wolfBoot now boots a signed application from an SD card on the NXP LS1028A, so the boot image lives on removable storage instead of NOR flash.
Booting from the card
- Loads the signed image over the on chip eSDHC controller and verifies it before handing over control.
- Uses A/B partitions on a GPT or MBR card. wolfBoot reads both headers, picks the higher version, and boots that one.
- Runs the card at 25 MHz on a 4 bit bus. Measured on the LS1028ARDB at about 6.3 MB/s, loading a 180 KB signed image in about 31 ms. Card initialization to verified image takes about 1.45 s, nearly all of it the card answering its own power up sequence.
- Reuses the same eSDHC driver as the QorIQ PowerPC targets (T1040, T1024, T2080). Base address, source clock, and data port byte order are selected per target, so one driver covers both the big endian QorIQ parts and the little endian Layerscape parts.
Choosing the signature algorithm
The example configuration signs with ECC256 and SHA256, but that is only the default. The signature and hash algorithms are a build option, and SD boot works with any of them:
- Classical: ECC256, ECC384, ECC521, RSA2048, RSA3072, RSA4096, ED25519, ED448, with SHA256, SHA384 or SHA3.
- Post quantum: ML-DSA (FIPS 204), plus the stateful hash based schemes LMS/HSS and XMSS/XMSS^MT from NIST SP 800-208, which are also recommended in the NSA CNSA 2.0 suite.
- wolfBoot can be built against the FIPS 140-3 validated wolfCrypt module, so the signature check runs inside the validated boundary with the power on self test and in core integrity check.
- wolfBoot is available with complete DO-178C DAL A certification evidence.
Updating a device without reflashing
Booting from a card makes it easy to replace a system image in the field without reflashing NOR, and the A/B layout keeps a known good image in place while a new one is installed. Verification still happens before anything runs, so removable media does not weaken the secure boot chain.
Full details are in the pull request #899/
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now