Secure Boot 2

[Alberk]

Hi,

May I know why RSA3072 is used instead of ECC considering the size of the keys for RSA is much larger?.

[ESP_Angus]

Hi AlberK,

Verifying RSA saves significant time during the boot process, especially because of the RSA accelerator hardware. Secure Boot V1 ECDSA signification verification adds a noticeable pause to the boot time (order of hundreds of milliseconds). RSA signature verification during boot is over ten times faster.

The key size is larger but as the key data is stored in flash (and we use the SHA of the key data stored in efuse to verify it), this doesn't cause a significant increase of resource use.

Angus

[Alberk]

Thank you for the explanation.