"Intent to Secure" vs RCW[SB_EN]

[b_straehl]

• Non-Secure state- the state of the Security Monitor when the device boots with
the Intent to Secure fuse =0, or RCW[SB_EN]=0, and a non-fatal security
violation (including signature verification failure) occurs.
• In this state, non-trusted software is allowed to run, but it cannot request the
SEC to use persistent or ephemeral secret keys.
• Trusted state - the state of the Security Monitor when the device boots with the
Intent to Secure fuse or RCW[SB_EN]=1, and no security violations are
detected.
• In this state, trusted software (at least one trusted partition) is allowed to run,
and any software with memory mapped access to the SEC can request the
SEC to use persistent or ephemeral secret keys.

After a lot of reading I still don't understand the relationship between the "Intent to Secure" fuse and the RCW[SB_EN] bit. If I read the text above, I understand that if either the ITS fuse OR the RCW[SB_EN] bit is 0, then I can run non-trusted software. But it either the ITS fuse OR the RCW[SB_EN] bit is 1, then I can run trusted software. So let's see:

ITS=0; RCW[SB_EN]=0  > non-trusted SW
ITS=1; RCW[SB_EN]=0  > non-trusted SW or trusted SW
ITS=0; RCW[SB_EN]=1  > non-trusted SW or trusted SW
ITS=1; RCW[SB_EN]=1  > non-trusted SW or trusted SW

Is this correct?

[yipingwang]

ITS (Intent To Secure), if you set ITS bit the system operates in secure and trusted manner, Setting RCW[SB_EN] performs the same function.

Secure Boot is enabled if either this RCW bit is set or the Intent to Secure fuse value is set.

For prototyping phase, please don't blow the ITS fuse, but use rcw with SB_EN = 1.

In Trusted Manufacturing Process, program the ITS fuse at the same time or after provisioning all other fuses in the SoC.

[b_straehl]

Okay, thank you. But somehow this is not the full answer I expected.

According to the first part of the quotation I made in my original post, it seems to be possible that non-trusted application are executed if ITS OR RCW[SB_EN] is 0.

Can you confirm that please?

[yipingwang]

Non-trusted software is allowed to run if both ITS and  RCW[SB_EN] is 0.

[b_straehl]

Okay, thank you. But then I would say, that the following text, which I copy/pasted from the User Guide is wrong or at least confusing:

Non-Secure state- the state of the Security Monitor when the device boots with
the Intent to Secure fuse =0, or RCW[SB_EN]=0, and a non-fatal security
violation (including signature verification failure) occurs.

As you mentioned in your last response too, it shoud state ....Intent to Secure fuse =0 AND RCW[SB_EN]=0...