Espressif's ESP RainMaker Delivers Easier Key Handling, Safer Updates with "Secure Signing" Feature
With transparent signing of updates, built-in key generation, and integrated key management, RainMaker Secure Signing makes things a breeze.
Espressif's Piyush Shah has written an introduction to the new "Secure Signing" functionality in ESP RainMaker — and how it can provide protection for Over-The-Air (OTA) updates and secure boot.
"Espressif MCUs come with various security features like secure boot, flash encryption, etc.," Shah explains. "The secure boot feature is especially important as it allows only authorized firmware to run on the MCUs. ESP IDF has made enabling secure boot very easy. However, managing the secure boot keys is still the developer’s responsibility."
That's where the new Secure Signing functionality in ESP RainMaker, Espressif's severless cloud platform for deployment to and management of ESP-based devices, comes in. This, Shah explains, provides an easy way to generate and manage keys, sign bootloader and firmware images, and transparently sign Over-The-Air (OTA) firmware updates — even if they're uploaded to ESP RainMaker unsigned.
"The developer no more needs to keep track of the keys (or should even have the visibility of the keys), making the fleet management simpler," Shah explains. "The secure boot signing keys are created and maintained in the cloud with ESP RainMaker. The private key itself is not accessible to the user but can be used only for signing requests. Access control, for who can trigger signing requests, ensures that only authorized persons in your organization can utilize this for signing firmware images. This adds another layer of security to the system."
Secure Signing is available in ESP RainMaker back-end 2.1.0 and front-end 2.0.1 and later; more information is available in Shah's blog post and the RainMaker docs.