Elvis Wiki - User contributions [en]

Password Security, Threats and Measures

2024-03-04T18:25:16Z

NSelimovic:

== Summary ==

This documentation provides an overview of the threats to passwords and the security measures taken against them. Furtheron, this article provides a presentation on how to crack a password with the pentesting tool "John The Ripper".

== Password Security ==

Passwords are the most used authentication method. Therefore, the security of a password is of significant importance. The strenght of a password can be measured through the quality of the password or its entropy. Besides the quality and entropy of a password, factors like personal data or known passwords have to be considered.

The quality of a password is described as the time it takes to crack a password using the trial and error method. Passwords which take longer to crack are considered to be of higher quality.
The entropy of a password is described as the randomness and unpredictability of a password. The entropy of a password can be impacted through factors like the length and character set size.

=== Password Managers ===

Password managers can store the passwords, guide the creation and provide security when sharing passwords. Password managers can include aid in the cases of long, complex and important passwords as they store the passwords of the user and provide a certain level of security. These managers often consist of several authentication steps in order to achieve this certain level of security. The functionality can differ as there are different types of managers.

Types of password managers:
* Cloud-Based Password Managers
* Local Password Managers
* Browser-Based Managers
* Enterprise Managers
* Hardware Password Managers

== Vulnerabilities and Threats ==

Passwords are mostly created by humans and are therefore a subject to vulnerabilities. Humans seek simplicity and comfort and they try to create easy to remember passwords. They often use personal information in order to provide a memorable word. Most of them use the same passwords on multiple websites and neither do they change them frequently. Close to two thirds of users do not use special characters in their passwords.

These factors create many vulnerabilities as they make the passwords predictable, of low quality or entropy and therefore easier to crack.

=== Threats ===

These weakly created passwords are often the victim to different threats. Most of these threats require some sort of fraud or deception.

Some of these threats are:
* Phishing
Is trying to gain login credentials by impersonating a person or faking a website.

* Keylogging
Is recording the keystrokes which a user puts in.

==== Attacks ====
These attacks vary and can be successful at compromising the victims password. Different attacks require different computational power, memory and time when cracking passwords.

Some of these attacks are:
* Brute-Force and Dictionary Attacks
Trying to guess the password or using wordlists.
* Rainbow-Table Attack
Hashing a password over and over again in order to gain the same hash as the victim password and then reconstruct the plaintext password.

== Security Measures ==
In order to prevent attackers from gaining unauthorized access, developers have came up with different security measures. These measures can provide further steps of authentication and achieve more security.

These are some security measures which can help to withstand most of the named threats:
* Two-Factor Authentication
This measure requires and additional step of authentication on system access.

* Security Questions
Security questions also require an additional step of authentication by requiring the answer to personal questions.

* Account Policies
Account policies force the user to frequently change the password or to lock the account if the password is entered wrong multiple times.

* Activity Monitoring
The monitoring of suspicious activity like a login attempt of a new devices can alert the user to pay attention to a certain account and maybe change the login credentials.

== Password Cracking Tools ==
These are only some of the cracking tools which can be used to attack a victims account:
* John The Ripper
Supports brute-force and dictionary attacks. This tool will be used later in this documentation to present a password cracking process.

* Hashcat
Offers brute-force, dictionary, mask attacks and more.

* OPH Crack
Implements the rainbow table attack.

== Requirements ==

* Operating system/Platform: Kali Linux
* Packages: git openwall/john

== Cracking a password ==
The following steps are necessary in order to crack a password. Kali linux is used as the operating system as it provides different cracking tools and more. The used tool for this crack process is "John The Ripper".
* NOTE: Password cracking is unethical. This demonstration serves for educational purposes and should not be recreated.

=== Step 1 ===

Create a .zip password secured archive.

sudo apt-get install zip

sudo nano document.txt

zip -e archive.zip document.txt

You will be prompted to enter a password.
=== Step 2 ===

Now the hash of the password needs to be achieved.

zip2john archive.zip > hash.txt

This command saves the hash of the password which is used to secure the archive.zip archive in a hash.txt file.

