F29H85X-SOM-EVM: Can user create custom SecCfg.out for Code provision flow.

Hi Aditya,

Can you clarify this, it is not the part of this thread - The RAM-based SBL .bin is encrypted using AES-256-CBC when built with the Only-CP build configuration. How are the HSMRt (CP, HS-SE) and Application.bin (flash-based applications built from the examples available in the F29 SDK) encrypted using AES-256-CBC?

Regards,

Shashank

Hi Shashank,

What do you mean by how is it encrypted using AES-256-CBC?
Could you elaborate a little more?
By default CP and HS-SE HSMRt has encryption enabled by default if building through CCS. You can check the build steps in project properties.

Thanks and Regards,
Aditya Singal

Hi Aditya,

What do you mean by “how is it encrypted using AES-256-CBC”? - During the creation of the X.509 certificate, the .out file is encrypted in step 2 using symmetric encryption with AES-256 in CBC mode as shown below image (from F29 HSM TRM). is this step is mandatory for All Images(HSMRT, SBL and Application).

By default CP and HS-SE HSMRt has encryption enabled by default if building through CCS -No, Enc_Enable is set to no by default in the post-build steps of CP and HS-SE HSMRt, and I also observed that in the makefile build command Enc_Enable = no in the TIFS SDK.

Regards,

Shashank

In F29 HSM TRM it is mentioned that AES256bit encryption is used for Peripheral bootloader.

Hi Aditya,

Thank you for confirmation, so for HS-SE device we should change Enc_enable = yes. 

This is image from TI-FS SDK:

But in this in this image encryption is disabled. 

Regards,

Shashank

Hi Aditya,

Incase of CCS build?

Thanks and Regards,

Shashank