AM3354: Encrypted eMMC flash

Andreas Hansson64

Part Number: AM3354

We have a design with 4Gbyte MMC flash. We are using u-boot to boot from a FAT partition on the flash.

Now, I have been told that it should be possible to encrypt all of the flash during production, however I can not find any documentation about the procedure. I want to know how I can achieve this.

I have read the documents about the secure boot but that procedure is a little bit more than we need. We just want to enable flash encryption.

Can anyone here point me in the right direction?

BR
Andreas

over 7 years ago

0 Biser Gatchev-XID over 7 years ago

TI__Guru**** 393215 points

The factory team have been notified. They will respond here.

0 Hong Guan64 over 7 years ago in reply to Biser Gatchev-XID

TI__Guru 71260 points

On AM335x High Security (HS) device, secure boot is supported, including SW blob authentication plus optionally encryption/decryption of SW blob during secure boot process.

On AM335x General Purpose (GP) device, some of SW based options to enable disk/file encryption are

dm-crypt (https://en.wikipedia.org/wiki/Dm-crypt)

eCryptfs (https://en.wikipedia.org/wiki/ECryptfs)

ext4 encryption (https://wiki.archlinux.org/index.php/ext4#Using_file-based_encryption)

0 Andreas Hansson64 over 7 years ago in reply to Hong Guan64

Prodigy 220 points

Thank you for the answer. However, as far as I understand, the tools you mention above (dm-crypt etc) is not using hardware supported decryption of the flash. They are standard tools that can be used in any Linux computer and I don't think that they will satisfy our needs.

What we want is to enable encryption during production in such a way that the cpu can decrypt the data. We don't need secure boot though.

Are you saying that we have to have a HS device?

Is is possible to have a HS device with encryption and skip secure boot?

How do we enable the HS mode?

Andreas

0 Hong Guan64 over 7 years ago in reply to Andreas Hansson64

TI__Guru 71260 points

There’re Linux crypto driver SW to support data encryption/decryption on AM335x GP/HS device.
On HS device, secure boot is mandatory, and SW blob encryption/decryption is optional feature.
HS device is configured differently from GP device, and device type is fixed out of TI fab.

0 Rogerio Almeida over 7 years ago in reply to Hong Guan64

TI__Mastermind 26215 points

Hong,
it is possible to customer to enable the level of flash encryption desired without having to go to an HS device?

0 Hong Guan64 over 7 years ago in reply to Rogerio Almeida

TI__Guru 71260 points

Rogerio,

On AM335x General Purpose (GP) device, there’s no built-in HW support to perform decryption out of flash.

There’s SW based option for disk/file decryption based on dm-crypt…

Best,

-Hong

0 Rogerio Almeida over 7 years ago in reply to Hong Guan64

TI__Mastermind 26215 points

Thanks Hong. In case customer has more questions, they will post here.

0 Andreas Hansson64 over 7 years ago in reply to Hong Guan64

Prodigy 220 points

Thank you Hong for the answer.

I have a followup question. When I read the document "Secure boot on embedded Sitara™ processors
", on page 4, it says:

"TI provides evaluation modules (EVMs), software development kits (SDKs), tools and documentation to showcase the generation of keys and procedure to provision booting keys into the device. These collaterals are designed for early evaluation of key provisioning and support customers to transition from development to volume production."

I have downloaded the sitara SDK and read a lot of documentation on the TI site and I can not find any information about the procedure above. Can you please point me in the right direction here?

BR
Andreas

0 Hong Guan64 over 7 years ago in reply to Andreas Hansson64

TI__Guru 71260 points

Hi Andreas,
There’s special note (listed below) on AM437x product page www.ti.com/.../AM4378
Special Notes
Fill out a request to get more information about AM437xS secure boot devices, to purchase a high secure EVM and to obtain SEC-DEV software.

Best,
-Hong

Processors

Processors forum

AM3354: Encrypted eMMC flash