Secure Boot
The SR OS Secure Boot ensures that the software executed by the system is trusted and originated from Nokia IP Routing.
At every boot of the system, each step in the boot process verifies the digital signature of the next software element to boot for integrity and authenticity up to the SR OS operating system images. This boot sequence forms the chain of trust for Secure Boot.
Software image signatures use RSA-4096 keys and SHA-384 hashes.
The Secure Boot chain is rooted in the platform CPM firmware based on UEFI specifications. As such, the Nokia Platform Key, Key Exchange Key, allowed and disallowed databases are provisioned when Secure Boot is activated to perform the required signature verification.
Firmware updates are also digitally signed and verified using the same principle. The signature verification of a firmware update is performed at boot time by the existing firmware before the firmware update can proceed.