How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to boot into a luks encrypted rootfs partition from initramfs on i.MX6ULZ?

9,970 Views
skwang6272
Contributor II

Hi everyone, 

I am trying to do disk encryption on i.MX6UL. The device is USB armory II. It has DCP and no CAAM.

This is my plan:

1、Two partitions. One for /boot, one for rootfs. Bootloader and kernel are stored in /boot and they are in plain text. The rootfs is encrypted by LUKS(DM-crpty).

2、Configure initramfs in the kernel. During the boot process, decrypt the encrypted rootfs and mount the root directory automatically.

3、LUKS uses file as key. At the same time this key file is encrypted with DCP.

Here is my question:

1、How to install the system on an already partitioned SD card?How to configure the encrypted file system?

2、How to configure initramfs to encrypt and load rootfs automatically?

I am just new to embedded development. Any suggestions, documentation and tutorials are welcome.

I have searched for similar issues

How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

The document "Root filesystem encryption using DM-Crypt"  looks useful but I don't have permission to access it.

Thanks!

Labels (1)
28 Replies

2,345 Views
aadebayo
Contributor I

Dear Mr. Yuri
I also working on rootfs encryption for IMX6, if you could please also provide me with a copy of the "Root filesystem encryption using DM-Crypt" document I would appreciate ie.
Best regards,

Adeola 

0 Kudos
Reply

7,566 Views
MikeAtMT
Contributor I

+1 looking for "Root filesystem encryption using DM-Crypt" - I've worked on this many years ago, but need to refresh my memory. Thank you!

8,528 Views
r1cebank
Contributor II

Hi,

I am not sure if you already figured this out, but recently I've modified the USB Armory's image builder script to support the encrypted rootfs you mentioned.

https://github.com/r1cebank/usbarmory-debian-base_image

Hope this helps.

9,046 Views
Yuri
NXP Employee
NXP Employee

Hello,

  Please refer to the following app note (assuming encrypted boot of U-boot and kernel).
"i.MX Encrypted Storage Using CAAM Secure Keys"
 
https://www.nxp.com/docs/en/application-note/AN12714.pdf

Regards,

Yuri.

0 Kudos
Reply

9,046 Views
skwang6272
Contributor II

Hi,

Thanks a lot!

But I have seen this doc. And I have no CAAM, only DCP. Are threy same?

0 Kudos
Reply

9,046 Views
Yuri
NXP Employee
NXP Employee

Hello,

  If i.MX processor does not have CAAM - only software based DM-crypt

may be applied.

Regards,

Yuri.

0 Kudos
Reply

6,670 Views
adde_ado
Contributor III

Hi Yuri,

Could you please send to me 

"Root filesystem encryption using DM-Crypt" document?

I'm working with Imx8mm and I have same issue.

Best regards,

Adde

0 Kudos
Reply

9,046 Views
skwang6272
Contributor II

Hi, 

Thank you for your reply. Could you show me any docs explain how to preform software based DM-crypt?

btw Why can't DCP do what CAAM does?

0 Kudos
Reply

9,046 Views
Yuri
NXP Employee
NXP Employee

Hello,

  Some material have been sent directly.

Regards,

Yuri.

0 Kudos
Reply

5,646 Views
arunkrishnank
Contributor I

Dear Yuri,

Is it possible to share the document to me. I am attempting rootfs encryption on a i.MX 6 ULL

0 Kudos
Reply

8,203 Views
andreamengalli
Contributor II

Hello Yuri,

I am working on encryption on i.MX8Mmini.

Could I have access to the document "Root filesystem encryption using DM-Crypt"?

Thanks in advance.

0 Kudos
Reply

7,143 Views
YoussefDALIL
Contributor I

Hello @Yuri ,

Could I have also access to the document "Root filesystem encryption using DM-Crypt"

I really need this document to work on my project please.

Waiting for your reply

Thanks

0 Kudos
Reply

7,126 Views
Yuri
NXP Employee
NXP Employee

@YoussefDALIL 
Hello,

In addition to AN12714 (i.MX Encrypted Storage Using CAAM Secure Keys) use
section 10.5 (Disk encryption acceleration) of i.MX Linux User's Guide.


https://www.nxp.com/webapp/Download?colCode=AN12714

https://www.nxp.com/docs/en/user-guide/IMX_LINUX_USERS_GUIDE.pdf

 For specific customer's cases (OS releases) NXP Pro Support may be involved.

Regards,
Yuri.

0 Kudos
Reply

1,745 Views
beestarbush
Contributor I

Hello,

I have the AN12714 and IMX Linux User Guide (IMXLUG_6.6.23_2.0.0) but would like to have a look into "Root filesystem encryption using DM-Crypt". Could you provide me this?

0 Kudos
Reply

8,199 Views
Yuri
NXP Employee
NXP Employee
0 Kudos
Reply

7,682 Views
parthitce
Contributor III

@YuriCould you please share the documents for dm-crypt to do with imx6ULL/imx6ULZ?

Thanks,

Parthiban N

7,675 Views
Yuri
NXP Employee
NXP Employee

@parthitce 
Hello,

  I've sent You the file.

Regards,
Yuri.

0 Kudos
Reply

1,246 Views
kiranc
Contributor I

Hello Yuri,

I am also working on encryption.

Could I have access to the document "Root filesystem encryption using DM-Crypt"?

Thanks,

0 Kudos
Reply

8,382 Views
kmaincent
Contributor I

Hello Yuri,

I am also working on encryption.

Could I have access to the document "Root filesystem encryption using DM-Crypt"?

Thanks,

0 Kudos
Reply

8,368 Views
Yuri
NXP Employee
NXP Employee

@kmaincent 
Hello,

  I've sent You some comments.

Regards,
Yuri.

Tags (1)
0 Kudos
Reply