=== Step 3 ===

Now the hash can be cracked. The crack is only successful if the password is in the password list that john uses to compare the hashes.

john hash.txt

The passwordlist in this case is the default password list of john. However, different password lists can be used by specifying the file they are saved as.

john --wordlist=/tmp/password-list.txt hash.txt

This way john will try to crack the password with the password-list.txt password list file.
* In the case of a successful attack, john will provide a confirmation message about the successful attack and display the password.

== References ==

* https://www.overleaf.com/project/64fc39ddb97b168fb7bd033d
* https://www.openwall.com/john/
* https://www.kali.org/tools/john/
* https://www.kali.org/
* https://ieeexplore.ieee.org/document/6234434
* https://ieeexplore.ieee.org/document/8936178
* https://doi.org/10.1145/359168.359172
* https://ieeexplore.ieee.org/document/9023888
* https://ieeexplore.ieee.org/document/9609778

[[Category:Documentation]]

Password Security, Threats and Measures

2024-03-04T18:22:51Z

NSelimovic: /* Description */

== Summary ==

This documentation provides an overview of the threats to passwords and the security measures taken against them. Furtheron, this article provides a presentation on how to crack a password with the pentesting tool "John The Ripper".

== Password Security ==

Passwords are the most used authentication method. Therefore, the security of a password is of significant importance. The strenght of a password can be measured through the quality of the password or its entropy. Besides the quality and entropy of a password, factors like personal data or known passwords have to be considered.

The quality of a password is described as the time it takes to crack a password using the trial and error method. Passwords which take longer to crack are considered to be of higher quality.
The entropy of a password is described as the randomness and unpredictability of a password. The entropy of a password can be impacted through factors like the length and character set size.

=== Password Managers ===

Password managers can store the passwords, guide the creation and provide security when sharing passwords. Password managers can include aid in the cases of long, complex and important passwords as they store the passwords of the user and provide a certain level of security. These managers often consist of several authentication steps in order to achieve this certain level of security. The functionality can differ as there are different types of managers.

Types of password managers:
* Cloud-Based Password Managers
* Local Password Managers
* Browser-Based Managers
* Enterprise Managers
* Hardware Password Managers

== Vulnerabilities and Threats ==

Passwords are mostly created by humans and are therefore a subject to vulnerabilities. Humans seek simplicity and comfort and they try to create easy to remember passwords. They often use personal information in order to provide a memorable word. Most of them use the same passwords on multiple websites and neither do they change them frequently. Close to two thirds of users do not use special characters in their passwords.

These factors create many vulnerabilities as they make the passwords predictable, of low quality or entropy and therefore easier to crack.

=== Threats ===

These weakly created passwords are often the victim to different threats. Most of these threats require some sort of fraud or deception.

Some of these threats are:
* Phishing
Is trying to gain login credentials by impersonating a person or faking a website.

* Keylogging
Is recording the keystrokes which a user puts in.

==== Attacks ====
These attacks vary and can be successful at compromising the victims password. Different attacks require different computational power, memory and time when cracking passwords.

Some of these attacks are:
* Brute-Force and Dictionary Attacks
Trying to guess the password or using wordlists.
* Rainbow-Table Attack
Hashing a password over and over again in order to gain the same hash as the victim password and then reconstruct the plaintext password.

== Security Measures ==
In order to prevent attackers from gaining unauthorized access, developers have came up with different security measures. These measures can provide further steps of authentication and achieve more security.

These are some security measures which can help to withstand most of the named threats:
* Two-Factor Authentication
This measure requires and additional step of authentication on system access.

* Security Questions
Security questions also require an additional step of authentication by requiring the answer to personal questions.

* Account Policies
Account policies force the user to frequently change the password or to lock the account if the password is entered wrong multiple times.

* Activity Monitoring
The monitoring of suspicious activity like a login attempt of a new devices can alert the user to pay attention to a certain account and maybe change the login credentials.

== Password Cracking Tools ==
These are only some of the cracking tools:
* John The Ripper
Supports brute-force and dictionary attacks. This tool will be used later in this documentation to present a password cracking process.

