Security Updates

Zephyr Security & Updates

Build production-ready, secure embedded systems using Zephyr's modular security stack and MCUboot bootloader.

Core Workflows

1. MCUboot Integration

Set up the secure bootloader and define fail-safe flash partitions.

• Reference: [mcubootintegration.md](references/mcubootintegration.md)
• Key Tools: CONFIG_BOOTLOADER_MCUBOOT, fixed-partitions, Devicetree.

2. Image Signing

Ensure firmware integrity with production-grade digital signatures.

• Reference: [imagesigning.md](references/imagesigning.md)
• Key Tools: imgtool.py, ECDSA-P256, RSA.

3. DFU Protocols

Transport updates securely using MCUmgr or cloud-based OTA.

• Reference: [dfuprotocols.md](references/dfuprotocols.md)
• Key Tools: mcumgr, Golioth OTA, SMP transport.

4. Rollback Protection

Implement atomic swaps and image confirmation to prevent bricking devices.

• Reference: [rollbackprotection.md](references/rollbackprotection.md)
• Key Tools: boot_write_img_confirmed(), mcumgr image test.

5. Crypto Basics

Implement secure storage and cryptographic operations using mbedTLS.

• Reference: [cryptobasics.md](references/cryptobasics.md)
• Key Tools: CONFIG_MBEDTLS, TF-M, secure storage.

Quick Start (Kconfig for Secure Boot)

# Enable MCUboot support in application
CONFIG_BOOTLOADER_MCUBOOT=y

# Build with MCUboot using Sysbuild
west build -b nucleo_f401re --sysbuild samples/basic/blinky

Professional Patterns (Security-First)

• Production Keys: Never use default MCUboot keys. Provision unique keys during manufacturing.
• Heartbeat Confirmation: Only confirm a new image after the application has successfully connected to its cloud backend.
• Version Integrity: Enable version monotonicity to prevent accidental or malicious firmware downgrades.

Automation Tools

• [mcubootversionguard.py](scripts/mcubootversionguard.py): Enforce monotonic semantic version progression in update pipelines.

Examples & Templates

• [mcubootprjfragment.conf](assets/mcubootprjfragment.conf): Starter secure-boot + image-management config fragment.

Validation Checklist

• [ ] Signed image verifies at boot and unsigned/tampered image is rejected.
• [ ] DFU flow completes end-to-end and boots into the new slot.
• [ ] Rollback behavior triggers correctly when image confirmation is withheld.
• [ ] Key handling and version policy prevent downgrade and test-key usage in production configs.

Resources

• [References](references/):
• mcuboot_integration.md: Partition layouts and setup.
• image_signing.md: Key management and imgtool usage.
• dfu_protocols.md: MCUmgr commands and cloud OTA.
• rollback_protection.md: Swap mechanisms and confirmation code.
• crypto_basics.md: mbedTLS and secure storage.
• [Scripts](scripts/):
• mcuboot_version_guard.py: Version monotonicity checker for release gates.
• [Assets](assets/):
• mcuboot_prj_fragment.conf: Secure-update config baseline.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: beriberikix
• Source: beriberikix/zephyr-agent-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.