Show Contents

# Secure boot overview

Secure boot is disabled by default. The secure device configuration states are:

- Open: This is the default state. An open device does not have secure boot enabled and will boot any U-Boot image, regardless of whether the signature is invalid or if no signature is attached at all. However, when a signed U-Boot image is used, the ROM loader attempts to validate it and generates events if the U-Boot image is not properly signed. You can use this behavior to verify the images before you close a device. Open devices use a default test key for encryption and decryption.
- Closed: In the closed state, secure boot features are enabled and only properly signed U-Boot images will boot the device. Closed devices use the OTPMK (One Time Programmable Master Key) for encryption and decryption.

Secure boot can be divided into two distinct processes:

- Manufacturing: The device is programmed in a secure environment that protects the authentication and encryption keys.
- Deployment: The image signature is verified at boot and the images are decrypted.

© 2018 Digi International Inc. All rights reserved.
Secure boot overview updated on 22 January 2018 02:43:37 PM