AM623: Security boot key storage query

And please help to check below requirement.algorithm.

4. Support encryption, signature and signature verification algorithms based on RSA2048 and 3072(Seems we support RSA)
5. Support encryption, signature and signature verification algorithms based on ECDH/ECDSA, key exchange (Seems we do not support ECDSA now)
6. Support AES encryption algorithm

Regards

Zekun

Hello,

Zekun Bai said:

• a private key, size is 256bit
• an AES key is also 256bit
• a public key is 512bit

Are these keys required on top of the two sets of keys (SMPK/SMEK and BMPK/BMEK) programmed during the HSFS to HSSE conversion? If yes, is the customer looking for a solution to store multiple keys securely?

My previous response assumed that the customer is looking to store just a single key (a private key, size is 256 bit) and the other two were just the keys programmed during the HSFS to HSSE conversion.

Hi Zekun, 

What is the uses case these keys are aimed at?
Can these keys be imported be securely imported every boot?
In that case key ring feature can enable this (only supports Public Key import at the moment)
More details here:
https://software-dl.ti.com/tisci/esd/latest/6_topic_user_guides/keyring.html

Regards,

Kavitha

4. Support encryption, signature and signature verification algorithms based on RSA2048 and 3072(Seems we support RSA)

-    RSA 2K and 3K support are not validated 
5. Support encryption, signature and signature verification algorithms based on ECDH/ECDSA, key exchange (Seems we do not support ECDSA now)

- ECDSA support is getting added in 11.2 SDK onwards.
6. Support AES encryption algorithm

 - yes, support AES 256 is available

HI Kavitha, Prashant

Let me check the usage of these .

And for algorithm support status, RAS2K and 3K is want we supported but not validated? RSA4K is what we supported and validated, right?

And ECDSA, what is the release time for 11.2 SDK?

Thanks

Zekun

Hi 

Can we leverage extend OTP to store these keys because it can provide 1024 bits as input size.

What is the user case of extended OTP?

Thanks

Zekun

Hello,

Zekun Bai said:

And ECDSA, what is the release time for 11.2 SDK?

It is December 25.

Zekun Bai said:

What is the user case of extended OTP?

It is entirely upto the customer to decide the use case of these Extended OTP bits.

Regards,

Prashant

Hi Pranshat

Can use Extended OTP to achieve this:

• a private key, size is 256bit
• an AES key is also 256bit (These 2 keys are used for security boot)
• a public key is 512bit
• another public key is 512bit

Regards

Zekun

Hello,

It is entirely upto the customer to design the use cases of Extended OTP bits.

Please note, for secure boot, there is a already a provision of programming two sets of keys as already explained previously. These are the only keys used by the ROM and TIFS for secure boot.

Hi Prashant

Do TI provide a guide of how to use OTP programing? I think it is clear for customer about how to use 2 set of keys used by ROM and TIFS and convert HS-FS to HS-SE. But do we have guide of extended OTP?

Thanks

Zekun

Hi Zekun,

Programming Extended OTP is offered as a TISCI API service, documented here:
software-dl.ti.com/.../extended_otp.html

Regards,

Kavitha