STM32 Secure boot firmware keys

[CEagl.1]

Hi,

I am looking to implement a secure boot system into an application. My product will only be updated OTA.

I understand that when a firmware is written i need to hash it and create a digest and then sign it and add it to the hex file payload.

Along with this i need to send the private key or have already preinstalled the private key to the bootloader when it was flashed.

I am aware that the private key needs to be kept secret and safe within a company so as not to let it fall into the wrong hands and breach security of all devices.

So with this being the case, how does this happen? Is it possible to buy a USB dongle and software that will allow these firmware's to be secured. That way i can keep the dongle in a safe etc.

Is there a better method than this?

[berendi]

You need the private key to create the signature, and only the public key to verify it. So you do not have to install the private key to the product, only the public one. The public key is not sensitive, you could as well post it on the company homepage.

A private key on a USB drive is in danger every time you plug it into a PC which is connected to the outside world. You decide whether the risk is acceptable.

It would be better to have a dedicated machine which is never connected to a network to do the signing. The rest depends on your threat model and budget.