* Hashcat
Offers brute-force, dictionary, mask attacks and more.

* OPH Crack
Implements the rainbow table attack.

== Requirements ==

* Operating system/Platform: Kali Linux
* Packages: git openwall/john

== Cracking a password ==
The following steps are necessary in order to crack a password. Kali linux is used as the operating system as it provides different cracking tools and more. The used tool for this crack process is "John The Ripper".
* NOTE: Password cracking is unethical. This demonstration serves for educational purposes and should not be recreated.

=== Step 1 ===

Create a .zip password secured archive.

sudo apt-get install zip

sudo nano document.txt

zip -e archive.zip document.txt

You will be prompted to enter a password.
=== Step 2 ===

Now the hash of the password needs to be achieved.

zip2john archive.zip > hash.txt

This command saves the hash of the password which is used to secure the archive.zip archive in a hash.txt file.

=== Step 3 ===

Now the hash can be cracked. The crack is only successful if the password is in the password list that john uses to compare the hashes.

john hash.txt

The passwordlist in this case is the default password list of john. However, different password lists can be used by specifying the file they are saved as.

john --wordlist=/tmp/password-list.txt hash.txt

This way john will try to crack the password with the password-list.txt password list file.
* In the case of a successful attack, john will provide a confirmation message about the successful attack and display the password.

== References ==

* https://www.overleaf.com/project/64fc39ddb97b168fb7bd033d
* https://www.openwall.com/john/
* https://www.kali.org/tools/john/
* https://www.kali.org/
* https://ieeexplore.ieee.org/document/6234434
* https://ieeexplore.ieee.org/document/8936178
* https://doi.org/10.1145/359168.359172
* https://ieeexplore.ieee.org/document/9023888
* https://ieeexplore.ieee.org/document/9609778

[[Category:Documentation]]

Password Security, Threats and Measures

2024-03-04T18:22:16Z

NSelimovic:

== Summary ==

This documentation provides an overview of the threats to passwords and the security measures taken against them. Furtheron, this article provides a presentation on how to crack a password with the pentesting tool "John The Ripper".

== Password Security ==

Passwords are the most used authentication method. Therefore, the security of a password is of significant importance. The strenght of a password can be measured through the quality of the password or its entropy. Besides the quality and entropy of a password, factors like personal data or known passwords have to be considered.

The quality of a password is described as the time it takes to crack a password using the trial and error method. Passwords which take longer to crack are considered to be of higher quality.
The entropy of a password is described as the randomness and unpredictability of a password. The entropy of a password can be impacted through factors like the length and character set size.

=== Password Managers ===

Password managers can store the passwords, guide the creation and provide security when sharing passwords. Password managers can include aid in the cases of long, complex and important passwords as they store the passwords of the user and provide a certain level of security. These managers often consist of several authentication steps in order to achieve this certain level of security. The functionality can differ as there are different types of managers.

Types of password managers:
* Cloud-Based Password Managers
* Local Password Managers
* Browser-Based Managers
* Enterprise Managers
* Hardware Password Managers

== Vulnerabilities and Threats ==

Passwords are mostly created by humans and are therefore a subject to vulnerabilities. Humans seek simplicity and comfort and they try to create easy to remember passwords. They often use personal information in order to provide a memorable word. Most of them use the same passwords on multiple websites and neither do they change them frequently. Close to two thirds of users do not use special characters in their passwords.

These factors create many vulnerabilities as they make the passwords predictable, of low quality or entropy and therefore easier to crack.

=== Threats ===

These weakly created passwords are often the victim to different threats. Most of these threats require some sort of fraud or deception.

Some of these threats are:
* Phishing
Is trying to gain login credentials by impersonating a person or faking a website.

* Keylogging
Is recording the keystrokes which a user puts in.

==== Attacks ====
These attacks vary and can be successful at compromising the victims password. Different attacks require different computational power, memory and time when cracking passwords.

Some of these attacks are:
* Brute-Force and Dictionary Attacks
Trying to guess the password or using wordlists.
* Rainbow-Table Attack
Hashing a password over and over again in order to gain the same hash as the victim password and then reconstruct the plaintext password.

