Running encrypted image on i.mx6

[vadimlomovtsev]

Let's say we have encrypted image which have to be loaded and run at the i.MX6-based board. Image was created and encrypted at some build-server.

According to documentation it is possible to decrypt it using CAAM module but we need to specify keys to decrypt our image in some way.

The question is - how we could store keys for image decryption at the board (e.g. decryption could be made by u-boot)?

Is it possible to use OTPMK fuse block for storing keys (which is quite small)? Or there is another solution to handle such scenarios?

Also it is said that in order to run HAB authentication we need to burn some values onto OTPMK fuses block, would it be critical if we try to store our secret keys there?

[Yuri · Accepted solution]

The following thread provides some information about CAAM using

for application encryption / decryption. 

https://community.freescale.com/message/362564#362564

As for OTPMK, please refer to i.MX6 Security Reference Manual.

Note, the OTPMK is factory burned. This means blobs MUST be generated on the i.MX6 :

the blob is the DEK (Data Encryption Key) encrypted with the OTP Master Key (programmed

in fuses on the i.MX6).

  So, Your requirement to use own key to encrypt an image on an external server and decrypt

it on the i.MX6 is not supported.