AM263P4: Encryption disabled for application

Hi Geetha,

YES, you still need the Keyring Certificate even when ENC_ENABLED=no on HS-SE devices.

Why:
- APP_SIGNING_KEY_KEYRING_ID is for signature verification, not encryption
- Even with encryption disabled, your app is still signed during build
- At boot, HSMRT uses sign_key_id to look up the public key in the keyring to verify the signature
- Without the keyring, HSMRT cannot verify signatures and boot will fail

Two separate operations:
1. Signing (authentication) - Always required on HS devices, needs keyring
2. Encryption - Optional, controlled by ENC_ENABLED

For GP devices: No keyring needed (uses degenerate/dummy keys for development)

Note: APP_SIGNING_KEY_KEYRING_ID = 0 means the root of trust keys.
So the keyring certificate need not be sent as based on the ID 0, HSM will already have the Root of trust keys to authenticate the signed binary.

Thanks and Regards,
Aditya Singal

Hi Geetha,

You can only import the keyring using sysconfig.

You can also refer to this academy chapter on the same for more details: 

https://dev.ti.com/tirex/explore/content/am26x_academy_10_02_00_03/_build_am26x_academy_10_02_00_03/source/security_and_safety/security/keyring.html#key-ring-service-in-am26x-devices

Thanks and Regards,
Aditya Singal