AM625: Compiling with Custom Keys in Yocto Build

Hello Veysel,

Veysel Oguz said:

I am able to compile with custom keys in sdk build. (I am using SDK 09.00.00.03), but I couldn't find any documents about how to integrate custom keys in yocto build. Where should I place them?

Can you explain me how to do this in details?

Following up our discussions in an early e2e, it is good to know you're able to build/sign with the customer keys with BINMAN in SDK 9.0
e2e.ti.com/.../4864737

One reference on adding BINMAN in meta-ti layer
https://git.ti.com/cgit/arago-project/meta-ti/commit/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc?h=09.00.00.006&id=df7c7e627de8e5b92ef5fa8d97e023ad4d15d9c6

Veysel Oguz said:

Another issue is that I know that encryption is optional for signing process. How can I enable encryption option for binman flow?

Binary blob encryption option is not currently enabled in Linux SDK

Veysel Oguz said:

Lastly, according to 3.1.1.1.2. Build U-Boot in foundational components, only tiboot3.bin differs for GP, HS-FS and HS-SE devices as targer images. Does it mean that tispl.bin and u-boot.img isn't signed? I checked this

issue with tispl.bin and u-boot.img which signed with different key set. I saw that Authentication Failed. How can two same images can boot on both HS-FS and HS-SE devices?

Note that different key is used for signing on GP/HS in Linux SDK
- GP: degenerate key
- HS-FS: either degenerate key or customer RSA key, currently customer RSA key is used in Linux SDK
- HS-SE: customer RSA key

Refer to FAQ on difference on degenerate key on GP and customer RSA key for HS
e2e.ti.com/.../4487718

Check RSA public key in x.509 certificate in secure boot flow on HS
- calculate hash(RSA public key), and compare it against SMPK in eFUSE on HS-SE
- but the above step is skipped on HS-FS as SMPK is not programmed on HS-FS

Best,
-Hong

Hello Hong,

Thank you for your support.

1. We managed to carry our custom keys into yocto build. Basicly, we created a patch file that replaces default keys with custom keys under / u-boot / board / ti / keys directory in yocto build. Is our approach is correct? Are there any alternative way to manage this task?

2. Using the method I explained above, we succeed to verfiy u-boot authentication (tiboot3.bin, tispl.bin, u-boot.img) but, we have a problem with fitImage signature. We have a default key provisioned board and we expect to see authentication failure when we try to boot with fitImage which is signed with our custom generated key. We do not see any authentication failure with both fitImage (signed with custom key and signed with default key).

3. When we created the custom keys, we replaced them with default keys stored in / u-boot / board/ ti / keys. We noticed that there is also a .crt file. We did not have any .crt file output in KeyWriter app. Also, it is not been used in binman dtsi. Should we update it for custom keys? If yes, where we can find it?

4.

Hong Guan64 said:

Binary blob encryption option is not currently enabled in Linux SDK

Is it in progress currently? Are you going to enable it for future SDK versions? Do you have any plan on which version you will enable the encryption?

Hi Hong,

Lastly I want to be sure about something.

I generated custom keys using ./gen_keywr_cert.sh -g. I know that I need .pem, .key and .crt file to sign fitImage. The .pem file is already generated with the script I mentioned. I am using the command below to convert .pem file to .key file:

                     openssl rsa -in custMpk.pem -out custMpk.key

and I am using the command you mentioned previous reply to convert .key file to .crt file. 

Hong Guan64 said:

3/. One example to convert dev.pem to dev.crt
openssl req -batch -new -x509 -key keys/dev.key -out keys/dev.crt

Is everything ok for key generation process? I created a .patch file to place these new generated custom keys in yocto build. I also created the fitImage successfully and also booted on HS-SE board successfully.

Hello Veysel,

Veysel Oguz said:

I also created the fitImage successfully and also booted on HS-SE board successfully.

It is good to know you're able to boot the fitImage on HS-SE board.

Hong Guan64 said:

3/. One example to convert dev.pem to dev.crt
openssl req -batch -new -x509 -key keys/dev.key -out keys/dev.crt

Let me add clarifications.
"keys/dev.key" is the private key, i.e. "board/ti/keys/custMpk.pem" = "board/ti/keys/custMpk.key" in SDK.
Best,
-Hong