Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.arch.embedded > #26932
| From | Don Y <blockedofcourse@foo.invalid> |
|---|---|
| Newsgroups | comp.arch.embedded |
| Subject | Re: Is there a process for secure firmware install/upgrade for device made offshore? |
| Date | 2017-06-24 09:11 -0700 |
| Organization | A noiseless patient Spider |
| Message-ID | <oim2oa$mbl$1@dont-email.me> (permalink) |
| References | <03e50228-28e2-44a1-a9d5-9617c38585a0@googlegroups.com> |
On 6/23/2017 9:34 PM, jhnlmn@gmail.com wrote: > Hi Recently more and more companies want to add security (authentication > and/or encryption) to their devices firmware install/update process. > Typically this is done by storing a secret encryption key in bootloader or > elsewhere in internal MCU flash. This should work if bootloader is installed > in secure facility by trusted people. But then manufacturing is > outsourced/offshored and then what? I do not want to send my precious key to > China. So, I wonder whether it is possible to design an algorithm or process > for secure firmware installation and updates while initial firmware is > installed by a factory in China. Typically my devices have JTAG, some other > port (UART, etc) and often wireless (WiFi or Bluetooth). Note: moving all > newly manufactured devices to a secure location and reflashing via JTAG > would be too expensive. This problem seem to be very common now, there must > be some common solutions, are there? If pure software solution is not > possible, are there some hardware assisted solutions? I guess if a chip > would include a hardcoded inaccessible private key and assymetric decryption > module, this would solve this problem, would it? Are there such chips? What are you trying to guard/protect against? "Factory" being able to create unlicensed updates for your product? Are you expecting to distribute unencrypted (though *signed*) updates to your users? How complex is the device (i.e., you;ll be giving your manufacturer the binary image of the code to install in the virgin devices)? Reflashing via JTAG (at a "secure location") isn't the *only* option. (Hint: how will your end users install updates?) All you need (to allow you to NOT trust your manufacturing source) is a "secret" that isn't available to them, or your users.
Back to comp.arch.embedded | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-23 21:34 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 09:11 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-24 15:27 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 16:42 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-24 19:26 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 21:05 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Bill Davy" <Bill@XchelSys.co.uk> - 2017-06-25 10:37 +0100
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 02:47 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2017-06-25 13:05 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-24 21:59 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 23:14 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 07:59 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 10:43 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 12:43 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 13:13 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 13:18 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 13:53 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 14:05 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 14:24 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-25 16:46 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 18:19 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-25 18:57 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 19:14 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? David Brown <david.brown@hesbynett.no> - 2017-06-26 09:26 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-25 19:27 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Stef <stef33d@yahooI-N-V-A-L-I-D.com.invalid> - 2017-06-26 08:56 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-26 12:35 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-06-29 16:09 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-29 10:44 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-29 20:22 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-06-30 13:44 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? Richard Damon <Richard@Damon-Family.org> - 2017-06-29 23:35 -0400
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-06-30 13:33 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-30 17:11 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-07-03 12:05 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-07-03 10:16 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-07-04 13:32 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2017-07-04 13:40 -0400
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-07-05 14:14 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2017-07-05 19:51 -0400
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-07-07 17:09 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Chris <xxx.syseng.yyy@gfsys.co.uk> - 2017-07-17 18:52 +0000
Re: Is there a process for secure firmware install/upgrade for device made offshore? Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2017-07-17 21:38 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-08-12 18:04 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Paul Rubin <no.email@nospam.invalid> - 2017-08-14 09:53 -0700
csiph-web