• State Resolved
  • Locked Locked
  • Replies 1 reply
  • Subscribers 96 subscribers
  • Views 282 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

[FAQ] SYSFW/TIFS Secure Crypto Service Example on AM62x

Hong Guan64
Guru* 80100 points

Part Number: AM625

- SYSFW/TIFS Crypto Service
The crypto services allow SYSFW/TIFS client to encrypt/decrypt data blobs using one of AES-ECB, AES-CBC or AES-GCM operations.
- SYSFW/TIFS Crypto Service API
https://software-dl.ti.com/tisci/esd/latest/6_topic_user_guides/csp.html
https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/security/csp.html

The FAQ lists how to call SYSFW/TIFS secure crypto service API in OPTEE with AM62x Linux SDK 10.1.10.4 [1]
- TIFS 10.1.8
- OPTEE 4.4.0
[1] https://www.ti.com/tool/download/PROCESSOR-SDK-LINUX-AM62X/10.01.10.04

  • +1
    TI__Guru* 80100 points

    1/. provision the master encryption key to OTP eFuse using OTP keywriter 
    - HW security resource: OTP eFuse
    - SYSFW/TIFS: runs on SMS on AM62x, and provides the secure services via TISCI API
    - OTP keywriter: OTP eFuse programming tool, and runs once at customer factory floor

    2/. refer to "csp_bin.sh" on how the two stage binary streams used in the example are generated with AES-CBC-256 encryption & decryption

    3/. am62x_optee_csp_otp.patch: the sample optee patch on calling secure crypto service
    - call SYSFW/TIFS secure service to retrieve master encryption key from OTP eFuse
    - call crypto service to decrypt data encryption key w/ master encryption key
    - call crypto service to decrypt data with data encryption key

    4/. am62x_optee_otp_csp_dec.log: the sample log

    Best,
    -Hong

    https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/791/csp_5F00_bin.sh

    https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/791/am62x_5F00_optee_5F00_csp_5F00_otp.patch

    Fullscreen am62x_optee_otp_csp_dec.log Download 
    U-Boot SPL 2024.04-dirty (Feb 18 2025 - 11:38:48 -0600)
SYSFW ABI: 4.0 (firmware rev 0x000a '10.1.8--v10.01.08 (Fiery Fox)')
SPL initial stack usage: 13392 bytes
Trying to boot from MMC2
Authentication passed
Authentication passed
Authentication passed
Authentication passed
Authentication passed
Starting ATF on ARM64 core...

