topic Re: Non Volatile Memory in CAAM (iMX6) in i.MX Processors

Non Volatile Memory in CAAM (iMX6)

satyadamarla — Thu, 23 Feb 2017 07:18:10 GMT

Hello Everyone,

I would like to know if there is any non volatile memory in CAAM for storing keys.

My application is as follows:

I would like to save the key for my encrypted rootfs in the processor and access it at boot time and use it to decrypt it through initramfs. I know the keys can be placed in the kernel, initramfs or sdcard (also usb) but I want to know if its possible to save it somewhere in the processor or any hardware modules. I have researched the CAAM Secure Memory but I understood it is used to save stuff on a running system and when the system is restarted then it is lost as it is a volatile memory like RAM. I researched SNVS (Secure Non Volatile Storage) but there is no mention of it being used to save keys from userspace.

Can anyone tell me if there is a possibility in iMX6 to save a key permanently and use it at boot time?
If not, where do you save your encryption keys for your rootfs?

Greets,

Satya

Re: Non Volatile Memory in CAAM (iMX6)

igorpadykov — Thu, 23 Feb 2017 09:01:01 GMT

Hi Satya

fuses are non-volatile memory, one can check Table 5-10. Fusemap Descriptions

http://cache.freescale.com/files/32bit/doc/ref_manual/IMX6DQRM.pdf

and SRK fuses described in AN4581 Secure Boot

http://www.nxp.com/assets/documents/data/en/application-notes/AN4581.pdf

Best regards
igor
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: Non Volatile Memory in CAAM (iMX6)

satyadamarla — Thu, 23 Feb 2017 15:16:36 GMT

Hello Igor,

Thank you.

I think it's not possible as the key is 256bit but there are only two General Purpose Words (GP1 and GP2) which make 64bit. I am not sure what will happen if I write the key into other registers. I can't take that risk.

Greets,

Satya