wolfBoot by wolfSSL secures the boot process of your device against malicious attacks aiming to replace firmware, take control, or steal data. It provides firmware authentication and update mechanisms. Due to its minimalistic design and tiny HAL API, wolfBoot is completely independent from any OS or bare-metal application. wolfBoot can be easily ported and integrated into existing embedded software projects to provide a secure firmware update mechanism. Upon installing a verified update, wolfBoot creates a backup copy of the last firmware image known to work correctly. If the new version is not confirmed by the application, or if the image installed is somehow corrupted, wolfBoot will restore the state of the system before the most recent update. It supports multi-slot partitioning of the flash device, integrity verification of firmware images using SHA2 or SHA3, and authenticity verification of firmware images using wolfCrypt's digital signature algorithms (ECDSA SECP256R1, Ed25519, Ed448, RSA 2048/4096). wolfBoot also includes post-quantum crypto support with LMS/HSS and XMSS/XMSS^MT (stateful hash-based signature schemes). It features a highly reliable, transport-agnostic firmware update mechanism, anti-rollback protection via version numbering, ARM TrustZone-M support, and hardware-assisted dual-bank swapping. wolfBoot supports secure key storage, OTP memory, TPM 2.0, encrypted firmware images, delta/incremental updates, and multiple architectures (ARM, Risc-V). It includes firmware backup and restore functionality after verified updates. wolfBoot supports multiple hardware-based public-key accelerators, such as Freescale-PKHA and STM32-PKA, and hardware security modules (HSM), including Trusted Platform Module (TPM). TPM 2.0 support is integrated with wolfTPM. It does not enforce specific key provisioning; you can create a private key to sign authentic updates for your target. Thanks to its OS agnosticism, wolfBoot is easily ported and integrated into existing embedded software projects. Example platforms have been specifically tested and many targets are already supported, including STM32, NXP, SiFive, RISC-V, Cortex-A53, Raspberry Pi, Xilinx, TI, ARM Cortex-R, PowerPC, Renesas, and Intel 11th Gen Core i7 (Tiger Lake). wolfSSL provides examples for wolfBoot on GitHub to help users quickly understand and start using wolfBoot.
