2191947_en-US

[#1]

Use private key on an i.MX 8QuadMax while keeping it non-exportable (opaque)?

Hi,

Does the iMX8QM support using asymmetric keys with CAAM, while keeping the private key non-exportable?

With a symmetric key, I can persistently store the in a black blob, import it to the system as a black key and then use it with dm-crypt. All without the kernel or userspace being able to access the plaintext version of the key.

I'd like to be able to do something similar, but with an asymmetric private key, and use that key for decryption/signing.

Is this possible, and could someone perhaps refer me to an application note or similar?

i.MX 8 Family | i.MX 8QuadMax (8QM) | 8QuadPlusSecurityRe: Use private key on an i.MX 8QuadMax while keeping it non-exportable (opaque)?

Hi,

With confirming internal security team, PKCS#11 + OPTEE only.

Regards

Harvey 

Re: Use private key on an i.MX 8QuadMax while keeping it non-exportable (opaque)?

Hi,

I forgot to say that if possible we'd like to not have to use OPTEE.

Regard,
Christian

Re: Use private key on an i.MX 8QuadMax while keeping it non-exportable (opaque)?

Hi,

Which version of BSP are you working with? 

You may use OPTEE + PKCS#11.

Regards

Harvey