Encrypt a device by using CAAM on iMX7

cancel
Showing results for 
Search instead for 
Did you mean: 

Encrypt a device by using CAAM on iMX7

232 Views
aleksandar_niko
Contributor II

Hello,

I am trying to have a secure boot chain which will have the rootfs decryption integrated. The board would boot up to the initramfs, where I would like to decrypt the rootfs and mount it.The following requirement is to be fulfilled:

- the rootfs partition should be encrypted on the host machine in Yocto

I am not sure how to proceed with this. I have found the following two documents which describe how to create an encrypted storage by using the CAAM module:

- AN12554 (https://www.nxp.com/docs/en/application-note/AN12554.pdf)

- AN12714 (https://www.nxp.com/docs/en/application-note/AN12714.pdf)

As I can see, the latter document is newer (from February 2020) but seems like a device is encrypted on the target, which is not what I want. The former document is from August 2019 and seems to support the device encryption on the host and its decryption on the target.

Could someone assist me on how I should proceed on this?

Regards,

Aleksandar

0 Kudos
2 Replies

205 Views
aleksandar_niko
Contributor II

Thanks Yuri.

220 Views
Yuri
NXP TechSupport
NXP TechSupport

@aleksandar_niko 
Hello,

  We do not have example for Your situation.
You may use the recent NXP Linux BSP (L5.4.47). Look at section 9.5 (Disk
encryption acceleration) of "IMX_LINUX_USERS_GUIDE.pdf".

https://www.nxp.com/design/software/embedded-software/i-mx-software/embedded-linux-for-i-mx-applicat...

 

Regards,
Yuri.

0 Kudos