NOTICE:  BL31: v2.11.0(release):v2.11.0-906-g58b25570c9-dirty
NOTICE:  BL31: Built : 04:20:32, Nov  1 2024
I/TC: 
I/TC: OP-TEE version: 4.4.0-dev (gcc version 11.3.1 20220712 (Arm GNU Toolchain 11.3.Rel1)) #97 Tue Feb 18 17:38:19 UTC 2025 aarch64
I/TC: WARNING: This OP-TEE configuration might be insecure!
I/TC: WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html
I/TC: Primary CPU initializing
I/TC: GIC redistributor base address not provided
I/TC: Assuming default GIC group status and modifier
I/TC: SYSFW ABI: 4.0 (firmware rev 0x000a '10.1.8--v10.01.08 (Fiery Fox)')
I/TC: TIFS CSP AES-CBC-256 decryption S1
I/TC: len_in = 0x00000078  
I/TC: len_ref = 0x00000020  
I/TC: encrypted_input[0] = 0x24	
I/TC: encrypted_input[1] = 0x67	
I/TC: encrypted_input[2] = 0x2	
I/TC: encrypted_input[3] = 0x95	
I/TC: encrypted_input[4] = 0x92	
I/TC: encrypted_input[5] = 0x25	
I/TC: encrypted_input[6] = 0x1B	
I/TC: encrypted_input[7] = 0x71	
I/TC: encrypted_input[8] = 0xB0	
I/TC: encrypted_input[9] = 0x39	
I/TC: encrypted_input[10] = 0x59	
I/TC: encrypted_input[11] = 0x31	
I/TC: encrypted_input[12] = 0x9	
I/TC: encrypted_input[13] = 0x14	
I/TC: encrypted_input[14] = 0x3A	
I/TC: encrypted_input[15] = 0x9A	
I/TC: encrypted_input[16] = 0xAE	
I/TC: encrypted_input[17] = 0x3A	
I/TC: encrypted_input[18] = 0x39	
I/TC: encrypted_input[19] = 0x5	
I/TC: encrypted_input[20] = 0xB1	
I/TC: encrypted_input[21] = 0x3E	
I/TC: encrypted_input[22] = 0x6B	
I/TC: encrypted_input[23] = 0x3A	
I/TC: encrypted_input[24] = 0x4C	
I/TC: encrypted_input[25] = 0x7D	
I/TC: encrypted_input[26] = 0x5A	
I/TC: encrypted_input[27] = 0x7	
I/TC: encrypted_input[28] = 0x3C	
I/TC: encrypted_input[29] = 0xBD	
I/TC: encrypted_input[30] = 0x44	
I/TC: encrypted_input[31] = 0xFC	
I/TC: req.ctx_address_lo = 0x43C3B000  
I/TC: req.ctx_address_hi = 0x00000000  
I/TC: req.hdr.type = 0x9041  
I/TC: req.hdr.host = 0xB  
I/TC: req.hdr.seq = 0xA  
I/TC: req.hdr.flags = 0x2  
I/TC: >>>>>>>> The decrypted data matchs the reference data
I/TC: resp.hdr.type = 0x9041  
I/TC: resp.hdr.host = 0xB  
I/TC: resp.hdr.seq = 0xA  
I/TC: resp.hdr.flags = 0x2  
I/TC: >>>> ti_sci_csp_dec() return success!!!
I/TC: output[0] = 0x18	
I/TC: output[1] = 0x16	
I/TC: output[2] = 0x40	
I/TC: output[3] = 0xA4	
I/TC: output[4] = 0xCC	
I/TC: output[5] = 0x2E	
I/TC: output[6] = 0xC2	
I/TC: output[7] = 0x98	
I/TC: output[8] = 0x13	
I/TC: output[9] = 0x4F	
I/TC: output[10] = 0x16	
I/TC: output[11] = 0xE0	
I/TC: output[12] = 0x6F	
I/TC: output[13] = 0xB	
I/TC: output[14] = 0x29	
I/TC: output[15] = 0x51	
I/TC: output[16] = 0x15	
I/TC: output[17] = 0xF5	
I/TC: output[18] = 0xA9	
I/TC: output[19] = 0xEB	
I/TC: output[20] = 0x11	
I/TC: output[21] = 0x19	
I/TC: output[22] = 0xF0	
I/TC: output[23] = 0x61	
I/TC: output[24] = 0x9D	
I/TC: output[25] = 0x7E	
I/TC: output[26] = 0x79	
I/TC: output[27] = 0xBC	
I/TC: output[28] = 0x23	
I/TC: output[29] = 0xC5	
I/TC: output[30] = 0x24	
I/TC: output[31] = 0xE4	
I/TC: TIFS CSP AES-CBC-256 decryption S2
I/TC: len_in = 0x00000458  
I/TC: len_ref = 0x00000400  
I/TC: encrypted_input[0] = 0x55	
I/TC: encrypted_input[1] = 0x90	
I/TC: encrypted_input[2] = 0xAA	
