iMX8 - Encryption key management

my_tcn0 — Thu, 06 May 2021 10:40:41 GMT

I'm working on iMX8 Quad module, and i need to manage an unique cryptographic key to encrypt/decrypt some internal files.

I would like to store this key (or a passphrase to generate it) in secure memory (HW not accesible and SW accessible for an authorized process).

In IMX8MDQLQRM.pdf section 6.3, OCOTP_CTRL provides API to store the key. My problem is, if anyone access to the userspace of my OS, he can access also to the OCOTP mounted module and can read the content of the eFuses.

Is it possible to disable the OCOTP_CTRL and access to the eFuses in another way? (with C API for exemple).

The SNVS (Section 6.4) provides also the possibility to manage keys. Is there some privileged way to access to this memory ?

Thank you,

Re: iMX8 - Encryption key management

Yuri — Mon, 17 May 2021 09:42:51 GMT

@my_tcn0
Hello,

please refer to the following app notes regarding recommended approach
for encryption key management.

"Demo Application to Generate Red/Black Blobs Using CAAM and Encrypt/Decrypt Data"

https://www.nxp.com/webapp/Download?colCode=AN12554

"i.MX Encrypted Storage Using CAAM Secure Keys"

https://www.nxp.com/webapp/Download?colCode=AN12714

Regards,
Yuri.

topic Re: iMX8 - Encryption key management in i.MX Processors

iMX8 - Encryption key management

Re: iMX8 - Encryption key management