How to Create Blob

[fsquestion]

Where is the example code to create a blob for i.MX6?

All the specs for caam are in IMX6DQ6SDLSRM, but I just want to see how to use it with an example.

Something like, here is how to

(1) create blob

(2) write to blob

(3) read from blob

Thanks...

[fsquestion]

Please give me a hint.

Thanks.

[Yuri]

1.

As part of the offline image encryption process the CST will first generate a Data Encryption Key (DEK). The DEK is the key that will be used to actually encrypt the image. The problem then is how do we protect the DEK since it is required on the IC to decrypt the image at boot time? The solution is to create a DEK blob. The DEK blob is created by CAAM HW (using a proprietary protocol) that encrypts the DEK using the OTP master key. The OTP master key an AES-256 key burned to fuses by FSL before the IC is shipped. The OTPMK is unique per chip and only CAAM can access the key. This allows CAAM to encrypt and decrypt secrets for that chip. So, once that DEK blob is created only CAAM can decrypt it. To further add to the security of the DEK, the blob is decrypted to a partition of secure memory that only CAAM can access. After the DEK blob is created software will never have access to the DEK – not even the ROM. Section 5.6.5 of the i.MX6 Security Reference Manual has a full description on CAAM blobs.

https://www.freescale.com/webapp/Download?colCode=IMX6DQ6SDLSRM&appType=moderatedWithoutFAE

The ROM will first load the encrypted image to DDR and then as part of the CSF processing (i.e. an Install Key and corresponding Authenticate Image command) will decrypt the image in place. CAAM HW is used to perform the actual AES operations. Note in this case encrypted boot does not provide confidentiality but does provide anti-cloning protection of the flash image. Device secrets can be wrapped in blobs similar to the DEK blob but this is currently outside the scope of HAB.

2.

Encrypted boot has been prototyped and support has been included in the i.MX6 platform SDK.  The code can be found at sdk/drvers/caam. 

Keep in mind that in order to generate a blob with the CAAM OTPMK a secure boot with HAB  in closed config (see the notes for slide 4),

otherwise in open config the blob will be created using the known CAAM default master key.  The platform SDK code is useful for generating

a blob for a single chip but is not useful in a production environment.  The platform SDK code:

2.1. Configures CAAM appropriately in order to generate a key blob

2.2. Writes a fixed data encryption key (DEK) to a CAAM memory partition - same partition used by HAB

2.3. Configures the CAAM memory partition as CAAM read only

2.4. Generates the blob with CAAM

2.5. Re-allocate CAAM memory parition - erases original DEK

2.6. Decapsultates the blob to obtain the original DEK in CAAM read only memory partition

2.7. Perform a self test with the decapsulated DEK to ensure the DEK was properly restored

For a production environment steps 1-4 would be done by the MfgTool.  The remainder of the steps would be performed by HAB when i.MX6 boots.

3.

As for MFG :

"We don't provide native key blob creation support in the  Mfg Tool for encrypted boot.

We do have a process to create it, but not in a seamless way."

[vijaikumar]

As for MFG :

"We don't provide native key blob creation support in the  Mfg Tool for encrypted boot.

We do have a process to create it, but not in a seamless way."

Hi Yuri Muhin,

                      I need to support MFGTool for flashing encrypted images. I see your above statement from 2013. Are there any support added in the recent times?

Thanks,

Vijai Kumar K

[Yuri]

Hello,

  You may create the blob, using  U-boot of recent Linux BSPs.

Then,  the MFG can be used just to load and burn the encrypted images.

Regards,

Yuri.

[toddgoodman]

Hi Yuri,

From what you wrote above (back in 2013) it sounds like the only way to support encrypted images is using the OTPMK which is preprogrammed by Freescale and is different for each i.MX 6?

So, we'd have to generate a DEK blob on each physical  i.MX 6 during manufacturing?  And then save it for use when we need to update images in the future?

Thank you,

Todd

[Yuri]

Hello,

  generally it is possible to create blobs, using any keys, accessible by the CAAM.

Additional level of security (cloning disable) can be implemented, when using the
OTPMK - unique key, visible only be the CAAM. In this sense each i.MX6 part should

be treated separately.

Regards,

Yuri.

[toddgoodman]

Thank you Yuri!

Todd

[fsquestion]

For the record, I have not figured out how to create a General Memory Blob yet.   All sample code, and answers to questions asked always refer to Secure Memory.

I would like to take some PT data, and export this data as a GM blob.  This uses a BK that is randomly generated to create the BKEK, and then encapsulated as a blob.  I shouldn't have to do more than just point to a place in memory external to the CAAM, give the size, and the instructions to decrypt/encrypt and the output location.

However, I have not been able to figure out the CAAM instruction sequence.  I have tried so many things.  Please give an example of the descriptor I would need for encrypt/decrypt using memory external to the CAAM.

Thanks in advance to anyone that has had success doing this.

[jdepedro]

Hi, I am trying to achieve something similar. Did you succeed? Could you provide details?

[michaelroeder]

Hi Yuri/Rod

* Can you provide an example how to tell CST in the .csf file to generate the DEK and to encrypt the image with it?

* Where is the DEK stored by the CST? I need the storage location, so that I can transfer it onto the target to be encrypted by the CAAM

Any additional things to keep in mind ? :smileyhappy:

thanks for your help in advance,

Michael

[fsquestion]

Yuri,

Thanks for the reply.  I have short deadlines to meet though ;-)

How can I get started? 

Is all the code checked in?

Do I look at or use:

sm_store.c/sm_test.c?

Or from the sdk:

cam_blob_gen.c?

I tried to port the files over from cam_blog_gen, but there seems to be different definitions for the same registers, etc.

I want to create a blob.

Thanks...