Encrypt flash and anchor secure boot in hardware

How to do it

External flash comes off the board with a clip and a cheap reader. Without encryption it hands over the network password, the owner's data and the code to study for holes. Most microcontrollers offer flash encryption with a per-chip key held in fuses, and some offer a key only the hardware can read. Secure boot proves each stage before it runs, but only when the first key cannot be changed. Name for each model where that key lives, which stage checks which, and which fuses lock it. Then verify the firmware signature on the device builds on a root nobody can swap. Lock the debug ports in the same factory step, as lock debug ports before the device ships says. ETSI EN 303 645 provision 5.4-1 asks that sensitive security parameters are stored securely. NIST SP 800-193 describes roots of trust for firmware.

Examples

Python example

REQUIRED_FUSES = ("flash_encryption", "secure_boot", "jtag_disabled")

def end_of_line_fuse_check(serial: str, fuses: dict[str, bool], records) -> None:
    records.store(serial, fuses)
    missing = [name for name in REQUIRED_FUSES if not fuses.get(name)]
    if missing:
        raise RuntimeError(f"Unit {serial} fails: fuses not set {missing}")

Go example

var requiredFuses = []string{"flash_encryption", "secure_boot", "jtag_disabled"}

func EndOfLineFuseCheck(serial string, fuses map[string]bool, records Records) error {
	records.Store(serial, fuses)
	for _, name := range requiredFuses {
		if !fuses[name] {
			return fmt.Errorf("unit %s fails: fuse %s not set", serial, name)
		}
	}
	return nil
}

How to check

The end-of-line test reads the fuse state of every unit and stores it with the serial number. It fails a unit whose flash encryption or secure boot fuse is not set. A raw dump of the flash from a sample unit holds no readable string from a known test file.

Sources

• ETSI EN 303 645 V3.1.3, provision 5.4-1
• NIST SP 800-193, Platform Firmware Resiliency Guidelines

Related rules

• IOT-9 Verify the firmware signature on the device in Connected devices
• IOT-25 Lock debug ports before the device ships in Connected devices