RT1046 DCP kDCP_OtpUniqueKey not working

[ScottW_7]

Hi NXP team,

        I used the RT1046 as the encryption operation unit for DCP, setting GPR10 to use the key from OCOTP (SW_GP2), and then programmed the key(sw_key) into SW_GP2.

        During testing, I found that the data encrypted with AES_ECB using kDCP_OtpKey and kDCP_OtpUniqueKey are identical, they also match the result when I directly use sw_key for AES_ECB encryption.

        According to the Reference Manual, kDCP_OtpUniqueKey should be independent and not the same as kDCP_OtpKey. Why is this happening?

[Bio_TICFSL]

Hello,

The difference between kDCP_OtpKey and kDCP_OtpUniqueKey relates to how these keys are derived:

1. kDCP_OtpKey corresponds to the SW_GP2 key that you've programmed into the OCOTP fuses.

2. kDCP_OtpUniqueKey should be a device-unique key derived from the OTPMK (On-Time Programmable Master Key) and should produce different results than kDCP_OtpKey.

The reason you're seeing identical results is likely because your device is operating in an "open" (non-secure) configuration. In this configuration, the DCP doesn't generate true unique keys but instead uses standard values that may be identical across devices.

For kDCP_OtpUniqueKey to produce truly unique results different from kDCP_OtpKey, your RT1046 would need to be configured in a "secure closed" mode, where the OTPMK is properly utilized to create device-specific unique keys.

To verify this, check if you have properly configured the security settings, particularly SEC_CONFIG bits related to the OTPMK. Without proper security configuration, both key options will effectively use the same SW_GP2 value you programmed.

Regards