topic Re: En/Decryption of data on iMX6 board in i.MX Processors

En/Decryption of data on iMX6 board

rashmi — Wed, 13 Nov 2013 14:13:45 GMT

Hi,

How do I set up a CAAM to en/decrypt a data on a iMX6 SABRE board? Are there any sample application available?

I have gone through Security Reference manual which gives me low level information, does not seem of too much help to me.

Thanks

Re: En/Decryption of data on iMX6 board

LaurenPost — Wed, 13 Nov 2013 16:44:44 GMT

We will provide CAAM support on mx6 through openssl in our 3.10.17-1.0.0 beta release coming out early next year. We are using cryptodev through openssl to access the CAAM support.

Re: En/Decryption of data on iMX6 board

Yuri — Thu, 14 Nov 2013 02:37:09 GMT

You may look at the Platform SDK - it contains an example regarding blob using.

"The i.MX6 Platform SDK is located on Freescale Web.

The code can be found at sdk/drvers/caam. Keep in mind that in order to generate a blob with the CAAM OTPMK a secure boot with HAB

in closed config [...], otherwise in open config the blob will be created using the known CAAM default master key.

The platform SDK code is useful for generating a blob for a single chip but is not useful in a production environment.

The platform SDK code:

1. Configures CAAM appropriately in order to generate a key blob

2. Writes a fixed data encryption key (DEK) to a CAAM memory partition - same partition used by HAB

3. Configures the CAAM memory partition as CAAM read only

4. Generates the blob with CAAM

5. Re-allocate CAAM memory parition - erases original DEK

6. Decapsultates the blob to obtain the original DEK in CAAM read only memory partition

7. Perform a self test with the decapsulated DEK to ensure the DEK was properly restored"

Re: En/Decryption of data on iMX6 board

rashmi — Thu, 14 Nov 2013 13:23:05 GMT

So Can I use openssl commands with cryptodev engine to encrypt and decrypt data files?

Can you please brief me on how does cryptodev through openssl can access the CAAM support.

Are there any user space C application.

Thanks

Re: En/Decryption of data on iMX6 board

XXiao1z — Mon, 18 Nov 2013 14:55:50 GMT

what does "3.10.17-1.0.0 beta release" mean? is this LTIB release number, Yocto release number, or OpenSSL release number, or android release number? I could not make sense out of any of these numbers.

thanks,

Re: En/Decryption of data on iMX6 board

LaurenPost — Mon, 18 Nov 2013 15:11:49 GMT

We just released 3.10.9-1.0.0 alpha a BSP release under Yocto back in October. Next we are planning a 3.10.17-1.0.0_beta release for Yocto in early 2014. This is a Linux BSP release. We no longer release ltib releases for Linux.

Re: En/Decryption of data on iMX6 board

XXiao1z — Tue, 19 Nov 2013 21:04:30 GMT

I'm using repo with fsl-community-bsp-platform, how can I find the specific BSP release(e.g. 3.10.9-1.0.0 alpha BSP)? or am I missing something? all I saw is 1.4 release, 1.5 release at github and I did not find any tag for the BSP you mentioned. do you mean just the kernel release? I'm confused.

Thanks,

Re: En/Decryption of data on iMX6 board

XXiao1z — Tue, 19 Nov 2013 21:04:53 GMT

Thanks,

Re: En/Decryption of data on iMX6 board

rashmi — Tue, 26 Nov 2013 14:07:12 GMT

Hi Yuri,

I tried building the sdk to test the caam module with the command ./tools/build_sdk with test=caam. But found no useful information on "./output/mx6dq/sdk_unit_test/sabre_ai_rev_a" folder. can you please suggest me on how to understand the output upon testing caam driver using sdk.

Thanks,

Rashmi.

Re: En/Decryption of data on iMX6 board

Yuri — Thu, 28 Nov 2013 04:10:55 GMT

You wrote " found no useful information on "./output/mx6dq/sdk_unit_test/sabre_ai_rev_a" folder".

Do You mean that there are no .elf, .bin, .map files in the output directory ?

Are there errors reported during build process ?

Re: En/Decryption of data on iMX6 board

rashmi — Thu, 28 Nov 2013 04:40:14 GMT

Hi Yuri,

No errors, have got .elf .bin .map files in output directory. But throught this files how can I ensure whether CAAM is tested on board or not.

Thanks,

Rashmi

Re: En/Decryption of data on iMX6 board

Yuri — Thu, 28 Nov 2013 09:38:40 GMT

The Platform SDK (after cross-compiling) provides executable images (.elf, .bin), that should be run on a target board (say, on i.MX6 SDP).

Please to run .elf on the SDP, using a JTAG debugger.

Re: En/Decryption of data on iMX6 board

rashmi — Thu, 28 Nov 2013 12:22:44 GMT

Thanks for the reply Yuri.

