DM-verity Performance Comparing Software Solutions (Initramfs and Without-Initramfs) and HSE for Root Hash Verification in Embedded Linux

This paper investigates the performance impact of different root hash verification methods for DM-verity in embedded Linux systems. We compare three approaches: the traditional initramfs-based approach, a Hardware Security Engine (HSE)-based approach, and a without-initramfs approach that leverages kernel-space verification. Our analysis focuses on the NXP RDB2 platform running Wind River Linux LTS23, examining the trade-offs between security, performance, and implementation complexity for each method. The findings provide valuable insights for embedded developers seeking to optimize DM-verity implementations in resource-constrained environments.