AM2432: EVM

Hi Venkata,

The latest Keywriter v10.00.08 recommends using OpenSSL v3.1.2 or v3.2.1 both of which are not FIPS validated as outlined in the following OpenSSL documentation

https://openssl-library.org/source/#:~:text=The%20following%20OpenSSL%20version(s)%20are%20FIPS%20validated%3A

Regards,

Prashant

Prashant Shivhare But once validated this still will cause issue as PKCS1 padding will be disallowed in FIPS mode. Does TI have any workaround for this? or are we not able to generate certs with FIPS mode?  https://github.com/openssl/openssl/blob/f1607c8a2c04bcb95ddb2e6fc4e0aaec9729929b/doc/man7/fips_module.pod#L240 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf

Hi,

Does the security controller firmware support any other padding modes that we can use? or just PKCS1? If OEAP is supported, we could use that in FIPS mode

Hi Prashant,

Any update here?

Thx, Merril

Hi Prashant,

Any update?

Thx, Merril

Hi Prashant,

Can you please update this thread w/ the latest status?

Thanks, Merril

Hi Venkat,

Venkata Kishore Kajuluri said:

Does the security controller firmware support any other padding modes that we can use? or just PKCS1?

The AM64/243 SYSFW only has the support for PKCS#1v1.5 scheme. If the FIPS valiated OpenSSL mandatorily prevents using this scheme then you have to use the regular OpenSSL only.

Regards,

Prashant

Hi Venkat,

The customer would like to request "FIPS validated Openssl support for future release. This means changing TI's sysfw binary for a new padding, for example OEAP, which is allowed in FIPS mode.  Need to understand whether this needs to involve ROM code change or if this could be handled/implemented without a ROM code change." 

If TI can add this feature/mode, when could it be implemented?  Can a Jira be opened for this?

Thanks, Merril

Hi , 

ROM code only supports PKCS#1.5 signing scheme for signing the SBL Key-writer.

Regards,

Kavitha

Hello Venkat

I believe as per Merill  this issue is still open and being tracked by you. I wanted to just re-iterate that as mentioned by Kavitha and team, there is currently no ability to workaround this, as the AM24 ROM does not support this. To address this requirement requires a silicon spin, that is currently not in scope for this device. 

Let us know how we can help you move forward on this.