🛠 TrustZone, secure boot et OTP : sécuriser son firmware

Objectives

The RP2350 is one of the most security-open MCUs: Cortex-M TrustZone, ROM-verified signed boot, 8 KB of antifuse OTP for keys, hardware SHA-256 accelerator, TRNG, and a public $10,000 hacking challenge (results January 2025). This tutorial explains the chain of trust, generates keys and signs firmware with picotool, and manipulates TRNG/SHA-256 on the application side. Warning: secure boot disables the RISC-V Hazard3 cores.

Hardware

• 1 × Raspberry Pi Pico 2 (warning: writing OTP keys is IRREVERSIBLE — test only on a demo board)
• Pico SDK ≥ 2.0.0, picotool, OpenSSL
• Serial terminal to verify outputs

Complete code

/* trng_sha.c — entropie materielle et empreinte SHA-256 acceleree (RP2350) */
#include "pico/stdlib.h"
#include "hardware/sha256.h"
#include "hardware/trng.h"
#include <stdio.h>

int main(void) {
    stdio_init_all;
    uint8_t seed[32], digest[32];
    for (uint i = 0; i < 32; i++)          /* vrai alea materiel */
        seed[i] = (uint8_t) trng_read_bool_random | (rand & 1);
    sha256_init;
    sha256_update_data(seed, sizeof seed);
    sha256_final(digest);
    printf("SHA-256 du seed : ");
    for (uint i = 0; i < 32; i++) printf("%02x", digest[i]);
    printf("\n");
}

Signing chain (commands):

# 1. Cle de signature (une fois, a proteger hors ligne)
openssl ecparam -name prime256v1 -genpriv -out signing.key
cat signing.key | picotool otp load_key - --key-type ecdsa_p256 --version 0 --revoke-key 0 --disable-key 0 --permanently-lock-key 0 --address 0x0
# 2. Hash public -> OTP (IRREVERSIBLE !)
picotool info -t public_key2 -e signing.key | picotool otp hash -
# 3. Signer puis convertir l'UF2
picotool sign -k signing.key -a 0 -v 0 firmware.uf2

Expected verification

Each execution displays a different fingerprint (the TRNG is working). After OTP locking, only a correctly signed image boots; an unsigned UF2 is rejected by the ROM. Also verify that RISC-V mode becomes unavailable once secure boot is active.

Common errors

• Writing the key to OTP without a backup: the antifuse is irreversible, a lost key = board permanently locked to your own binaries.
• Forgetting that secure boot disables the Hazard3 cores: choose between security and RISC-V.
• Thinking security is absolute: the DEF CON 32 challenge showed physical attacks (FIB, laser) — size your defenses against your actual threat model.
• Anti-replay by version number (-v) must be managed: signing version 0 and then revoking another can lock you out.
• Compiling without the correct boot2/boot signature aware: use a recent SDK and picotool verify before flashing.