topic Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ? in i.MX Processors

How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

skwang6272 — Mon, 18 May 2020 15:46:03 GMT

Hi everyone,

I am trying to do disk encryption on i.MX6UL. The device is USB armory II. It has DCP and no CAAM.

This is my plan：

1、Two partitions. One for /boot, one for rootfs. Bootloader and kernel are stored in /boot and they are in plain text. The rootfs is encrypted by LUKS(DM-crpty).

2、Configure initramfs in the kernel. During the boot process, decrypt the encrypted rootfs and mount the root directory automatically.

3、LUKS uses file as key. At the same time this key file is encrypted with DCP.

Here is my question:

1、How to install the system on an already partitioned SD card？How to configure the encrypted file system？

2、How to configure initramfs to encrypt and load rootfs automatically?

I am just new to embedded development. Any suggestions, documentation and tutorials are welcome.

I have searched for similar issues

How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

The document "Root filesystem encryption using DM-Crypt" looks useful but I don't have permission to access it.

Thanks!

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

Yuri — Tue, 19 May 2020 03:42:51 GMT

Hello,

Please refer to the following app note (assuming encrypted boot of U-boot and kernel).
"i.MX Encrypted Storage Using CAAM Secure Keys"

https://www.nxp.com/docs/en/application-note/AN12714.pdf

Regards,

Yuri.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

skwang6272 — Mon, 25 May 2020 01:17:15 GMT

Hi,

Thanks a lot!

But I have seen this doc. And I have no CAAM, only DCP. Are threy same?

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

Yuri — Mon, 25 May 2020 12:33:13 GMT

Hello,

If i.MX processor does not have CAAM - only software based DM-crypt

may be applied.

Regards,

Yuri.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

skwang6272 — Thu, 28 May 2020 01:20:05 GMT

Hi,

Thank you for your reply. Could you show me any docs explain how to preform software based DM-crypt?

btw Why can't DCP do what CAAM does?

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

Yuri — Fri, 29 May 2020 07:11:45 GMT

Hello,

Some material have been sent directly.

Regards,

Yuri.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

skwang6272 — Tue, 02 Jun 2020 13:06:35 GMT

Hi,

I have received it. Thank you very much!

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

r1cebank — Wed, 24 Feb 2021 23:16:22 GMT

I am having the same question, is it possible to send me the same documents?

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

Yuri — Thu, 25 Feb 2021 05:35:47 GMT

@r1cebank

Done!

~Yuri.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

r1cebank — Mon, 15 Mar 2021 07:13:48 GMT

Hi,

I am not sure if you already figured this out, but recently I've modified the USB Armory's image builder script to support the encrypted rootfs you mentioned.

https://github.com/r1cebank/usbarmory-debian-base_image

Hope this helps.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

kmaincent — Fri, 07 May 2021 09:13:46 GMT

Hello Yuri,

I am also working on encryption.

Could I have access to the document "Root filesystem encryption using DM-Crypt"?

Thanks,

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

Yuri — Fri, 07 May 2021 10:22:54 GMT

@kmaincent
Hello,

I've sent You some comments.

Regards,
Yuri.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

andreamengalli — Wed, 09 Jun 2021 12:57:52 GMT

Hello Yuri,

I am working on encryption on i.MX8Mmini.

Could I have access to the document "Root filesystem encryption using DM-Crypt"?

Thanks in advance.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

Yuri — Thu, 10 Jun 2021 09:20:27 GMT

@andreamengalli
Hello,

please refer to

https://www.nxp.com/docs/en/application-note/AN12714.pdf

Regards,
Yuri.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

d1ken — Thu, 24 Jun 2021 18:29:34 GMT

I am working on rootfs encryption for i.MX7D.

Could you give me access to the "Root filesystem encryption using DM-Crypt" document?

Thanks.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

Yuri — Fri, 25 Jun 2021 03:25:14 GMT

@d1ken
Hello,

In addition to AN12714 (i.MX Encrypted Storage Using CAAM Secure Keys) use
section 10.5 (Disk encryption acceleration) of i.MX Linux User's Guide.

https://www.nxp.com/webapp/Download?colCode=AN12714

https://www.nxp.com/docs/en/user-guide/IMX_LINUX_USERS_GUIDE.pdf

For specific customer's cases (OS releases) NXP Pro Support may be involved.

Regards,
Yuri.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

parthitce — Tue, 12 Oct 2021 21:19:44 GMT

@YuriCould you please share the documents for dm-crypt to do with imx6ULL/imx6ULZ?

Thanks,

Parthiban N

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

Yuri — Wed, 13 Oct 2021 05:25:19 GMT

@parthitce
Hello,

I've sent You the file.

Regards,
Yuri.

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

MikeAtMT — Mon, 01 Nov 2021 21:34:10 GMT

+1 looking for "Root filesystem encryption using DM-Crypt" - I've worked on this many years ago, but need to refresh my memory. Thank you!

Re: How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

YoussefDALIL — Fri, 28 Jan 2022 13:53:13 GMT

Hello @Yuri ,

Could I have also access to the document "Root filesystem encryption using DM-Crypt"

I really need this document to work on my project please.

Waiting for your reply

Thanks