wolfSSL is a popular tool for digitally signing applications, libraries or files prior to loading them on embedded devices. Most desktop and server operating systems allow creation of this type of functionality through system libraries, but stripped down embedded operating systems do not. The reason that embedded RTOS environments do not include digital signature functionality is because it has historically not been a requirement for most embedded applications. However, the times they are a changing. In today’s world of connected devices and heightened security concerns, digitally signing what is loaded onto your embedded or mobile device has become a top priority. Examples of embedded connected devices where this requirement was not found in years past include set top boxes, DVR’s, POS systems, both VoiP and mobile phones, and even automobile based computing systems. Because wolfSSL supports the key embedded and real time operating systems, encryption standards and authentication functionality, it is a natural choice for embedded systems developers to use when adding digital signature functionality.
Generally, the process for setting up code and file signing on an embedded device are as follows:
1. The embedded systems developer will generate an RSA key pair.
2. A server side script based tool is developed
a. The server side tool will create a hash of the code to be loaded on the device with SHA-256 for example.
b. The hash is then digitally signed, also called a RSA private encrypt.
c. A package is created that contains the code along with the digital signature.
1. The package is loaded on the device along with a way to get the RSA public key. The hash is re-created on the device then digitally verified (also called RSA public decrypt) against the existing digital signature.
Benefits to enabling digital signatures on your device:
1. Easily enable a secure method for allowing third parties to load files to your device.
2. Ensure against malicious files finding their way on to your device.
3. Digitally secure firmware updates
4. Ensure against firmware updates from unauthorized parties
Do you need help setting up code signing for your embedded device? Let us know as we can help setting up servers side scripts as well as on the device side. Contact us at info@yassl.com.
More background on code signing:
A great article on the topic at embedded.com: http://embedded.com/design/216500493?printable=true
General information on code signing: http://en.wikipedia.org/wiki/Code_signing
Questions? Contact Us- Support Forums