== Security Measures ==
In order to prevent attackers from gaining unauthorized access, developers have came up with different security measures. These measures can provide further steps of authentication and achieve more security.

These are some security measures which can help to withstand most of the named threats:
* Two-Factor Authentication
This measure requires and additional step of authentication on system access.

* Security Questions
Security questions also require an additional step of authentication by requiring the answer to personal questions.

* Account Policies
Account policies force the user to frequently change the password or to lock the account if the password is entered wrong multiple times.

* Activity Monitoring
The monitoring of suspicious activity like a login attempt of a new devices can alert the user to pay attention to a certain account and maybe change the login credentials.

== Password Cracking Tools ==
These are only some of the cracking tools:
* John The Ripper
Supports brute-force and dictionary attacks. This tool will be used later in this documentation to present a password cracking process.

* Hashcat
Offers brute-force, dictionary, mask attacks and more.

* OPH Crack
Implements the rainbow table attack.

== Requirements ==

* Operating system/Platform: Kali Linux
* Packages: git openwall/john

== Description ==
The following steps are necessary in order to crack a password. Kali linux is used as the operating system as it provides different cracking tools and more. The used tool for this crack process is "John The Ripper".
* NOTE: Password cracking is unethical. This demonstration serves for educational purposes and should not be recreated.

=== Step 1 ===

Create a .zip password secured archive.

sudo apt-get install zip

sudo nano document.txt

zip -e archive.zip document.txt

You will be prompted to enter a password.
=== Step 2 ===

Now the hash of the password needs to be achieved.

zip2john archive.zip > hash.txt

This command saves the hash of the password which is used to secure the archive.zip archive in a hash.txt file.

=== Step 3 ===

Now the hash can be cracked. The crack is only successful if the password is in the password list that john uses to compare the hashes.

john hash.txt

The passwordlist in this case is the default password list of john. However, different password lists can be used by specifying the file they are saved as.

john --wordlist=/tmp/password-list.txt hash.txt

This way john will try to crack the password with the password-list.txt password list file.
* In the case of a successful attack, john will provide a confirmation message about the successful attack and display the password.
== References ==

* https://www.overleaf.com/project/64fc39ddb97b168fb7bd033d
* https://www.openwall.com/john/
* https://www.kali.org/tools/john/
* https://www.kali.org/
* https://ieeexplore.ieee.org/document/6234434
* https://ieeexplore.ieee.org/document/8936178
* https://doi.org/10.1145/359168.359172
* https://ieeexplore.ieee.org/document/9023888
* https://ieeexplore.ieee.org/document/9609778

[[Category:Documentation]]

Password Security, Threats and Measures

2024-03-04T01:17:19Z

NSelimovic: Created page with "== Summary == This documentation provides an overview of the threats to passwords and the security measures taken against them. Furtheron, this article provides a presentation on how to crack a password with the pentesting tool "John The Ripper". == Password Security == Passwords are the most used authentication method. Therefore, the security of a password is of significant importance. The strenght of a password can be measured through the quality of the password or..."

Secure Boot Zynq-7000 SoC Family

2024-02-29T00:45:39Z

NSelimovic:

== Summary ==

The Secure Boot process for the Zynq 7000 SoC family is an important securiy features which is designed to protect the integrity and authenticity of the system´s software. This documentation contains a tutorial and basic information on how to implement the Secure Boot technology onto the Zybo Z7 development board.

== Hardware and Software ==

Required Hardware and Software:

* Software: Vitis(2023.2), Vivado(2023.2)
* Hardware: Zybo Z7 Zynq-7020 Development Board

The implementation of the Secure Boot works the same as on other Zynq-7000 development boards, as long as they are available in the Vitis and Vivado software. The used software to configure the boards and implement the technology is provided by Xilinx. The used board is provided by the ELVIS Embedded Lab Vienna for IoT & Security at FH Campus Vienna.

