Binary images are verified by HS-SE
devices, as illustrated in Figure 5-6. The process includes the following steps:
- Compute hash (SHA-512) of the
public key in certificate (1a), and compare with the stored public key hash
value (1b).
- Hash (SHA-512) the certificate
(2a), decrypt the signature using the public key (2b), and verify the match
(2c).
- Determine whether software
revision is allowed (3).
- Read the binary image load
address from the certificate.
- Compute hash (SHA-512) of the
encrypted image (4a), and compare with the code hash value from the
certificate (4b).
- Decrypt code (AES-256-CBC)
using the 256-bit key derived from the symmetric key (5), if required.
- Verify the value of the magic
number from the certificate and from clear text binary image.