AM625: Mechanisms to guarantee the integrity and/or confidentiality of specific regions of the eMMC.

Hello,

Geoffrey Ficara said:

Is it possible to sign some regions and then verify them using the crypto accelerators? 

The customer may sign or encrypt the data and use OpenSSL in Linux at runtime to authenticate or decrypt the data before using it.

Hi Prashant, 

What they want is HW support to provide an anchor of trust within the SoC to be able to support dm-verity in certain partitions, and dm-crypt in others. This can be as simple as a secret, non-readable derivation key that allows them to generate encryption/signature keys to store each partition encryption/signature in a non-encrypted region of the eMMC.

Can you provide more details about the SW flow explaining how that would be achieved in our SoC and how the chain of trust remains unbroken ?

Also do you confirm that firewalls can't cover the eMMC ?

Regards

Geoffrey 

Hi, please see if the following guide helps: software-dl.ti.com/.../Auth_boot.html