AM6421: Some questions for secure boot solution on AM64

Jenny Zhou

Part Number: AM6421
Other Parts Discussed in Thread: SYSCONFIG,

Tool/software:

Hi TI expert,

I'm using the MCU SDK: mcu_plus_sdk_am64x_11_00_00_15 with sysConfig: sysconfig_1.22.0

Q1: From the training ppt of 'AM64x Security Overview', there's a 'magic number' verification step, circled in yellow below.

But I didn't see there isn't any 'magic number' configuration within 'appimage_x509_cert_gen.py', could you help me to figure out where it is?

Q2: Where's TI FEK public key's 'Priviate Key' stored? in OTP or DMSC's SYSFW?

I see TI-FEK public key is stored in OTP, and is required by scripts, I'm wonder where's corresponding private key stored? If it's in SYSFW, and SYSFW is stored into an external flash, is there a potential secure issue?

5 months ago

0 Prashant Shivhare 5 months ago

TI__Guru 72491 points

Hello,

Jenny Zhou said:
But I didn't see there isn't any 'magic number' configuration within 'appimage_x509_cert_gen.py', could you help me to figure out where it is?

The "Magic Number" here is actually the "Random String" in the script:

https://github.com/TexasInstruments/tifs-mcu-common/blob/next/tools/boot/signing/appimage_x509_cert_gen.py#L101-L101

The usage of this "Random Strings (aka Magic Number)" is described in the TISCI documentation:

https://software-dl.ti.com/tisci/esd/latest/6_topic_user_guides/secure_boot_signing.html?highlight=random%20string#signing-an-encrypted-binary-for-secure-boot

Jenny Zhou said:
I see TI-FEK public key is stored in OTP, and is required by scripts, I'm wonder where's corresponding private key stored? If it's in SYSFW, and SYSFW is stored into an external flash, is there a potential secure issue?

The TIFEK key pair is not stored in the OTP. The TIFEK public key comes with the OTP Keywriter package while the TIFEK private key is part of the SYSFW binary which is encrypted.

Regards,

Prashant

0 Jenny Zhou 4 months ago in reply to Prashant Shivhare

Prodigy 230 points

Hi Prashant,

thanks for your help.

About this:

"The TIFEK key pair is not stored in the OTP. The TIFEK public key comes with the OTP Keywriter package while the TIFEK private key is part of the SYSFW binary which is encrypted."

So SYSFW bianry is encrypted by 'MEK' , and authenticated by 'MPK', which are all stored in OTP, right?

Also, SYSFW binary in OPT Keywriter binary and in SBL both are encypted, that's the way to guarantee TIFEK private key's security, right?

0 Jenny Zhou 4 months ago in reply to Jenny Zhou

Prodigy 230 points

Hi Prashant,

One more question for you.

Our company's security policy requires to support RSAv2.0, which is 'RSA-PSS' algorithm. In following thread, I saw you replied with "AM6421 doesn't support it". I'm wondering whether hardware does not support, like security engine or bootRom? or it's just related to SYSFW.

Since bootrom relies on SYSFW to do all autentication, I suppose it's SYSFW, right? if yes, Is there a scheduled plan to add support inside SYSFW?

AM6412: Images authentication with RSASSA-PSS algorithm - Processors forum - Processors - TI E2E support forums

0 Prashant Shivhare 4 months ago in reply to Jenny Zhou

TI__Guru 72491 points

Hello,

Jenny Zhou said:
Also, SYSFW binary in OPT Keywriter binary and in SBL both are encypted, that's the way to guarantee TIFEK private key's security, right?

Yes. The TIFEK is relevant only in the context of the Keywriter. It is not used anywhere else.

Jenny Zhou said:
I'm wondering whether hardware does not support, like security engine or bootRom? or it's just related to SYSFW.

The ROM does not support it.

Jenny Zhou said:
Since bootrom relies on SYSFW to do all autentication, I suppose it's SYSFW, right? if yes, Is there a scheduled plan to add support inside SYSFW?

The SYSFW is the next firmware that runs on the DMSC core after the ROM. So, the ROM does not rely on SYSFW for anything. The ROM itself has all the implementation for the authentication procedure.

There are no plans as of now to support any additional signing scheme for AM64/243 devices.

Regards,

Prashant

0 Jenny Zhou 4 months ago in reply to Prashant Shivhare

Prodigy 230 points

Hi Prashant,

ok, I see.

I want to make sure 'ECDSA' support only matters SYSFW, and is scheduled by 1Q26, right?

0 Prashant Shivhare 4 months ago in reply to Jenny Zhou

TI__Guru 72491 points

Hello,

Jenny Zhou said:
I want to make sure 'ECDSA' support only matters SYSFW, and is scheduled by 1Q26, right?

It's tentative only. The ECDSA support is currently scheduled for AM62 devices only.

Regards,

Prashant