== Requirements ==

In order to fulfill the task, the board has to be configured and set up correctly. The setup and configuration of certain hardware features can be done with the Vivado 2023.2 software which is provided by Xilinx. The configuration inside the Vivado 2023.2 creates an output which can be used to create a platform project. A platform project offers the configuration of certain libraries and templates which can be used inside the Vitis 2023.2 IDE. The configuration of the platform project enables the creation of application projects which are used to program the board.

The implementation of the Secure Boot process requires the project to be configured to the point where the application project can be coded and programmed onto the board.

== Description ==

The implementation of the Secure Boot technology requires the developer to create a boot image which is secure.
The Vitis IDE offers an "Create Boot Image" tool which enables the creation of different boot images of an application.

=== Step 1 ===

Right click on the application, which is supposed to have the Secure Boot implemented, in the explorer folder and choose the option "Create Boot Image".
[[File:Createbootimage.png|250px|thumb|left]]

=== Step 2 ===

After the "Create Boot Image" window opens, the window offers 2 different tabs. One being labeled "Basic" and one being labeled "Security".

The Security tab offers 2 more tabs which are labeled "Authentication" and "Encryption". Both of these options offer a checkbox to enable either authentication or/and encryption of the boot process.
[[File:Encryptiontab.PNG|400px|thumb|left]]

=== Step 3 ===

In this example, the encryption of the boot process is used. In order to encrypt the boot process, the "Use Encryption" check box has to be checked and an part name has to be given in order to auto generate a key file.

The "Create Boot Image" window previews the different Boot image partitions in the lower half. After the enabling the use of encryption, different boot image partitions can be encrypted.

To encrypt the different partitions, the partitions have to be marked in the window and than the "Edit" button has to be pressed.

After pressing the "Edit" button, an "Edit Partition" window opens and the partition can be encrypted by choosing an encryption type in the encryption menu.

After choosing the encryption types for the different partitions, the image can be created by pressing the "Create Image" button.

- NOTE: In order to encrypt the partitions, the bootloader has to be encrypted.
[[File:Bootimagepartition.PNG|400px|thumb|left]]

=== Step 4 ===

This step requires the device to be connected to the computer.

The boot image that was just created can now be flashed onto the device. To flash the boot image onto the device, right click onto the application and choose "Program Flash".

A "Program Flash Memory" window opens. In order to flash the just created encrypted boot image, it has to be chosen as the "Image File".
[[File:Flashingimage.png|300px|thumb|left]]

NOTE:
* In order to be able to flash the boot image onto the device, the "QSPI" pins have to be enabled. On the ZYBO Z7 development board, a jumper placement onto the 2 QSPI pins is required.

=== Step 5 ===

After confirming the flash onto the device, the device will load the boot image that was just created and boot it. The flashing of a different boot image is now disabled as long as the encryption is not decrypted.

=== Resetting the device ===

In order to use the development board for its further development purposes, the flashing of other boot images still has to be an option. The JTAG ports, which can be either disabled or enabled are a way to boot or flash different boot images onto the board. This requires, as long as the JTAG ports are enabled, a jumper connection onto the 2 JTAG pins. Now the consumer is able to flash other images onto the device.

== References ==

* https://digilent.com/reference/programmable-logic/guides/start
* https://digilent.com/reference/programmable-logic/guides/vivado-generate-bitstream
* https://docs.xilinx.com/v/u/en-US/wp426-zynq-7000-secure-boot
* https://www.xilinx.com/video/soc/create-zynq-boot-image-using-xilinx-sdk.html

[[Category:Documentation]]

File:Flashingimage.png

2024-02-29T00:43:37Z

NSelimovic:

File:Bootimagepartition.PNG

2024-02-29T00:35:28Z

NSelimovic:

File:Encryptiontab.PNG

2024-02-29T00:26:57Z

NSelimovic:

Secure Boot Zynq-7000 SoC Family

2024-02-29T00:14:04Z

NSelimovic: /* Step 1 */

== Summary ==

The Secure Boot process for the Zynq 7000 SoC family is an important securiy features which is designed to protect the integrity and authenticity of the system´s software. This documentation contains a tutorial and basic information on how to implement the Secure Boot technology onto the Zybo Z7 development board.

