CSEC ON 32K148

[hajianik]

Hi,

My target is S32K148.

I'm running the NXP project (Configure_parts_and_load_keys) with a little bit of modification:

This mode will change the MASTER_ECU_KEY_Value from blank(0xFFs) to zero,

Also will load zero in KEY_1 slot(key_id=4).

while it is successful in loading zeros in MASTER_ECU_KEY slot(key=1)

by comparing calculated M4,M5 to M4_OUT/M5_OUT however it fails with loading KEY_1 with the zero value.

uint32_t BLANK_KEY_VALUE[4] = {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF};

uint32_t ZERO_KEY_VALUE[4] = {0x00000000, 0x00000000, 0x00000000, 0x00000000};

//install zero values for Master_ECU_KEY

calculate_M1_to_M5(M1, M2, M3, M4, M5, BLANK_KEY_VALUE/*ZERO_KEY_VALUE*/,/*MASTER_ECU_KEY_VALUE_1*/ ZERO_KEY_VALUE, MASTER_ECU_KEY, MASTER_ECU_KEY, 1, 0); /* Calculate M1 to M5 in Software */

csec_error = LOAD_KEY(M4_out, M5_out, M1, M2, M3, MASTER_ECU_KEY); /* Load the key using SW calculated M1 to M3, and it returns M4 and M5 */

result = compare_results(M4, M4_out); /* Compare M4 generated by SW with the M4_out returned by CSEc */

/* Load KEY_1 */

calculate_M1_to_M5(M1, M2, M3, M4, M5, /*MASTER_ECU_KEY_VALUE*/ZERO_KEY_VALUE,/* KEY_1_VALUE*/ZERO_KEY_VALUE, MASTER_ECU_KEY, KEY_1, 1, 0); /* Calculate M1 to M5 in Software, Authorizing Key = Master ECU Key */

csec_error = LOAD_KEY(M4_out, M5_out, M1, M2, M3, KEY_1); /* Load the key using M1 to M3, returns M4 and M5 */

result = compare_results(M4, M4_out); /* Compare M4 generated by SW with the M4_out returned by CSEc */

Please tell me what I'm doing wrong.

Koorosh Hajiani

[lukaszadrapa]

Hi,

I did quick test on my side and it works. The only thing I changed in default project Configure_parts_and_load_keys from AN5401 is CSEc_keys.h:

uint32_t MASTER_ECU_KEY_VALUE[4] = {0, 0, 0, 0};

uint32_t KEY_1_VALUE[4] = {0, 0, 0, 0};

No other changes.

Output of compare_results() function was 1 (success) in both cases.

Regards,

Lukas

[hajianik]

Hi Lucas,

I followed your advise and it did not work.

I mean I still can not load KEY_1, NOW YOU JUST CHANGE THE NAME OF POINTER TO THE FUNCTION. THAT SHOIULD NOT MATTER.

I did what you did however the result is the same :

I can successfully load the ECU_MASTER_KEY_VALUE of zeros but it fails in loading KEY_1.

I used several boards to do this, the RESET_PARTS_TO_FACTORY_RESET does not work even with

ECU_MASTER_KEY_VALUE of zeros . so each time I need to do this on a new PCB.

This a mystery, here is the modified code based on your suggestion:

* CSEc_keys.h
 *
 *  Created on: Oct 19, 2016
 *      Author: B55457
 */

#ifndef CSEC_KEYS_H_
#define CSEC_KEYS_H_

uint32_t BLANK_KEY_VALUE[4] =   {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF}; //When key value is not written it is all FFs
//uint32_t MASTER_ECU_KEY_VALUE[4] = {0xD275F12C, 0xA863A7B5, 0xF933DF92, 0x6498FB4D}; //MASTER_ECU_KEY
//uint32_t MASTER_ECU_KEY_VALUE[4] =      {0x43414e44, 0x69566120, 0x4d535452, 0x204b4559}; //MASTER_ECU_KEY_GM
uint32_t MASTER_ECU_KEY_VALUE[4] = {0, 0, 0, 0};

