• State TI Thinks Resolved
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 97 subscribers
  • Views 25 views
  • Users 0 members are here
Support feedback
Options
Options
Related

AM62P-Q1: Secure Boot implementation in HS-FS devices

Tim Wang
Prodigy 180 points

Part Number: AM62P-Q1

Hello Ti Expert,

As we know, the HS-SE device will mandatory execute Secure Boot. will follow the sequence as:

image.png

If the device is HS-FS, because eFuse don't have public key hash, if we send TISCI msg of " TISCI_MSG_PROC_AUTH_BOOT" to TIFS, whethe it also handle the sequence?

We test the secure boot on FS device, tampered a byte of iamge file: xxx.appimage.hs_fs, but finally the boot sequence failed.

image.png 

So we guess in FS device, even if eFuse don't have public key hash, the above secure boot sequence, still hanldled, but only the first step of "public hash verification" is skipped?

Please help to confirm, Thanks!

B.R

  • 0
    TI__Guru* 89631 points

    Hello,

    Tim Wang said:
    So we guess in FS device, even if eFuse don't have public key hash, the above secure boot sequence, still hanldled, but only the first step of "public hash verification" is skipped?

    This is correct. On HSFS devices, the public key hash comparison is skipped effectively meaning the authentication of the certificate is skipped and only the integrity checks are performed. This means if you corrupt even a byte then the authentication would fail. The difference from HSSE device is that an image signed with any random key would pass authentication on HSFS but fail on HSSE device. Additionally, there is no decryption possible on HSFS devices.