Running encrypted image on i.mx6

cancel
Showing results for 
Search instead for 
Did you mean: 

Running encrypted image on i.mx6

Jump to solution
927 Views
vadimlomovtsev
Contributor II

Let's say we have encrypted image which have to be loaded and run at the i.MX6-based board. Image was created and encrypted at some build-server.

According to documentation it is possible to decrypt it using CAAM module but we need to specify keys to decrypt our image in some way.

The question is - how we could store keys for image decryption at the board (e.g. decryption could be made by u-boot)?

Is it possible to use OTPMK fuse block for storing keys (which is quite small)? Or there is another solution to handle such scenarios?

Also it is said that in order to run HAB authentication we need to burn some values onto OTPMK fuses block, would it be critical if we try to store our secret keys there?

Labels (6)
Tags (2)
1 Solution
158 Views
Yuri
NXP TechSupport
NXP TechSupport

The following thread provides some information about CAAM using

for application encryption / decryption. 

https://community.freescale.com/message/362564#362564

As for OTPMK, please refer to i.MX6 Security Reference Manual.

Note, the OTPMK is factory burned. This means blobs MUST be generated on the i.MX6 :

the blob is the DEK (Data Encryption Key) encrypted with the OTP Master Key (programmed

in fuses on the i.MX6).

  So, Your requirement to use own key to encrypt an image on an external server and decrypt

it on the i.MX6 is not supported.


View solution in original post

0 Kudos
1 Reply
159 Views
Yuri
NXP TechSupport
NXP TechSupport

The following thread provides some information about CAAM using

for application encryption / decryption. 

https://community.freescale.com/message/362564#362564

As for OTPMK, please refer to i.MX6 Security Reference Manual.

Note, the OTPMK is factory burned. This means blobs MUST be generated on the i.MX6 :

the blob is the DEK (Data Encryption Key) encrypted with the OTP Master Key (programmed

in fuses on the i.MX6).

  So, Your requirement to use own key to encrypt an image on an external server and decrypt

it on the i.MX6 is not supported.


View solution in original post

0 Kudos