version in case the installation of a new image fails.
  • *Swap and update partitions can be mapped on external NVMs.

During a typical boot process with firmware authentication, wolfBoot will verify the current firmware every time the device boots. When running the application and performing a remote firmware update that is signed and versioned accurately by the same server or same key, the update is transmitted using an OTA mechanism and stored by the application in a firmware update partition. After a reboot, the bootloader verifies the update and then checks that the new image is newer than the existing one to prevent roll-back attacks and verify the image's overall integrity with SHA-2 or SHA-3 hashes and authenticity via wolfCrypt.

wolfBoot bootloader offers two options for secure update management: the A/B approach and the BOOT/UPDATE approach. The A/B approach consists of two partitions in non-volatile memory sharing the same hierarchy level, and updates are installed in the partition that is not in use while the old firmware is kept in place to allow for a possible fall-back. Per wolfSSL, A/B approach is for position-independent firmware images and is not recommended for microcontrollers with physical memory mapping constraints because it causes execution-in-place constraints at compile time and does not allow the use of external NVMs to store the updates.

The BOOT/UPDATE approach allows the active firmware to always boot from the same partition while updates are stored in a second partition. During installation, the content of the two partitions is swapped. In case a fall-back is required, a second swap operation is performed.

In addition, wolfBoot features an integrated Python and C-based ECC/Ed25519 key and image signature generation tool that creates key pairs while the wolfBoot library is built. This key pair can be used both to sign firmware that is being added to a device, or to change firmware image formats so that they are compatible with the bootloader.

Other features include wolfBoot test applications, secure key storage, support for an external flash for update/swap, support for encrypted firmware images, support for hardware-assisted signature verification, and, of course, the ability to update the bootloader itself.

Getting Started with the wolfBoot Secure Bootloader

Version 1.7.1 of the wolfBoot secure bootloader is available under the open source GPLv2 license and can be downloaded from www.wolfssl.com/download. wolfSSL has also made a number of wolfBoot examples available on Github.

To get started, users can leverage the secure bootloader with devices including hardware accelerators with hardware-aassisted signature verification like STM32-PKA and Freescale-PKHA devices, haaardware security modules with TPM 2.0 support (available via wolfTPM), various other STM32 and NXP/Freescale i.MX/LPC MCUs, SiFive's HiFive1, Xilinx Zynq UltraScale+, and even the Raspberry Pi 3.

For more information, visit www.wolfssl.com/products/wolfboot, watch the webinar recording below, or check out the addtional resources.

Resources:

wolfBoot Secure Bootloader product page: www.wolfssl.com/products/wolfboot

More on the wolfBoot Secure Bootloader: www.wolfssl.com/wolfboot-wolfssls-secure-bootloader

wolfCrypt Embedded Crypto Engine product page: www.wolfssl.com/products/wolfcrypt-2

Download the wolfBoot Secure Bootloader: www.wolfssl.com/download