I'm developing a bootloader for an embedded device, with which it should be possible for customers (i.e. device owners) to update the device's firmware. It is required that:
- the firmware is distributed encrypted
- the firmware's integrity is protected
- the firmware is authentic, meaning that it was released by us (the manufacturer).
Based on my limited knowledge about cryptographic schemes, I came up with the following potential solution (see below for explanation):
- For enryption and data integrity the firmware would be encrypted using AES256 in EAX mode using a key, which is shared between the manufacturer and the bootloader on the device, in addition to a nonce (i.e. initialization vector), which is encrypted (signed) using a private RSA key
- The AES encrypted firmware and the RSA encrypted nonce are then distributed to the customer
- The bootloader on the customer's device would then decrypt the nonce with the "public" RSA key (to ensure authenticity), and decrypt the firmware using the AES key and the nonce
Does this constitute a valid scheme for a secure bootloader (in terms of data privacy, integrity and authenticity)?
I am aware that using AES in EAX mode already provides data authenticity, however I would like to make sure that authenticity is still ensured in case the AES key is compromised.