topic Using /dev/caam_kb to generate key blobs in i.MX Processors

Using /dev/caam_kb to generate key blobs

terateller — Tue, 22 Aug 2017 09:14:40 GMT

Hi All,

The Yocto build has a /dev/caam_kb when CAAM is enabled. Does anyone know or refer me to some documentation on how to generate a key blob(using OTPMK?) using this ioctl device interface?

Is there some examples or documentation? How can CAAM be called to make a key blob using OTPMK?

Thanks,

Tera

Re: Using /dev/caam_kb to generate key blobs

terateller — Tue, 22 Aug 2017 12:37:22 GMT

Dear All,

I chanced upon the dek_blob tool in connection with HABv4.

So from what I read, using this tool one can generate use a DEK (encryption key) and encrypt data. In case of HAB, using this tool, we can encrypt our uboot image, isn't it?

Here is how the command can be used:

dek_blob <DEK address> <Output Address> <Key Size in Bits>

Here what is the DEK Address? Also, does this command per default use the OTPMK , i.e the master key bound to each chip burned in silicon?

Please throw light.

Thanks a lot.

Re: Using /dev/caam_kb to generate key blobs

joanxie — Thu, 24 Aug 2017 07:13:32 GMT

you need to use the signed U-boot. pls refer to the document as below:

https://community.nxp.com/docs/DOC-330622