Encrypted storage with TrustZone

[brucezhao]

Hi, 

    AN12714 (i.MX Encrypted Storage Using CAAM Secure Keys) document describes Encrypted storage with CAAM.

    My question is that if I want to use CSU(Central Security Unit) to limit only OP-TEE can access CAAM, then CAAM can not be accessed by Normal world directly. I mean how to implement encrypted storage with OP-TEE, which uses OTPMK as root key by CAAM. 

    Thanks. 

[brucezhao]

Hi Harvey, I got it. Thank you for your reply. 

[Harvey021 · Accepted solution]

Hi @brucezhao 

OP-TEE itself is secure world, which should be able to access CAAM. AN12714 here mainly uses the kernel module DM-Crypt, which uses CAAM's secure key to implement disk encryption, and does not implement the requirements you mentioned.

Best regards

Harvey

Harvey