i.MX ProcessorsのトピックRe: [i.MX6ULL] Key path control fuse

[i.MX6ULL] Key path control fuse

ceggers — Mon, 02 Dec 2019 14:17:25 GMT

IMX6ULLSRM.pdf, page 162, section 5.3.2.2 "AES OTP Key"

Depending on the key path control fuse, the DCP receives the CRYTPO KEY either directly or indirectly through the SNVS trust controller module. The CRYPTO KEY in fuses is actually 256-bit and a mux is used to select the high or low 128 bits of the key.

I couldn't find the "key path control fuse". Where is it located and which paths are set for the values 0 (intact) and 1 (blown)? How do I select the low or high 128 bits of the key?

Re: [i.MX6ULL] Key path control fuse

Yuri — Mon, 09 Dec 2019 05:04:39 GMT

Hello,

It is confirmed, that the same "OTP_KEY_TO_DCP_DISABLE" fuse, as described in

the i.MX 6SL RM exists in i.MX 6ULL.

Documentation team is informed, that corresponding information should be added to

i.MX 6ULL RM.

Regards,

Yuri.

Re: [i.MX6ULL] Key path control fuse

ceggers1 — Mon, 09 Dec 2019 18:59:38 GMT

Hi Yuri,

thank you for working on this. Unfortunately I couldn't find "OTP_KEY_TO_DCP_DISABLE" in IMX6SLRM.pdf. Can you please provide the chapter/page number?

regards

Christian

Re: [i.MX6ULL] Key path control fuse

Yuri — Wed, 11 Dec 2019 03:29:11 GMT

Hello,

I meant the Security Reference Manual. Sorry.

https://www.nxp.com/webapp/Download?colCode=IMX6SLSRM&appType=moderatedWithoutFAE

Regards,

Yuri.

Re: [i.MX6ULL] Key path control fuse

ceggers — Thu, 12 Dec 2019 09:09:43 GMT

Hi Yuri,

I found the "OTP_KEY_TO_DCP_DISABLE" in the IMX6SLSRM. Can you please provide further information:

Where is this fuse located on the i.MX6ULL?
Which key path (OTP controller / SNVS) do I get when the fuse is intact or blown?

regards

Christian

Re: [i.MX6ULL] Key path control fuse

Yuri — Wed, 18 Dec 2019 07:58:03 GMT

Hello,

I've sent You information directly.

Regards,

Yuri.

Re: [i.MX6ULL] Key path control fuse

ceggers — Sat, 11 Jan 2020 08:15:21 GMT

Looks somebody else had the same question(s) as me:

https://community.nxp.com/thread/325009

I hope it's ok to post what I already got without coming into conflict with NXPs "security by obscurity" concept:

The KEY PATH on i.MX6ULL is set to SNVS at production time by a fuse whose location is not documented publically.
- This is not reversible by the customer, so the CRYPTO KEY is always provided via the SNVS.

Re: [i.MX6ULL] Key path control fuse

mike15 — Wed, 16 Dec 2020 00:13:39 GMT

Hello Yuri,

It is now the end of 2020 and I have searched everywhere for the fuse location of "OTP_KEY_TO_DCP_DISABLE" (bank / word or hex location). The [S]RMs for i.MX6SL, i.MX6ULL and i.MX6ULZ do not contain the location.

If possible, please reply privately with this information.

Also: consider raising a request to update the SRMs to avoid this in the future.

Mike