HSE concept

[anpa711]

Hi NXP,

Is the synchronization taken care internally for accessing the HSE from M7 and from A53 in parallel? Are they completely separated?
If there is usage of the HSE as per SHE specification on M7 and usage of the HSE as per pkcs11 on A53 can they in theory access each other keys (use same keys for some cryptography)? Can we provision key with SHE but use it on other partition?

Custom board using s32g274

Regards,

anpa

[anpa711]

Hi chenyin_h,

Thx for answer.

1. OK understood, we dont need to do any synchronization I guess

2. I didnt meant to extract the key I meant the following use case. With SHE spec I provision AES key to slot 8. When this key exist using this key on A53 side to decrypt/encrypt using pkcs11. Is this possible?

Regards,

anpa

[chenyin_h]

Hello, @anpa711 
Thanks for your reply.

Yes, it is possible.

BR

Chenyin

[anpa711]

Hi  chenyin_h,

Thx this looks than good.

Do you provide with your MCALs for s32K and s32g some key provisioning demo/test as per SHE specification (we are using EB Autosar stack plus your MCAL) or in some other form?

Regards,

anpa

[chenyin_h · Accepted solution]

Hello, @anpa711 

Thanks for your reply.

1. From S32G perspective, there is only a SHE based secure boot demo provided, included in the HSE_DEMOAPP,  which could be found from the HSE FW download page in your NXP account.

2. For S32K part, sorry that I am not very familiar with it and the replies should be provisioned by my colleague that response to this board: https://community.nxp.com/t5/S32K/bd-p/S32K

BR

Chenyin

[chenyin_h]

Hello, @anpa711 

Thanks for your post.

1. Typically, the M7 part will access the HSE via one MU, while A53 part may access the HSE in parallel via another MU, the HSE will handle these requirements base on its internal logic, it is transparent to the users. 

2. In HSE, the SHE keys is with HSE_KEY_TYPE_SHE, while the common operation may be with HSE_KEY_TYPE_AES, they are different types in HSE, and the SHE operation could only be provisioned via SHE services only,  exporting a key of type HSE_KEY_TYPE_SHE is not possible.

BR

Chenyin