secure boot i.MX, key management

emptyfridge — Wed, 27 May 2020 05:43:39 GMT

Hi guys,

Try to introduce secure boot in our products. Before I turn it on in the whole world I would like to clear some points. maybe you can help me with that. would be great.

1. If I generated 4 SRKs and burned the hash from the hexdump command in the fuses of the i.MX, it is

not possible to generate/add an other key with add_key and use it to sign the uImage and u-boot, right?

2. which files do I need to protect for example with "git secret"? key management suggetion?

3. Is there any chance to "regenerate" a key from the key_pass.txt that I can use to sign images. let's say in case that all of the 4 SRK/IMG files I need to sign get lost. (for what reason ever). Am I able to still generate signed images that will be accepted by the burned hash on the i.MX?

4. what about the validity date of the generated key/crts. Can this be checked from i.MX processor? if i set it to 10 years, will the device stop booting after this time?

Maybe an additional question, is there any yocto-integration planed on meta-freescale?

Thanks guys

Re: secure boot i.MX, key management

Yuri — Thu, 28 May 2020 06:07:06 GMT

thomaslinder

Hello,

Please look at my comments below.

1.
Yes, it is not possible to generate/add an other key, since
SRK fuse hash is generated for all 4 keys.

2.
Private keys must be protected as much as possible.

3.
No ability to "regenerate" keys from the key_pass.txt.
Private keys are used to sign images; corresponding public keys are applied
to check the images.

4.
The validity date is not checked by boot ROM (HAB).

Use U-boot documentation.

habv4\imx\doc - uboot-imx - i.MX U-Boot

Regards,

Yuri.

topic Re: secure boot i.MX, key management in i.MX Processors

secure boot i.MX, key management

Re: secure boot i.MX, key management