Skip to content

Best Practices for Embedded Devices

Creating Private Keys

Embedding a private key into firmware allows anyone to extract the key and turns an otherwise secure connection into something nothing more secure than TCP.

We have a few ideas about creating private keys for SSL enabled devices.

  1. Each device acting as a server should have a unique private key, just like in the non-embedded world.
  2. If the key can't be placed onto the device before delivery, have it generated during setup.
  3. If the device lacks the power to generate its own key during setup, have the client setting up the device generate the key and send it to the device.
  4. If the client lacks the ability to generate a private key, have the client retrieve a unique private key over an SSL/TLS connection from the devices known website (for example).

wolfSSL (formerly CyaSSL) can be used in all of these steps to help ensure an embedded device has a secure unique private key. Taking these steps will go a long way towards securing the SSL connection itself.

Digitally Signing and Authenticating with wolfSSL

wolfSSL is a popular tool for digitally signing applications, libraries, or files prior to loading them on embedded devices. Most desktop and server operating systems allow creation of this type of functionality through system libraries, but stripped down embedded operating systems do not. The reason that embedded RTOS environments do not include digital signature functionality is because it has historically not been a requirement for most embedded applications. In today’s world of connected devices and heightened security concerns, digitally signing what is loaded onto your embedded or mobile device has become a top priority.

Examples of embedded connected devices where this requirement was not found in years past include set top boxes, DVR’s, POS systems, both VoIP and mobile phones, connected home, and even automobile-based computing systems. Because wolfSSL supports the key embedded and real time operating systems, encryption standards, and authentication functionality, it is a natural choice for embedded systems developers to use when adding digital signature functionality.

Generally, the process for setting up code and file signing on an embedded device are as follows:

  1. The embedded systems developer will generate an RSA key pair.
  2. A server-side script-based tool is developed
    1. The server side tool will create a hash of the code to be loaded on the device (with SHA-256 for example).
    2. The hash is then digitally signed, also called RSA private encrypt.
    3. A package is created that contains the code along with the digital signature.
  3. The package is loaded on the device along with a way to get the RSA public key. The hash is re-created on the device then digitally verified (also called RSA public decrypt) against the existing digital signature.

Benefits to enabling digital signatures on your device include:

  1. Easily enable a secure method for allowing third parties to load files to your device.
  2. Ensure against malicious files finding their way onto your device.
  3. Digitally secure firmware updates
  4. Ensure against firmware updates from unauthorized parties

General information on code signing:

https://en.wikipedia.org/wiki/Code_signing