Secure Boot questions on MPC5777C

[srikanth_vemula]

Hi,

I am working on Cryptographic Service Engine (CSE) for enabling Secure Boot feature on MPC5777C. After going through the reference manual and AN4234, I have got below doubts:

1. Is Secure Boot feature by default enabled on the product or we need to enable it?

2. Where can I get MASTER_ECU_KEY and BOOT_MAC_KEY which are required for executing secure boot process.

3. What happens if the BOOT_MAC_KEY is not matching with the calculated MAC? Would the Microcontroller hang in while(1)?

4. It is mentioned in the document : "For details about how and when the SECURE_BOOT
command is issued on this chip, see the chip-specific CSE information." can you please provide this chip specific information for MPC5777C.

5. Could you please provide any example code to enable the secure boot feature on MPC5777C.

Thanks in advance.

Regards,

Srikanth Vemula.

[lukaszadrapa]

Hi,

AN4234 was written mainly for MPC5646C, take a look at:

https://www.nxp.com/webapp/Download?colCode=AN5418

1. Secure Boot is enabled on all devices, it’s not necessary to program a DCF record.
2. MASTER_ECU_KEY and BOOT_MAC_KEY are your keys, those are provided by a user.
3. In case of parallel and sequential boot mode, you are just not able to use boot protected keys. In case of strict sequential boot mode, the device is bricked and there’s no way to recover.
4. This is talking about the DCF record mentioned earlier. It’s enabled in the factory, so you can ignore this.
5. The AN5418 contains also short code snippets. In case if secure boot, it’s just necessary to execute SECURE_BOOT command to define address and size of protected area and then load BOOT_MAC_KEY (it’s loaded as any other key).

There are also some examples in SDK. Not for secure boot but it could be also helpful:

c:\NXP\S32DS_Power_v2.1\S32DS\software\S32_SDK_S32PA_RTM_3.0.3\examples\MPC5777C\driver_examples\system\cse_keyconfig\

c:\NXP\S32DS_Power_v2.1\S32DS\software\S32_SDK_S32PA_RTM_3.0.3\examples\MPC5777C\driver_examples\system\security_pal\

Regards,

Lukas