Embedded Secure Boot Toolkit

The Embedded Secure Boot Toolkit helps firmware teams verify that firmware updates and loadable modules are authentic before they run. Use it when your product needs signed updates, trusted boot flows, and cryptographic verification based on X.509 certificates, RSA, ECC, SharkSSL, and RayCrypto.

Certificate Guide RayCrypto Engine SharkSSL TLS Stack

Use Secure Boot When

  • Your device must reject firmware that is not signed by the manufacturer.
  • You need to verify software updates, plugins, or loadable modules before activation.
  • Your product needs X.509-based RSA or ECC signature verification.
  • You want embedded crypto building blocks backed by SharkSSL and RayCrypto.

Secure Boot Benefits

Connected products are expected to receive updates, but every update path also becomes a security boundary. Secure Boot adds a cryptographic check before new firmware or modules are trusted, reducing the risk that a compromised update, a modified image, or an unauthorized module can run on the device.

Secure boot firmware verification

Signed Firmware

Verify firmware images before installation or activation using signatures created by the manufacturer.

Loadable Modules

Check plugins or optional modules before they become part of the running product.

X.509 Trust Model

Use certificate-based signing with RSA or ECC, depending on target performance and security requirements.

Embedded Crypto

Use SharkSSL and RayCrypto components designed for embedded footprint and performance constraints.

How Signature Verification Works

The update image is hashed, and the hash is signed with the private key associated with the manufacturer's certificate. The device calculates its own hash of the received image, verifies the signature with the corresponding public certificate, and accepts the software only when the signature and hash match.

RSA and ECC are both supported approaches for asymmetric verification. ECC can be attractive on constrained targets because it can provide strong security with smaller keys, while SharkSSL and RayCrypto provide optimized embedded crypto building blocks for the verification process.

References