I/TC: encrypted_input[3] = 0xF3	
I/TC: encrypted_input[4] = 0xB9	
I/TC: encrypted_input[5] = 0xE8	
I/TC: encrypted_input[6] = 0x28	
I/TC: encrypted_input[7] = 0x96	
I/TC: encrypted_input[8] = 0x2D	
I/TC: encrypted_input[9] = 0x67	
I/TC: encrypted_input[10] = 0xBB	
I/TC: encrypted_input[11] = 0x2	
I/TC: encrypted_input[12] = 0xD9	
I/TC: encrypted_input[13] = 0x46	
I/TC: encrypted_input[14] = 0xD2	
I/TC: encrypted_input[15] = 0x58	
I/TC: encrypted_input[16] = 0xF2	
I/TC: encrypted_input[17] = 0x41	
I/TC: encrypted_input[18] = 0xD6	
I/TC: encrypted_input[19] = 0xB7	
I/TC: encrypted_input[20] = 0x9A	
I/TC: encrypted_input[21] = 0x80	
I/TC: encrypted_input[22] = 0x16	
I/TC: encrypted_input[23] = 0xE8	
I/TC: encrypted_input[24] = 0x70	
I/TC: encrypted_input[25] = 0x15	
I/TC: encrypted_input[26] = 0x4D	
I/TC: encrypted_input[27] = 0x27	
I/TC: encrypted_input[28] = 0xFE	
I/TC: encrypted_input[29] = 0x1E	
I/TC: encrypted_input[30] = 0x8	
I/TC: encrypted_input[31] = 0x22	
I/TC: req.ctx_address_lo = 0x43C3B000  
I/TC: req.ctx_address_hi = 0x00000000  
I/TC: req.hdr.type = 0x9041  
I/TC: req.hdr.host = 0xB  
I/TC: req.hdr.seq = 0xB  
I/TC: req.hdr.flags = 0x2  
I/TC: >>>>>>>> The decrypted data matchs the reference data
I/TC: resp.hdr.type = 0x9041  
I/TC: resp.hdr.host = 0xB  
I/TC: resp.hdr.seq = 0xB  
I/TC: resp.hdr.flags = 0x2  
I/TC: >>>> ti_sci_csp_dec() return success!!!
I/TC: output[0] = 0x94	
I/TC: output[1] = 0xEC	
I/TC: output[2] = 0x74	
I/TC: output[3] = 0xC9	
I/TC: output[4] = 0xFB	
I/TC: output[5] = 0x6F	
I/TC: output[6] = 0x31	
I/TC: output[7] = 0xE2	
I/TC: output[8] = 0x8E	
I/TC: output[9] = 0x28	
I/TC: output[10] = 0xA1	
I/TC: output[11] = 0x22	
I/TC: output[12] = 0x22	
I/TC: output[13] = 0xC2	
I/TC: output[14] = 0xB0	
I/TC: output[15] = 0x96	
I/TC: output[16] = 0xEA	
I/TC: output[17] = 0xCE	
I/TC: output[18] = 0xDA	
I/TC: output[19] = 0xF7	
I/TC: output[20] = 0xF2	
I/TC: output[21] = 0x36	
I/TC: output[22] = 0xEB	
I/TC: output[23] = 0x2B	
I/TC: output[24] = 0x1D	
I/TC: output[25] = 0x14	
I/TC: output[26] = 0xF5	
I/TC: output[27] = 0x35	
I/TC: output[28] = 0x43	
I/TC: output[29] = 0x33	
I/TC: output[30] = 0xDB	
I/TC: output[31] = 0xA1	
I/TC: Activated SA2UL device
I/TC: Enabled firewalls for SA2UL TRNG device
I/TC: SA2UL TRNG initialized
I/TC: SA2UL Drivers initialized
I/TC: HUK Initialized
I/TC: Primary CPU switching to normal world boot

U-Boot SPL 2024.04-dirty (Feb 18 2025 - 11:39:00 -0600)
SYSFW ABI: 4.0 (firmware rev 0x000a '10.1.8--v10.01.08 (Fiery Fox)')
SPL initial stack usage: 1904 bytes
Error (-2): cannot determine file size
Trying to boot from MMC2
Authentication passed
Authentication passed


U-Boot 2024.04-dirty (Feb 18 2025 - 11:39:00 -0600)

SoC:   AM62X SR1.0 HS-FS
Model: Texas Instruments AM625 SK
EEPROM not available at 0x50, trying to read at 0x51
Reading on-board EEPROM at 0x51 failed -121
DRAM:  2 GiB
Core:  81 devices, 31 uclasses, devicetree: separate
MMC:   mmc@fa10000: 0, mmc@fa00000: 1
Loading Environment from nowhere... OK
In:    serial
Out:   serial
Err:   serial
EEPROM not available at 0x50, trying to read at 0x51
Net:   eth0: ethernet@8000000port@1
Hit any key to stop autoboot:  2  0 
=>