I need to establish a secure link between the TNS320280037C and another CPU (ESP32) to interact with and securely program code in the TI MCU. My plan is for the ESP32 to generate an AES key and provide that securely to the TI MCU (similar to TLS). The key will be used to encrypt/decrypt all messages between the two mcc's using their HW crypto support.
However a secure connection must be established to pass the AES key to the TI mcu. For this I plan for the TI MCU to send a 2048 bit RSA key to the ESP which will be used to encrypt the AES key (similar to TLS).
I see that the TMS320F280037C supports RSA and AES encryption and decryption in HW however there does not appear to be any support for key generation or mention of a solution for provisioning the devices with a PKI.
We are assuming a zero trust model and do not want to expose the keys in the devices at any time during the manufacturing process. I believe our options are
- Have the TI mcu generate the RSA key and store it in secure FLASH / OTP. This would require implementing mbedtls or another SW encryption library to generate the keys in software (probably at first boot) or
- Pre-provision the chips prior to receipt at the contract manufacturer.
Does TI have a solution for either of these approaches that permits users of these parts to securely provision them with asymmetric PKI?
Thank you in advance!
