Skip to content

Back to the catalog

wolfssl.comarticle

wolfBoot 2.9.0

wolfSSL's release announcement for wolfBoot 2.9.0, an open-source secure bootloader for embedded systems, covering new hardware targets (STM32N6/U3/C5/G4/WBA, NXP LPC54S018M-EVK, Kinetis KL26, Xilinx Zynq-7000), new crypto features (RSA-PSS image signatures, hardware crypto-callback interface, multi-root-CA verification, pre-computed IDevID/DICE attestation), and continued security hardening from Fenrir fuzzing including bounded unauthenticated image sizes, memory-copy limits during updates, and fault-injection resistant integrity verification. It also adds an sbom Makefile target producing CycloneDX and SPDX output for CRA-readiness.

TL;DR wolfBoot 2.9.0 adds new embedded hardware targets, RSA-PSS/DICE crypto features, and fuzzing-driven security hardening against fault injection in the secure boot/update path.
Open original ↗

Technologies named here

  • wolfBoot
  • wolfHAL
  • STM32N6
  • wolfHSM
  • STM32U3
  • STM32C5
  • Fenrir
  • sbom Makefile target
  • STM32G4
  • STM32WBA
  • NXP LPC54S018M-EVK
  • Kinetis KL26
  • Xilinx Zynq-7000 ZC702
  • NXP T2080
  • CW VPX3-152
  • STM32WB
  • STM32H5
  • LPC55S69
  • NXP MCXN
  • PolarFire SoC
  • ZynqMP
  • Vorago VA416x0
  • wolfSSL
  • CycloneDX
  • SPDX
  • LMS
  • XMSS
  • STM32

Techniques named here

  • RSA-PSS image signatures
  • Generic crypto-callback interface
  • Boot benchmarking
  • One-shot hashing
  • Monolithic self-update optimizations
  • Multi-root-CA verification
  • Keystore-less operation with wolfHSM
  • Pre-computed IDevID authentication values
  • Persistent boot and update failure diagnostics
  • Fuzzing-driven hardening of image parsing and update paths
  • Memory-copy limits enforced during disk updates
  • Zeroization of sensitive DICE claim data after use
  • Hardware-based DICE attestation

Related in Hardware & RF