\subsection{ROM code - Root of trust}

\begin{frame}[fragile]{Specific to the SoC
  \hfill\includegraphics[width=.5\linewidth]{drawings/00_banner-rom-code.pdf}\hspace*{0.5em}}
  \begin{itemize}
  \item need a way to store the public key(s) which will be used to
  decrypt the signature of the bootloader and make them tamper-proof
  \item each vendor can decide whatever medium they want to use to store
  the public keys
  \item microcode in charge of checking the signature is embedded in the
  ROM code
  \item different vendors: Xilinx, Tegra, Atmel, Freescale/NXP, Rockchip,
  ST, Samsung, ...
  \end{itemize}
%This section of the talk will present only how to setup the root of
%trust on i.MX6. Refer to your vendor's datasheet for more explanation
%on this part.
\end{frame}

\begin{frame}[fragile]{NXP public key holder medium
  \hfill\includegraphics[width=.5\linewidth]{drawings/00_banner-rom-code.pdf}\hspace*{0.5em}}
  \begin{itemize}
  \item the public key has to be stored on an non-volatile memory (NVM)
  accessible to the ROM code
  \item One-Time-Programmable (OTP) fuses are blown
%all fuses are set to 1, applying a high current through the conductor
%ruptures it or makes its resistance significantly higher, blown fuse
%equals to a binary 0,
  \item OTP fuses are silicon-expensive in terms of occupied area and
  store a relatively small amount of information
  \item a public key is at least 1 KiB
  \item less expensive to store only the hash of the public key in OTP,
  then compare it to the hash of the public key embedded in a given
  binary
  \item good idea to have multiple public keys so that if one private key
  is stolen/leaked/lost, we revoke it and we can use others and:
  \begin{enumerate}
    \item not having a totally unverified device
    \item not having to brick the device
  \end{enumerate}
  \end{itemize}
%up to 4 key hashes for i.MX6
\end{frame}

\begin{frame}[fragile]{Secure boot sequence
  \hfill\includegraphics[width=.5\linewidth]{drawings/00_banner-rom-code.pdf}\hspace*{0.5em}}
ROM code:
  \begin{itemize}
  \item loads the bootloader in a secure space to avoid physical
  attacks
  \item loads the embedded public key
  \item checks the hash of the public key against the hash table in the OTP
  \item uses this verified public key to check the signature of the
  bootloader
  \item executes the bootloader binary
  \item called High Assurance Boot (HAB) for this SoC family
  \end{itemize}
\end{frame}

\begin{frame}[fragile]{Preparing the board
  \hfill\includegraphics[width=.5\linewidth]{drawings/00_banner-rom-code.pdf}\hspace*{0.5em}}
  \begin{itemize}
  \item create the keys using NXP custom tool (Code Signing Tool)
  \item flash fuses from working unverified U-Boot using NXP-specific
  code and the fuse table returned by CST
  \item sign the bootloader using one of the keys whose hash is in the
  fuse table, using CST
  \item check status of bootloader \code{hab_status} which is NXP specific
  \item lock down bootloader loading by blowing the locking fuse
  \end{itemize}
\end{frame}
%http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.prd29-genc-009492c/CACGCHFE.html

\begin{frame}[fragile]{Bootloader authentication check
  \hfill\includegraphics[width=.5\linewidth]{drawings/00_banner-rom-code.pdf}\hspace*{0.5em}}
\begin{block}{}
\fontsize{8}{8}\selectfont
\begin{minted}{bash}
=> hab_status
Secure boot disabled

HAB Configuration: 0xf0, HAB State: 0x66

--------- HAB Event 1 -----------------
event data:
    0xdb 0x00 0x08 0x41 0x33 0x11 0xcf 0x00

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_CSF (0x11)
CTX = HAB_CTX_CSF (0xCF)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 2 -----------------
event data:
[...]
\end{minted}
\end{block}
\begin{block}{}
\fontsize{8}{8}\selectfont
\begin{minted}{bash}
=> hab_status
Secure boot disabled

HAB Configuration: 0xf0, HAB State: 0x66
No HAB Events Found!
\end{minted}
\end{block}
\end{frame}