TMS320F28388D: Regarding to the TPM (Trusted Platform Module) standard, Is DCSM hardware based?

Hang Yang said:

they need confirmation that DCSM is hardware based,

Hang, I can confirm that DCSM is indeed hardware based.

Hi Janakiraman,

Thanks for confirming. The customer is preparing for cybersecurity certification, so they need to submit documents to certification organization to prove that it's hardware based, any document we can provide to them?

Regards,

Hang.

Hang,

            We don’t have any such “document” for proof. This is the first time we are being asked for something like this.

We have an application note on Secure Boot which may meet your requirements. The only keys that are protected are the CMAC keys used for secure boot:

https://www.ti.com/lit/an/spract3/spract3.pdf?ts=1714059209457&ref_url=https%253A%252F%252Fwww.google.com%252F

Hi Luke,

Thanks for the info. Do you mean that the secure boot on F28388 can follow the TPM standard? From the description in the app note, secure boot is based on ROM software, not hardware.

Regards,

Hang.

Hi Luke,

Thanks for clarifying that DCSM does not follow the TPM standard. Customer's requirement is hardware protected data and key storage. Although secure boot can provide a root of trust that may facilitate secure key and data storage, it's software based. So, It looks to me that secure boot does not meet customer's requirement. Could you please help check with the security expert that if secure boot can fulfill "hardware protected secure data and key storage"?  This is a key requirement from customer, and they already have the confirmation on ST devices. 

Regards,

Hang.

Hi Hang,

I've asked one of our security experts to clarify whether DCSM can provide hardware protected data and key storage. I will get back to you once I receive a response.

Thank you,

Luke

Hi Hang,

The DCSM cannot achieve hardware protected secure data and key storage because the CPU registers, stack pointers, and program counter is not secure. A hacker can easily read or write these registers to read or write any data that is not designated as EXEONLY, provided they have debug access or are able to upload malicious code to the device. The only protection guaranteed by DCSM is the confidentiality of code, assuming it has been designated EXEONLY.

The best protection against exposing data/keys would be to enable JTAGLOCK and zero-pin boot to prevent debug access and help prevent malicious code from being uploaded to the device via one of the boot modes provided by F2838x. It is up to the customer to determine whether their keys are adequately protected once they've enabled these features.

Thank you,

Luke