AM263P4: Encryption/decryption using symmetric keys in the keyring

Hi,

For all secure SW and Documentation please request here: https://www.ti.com/drr/opn/AM263PX-RESTRICTED-SECURITY 

Best Regards, Shiv

Hi,

I already have access to this documentation but cannot seem to find what I am looking for. Is there a section of the tifs documentation that might contain the information I am looking for?

Thanks

Hi

I understand how to import symmetric and asymmetric keys into the HSM keyring. However, I’m not seeing any API that allows application code running outside the HSM (e.g., on a non-secure R5F core) to actually use those keys for encryption or decryption.

Is there a supported HSM API that enables non-HSM code to perform crypto operations using keyring keys, without direct access to the key material?

Thanks,

Olivier H

Hi Oliver,

As you already know, there is a service for importing the keyring, where the service is called from R5 core which sends a keyring keys (in the form of signed certificate) to the HSM core and the keys are extracted from the certificate by the HSM core and placed in the HSM secure RAM.

This is a service available as part of TIFS SDK

The second is to use this keys.

Currently, if you sign the application with keyring keys, you would be placing the keyID in the application certificate, so that when this image is sent to HSM core, the certificate is parsed and with the keyID from certificate, the key is retrieved from HSM secure ram (still in HSM core) and authenticates/decrypts the image.

The above is also available as part of TIFS SDK.

In both cases, the keys are only accessible in the HSM core itself.

So, in order to use these keys, the encryption/decryption should be done in HSM core (as the keys should not be exposed to R5 core).

Also, the keys upon keyring import are available in gKeyringAsymmKey[ ]/ gKeyringSymmKey[ ] on the HSM side, which are arrays placed in HSM Secure ram.

So for your usecase, you can send the keyID from R5 core and get the corresponding keys to sign or encrypt on the HSM core.

Thanks and Regards,

Nikhil Dasan 

Is it common for people to write a driver that sends a key id and data from the 5f core to the hsm core for encryption / decryption and then the hsm core sends it back to the r5 core? Or does this sort of driver already exist?

So these keyring keys are only used for secure boot decryption and signing?