PROCESSOR-SDK-AM64X: Secure Boot Signing Server

Walter Stoll

Tool/software:

Hi Team

We are about to provide secure boot for our AM64x based products. We want to have the images signed by a signing server and keep the keys local to a HSM. Checking the web for solutions, we found that there exist some solutions for NXP SoCs based on a "YubiHSM 2" HSM device (see https://www.thegoodpenguin.co.uk/blog/i-mx-code-signing-using-a-yubihsm-2-hardware-token-from-yubico/) and a "digsigserver" signing server (see https://github.com/madisongh/digsigserver).

Does TI provide, suggest or investigate some solutions suitable for the AM64X SoCs ?

Regards

Walter

18 days ago

0 Hong Guan64 18 days ago

TI__Guru 61355 points

BINMAN is currently used in Linux SDK for code signing, where the "openssl" is used.
In general, the reference code signing scripts, i.e. openssl cmds involving secrete keys (RSA, symmetric key etc...), would need to be integrated/ported by the user with the secure key server.
Best,
-Hong

0 Walter Stoll 15 days ago in reply to Hong Guan64

Intellectual 420 points

So the answer is no, correct ?

+1 Hong Guan64 15 days ago in reply to Walter Stoll

TI__Guru 61355 points

There's no out-of-box code signing integration available on "digsigserver" or "YubiHSM".
Best,
-Hong

Processors

Processors forum

PROCESSOR-SDK-AM64X: Secure Boot Signing Server