• State TI Thinks Resolved
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 32 subscribers
  • Views 165 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM2634: HSM Service ROT_validateCert Fails to verify BMPK hash

Daniel Basch
Prodigy 60 points

Part Number: AM2634
Other Parts Discussed in Thread: LP-AM263

We have encountered inconsistent behaviors while testing ROT switching capabilities in the HSM.

Using the provided python script root_of_trust_switching_cert.py and passing our SMPK and BMPK private key pem files, we get the output file rot_switch_cert.cert. The cert file was passed to an SBL image that contains the example code from hsm_rot_cert_validate.c, along with an HSM firmware image header file. The ROT_validateCert HSM service is failing to hash the BMPK public key. All other checks pass, including digital signature verification of the BMPK if the BMPK hash check is forcibly skipped. The hash of the cert file also matches the expected hash that was calculated in the OTP Keywriter for BMPK. We have also confirmed that once the Key Rev is updated, all images boot successfully when signed with the BMPK.

TIFS Version: 11_00_00_01

Board: LP-AM263 Rev A

Device_Type: HS_SE

Device Revision: SR 1.1

  • 0
    TI__Guru* 90891 points

    Hi Daniel,

    May I know what is the inconsistent behaviour you are seeing here? 

    This is a one time process to switch from SMPK to BMPK. 

    Could you elaborate the concern? (possible screenshot or logs from the error)

    Thanks and Regards,

    Nikhil Dasan

  • 0
    Prodigy 60 points

    Hi Nikhil,

    The issue we are facing is that during the validation of the outer certificate (signed with the BMPK and contains the SHA512 hash of the primary certificate), it will fail to verify the hash of the BMPK key when compared to what was written to the EFUSE with the OTP Writer. However, it will successfully perform RSA digital signature verification with the BMPK if the hash verification is bypassed. The certificate hash also passes. during validation of the inner certificate, the SMPK hash verification passes along with its RSA digital signature verification.

    I have verified the certificate file is signed with the BMPK key, The public key hash matches what was written by the OTP, and the RSA digital signature verification for the BMPK passes, so there doesn't appear to be a reason it should be failing at that step.

    We have done the KeyRev update and verified that we can use the BMPK key to sign our images, but the TIFS does not work as packaged in this case.

    I don't have any specific errors or logs to show aside from the HSM client's request for the ROT switch being "NACKed" by the HSM server.

  • 0 in reply to Daniel Basch
    TI__Intellectual 2430 points

    Hi Daniel,

    Let me sync up internally on this with the respective teams and get back to you in a couple of days.

    Thanks and Regards,
    Aditya Singal

  • 0 in reply to Daniel Basch
    TI__Intellectual 2430 points

    Hi Daniel,

    Apologies for the late reply.
    Root Of Trust Switching is not supported in Device Revision: SR1.1

    Thanks and Regards,
    Aditya Singal