uint32_t KEY_1_VALUE[4] = {0, 0, 0, 0};

uint32_t BOOT_MAC_KEY_VALUE[4] = {0x12340000, 0x00000000, 0x00000000, 0x00005678}; //BOOT_MAC_KEY
//uint32_t KEY_1_VALUE[4] =   {0x2FF8B03C, 0x5C540546, 0x5A9C94BD, 0x2D863279}; //KEY_1
uint32_t KEY_11_VALUE[4] =   {0x85852FF8, 0xE7860C89, 0xB3AB9D63, 0xB8D6288F}; //KEY_11
uint32_t RAM_KEY_VALUE[4] =   {0x68B674CB, 0x8198A250, 0x3A285100, 0xF4DDC40A}; //RAM_KEY
//uint32_t ZERO_KEY_VALUE[4] = {0x00000000, 0x00000000, 0x00000000, 0x00000000};
#endif /* CSEC_KEYS_H_ */

/* Load KEY_1 */

calculate_M1_to_M5(M1, M2, M3, M4, M5, MASTER_ECU_KEY_VALUE/*ZERO_KEY_VALUE*/, KEY_1_VALUE/*ZERO_KEY_VALUE*/, MASTER_ECU_KEY, KEY_1, 1, 0); /* Calculate M1 to M5 in Software, Authorizing Key = Master ECU Key */

csec_error = LOAD_KEY(M4_out, M5_out, M1, M2, M3, KEY_1); /* Load the key using M1 to M3, returns M4 and M5 */

result = compare_results(M4, M4_out); /* Compare M4 generated by SW with the M4_out returned by CSEc */

Thanks,

Koorosh Hajiani

[lukaszadrapa]

Hi,

attached are working projects.

Notes:

- it's necessary to execute both projects from RAM

- when resetting back to factory state, it's necessary to change the MASTER_ECU_KEY directly in DBG_AUTH function. It's hardcoded here for some reasons. The CSEc_keys.h file is not used here:

- and I found small bug in startup code when creating new application project in S32DS 2.2 for S32K148. Not sure what kind of project you have but maybe for others - it's necessary to call SystemInit after stack initialization. Move it like this:

Regards,

Lukas

[hajianik]

Hi,

I was the culprit, I was messing around with calculate_M1_TO_M5 function for keys greater than or equal than KEY_1.

I DELETED MY CHANGES AND IT SEEMS TO BE WORKING.

sorry for wasting your time. just one more question :

For keys who reside on bank1(kbs=1) would these function work?

Thanks,

Koorosh

[lukaszadrapa]

Hi Koorosh,

yes, no difference, it's the same for kbs=1.

Regards,

Lukas

[hajianik]

Hi Lukas,

When updating a key, in addition to updating its value can we change its attributes?

Thanks,

Koorosh

[lukaszadrapa]

Hi Koorosh,

yes, the attributes can be changed when updating a key.

Regards,

Lukas

[hajianik]

Hi Lukas,

which part numbers of S32K148 will support the GM_SHE (20 KEY SLOTS).

I have the S32K 148_EVAL BOARD that supports only 17 slots, on the production PCB same code supports 10 slots.

Thanks,

Koorosh

[lukaszadrapa]

Hi Koorosh,

if CSE is available, there are 20 Keys. If you can use only 10 keys then you have configured 10 keys by Program Partition command:

Regards,

Lukas

[hajianik]

Hi Lucas,

Thanks for your response.

well it clears it up that we have 20 slots and only 17 user key. then why the enum

csec_key_id_t goes passed key_17, all the way through key_21?

second part of my question:

It is the same code that's running both on the EVAL board and the production board.

On the eval board I can load key_1 to key_17 however on the production board the same code will load key slots from key_1 to key_10.

any attempt to load passed key_10 fails.(production part number:SC668037VMH/R) which would support 20 keys.

Thanks,

Kooosh

[lukaszadrapa]

Hi Koorosh,

SC668037VMH/R is a custom part number and I can see there are some differences. Please ask your OEM for details. I'm not allowed to share details about custom devices.

Regards,

Lukas