In this lesson, you will learn how to leverage asymmetric cryptography to ensure that firmware updates are authentic and untampered before your device executes them.
The Integrity Problem
When an IoT device downloads an update, the binary arrives over an untrusted network. Without validation, a malicious actor could intercept the delivery and inject compromised code. Relying on simple checksums or symmetric MACs is insufficient here, as those methods require the device to share a secret key that could be extracted from a compromised peer device. By using asymmetric digital signatures, the device can verify the signature using only the developer’s public key, which is safe to store in the device's read-only memory.
How the Workflow Functions
The process consists of two distinct stages: signing (at the developer's server) and verification (on the embedded device).
- Signing: The developer hashes the firmware binary (e.g., using SHA-256) and encrypts that hash with their private key. This result is the digital signature appended to the firmware file.
- Verification: Upon reception, the device performs these steps:
- Computes the SHA-256 hash of the received firmware binary.
- Uses the stored public key to decrypt the attached digital signature to retrieve the "original" hash.
- Compares the locally computed hash with the decrypted hash.
If the hashes match, the device confirms that the binary was signed by the holder of the private key (authentication) and that not a single bit of the firmware was altered in transit (integrity).
// Conceptual verification flow on embedded firmware
bool verify_firmware(const uint8_t *firmware, size_t size, const uint8_t *sig) {
uint8_t computed_hash[32];
sha256(firmware, size, computed_hash); // 1. Hash the image
// 2. Decrypt/Verify signature using Public Key
// returns true if the signature is valid for this hash
return crypto_ecdsa_verify(public_key, sig, computed_hash);
}
By ensuring the public key is embedded in a secure, immutable hardware region (like a Root of Trust), you create a robust chain of trust that prevents the execution of malicious firmware, regardless of how insecure the delivery network may be.
Key Takeaway: Asymmetric digital signatures decouple firmware verification from secret-sharing, allowing embedded devices to verify the authenticity and integrity of updates using only a public key stored in secure hardware.