The OP-TEE on Raspberry Pi 3 webpage says,

This port of ARM Trusted Firmware and OP-TEE to Raspberry Pi3 IS NOT SECURE!

Although the Raspberry Pi3 processor provides ARM TrustZone exception states, the mechanisms and hardware required to implement secure boot, memory, peripherals or other secure functions are not available. Use of OP-TEE or TrustZone capabilities within this package does not result in a secure implementation.

This package is provided solely for educational purposes.

The description seems a little vague to me. What mechanisms and hardware do they talk about? Why does RPi3 fall short to provide a secure implementation?

1 Answer 1


According to slides (#7) from Sequitur Labs on the Raspberry Pi:

— It does not implement the crypto acceleration instructions
— Linux Device Tree Source (DTS) showed no indication of any security hardware IP
— No TZPC, TZASC, GIC or other proprietary bus/fabric security control interfaces
— No securable memory
— IE., A53 core security state signals not propagated throughout the fabric.

Also I don't believe there's any way to 'burn' a key onto the Raspberry Pi's SoC (like there is for other systems) which would allow for the secure boot to be trusted.

However Raspberry Pi 3B can be used for testing see the guide (which maybe the same as the old link on the question?).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.