i.MX 8X Encrypted Boot

[jmcdowell]

I just read in the IMX8DQXPRM the note at the end of section 5.9.6 that says "The booting of encrypted images is not currently available. Please contact your local NXP representative for more details."

Earlier in the reference manual in the System Security chapter, "Encrypted Boot" is listed as a feature of the CAAM within the list of SECO supported features.

Please clarify this conflicting information so we can proceed with our system design concept accordingly.

Justin

[Yuri]

@jmcdowell 
Hello,

   please refer to i.MX8X Security Reference Manual, section "Booting Encrypted Images".

https://www.nxp.com/webapp/sps/download/mod_download.jsp?colCode=IMX8QXPSRM&appType=moderatedWithout...

Regards,
Yuri.

[jmcdowell]

Yuri,

My company has completed the NDA and so I now have access to the i.MX8X Security Reference Manual.  Specifically IMX8QXPSRM Rev. B, 03/2019.

I have referenced the section "Booting Encrypted Images" as you directed and I find the same note: "The booting of encrypted images is not currently available.  Please contact your local NXP representative for more details".

How do I access the "more details" referenced in the note here?  Is this a SECO FW feature that NXP intends to support according to a roadmap that I could compare against my project's needs?  Is it a mkimage limitation that can be resolved?  Is it something that has already been resolved since the documentation publication 2 years ago? Or is it actually not supported in the SECO ROM and/or hardware, in which case I'm confused as to why it is described elsewhere in the documentation.

Thanks,

Justin

[Yuri]

@jmcdowell 
Hello,

  I've sent You some considerations. Hope it helps.

Regards,
Yuri.

[jmcdowell]

Thanks, I'll take a look.

[Yuri]

@jmcdowell 
Hello,

   also:

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/ahab/guides/mx8_mx8x_encrypted_boo...

Regards,
Yuri.

[jmcdowell]

Thank you for your quick response.  I will continue to work with my company in order to establish an NDA in order to get access to the security reference manual.

Justin