== Hardware and Software ==

Required Hardware and Software:

* Software: Vitis(2023.2), Vivado(2023.2)
* Hardware: Zybo Z7 Zynq-7020 Development Board

The implementation of the Secure Boot works the same as on other Zynq-7000 development boards, as long as they are available in the Vitis and Vivado software. The used software to configure the boards and implement the technology is provided by Xilinx. The used board is provided by the ELVIS Embedded Lab Vienna for IoT & Security at FH Campus Vienna.

== Requirements ==

In order to fulfill the task, the board has to be configured and set up correctly. The setup and configuration of certain hardware features can be done with the Vivado 2023.2 software which is provided by Xilinx. The configuration inside the Vivado 2023.2 creates an output which can be used to create a platform project. A platform project offers the configuration of certain libraries and templates which can be used inside the Vitis 2023.2 IDE. The configuration of the platform project enables the creation of application projects which are used to program the board.

The implementation of the Secure Boot process requires the project to be configured to the point where the application project can be coded and programmed onto the board.

== Description ==

The implementation of the Secure Boot technology requires the developer to create a boot image which is secure.
The Vitis IDE offers an "Create Boot Image" tool which enables the creation of different boot images of an application.

=== Step 1 ===

Right click on the application, which is supposed to have the Secure Boot implemented, in the explorer folder and choose the option "Create Boot Image".
[[File:Createbootimage.png|200px|thumb|left|alt text]]

=== Step 2 ===

After the "Create Boot Image" window opens, the window offers 2 different tabs. One being labeled "Basic" and one being labeled "Security".

The Security tab offers 2 more tabs which are labeled "Authentication" and "Encryption". Both of these options offer a checkbox to enable either authentication or/and encryption of the boot process.

=== Step 3 ===

In this example, the encryption of the boot process is used. In order to encrypt the boot process, the "Use Encryption" check box has to be checked and an part name has to be given in order to auto generate a key file.

The "Create Boot Image" window previews the different Boot image partitions in the lower half. After the enabling the use of encryption, different boot image partitions can be encrypted.

To encrypt the different partitions, the partitions have to be marked in the window and than the "Edit" button has to be pressed.

After pressing the "Edit" button, an "Edit Partition" window opens and the partition can be encrypted by choosing an encryption type in the encryption menu.

After choosing the encryption types for the different partitions, the image can be created by pressing the "Create Image" button.

- NOTE: In order to encrypt the partitions, the bootloader has to be encrypted.

=== Step 4 ===

This step requires the device to be connected to the computer.

The boot image that was just created can now be flashed onto the device. To flash the boot image onto the device, right click onto the applicaiton and choose "Program Flash".

A "Program Flash Memory" window opens. In order to flash the just created encrypted boot image, it has to be chosen as the "Image File".

NOTE:
* In order to be able to flash the boot image onto the device, the "QSPI" pins have to be enabled. On the ZYBO Z7 development board, a jumper placement onto the 2 QSPI pins is required.

=== Step 5 ===

After confirming the flash onto the device, the device will load the boot image that was just created and boot it. The flashing of a different boot image is now disabled as long as the encryption is not decrypted.

=== Resetting the device ===

In order to use the development board for its further development purposes, the flashing of other boot images still has to be an option. The JTAG ports, which can be either disabled or enabled are a way to boot or flash different boot images onto the board. This requires, as long as the JTAG ports are enabled, a jumper connection onto the 2 JTAG pins. Now the consumer is able to flash other images onto the device.

== Sources ==

* https://digilent.com/reference/programmable-logic/guides/start
* https://digilent.com/reference/programmable-logic/guides/vivado-generate-bitstream
* https://docs.xilinx.com/v/u/en-US/wp426-zynq-7000-secure-boot
* https://www.xilinx.com/video/soc/create-zynq-boot-image-using-xilinx-sdk.html

[[Category:Documentation]]

Secure Boot Zynq-7000 SoC Family

2024-02-29T00:12:53Z

NSelimovic:

== Summary ==

The Secure Boot process for the Zynq 7000 SoC family is an important securiy features which is designed to protect the integrity and authenticity of the system´s software. This documentation contains a tutorial and basic information on how to implement the Secure Boot technology onto the Zybo Z7 development board.

