iMX6 - 256-bit Zeroizable Master Key

取消
显示结果 
显示  仅  | 搜索替代 
您的意思是: 
已解决

iMX6 - 256-bit Zeroizable Master Key

跳至解决方案
1,980 次查看
viniciusmaciel
Contributor II

Hi,

I am using kernel 4.9.11 running on Wandboard. How do I read the 256-bit Zeroizable Master Key from iMX6 CPU fuse? 

Can I read from userspace or only from kernel space? Can I get this key from the CAAM driver?

Vini

标签 (2)
标记 (3)
0 项奖励
回复
1 解答
1,440 次查看
Bio_TICFSL
NXP TechSupport
NXP TechSupport
Hi Vinicius,

ZMK value (or the ZMK XORed with the OTPMK) can be selected as the  master key input to 
the DCP. Please refer to Security Reference Manual for the i.MX 6ULL Applications Processor for more details.
  The unique OTP Master Key (OTPMK) is a random value stored in the non-volatile memory 
(typically fuses) outside the SNVS module.  OTPMK is factory preprogrammed. 

  HAB incorporates signature verification using RSA public keys and the SHA-256 hash algorithm, but i.MX6 CAAM does not support asymmetric cryptographic acceleration..

Regards

在原帖中查看解决方案

0 项奖励
回复
2 回复数
1,441 次查看
Bio_TICFSL
NXP TechSupport
NXP TechSupport
Hi Vinicius,

ZMK value (or the ZMK XORed with the OTPMK) can be selected as the  master key input to 
the DCP. Please refer to Security Reference Manual for the i.MX 6ULL Applications Processor for more details.
  The unique OTP Master Key (OTPMK) is a random value stored in the non-volatile memory 
(typically fuses) outside the SNVS module.  OTPMK is factory preprogrammed. 

  HAB incorporates signature verification using RSA public keys and the SHA-256 hash algorithm, but i.MX6 CAAM does not support asymmetric cryptographic acceleration..

Regards

0 项奖励
回复
1,440 次查看
viniciusmaciel
Contributor II

Hi,

I am using sm_test.c(crypto/caam/sm_test.c) driver to try retrieve the OTP Master Key, but this driver actually has 4 keys(64 bits, 128 bits, 192 bits and 256 bits) with 2 groups: clear keys and black keys. The clear keys does not matter because is just a progression (0, 1, 2, 3, 4, ...). The "true" random keys are the black keys, so that is what we want. 

The problem is that everytime I reboot the Linux, i am getting different values for the 4 keys (64 bits, 128 bits, 192 bits and 256 bits).

Example:

[ 3.350716] platform caam_sm: 64-bit black key:
[ 3.353955] platform caam_sm: [0000] 12 e5 59 04 33 25 46 f9
[ 3.358318] platform caam_sm: [0008] c8 13 e4 d3 c1 45 27 bd

And in another boot:

[ 3.420722] platform caam_sm: 64-bit black key:
[ 3.423961] platform caam_sm: [0000] 67 f5 f6 f7 5a 3b 19 14
[ 3.428322] platform caam_sm: [0008] 4e f7 a7 85 66 14 44 f2

Are these keys supposed to be invariable?

0 项奖励
回复