RT6xx secure boot

yoeinhor — Mon, 31 Jul 2023 12:27:49 GMT

Hello,

I am working on converting RT6xx systems from normal boot to secure boot with plain signed non-XIP images in the field, and have a couple of questions:

1. OTP_MASTER_KEY: Is this OTP necessary? Why? I saw it is set by the secure provisioning tool but I don't see a reason for it.

2. Are there any implications to flashing an image with the "image_type" field set to "plain signed non-XIP (0x1)" while secure boot is not enabled in the OTP? Following the boot process diagram in the manual, it seems like the bootloader ROM will treat it the same way as non-signed images, but I need to make sure this is the case.

Thanks.

Re: RT6xx secure boot

diego_charles — Fri, 01 Sep 2023 06:20:44 GMT

Hi @yoeinhor

I am sorry for not getting back to you on time, but, regarding your questions.

1 No, the OTP_MASTER_KEY is not necesary for plain signed images . Its use is described at AN12079 which is under secure access.

2 The implication that I see is that for booting a signed image, you will need to provide a ROM the keys/root certicate in the key store area, instead of the OTPs.

All the best,

Diego

topic Re: RT6xx secure boot in i.MX Processors

RT6xx secure boot

Re: RT6xx secure boot