Encrypt / Decrypt data from uboot using CAAM

[jdepedro]

I would like to use the CAAM on the i.MX6Q to encrypt/decrypt data from uboot, using any available encryption protocol (I understand you can use AES 128-bit, 192-bit or 256-bit) and the OTPMK as key. That is, like the dek_blob is done. How can that be done?

I have seen some constructor for job descriptors available in drivers/crypto/fsl/jobdesc.c. I assume it would be necessary to create new job descriptor constructors for AES encryption and AES decryption which would use a src pointer, dst pointer and uint32_t data length.

However ensambling a job descriptor seems complicated and error prone. Is there any examples about how to do that?

[robertlubas]

Hi Jose,

Did you consider to use the black/red key blob from external memory? There is an implementation but resides in the kernel.

Do you have any experience with that?

Regards,

Robert Lubaś

[igorpadykov]

Hi jdepedro

please look at below links

Build the key blob generation utility with the Platform SDK

Generate the Encrypted U-boot v2014.04

DEK blob generator command for u-boot-imx

Best regards

igor

-----------------------------------------------------------------------------------------------------------------------

Note: If this post answers your question, please click the Correct Answer button. Thank you!

-----------------------------------------------------------------------------------------------------------------------

[jdepedro]

Hi  igorpadykov,

Thanks for those post, I have already read them, though. What I am looking for, is a way to encrypt / decrypt data from uboot using the OTPMK. dek blobing does not work for me because

* It is not a encryption (it generates a key, encrypt that key with the OTPKM, and encrypt the DEK with the generated key)

* It only works for some data lenghts

* It is not reversible on uboot (it is reversible in theory, but it is not implemented, right?)

What I want is to use the CAAM from uboot to encrypt/decrypt any data using AES-128/192 or 256 and the OTPMK as key. Is that possibe? How to do that?

[terateller]

Hi, any update on this?

Can we use CAAM via uboot to use OTPMK to generate keys to encrypt/decrypt images?

Thanks

[igorpadykov]

unfortunately caam is not offically supported in uboot.

It may be suggested to use NXP Professional Services:

http://www.nxp.com/support/nxp-professional-services:PROFESSIONAL-SERVICE

Best regards

igor