ARKSOFTENGINEERING CASE STUDY← PRODUCT ENGINEERING

CASE STUDY / SECURE BOOT / UPDATE COMPATIBILITY

Secure Boot migration from RSA-2048 to RSA-4096

A Qualcomm E51 root-of-trust signing migration where the real work extended beyond the first verifier into firmware image handling, production programming, and future update compatibility.

  • Qualcomm E51
  • Secure Boot
  • RSA-4096
  • Boot chain
  • Firmware updates
  • Compatibility
PUBLIC PROOFQualcomm E51 product page
BOUNDARYRoot of trust to updater
FOCUSSigned-image compatibility
ROLEImplementation and integration

Problem

The platform was moving from RSA-2048-signed images to RSA-4096-signed images. The direct OTP boot-stage change was only one part of the work. Every firmware component that receives, stores, installs, or hands off future images also had to remain compatible with the new signing format.

Qualcomm's E51 product page shows the modem as a deployable industrial IoT platform with an operating system, SDK, low-power features, and multiple peripheral interfaces. For this type of device, firmware images are not handled by one isolated module; they move through manufacturing, boot, update, and field support paths.

System context

Signed firmware image
        |
        v
OTP root of trust / Secure Boot verifier
        |
        v
Flash boot stage and runtime firmware
        |
        v
Production programming and firmware update mechanisms

The signing migration begins at the immutable trust boundary, but the product lifecycle continues through updater code and future image delivery. Treating only the first verifier as the migration boundary would leave downstream image paths at risk.

Engineering challenge

This was a system compatibility problem, not a local cryptography function change. Signature size, metadata assumptions, image buffers, verification handoff, storage layout, and update tooling can all be affected by a signing migration even when those components do not own the root-of-trust implementation.

Key principleA secure boot migration is complete only when the device can accept and process the next valid production image across the full supported lifecycle.

Implementation approach

Start at the immutable trust boundary

Implement the RSA-2048 to RSA-4096 migration where trusted execution decisions begin.

Trace every image-handling path

Follow the signed image through production programming, boot stages, runtime update assumptions, and handoff boundaries.

Protect future delivery

Make the update ecosystem understand the same image contract as the root-of-trust layer.

Outcome

The work connected a cryptographic root-of-trust upgrade to the lifecycle of production firmware images. It demonstrates secure boot experience that includes compatibility, updater behavior, and system integration, not only verifier implementation.

Public proof linkQualcomm E51 4G Modem-RF product page
PUBLIC-SAFE SUMMARY: Internal security implementation details, key material, signing metadata, source code, and product-specific update mechanisms are intentionally omitted.
More contextView embedded product engineering overview →