== Hardware and Software ==

Required Hardware and Software:

* Software: Vitis(2023.2), Vivado(2023.2)
* Hardware: Zybo Z7 Zynq-7020 Development Board

The implementation of the Secure Boot works the same as on other Zynq-7000 development boards, as long as they are available in the Vitis and Vivado software. The used software to configure the boards and implement the technology is provided by Xilinx. The used board is provided by the ELVIS Embedded Lab Vienna for IoT & Security at FH Campus Vienna.

== Requirements ==

In order to fulfill the task, the board has to be configured and set up correctly. The setup and configuration of certain hardware features can be done with the Vivado 2023.2 software which is provided by Xilinx. The configuration inside the Vivado 2023.2 creates an output which can be used to create a platform project. A platform project offers the configuration of certain libraries and templates which can be used inside the Vitis 2023.2 IDE. The configuration of the platform project enables the creation of application projects which are used to program the board.

The implementation of the Secure Boot process requires the project to be configured to the point where the application project can be coded and programmed onto the board.

== Description ==

The implementation of the Secure Boot technology requires the developer to create a boot image which is secure.
The Vitis IDE offers an "Create Boot Image" tool which enables the creation of different boot images of an application.

=== Step 1 ===

Right click on the application, which is supposed to have the Secure Boot implemented, in the explorer folder and choose the option "Create Boot Image".

=== Step 2 ===

After the "Create Boot Image" window opens, the window offers 2 different tabs. One being labeled "Basic" and one being labeled "Security".

The Security tab offers 2 more tabs which are labeled "Authentication" and "Encryption". Both of these options offer a checkbox to enable either authentication or/and encryption of the boot process.

=== Step 3 ===

In this example, the encryption of the boot process is used. In order to encrypt the boot process, the "Use Encryption" check box has to be checked and an part name has to be given in order to auto generate a key file.

The "Create Boot Image" window previews the different Boot image partitions in the lower half. After the enabling the use of encryption, different boot image partitions can be encrypted.

To encrypt the different partitions, the partitions have to be marked in the window and than the "Edit" button has to be pressed.

After pressing the "Edit" button, an "Edit Partition" window opens and the partition can be encrypted by choosing an encryption type in the encryption menu.

After choosing the encryption types for the different partitions, the image can be created by pressing the "Create Image" button.

- NOTE: In order to encrypt the partitions, the bootloader has to be encrypted.

=== Step 4 ===

This step requires the device to be connected to the computer.

The boot image that was just created can now be flashed onto the device. To flash the boot image onto the device, right click onto the applicaiton and choose "Program Flash".

A "Program Flash Memory" window opens. In order to flash the just created encrypted boot image, it has to be chosen as the "Image File".

NOTE:
* In order to be able to flash the boot image onto the device, the "QSPI" pins have to be enabled. On the ZYBO Z7 development board, a jumper placement onto the 2 QSPI pins is required.

=== Step 5 ===

After confirming the flash onto the device, the device will load the boot image that was just created and boot it. The flashing of a different boot image is now disabled as long as the encryption is not decrypted.

=== Resetting the device ===

In order to use the development board for its further development purposes, the flashing of other boot images still has to be an option. The JTAG ports, which can be either disabled or enabled are a way to boot or flash different boot images onto the board. This requires, as long as the JTAG ports are enabled, a jumper connection onto the 2 JTAG pins. Now the consumer is able to flash other images onto the device.

== Sources ==

* https://digilent.com/reference/programmable-logic/guides/start
* https://digilent.com/reference/programmable-logic/guides/vivado-generate-bitstream
* https://docs.xilinx.com/v/u/en-US/wp426-zynq-7000-secure-boot
* https://www.xilinx.com/video/soc/create-zynq-boot-image-using-xilinx-sdk.html

[[Category:Documentation]]

File:Createbootimage.png

2024-02-29T00:09:49Z

NSelimovic: Screenshot of bootimage creation

== Summary ==
Screenshot of bootimage creation

Secure Boot Zynq-7000 SoC Family

2024-02-06T01:01:10Z

NSelimovic: How to implement a secure boot process in the Zynq-7020 SoC

== Summary ==

The Secure Boot process for the Zynq 7000 SoC family is an important securiy features which is designed to protect the integrity and authenticity of the system´s software. This documentation contains a tutorial and basic information on how to implement the Secure Boot technology onto the Zybo Z7 development board.

