CAAM: ICV error when loading back a black key

throwException — Tue, 16 Nov 2021 08:38:21 GMT

We are trying to use the CAAM on i.MX 8M Mini with black keys.

First we create a black key by running the following job descriptor.

b081000d
12820004
00000020
82500010
a2000001
14810004
00000020
a2000001
10880004
e000006d
64140020
43b17000
a1001001

This job descriptor first generates 32 bytes of random data, then loads it into a key register and then uses the FIFO store to export the black key in AES-256-CCM. As far as we can tell, this works as expected.

Then we want to encapsulate the black key into a blob using the following job descriptor:

b0810008
f000002c
43b17000
f8000060
43b42000
870d0104
a2000001
a1001001

The job descriptor uses the protocol operation command with the blob protocol to encapsulate, but it returns the status code

2000051a

Which according to the security reference manual designates an ICV error.

We cannot find any reason for this ICV error as we are using the freshly generated black key and loading it with the same parameters as it was exported (AES-256-CCM with JDKEK).

Can anyone find our mistake?

Re: CAAM: ICV error when loading back a black key

throwException — Fri, 19 Nov 2021 09:10:59 GMT

For the record: The problem was the input length stated in the SEQ IN PTR command. This needs to be the length of the key (32 bytes) instead of the length of the black key data (32 + 12 bytes).

i.MX ProcessorsのトピックCAAM: ICV error when loading back a black key

CAAM: ICV error when loading back a black key

Re: CAAM: ICV error when loading back a black key