topic Re: Key generation for encrypted boot in i.MX Processors

Key generation for encrypted boot

friederbaumgrat — Tue, 17 Jan 2017 09:18:38 GMT

Dear NXP community,

I am currently working on the encrypted boot for IMX.6 CPUs.

Everything works, but I have one problem. I have to encrypt the same image and transfer them to different boards (same CPU). The current state is, that I run the CST Tool and transfer the generated output key (dek.bin) to the board and call the dek_blob function in order to generate the dek_blob.bin (final key).

Is there a way I don't need to transfer the dek.bin to the board?

Is is possible to generate the dek_blob.bin on my host computer?

Best regards,

Frieder

Re: Key generation for encrypted boot

gary_bisson — Tue, 17 Jan 2017 14:56:20 GMT

Hi,

No there is no way, that is the whole point of the process, to be unique per board since it relies on each board unique ID/key.

If you really want to flash the exact same image on each platform, I guess you'll need give up on encryption and sign only.

Regards,

Gary

Re: Key generation for encrypted boot

friederbaumgrat — Wed, 18 Jan 2017 08:03:19 GMT

Hey Gary,

Thank you for your answer.

Regards,

Frieder