Can you also brief me on how to execute those src .C files available on imx6_platform_SDk/sdk/drivers/caam. Can I use those C files to encrypt and decrypt my data.

Thanks ,

Rashmi

Re: En/Decryption of data on iMX6 board

Yuri — Fri, 29 Nov 2013 06:00:07 GMT

Source .c files may be used as example. It is needed to analyze them, using CAAM description in the Security Reference Manual for i.MX6.

You may download the security manual from our website (link below). You will

need to login in order to do this.

https://www.freescale.com/webapp/Download?colCode=IMX6DQ6SDLSRM&appType=moderatedWithoutFAE&fpsp=1&WT_TYPE=Reference%20Manuals&WT_VENDOR=FREESCALE&WT_FILE_FORMAT=pdf&WT_ASSET=Documentation&Parent_nodeId=1337694700967726419044&Parent_pageType=product&Parent_nodeId=1337694700967726419044&Parent_pageType=product

Re: En/Decryption of data on iMX6 board

rashmi — Fri, 29 Nov 2013 11:58:37 GMT

Hi Yuri,

I am using AF_ALG family for userspace interface for Kernel cryptoAPI. But when i try to test it using the command "openssl speed -evp aes-256 -cbc -engine af_alg -elapsed" i get the error as:

root@imx6qsabrelite:~# openssl speed -e aes-256-cbc -engine af_alg -elapsed
Error configuring OpenSSL
716629200:error:260BC066:engine routines:INT_ENGINE_CONFIGURE:engine configuration error:eng_cnf.c:204:
716629200:error:0E07606D:configuration file routines:MODULE_RUN:module initialization error:conf_mod.c:235:module=engines, value=openssl_engines, retcode=-1
root@imx6qsabrelite:~#

Please, Can you suggest me on how to fix these error.

Thanks,

Rashmi.

Re: En/Decryption of data on iMX6 board

rashmi — Fri, 29 Nov 2013 14:18:08 GMT

Hi Yuri,

Above issue is been resolved. We have setup the CAAM and tried the AF_ALG userspace interface to implement the same.But I am seeing the output as below with openssl command.

root@imx6qsabrelite:~# openssl speed -evp aes-128-cbc -engine af_alg -elapsed
engine "af_alg" set.
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-cbc for 3s on 16 size blocks: 2892 aes-128-cbc's in 2.98s
Doing aes-128-cbc for 3s on 64 size blocks: 2840 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 256 size blocks: 2816 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 1024 size blocks: 2668 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 8192 size blocks: 2031 aes-128-cbc's in 3.00s
OpenSSL 1.0.1e 11 Feb 2013
built on: Fri Oct 18 22:13:21 IST 2013
options:bn(64,32) rc4(ptr,int) des(idx,risc1,2,long) aes(partial) idea(int) blowfish(idx)
compiler: arm-poky-linux-gnueabi-gcc -march=armv7-a -mthumb-interwork -mfloat-abi=hard -mfpu=neon -mtune=cortex-a9 --sysroot=/home/developer/Y
octo-1.5/build/tmp/sysroots/imx6qsabrelite -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN     -DTERMI
O -O2 -pipe -g -feliminate-unused-debug-types -Wall -Wa,--noexecstack -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes 1024 bytes   8192 bytes
aes-128-cbc 15.53k       60.59k 240.30k      910.68k     5545.98k

I would like to know does the command "openssl speed -evp aes-128-cbc -engine af_alg -elapsed" has used CAAM for encryption?

How do I make sure whether CAAM is implemented?

Thanks,

Rashmi.

Re: En/Decryption of data on iMX6 board

Yuri — Mon, 02 Dec 2013 03:53:32 GMT

I think it makes sense check cpu usage using command "top"; if CAAM is working, cpu usage is ~several %.

Re: En/Decryption of data on iMX6 board

Yuri — Mon, 02 Dec 2013 03:54:23 GMT

The 3.10.9 release is not issued yet.

Re: En/Decryption of data on iMX6 board

rashmi — Wed, 04 Dec 2013 07:01:39 GMT

Dear Yuri,

I see the above output using openssl commands. But i'm not able to understand what does "Doing aes-128-cbc for 3s on 8192 size blocks: 2031 aes-128-cbc's in 3.00s" means, I have tried searching for the information but I got no information. If you could brief me on this result explains would be of great help to me.

Thanks,

Rashmi.

Re: En/Decryption of data on iMX6 board

Yuri — Mon, 09 Dec 2013 07:18:20 GMT

The phrase "Doing aes-128-cbc for 3s on 8192 size blocks: 2031 aes-128-cbc's in 3.00s" means,

that "aes-128-cbc" algorithm was used with data blocks of 8K and the speed of this operation

is 2031 ops per 3 sec. That is : ~[700 (aes-128-cbc) ops] / sec, when using 8K data blocks.