Tool/software:
Team,
Our customer has a few security queries we'd like further input on if we may please:
We have a few queries regarding secure boot and key management on TI AM62XX.
- In the secure boot flow, is it possible to update KEY_REV=2 to switch from S-keys to the B-set keys from the A53 user space?
We understand, we can load M4 firmware using remoteproc, but is it feasible to load an M4 image that includes the OTP key writer to update the KEY_REV in the eFuses?
- What is TI’s recommended approach to update the KEY_REV securely for field-deployed devices without requiring manual intervention (e.g., JTAG or physical access)?
We are looking for a secure, automated method to manage key transitions in production environments while maintaining the integrity of the secure boot process.
- If the BMPK is compromised what is the recommended mitigation strategy?
Does TI provide a fallback or recovery mechanism in such scenarios, and how can we ensure continued secure boot validation in the field?
We would appreciate your inputs on this at the earliest, as we are currently evaluating our secure boot strategy for production.
TY,
CY
