topic Re: Boot encrypted root file system from sd card in i.MX Processors

Boot encrypted root file system from sd card

alampret — Mon, 05 Feb 2018 14:29:14 GMT

Hello everyone,

I try to boot from an encrypted sd card but it's not possible. What have I missed?

Main setup was done as shown here: Installing Ubuntu Rootfs on NXP i.MX6 boards

The first partition is vfat and the second one ext4 with LUKS.

On boot I get "Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block"

What's necessary for booting? Unfortunately I found hundreds of tutorial how to sign uboot but nothing related encrypting root fs of Linux and booting into it.

Storing the key will be a separate question. For the moment I would be happy if key file is stored on vfat partition (partition one on sd card)

Thx in advance!

Best regards,

Alexander

Re: Boot encrypted root file system from sd card

igorpadykov — Mon, 05 Feb 2018 23:05:20 GMT

Hi Alexander

as starting point one can try with uboot:

Use HAB API from u-boot to decrypt Linux image

High Assurance Boot (HAB) for dummies - Boundary Devices

AN4581 Secure Boot

https://www.nxp.com/docs/en/application-note/AN4581.pdf

Best regards
igor
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: Boot encrypted root file system from sd card

dry — Tue, 06 Feb 2018 00:47:18 GMT

Hey,

Dunno if you seen something like this guide :

dm-crypt/Encrypting an entire system - ArchWiki

Note that you likely need to create a custom initrd/initramfs and setup/hookup your encrypted root from there, before Linux can use it and jump into it.

Re: Boot encrypted root file system from sd card

EliteHawk — Mon, 24 May 2021 10:00:08 GMT

Hi,

I'm trying to do the exact same thing but with another board.

So there is no way to carry out this task without adding an initrd/initramfs?

If is it so, could you kindly link me to any guide to do it?

Thank you and Regards

Re: Boot encrypted root file system from sd card

Yuri — Tue, 25 May 2021 03:42:42 GMT

@alampret
Hello,

use app note "i.MX Encrypted Storage Using CAAM Secure Keys"

https://www.nxp.com/webapp/Download?colCode=AN12714

Regards,
Yuri.

Re: Boot encrypted root file system from sd card

EliteHawk — Tue, 25 May 2021 06:41:10 GMT

I may be wrong, but isn't this one a guide to creating a generic new partition on the board instead of a root ("/") partition one? I think that there should be some hooks in initramfs/initrd to do so