Key generation for encrypted boot

[friederbaumgrat]

Dear NXP community,

I am currently working on the encrypted boot for IMX.6 CPUs.

Everything works, but I have one problem. I have to encrypt the same image and transfer them to different boards (same CPU). The current state is, that I run the CST Tool and transfer the generated output key (dek.bin) to the board and call the dek_blob function in order to generate the dek_blob.bin (final key).

Is there a way I don't need to transfer the dek.bin to the board?

Is is possible to generate the dek_blob.bin on my host computer?

Best regards,

Frieder

[gary_bisson · Accepted solution]

Hi,

No there is no way, that is the whole point of the process, to be unique per board since it relies on each board unique ID/key.

If you really want to flash the exact same image on each platform, I guess you'll need give up on encryption and sign only.

Regards,

Gary

[friederbaumgrat]

Hey Gary,

Thank you for your answer.

Regards,

Frieder