i.MX RT10xx Encrypted XIP with Authentication

[MulattoKid]

Hi,

I'm working on an RT1060, and testing HAB authentication and encrypted XIP. I've gotten both working, but I noticed behavior I didn't expect.

I'm using the Secure Provisioning Tool, and have generated a CA and an encryption key. I build the and write the image. I then switch back to "internal boot mode", and set the appropriate DIP switch on the EVK to enable encrypted XIP. When the MCU starts the application runs, which is expected. However, if I build without encrypted XIP enabled and perform the same procedure, the application still boots, even when the DIP switch is set to enable encrypted XIP.

Is this expected? I assumed that as long as encryption was enabled the image that's executed had to be encrypted, but perhaps it's only an optional thing? I.e. when booting with encrypted XIP both encrypted and non-encrypted images are supported? Of course, if I try an unsigned image it won't boot it, and an encrypted image won't boot without the DIP switch to enable encrypted XIP set.

Thanks,
Daniel

[diego_charles · Accepted solution]

Hi @MulattoKid 

Yes, this is expected, I have replicated the same procedure on the past using the  i.MX RT1060-EVK . As you mentioned once you enabled secure boot the BootROM will not longer accept images that are not signed, and as you figure out, after you enable the use of encrypted images, you can still boot non-encrypted images, but they must be signed. 

Diego

[MulattoKid]

Hi @diego_charles,

Thanks for confirming!