OpenIoT & ELC Europe 2016

On current ARM processors like Freescale's i.MX6 all requirements to cryptographically prevent undetected tampering of the system exist (and are openly documented). All the necessary building blocks are available right now as FOSS: Starting with the bootloader, through the Kernel and finally every byte on the root file system can be signed by our own cryptographic keys. When such a system booted successfully, the system's owner can be sure that no unwanted changes to the software have been made. In this talk, the involved software components are presented and the possibilities and limitations of this approach are discussed. Furthermore, some lessons learned during a large project are shared, especially to avoid some of the obstacles during development.