Is there any way in iMX6 to have Encryption/decryption mechanism unique per SOC

cancel
Showing results for 
Search instead for 
Did you mean: 

Is there any way in iMX6 to have Encryption/decryption mechanism unique per SOC

Jump to solution
537 Views
swapnilpendhare
Contributor III

Hi

As mentioned in earlier discussion Dose Data encryption done with help of black blob involve hardware key? , its clear that the Black blob generated with help of hardware key would be unique across boards; but encrypted data is going to be same if the black blob used for encryption , is created from same user key across boards.

Is there any way to generate unique encrypted data per SOC?

Labels (1)
0 Kudos
1 Solution
112 Views
Yuri
NXP TechSupport
NXP TechSupport

Hello,

  The unique OTP Master Key (OTPMK) is used to encrypt and wrap the DEK (Data Encryption Key) in a blob.
The OTMPK is protected by the hardware and can be accessed only by CAAM. Consequently, this step has to
be executed on the target processor with software capable of using CAAM. 

  The fact that the OTPMK can only be accessed by CAAM means that the blob can only be decrypted by the
same processor that encrypted it. To further add to the security of the DEK, the blob is decapsulated and decrypted
inside a secure memory partition that can only be accessed by CAAM.


Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

View solution in original post

1 Reply
113 Views
Yuri
NXP TechSupport
NXP TechSupport

Hello,

  The unique OTP Master Key (OTPMK) is used to encrypt and wrap the DEK (Data Encryption Key) in a blob.
The OTMPK is protected by the hardware and can be accessed only by CAAM. Consequently, this step has to
be executed on the target processor with software capable of using CAAM. 

  The fact that the OTPMK can only be accessed by CAAM means that the blob can only be decrypted by the
same processor that encrypted it. To further add to the security of the DEK, the blob is decapsulated and decrypted
inside a secure memory partition that can only be accessed by CAAM.


Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

View solution in original post