AM62A7: What the encryption algorithm for tiboot3.bin and what the detailed encryption command

Hello,

The Processor SDK does not have the support for the encryption. In any case, the encryption algorithm supported is AES-256-CBC.

BR, Prashant

Maybe my question is not clear.

We want to enable secure boot function ,and keep our private key in a HSM server.

 On the concept of step 4(shows as the screenshot), we want to  using our HSM server to do the signature, but our HSM server's capacity is limited, like it only it support  RSA2048, like RSASSA-PKCS1-v1_5

So we want to confirm TI's secure boot: it can use sha-256 with RSA2048, 

as we know , the signing process could be performed using standard tools like openssl,

So It's better send us the standard openssl command for the  signature

tao lu said:

So we want to confirm TI's secure boot: it can use sha-256 with RSA2048, 

As mentioned in the following section, the secure boot is supported only for RSA4096.

software-dl.ti.com/.../key_writer.html

Hi Prashant,

Thank you for your reply.

Now we confirm that our HSM server can support RSA4096.

We can generate a Keywriter Binary with mcu_plus_sdk_am62ax_09_00_00_19.

But the binary singed&generated in local, we want to use our HSM server to sign.

Could you share the standard openssl command for the signature?

So that we can deploy the signature step to the HSM server.

Thanks.

Tao

Hello,

tao lu said:

Could you share the standard openssl command for the signature?

Please refer to signing scripts used by the SDK for signing the SBL and Application images:

https://github.com/TexasInstruments/mcupsdk-core-k3/blob/k3_next/tools/boot/signing/rom_image_gen.py#L1-L1

https://github.com/TexasInstruments/mcupsdk-core-k3/blob/k3_next/tools/boot/signing/appimage_x509_cert_gen.py#L1-L1

Regards,

Prashant