SK-AM62B-P1: Building OTP keywriter with PROFILE=release possible?

Hello,

Benjamin Gruhler said:

But, when inserting both sets of keys (SMEK,SMPK, BMEK, BMPK), the size of primary_cert.bin exceeds the length of 5400 bytes.

It looks like you may not be using the correct OpenSSL version because the certificate generation is tested for One Shot (program everything at once) with the tools versions mentioned in the user guide.

For reference, following are the certificate generation logs with OpenSSL v1.1.x showing sizes of the primary & secondary certificate within 5400 bytes.

❯ ./gen_keywr_cert.sh -t tifek/ti_fek_public.pem --msv 0xC0FFE -s-def --smek-def -b-def --bmek-def --keycnt 2 --keyrev 1
# Using MSV[19:0]: 0x000C0FFE
INFO: Using default SMPK for programming
INFO: Using default SMEK for programming
INFO: Using default BMPK for programming
INFO: Using default BMEK for programming
# Using Key Count: 0x00000003
# Using Key Rev: 0x00000001
Generating Dual signed certificate!!
GEN: AES256 key generated, since not provided
# encrypt aes256 key with tifek public part
# encrypt SMPK-priv signed aes256 key(hash) with tifek public part
# encrypt smpk-pub hash using aes256 key
writing RSA key
# encrypt smek (sym key) using aes256 key
# encrypt BMPK-priv signed aes256 key(hash) with tifek public part
# encrypt bmpk-pub hash using aes256 key
writing RSA key
# encrypt bmek (sym key) using aes256 key
1668    secondary_cert.bin
5383    primary_cert.bin
7051    ../../x509cert/final_certificate.bin
# SHA512 Hashes of keys are stored in verify_hash.csv for reference..

Regards,

Prashant

Thanks for the fast reply - I'll have to doublecheck that.

We are using OpenSSL 3.0.15, and with the certificate creation command you where referring to, we got  5414 bytes for primary_cert.bin

# encrypt bmek (sym key) using aes256 key
1701    secondary_cert.bin
5414    primary_cert.bin
7115    ../../x509cert/final_certificate.bin
# SHA512 Hashes of keys are stored in verify_hash.csv for reference..