• State
  • Locked Locked
  • Replies 2 replies
  • Subscribers 98 subscribers
  • Views 771 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

basic secure omapl138 device encrypts images

zhongfeng chen
Intellectual 275 points
Other Parts Discussed in Thread: OMAPL138, OMAP-L138

HI:

There are some problems while we use basic secure omapl138 to encrypt images,and i need confirm some questions first:
1.  For SecureHexAIS_OMAP-L138.exe tool, dose it encrypt the CEK in the ini file ? If so, how does it get the KEK?
2. AIS command SECURE KEY LOAD, which is described in the <TMS320C674x/OMAP-L1xProcessor Security> file, it will installs CEK, what is this mean? Encrypts CEK by KEK?
3. IS secondaryBootLoader equal to UBL?

OK, we apply apps on ARM core and DSP core just for security currently. Both secure and non-secure, we can run DSP and ARM well. And for DSP' UBL, we have success encrypted the CEK which is provided in the code. For the encrypt,what's the next step should we do?
The uboot for ARM is stored in the nor flash, and we need to encrypt this image(or arm apps' image), and bind to an unique device.The <TMS320C674x/OMAP-L1xProcessor Security> file (Figure11) mentions we should placed the encrypted CEK into this image. And how to accomplish this?
Besides, we have got the Security_collateral_update.zip SDK from local TI' support. For this SDK, we can't open its projects with CCS4.2. And its demo applys SPI flash, unfortunately, there is no spi flash on our hardware, so ,we can't verity these demo.

And how to use LoadModGen tool?


thanks!

  • 0
    TI__Guru** 116100 points

    Hi Chen,

    2. AIS command SECURE KEY LOAD, which is described in the <TMS320C674x/OMAP-L1xProcessor Security> file, it will installs CEK, what is this mean? Encrypts CEK by KEK?

    Yes. CEK is unencrypted developer key and encrypted by KEK.

    3. IS secondaryBootLoader equal to UBL?

    Typically, UBL is first stage bootloader and u-boot is the secondary bootloader.

    http://omappedia.org/wiki/Bootloader_Project

    For further queries, I will answer in next reply.

  • 0 in reply to Titusrathinaraj Stalin
    Intellectual 275 points

    HI Titus S:


     Thanks!


    One more question about  LoadModGen tool Which uses to generate boot load modules.In its readme.txt file, usage for this tool : LoadModGen_OMAP-L138.exe -ini LoadModGen/ini/loadmod_1024.ini -otype carray data.bin test.out.


    The test.out file used fine by SecureHexAIS_OMAP-L138.exe tool, but when use above command, then i take the output file data.bin with the GenericSecureUartHost.exe to burn into L2 of DSP, the GenericSecureUartHost.exe reports information:

    (Serial Port): Opening COM1 at 57600 baud...
    (AIS Parse): Read magic word 0x16FC01A4.
    (AIS Parse): Boot aborted.

    The tool parses the magic word unmatched, and just aborted.

    how to deal with this ?

    Regards!