DEV Community

Discussion on: Secure Firmware Updates with a Secure Element: Building Trust Into the Bootloader

Collapse
 
motedb profile image
mote

Good overview of secure boot chain. For embedded devices with constrained secure element, I've found the key wrapping approach critical -- you need to ensure the primary key never exists in plaintext outside the secure boundary, even during the boot measurement phase.

One challenge we ran into: the rollback protection mechanism needs to survive unexpected power loss during the secure flash write. If the counter update gets interrupted, you can end up in a state where neither the old nor new firmware is verifiable.

The interaction between secure boot and OTA update verification is tricky -- how do you handle the case where the secure element and the main application processor have different trust hierarchies? That boundary is often where side-channel attacks find purchase.

Collapse
 
pratha_maniar profile image
Pratha Maniar

Most designs protect only the key inside the SE, but the comparison step happens outside - on the main chip. A compromised main chip can simply ignore a FAIL result. Fix: move the comparison inside the SE too, so the main chip never receives a result it can tamper with.

The counter update and firmware write are two separate steps. Power dies between them - old firmware erased, new one half-written, counter out of sync - device is stuck. Fix: write firmware first, verify it completely, then update the counter last. Add a state flag in the SE's locked zone so on restart the bootloader knows exactly which step failed and falls back cleanly.

The wire between the SE and main chip (I2C/SPI) is unprotected by default. An attacker can tap it, read the PASS signal, or replay it. Two fixes: either connect the SE output directly to the flash write-enable pin so the main chip is bypassed entirely, or use an authenticated session so every SE response carries a MAC that cannot be forged or replayed.