Though OCOTP_LOCK[SRK_LOCK] was set, SRKs in the shadow registers can be seen.

[george]

Dear All,

We use HAB.

And OCOTP_LOCK[SRK_LOCK] was set.

However, the keys can be seen via the shadow registers.

Is this the correct behavior?

Writen Lock Register :

• OCOTP_LOCK => 0x00004040 (SRK_LOCK, SJC_RESP_LOCK)

Read Shadow Registers :

• 21B_C580  OCOTP_SRK0  (The written key value)
• 21B_C590  OCOTP_SRK1  (The written key value)
• 21B_C5A0  OCOTP_SRK2  (The written key value)
• 21B_C5B0  OCOTP_SRK3  (The written key value)
• 21B_C5C0  OCOTP_SRK4  (The written key value)
• 21B_C5D0  OCOTP_SRK5  (The written key value)
• 21B_C5E0  OCOTP_SRK6  (The written key value)
• 21B_C5F0  OCOTP_SRK7  (The written key value)
• 21B_C600  OCOTP_RESP0  0xBADABADA
• 21B_C610  OCOTP_RESP1  0xBADABADA

Is there something where you noticed ?

Best Regards,

George

[Yuri · Accepted solution]

  From the RM :

SRK_LOCK :
0 - Unlock

   1 - Write Protect + Override Protect

No read protection.

Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[george]

Dear Yuri,

Thank you for telling carefully.

I understand very well.

Thnaks,

George

[george]

Dear All,

Is the above my misapprehension?

Can't it prevent looking into SRK?

Best Regards,

George

[Yuri]

George, hello

  OCOTP_SRKx registers contain hash of the SRK - just for checking of public keys,

assuming private key pairs are not accessible and are located on safe servers.
"The SRK table allows installation of one of four (maximum) public keys. This key is used as

the root of the HAB public key infrastructure. The SRK table is constructed from up to four public

SRKs. A cryptographic hash of this table is generated by the CST; the generated cryptographic

hash is then provisioned to the SRK_HASH field in OTP fuses during manufacturing."

Regards,
Yuri.