Home

Welcome to the Team Brugh wiki!

This wiki will detail the security measures that we (Team Brugh) are implementing.

Tackling the CIA Triad

Confidentiality: This is guaranteed by the use of AES encryption, specifically AES-GCM encryption, which implements AES-CTR.
Integrity: The GHASH should prevent tampering of data.
Authenticity: The use of keys known only by the 'factory' and bootloader should provide authenticity.

Running the Program

1. Run "make" in the firmware folder. The following commands will be run in the tools folder.
2. Generate keys and build bootloader: python3 ./bl_build.py
3. Encrypt firmware: python3 ./fw_protect.py --infile ../firmware/gcc/main.bin --outfile ../firmware/gcc/protected.bin --version 0 --message lolz --secret ../bootloader/secret_build_output.txt
   • In-file: the firmware that is to be encrypted
   • Out-file: the destination for the encrypted firmware
   • Version: the firmware version
   • Message: the firmware release message
   • Secret: where the encryption keys are stored
4. Launch the Stellaris emulator: python3 ./bl_emulate.py --debug
   • Debug: for launching a GDB debug server. Optional.
5. Run an update: python3 ./fw_update.py --firmware "../firmware/gcc/protected.bin" --debug
   • Firmware: the encrypted firmware that will be uploaded to the emulated Stellaris. This should be the out-file for fw_protect.py.
   • Debug: prints out debug messages on factory side. Optional.

Libraries

The Python cryptography library we will be using is PyCryptodome.
The C cryptography library we will be using is BearSSL.