AM623: How to boot ECDSA key signed Linux SDK on AM623 SoC

Hi Andreas,

ECDSA key support was enabled on AM62P SoC as a first step. ECDSA support need updating TIFS/SYSFW, which includes both the standard TIFS for regular secure boot as well as the special TIFS for OTP keywriter to program SMPK-H/BMPK-H for the user's ECDSA key.

ECDSA key support on AM62x SoC is under the TIFS SW planning now.
Do we have an estimate on your need timeline for ECDSA key support?

Best,
-Hong

Hi Hong,

Thank you very much for your quick reply. Unfortunately, that’s not the answer I was hoping for.

We are currently in the process of setting up the infrastructure for code signing and preparing for the production of our devices. I need to make a decision regarding the algorithm now. Once the first devices have been manufactured, we will no longer be able to change the algorithm.

This means that if ECDSA is not yet available for the AM623x, we will have to opt for RSA.

Best Regards

Andreas

Hi Andreas,

I'm checking internally on AM62x TIFS plan on ECDSA support, and will keep you posted.

Best,
-Hong

Hi Andreas,

The latest update from SW team is the AM62 Keywriter refresh to include ECDSA support is currently targeted by end of April.
Will the keywriter refresh schedule meet your timeline?

Best,
-Hong

Hello Hong,

End of April is something I can deal with. Thank you for the update.

Can you please give me some details about the supported algorithms.

Best Regards

Andreas

Hi Andreas,

These're the ECDSA curves to be supported in TIFS:
NIST P-256/secp256r1, NIST P-384/secp384r1, NIST P-521/secp521r1, and Brainpool p512r1

Best,
-Hong

Hi Andreas,

The new AM62x OTP keywriter 12.0 with the EC key support is accesible here
https://dr-download.ti.com/authenticated/secure/software-development/application-software-framework/MD-W5I8h4voaD/09.01.00.05/otp_keywriter_am62x_v12_00_00-linux-installer.run

Best,
-Hong