MCU-PLUS-SDK-AM263X: SBL X509Certificate Creation

Vishwas Chandrashekar

Hi,

I am using sbl_qspi_am263x-lp_r5fss0-0_nortos_ti-arm-clang to build the SBL and programming both SBL and example application hello_world_am263x-lp_r5fss0-0_nortos_ti-arm-clang using C:\ti\mcu_plus_sdk_am263x_08_05_00_24\tools\boot\sbl_prebuilt\am263x-lp\default_sbl_qspi.cfg. After programming and switching the boot mode to QSPI Boot, I am able to successfully boot and see "Hello World" on the terminal.

sbl_qspi_am263x-lp_r5fss0-0_nortos_ti-arm-clang project builds sbl_qspi_am263x-lp_r5fss0-0_nortos_ti-arm-clang.tiimage using the post build script makefile_ccs_bootimage_gen.

makefile_ccs_bootimage_gen script uses #BOOTIMAGE_CERT_KEY=$(MCU_PLUS_SDK_PATH)/tools/boot/signing/mcu_gpkey.pem and BOOTIMAGE_CERT_GEN_CMD=$(PYTHON) $(MCU_PLUS_SDK_PATH)/tools/boot/signing/mcu_rom_image_gen.py to generate and append the X509Certificate.

I generated my own key using genrsa -out key.pem 4096 and updated makefile_ccs_bootimage_gen script to use the key.pem file and generate sbl_qspi_am263x-lp_r5fss0-0_nortos_ti-arm-clang.tiimage. After programming the newly generated SBL and example application ("Hello Word), I am able to see "Hello World" on the terminal. I was expecting SBL validation failure because if incorrect key.

I wanted to understand the X509Certificate validation by HSM. Not sure why HSM successfully validated the SBL I created using the key.pem file. Please let me know the document where I get information about this.

Please let me know the procedure to create my own key file and how I share my key information to HSM for SBL validation.

Regards,

Vishwas HC

over 2 years ago

0 Aakash Kedia over 2 years ago

TI__Mastermind 26145 points

Hi Vishwas Chandrashekar,

We are working on this. Let us check the same and come back on the same.

Best Regards,
Aakash

0 Aakash Kedia over 2 years ago in reply to Aakash Kedia

TI__Mastermind 26145 points

Hi Vishwas Chandrashekar,

The GP Keys or the degenerate keys are generated from the random private keys created by the customer. GP key is an example used by the SDK. It is not a fixed key.

Although, RBL verifies the x509 certificate which is same as *.tiimage. The x509 certificate carries the public key and the same key is used to verify the SBL.

For programing the keys in the device and secure booting the SBL, you are looking for HS-SE devices. More details on the following FAQ -

https://e2e.ti.com/support/microcontrollers/arm-based-microcontrollers-group/arm-based-microcontrollers/f/arm-based-microcontrollers-forum/1136004/faq-what-are-the-ti-deliverables-for-security-in-mcu-devices

Hope this helps.

Aakash

0 Vishwas Chandrashekar over 2 years ago in reply to Aakash Kedia

Prodigy 180 points

Hi Aakash,

Thanks for the response. I have the following additional questions.

What is the difference between GP Key and Degenerate key?

HSM verifies the SBL using public key present in the x509 certificate, it does not matter what *.pem (key.pem or mcu_gpkey.pem) we use to generate the certificate. Is my understanding correct? Can you please point me to the documentation?

In order to use our own key and have HSM verify SBL based on our key, we need to convert the device to HS-SE. Is it right?

I should be able to convert the device to HS-SE using TIFS package. Is it explained in the TIFS documentation?

I have requested for TIFS package, how soon I can get it?

Regards,

Vishwas Chandrashekar

+1 Aakash Kedia over 2 years ago in reply to Vishwas Chandrashekar

TI__Mastermind 26145 points

Hi Vishwas Chandrashekar,

Vishwas Chandrashekar said:
What is the difference between GP Key and Degenerate key?

Both are same thing, or a random private key which is used to sign the SBL image.

Vishwas Chandrashekar said:
HSM verifies the SBL using public key present in the x509 certificate, it does not matter what *.pem (key.pem or mcu_gpkey.pem) we use to generate the certificate. Is my understanding correct? Can you please point me to the documentation?

Yes, this is the correct understanding. You can refer to the Chapter 5 Initialization of the Technical Reference Manual of AM263x.

Vishwas Chandrashekar said:
In order to use our own key and have HSM verify SBL based on our key, we need to convert the device to HS-SE. Is it right?

Yes, you need to convert the device to HS-SE device for the same.

Vishwas Chandrashekar said:
I should be able to convert the device to HS-SE using TIFS package. Is it explained in the TIFS documentation?

Yes, this is part of OTP Key Writer package which is an additional delivery with TIFS package.

Vishwas Chandrashekar said:
I have requested for TIFS package, how soon I can get it?

Did you raise a request via ti.com by this link ?

https://www.ti.com/product/AM2634#product-details

It should take 1-2 business days.

Hope this helps.
Aakash

0 Vishwas Chandrashekar over 2 years ago in reply to Aakash Kedia

Prodigy 180 points

Yes I requested in the same like you shared. It has been more than 2 business days. I am still waiting.

Arm-based microcontrollers

Arm-based microcontrollers forum

MCU-PLUS-SDK-AM263X: SBL X509Certificate Creation