topic Re: Encrypted DEK decryption error in i.MX Processors

Encrypted DEK decryption error

kanimozhi_t — Thu, 01 Apr 2021 10:51:30 GMT

Hi,

We're trying to encrypt the DEK for manufacturing protection following AN 12056

We have encrypted the DEK with CST as follows,

./cst -out csf_encrypt.txt -c CSF1_crt.pem -i csf_encrypt.bin

However when we try to decrypt the encrypted DEK (as produced in above step), we get the following error:

openssl cms -decrypt -in /cst_encrypt_sign/dek_spl.bin -inform DER -out ./dek_spl_dec.bin -binary -inkey /CSF1_1_sha256_2048_65537_v3_usr_key.pem -passin file:/key_pass_in.txt

Error reading S/MIME message\n140193583093056:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1149:\n140193583093056:error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:309:Type=CMS_ContentInfo\n

We're following the NXP app note closely, yet receiving these errors.

What are the steps to be followed for encrypting and decrypting the DEK with CST?

Re: Encrypted DEK decryption error

IvanRuiz — Thu, 08 Apr 2021 15:30:24 GMT

Hello,

Could you please tell me your CST tool version and your OpenSSL version?

Thank you,

Ivan.

Re: Encrypted DEK decryption error

kanimozhi_t — Fri, 09 Apr 2021 05:33:24 GMT

Hi,

We're using

CST version 3.3.1 and
OpenSSL version 1.1.1

and tried on both Ubuntu 18.04 and 20.04 yet no success.

Re: Encrypted DEK decryption error

IvanRuiz — Wed, 21 Apr 2021 21:44:14 GMT

Hello,

Seems that the front-end code of CST 3.3.1(also for CST3.1) has the issue. "-c" doesn't really work to input the public certification.

Need to add a ":" after c in cst.c in front end code and then rebuild the cst tool, then it can work.

I tried with below command and it work by updated cst binary.

-----

./cst -o csf_enc.bin -c IMG1_1_sha256_2048_65537_v3_usr_crt.pem -i csf_uboot_enc.txt

./openssl cms -decrypt -binary -in dek.bin -inform DER -inkey IMG1_1_sha256_2048_65537_v3_usr_key.pem -out decrypted_dek.bin --passin pass:test

-----

Please note that the dek.bin's size is 439 bytes(not 16 bytes) after you really encrypt the dek by the first command.

Hope it helps!

BR,

Ivan.