== Hardware and Software ==

Required Hardware and Software:

* Software: Vitis(2023.2), Vivado(2023.2)
* Hardware: Zybo Z7 Zynq-7020 Development Board

The implementation of the Secure Boot works the same as on other Zynq-7000 development boards, as long as they are available in the Vitis and Vivado software. The used software to configure the boards and implement the technology is provided by Xilinx. The used board is provided by the ELVIS Embedded Lab Vienna for IoT & Security at FH Campus Vienna.

== Requirements ==

In order to fulfill the task, the board has to be configured and set up correctly. The setup and configuration of certain hardware features can be done with the Vivado 2023.2 software which is provided by Xilinx. The configuration inside the Vivado 2023.2 creates an output which can be used to create a platform project. A platform project offers the configuration of certain libraries and templates which can be used inside the Vitis 2023.2 IDE. The configuration of the platform project enables the creation of application projects which are used to program the board.

The implementation of the Secure Boot process requires the project to be configured to the point where the application project can be coded and programmed onto the board.

== Description ==

The implementation of the Secure Boot technology requires the developer to create a boot image which is secure.
The Vitis IDE offers an "Create Boot Image" tool which enables the creation of different boot images of an application.

=== Step 1 ===

Right click on the application, which is supposed to have the Secure Boot implemented, in the explorer folder and choose the option "Create Boot Image".

=== Step 2 ===

After the "Create Boot Image" window opens, the window offers 2 different tabs. One being labeled "Basic" and one being labeled "Security".

The Security tab offers 2 more tabs which are labeled "Authentication" and "Encryption". Both of these options offer a checkbox to enable either authentication or/and encryption of the boot process.

=== Step 3 ===

In this example, the encryption of the boot process is used. In order to encrypt the boot process, the "Use Encryption" check box has to be checked and an part name has to be given in order to auto generate a key file.

The "Create Boot Image" window previews the different Boot image partitions in the lower half. After the enabling the use of encryption, different boot image partitions can be encrypted.

To encrypt the different partitions, the partitions have to be marked in the window and than the "Edit" button has to be pressed.

After pressing the "Edit" button, an "Edit Partition" window opens and the partition can be encrypted by choosing an encryption type in the encryption menu.

After choosing the encryption types for the different partitions, the image can be created by pressing the "Create Image" button.

- NOTE: In order to encrypt the partitions, the bootloader has to be encrypted.

=== Step 4 ===

This step requires the device to be connected to the computer.

The boot image that was just created can now be flashed onto the device. To flash the boot image onto the device, right click onto the applicaiton and choose "Program Flash".

A "Program Flash Memory" window opens. In order to flash the just created encrypted boot image, it has to be chosen as the "Image File".

NOTE:
* In order to be able to flash the boot image onto the device, the "QSPI" pins have to be enabled. On the ZYBO Z7 development board, a jumper placement onto the 2 QSPI pins is required.

=== Step 5 ===

After confirming the flash onto the device, the device will load the boot image that was just created and boot it. The flashing of a different boot image is now disabled as long as the encryption is not decrypted.

=== Resetting the device ===

In order to use the development board for its further development purposes, the flashing of other boot images still has to be an option. The JTAG ports, which can be either disabled or enabled are a way to boot or flash different boot images onto the board. This requires, as long as the JTAG ports are enabled, a jumper connection onto the 2 JTAG pins. Now the consumer is able to flash other images onto the device.

== Sources ==

* https://docs.xilinx.com/v/u/en-US/wp426-zynq-7000-secure-boot
* https://www.xilinx.com/video/soc/create-zynq-boot-image-using-xilinx-sdk.html

[[Category:Documentation]]