Lesson 35. TrustZone, Secure Boot, and secret isolation: separate keys and critical functions from normal firmware

Secure Boot        — permits only trusted firmware to boot
Flash Encryption   — hides external Flash contents
TrustZone          — isolates code and data at runtime
Secure Storage     — protects keys and secret parameters
Anti-rollback      — forbids revoked old versions from booting

MQTT client private key
APN and server passwords
command-signing keys
configuration-encryption keys
device certificates
safe OTA parameters
anti-replay counters
factory calibration
critical GPIO and power outputs

what we protect;
who we protect it from;
in which device state;
what loss is acceptable.

ROM / immutable Root of Trust
→ verify bootloader
→ verify application
→ begin execution

Secure Boot without Flash Encryption:
  code is verified, but may be read from Flash.
Flash Encryption without Secure Boot:
  code is hidden, but chain authenticity is weaker.

Secure world:
  keys;
  crypto;
  OTA verification;
  secure storage;
  critical counters;
  some peripherals.
NonSecure world:
  FreeRTOS;
  EC25 parser;
  MQTT/TCP;
  UI;
  normal logic.

typedef enum {
    SECURE_STATUS_OK = 0,
    SECURE_STATUS_INVALID_ARG,
    SECURE_STATUS_DENIED,
    SECURE_STATUS_INTERNAL_ERROR,
} secure_status_t;
secure_status_t secure_sign_event(const uint8_t *message,
                                  size_t message_size,
                                  uint8_t *signature,
                                  size_t signature_capacity,
                                  size_t *signature_size);

const uint8_t *secure_get_private_key(void);

secure_status_t secure_hmac_calculate(secure_key_id_t key_id,
                                      const void *message,
                                      size_t message_size,
                                      void *output,
                                      size_t output_size);

OTA signature verification
device identity key
HMAC/signing service
anti-replay counter
security version
factory provisioning state
secure storage
critical firmware confirmation operation

the whole MQTT client
JSON parser
EC25 AT parser
the whole FreeRTOS application
logger
web server
complex business logic

firmware version:
  changes with each release
build number:
  grows monotonically
security version:
  changes only when revoking an old security generation

DEVELOPMENT
→ test keys, debug open
PILOT
→ production-like keys, recovery test
PRODUCTION
→ final keys, eFuse/option bytes, provisioning report

1. Treating Flash Encryption as a substitute for Secure Boot.
2. Treating Secure Boot as protection of secrets in RAM.
3. Placing the whole project in the Secure world.
4. Giving NonSecure code a pointer to a key.
5. Not checking NonSecure pointer and length.
6. Keeping a signing key in an ordinary CI secret.
7. Enabling eFuse/option bytes on the only debug board.
8. Using one symmetric key for the whole fleet.
9. Putting a private key in logs or a core dump.
10. Not designing key rotation.

# Security architecture
## Assets
| Asset | Confidential? | Integrity critical? | Location |
|---|---:|---:|---|
| Firmware signing private key | yes | yes | offline signing environment |
| Firmware verification key | no | yes | eFuse/bootloader |
| MQTT device private key | yes | yes | secure storage/encrypted NVS |
| CA certificate | no | yes | firmware/read-only storage |
| APN password | yes | medium | encrypted NVS |
| Phase policy | no | yes | signed config/read-only runtime |
| Boot counter | no | yes | protected persistent storage |

Untrusted/external:
  EC25 bytes, MQTT, HTTP, CLI
Application:
  parser, networking, phase logic
Security services:
  OTA verification, encrypted storage
Hardware root:
  eFuse, Secure Boot digest, flash encryption key

NonSecure:
  EC25, MQTT, Modbus, UI, phase logic
Secure:
  key operations, OTA verification,
  anti-replay counter, secure storage
Immutable Root:
  STiRoT/OEMiRoT

immutable root
→ verified bootloader
→ verified application
→ Secure/NonSecure boundary
→ narrow secure services
→ isolated device keys
→ signed OTA
→ anti-rollback
→ controlled provisioning