• State Resolved
  • Locked Locked
  • Replies 14 replies
  • Answers 2 answers
  • Subscribers 52 subscribers
  • Views 1125 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

LP-CC2652R7: SECURE BOOT

Gayathri GP
Prodigy 50 points

Part Number: LP-CC2652R7
Other Parts Discussed in Thread: CC2652R7, SYSCONFIG

Hi team,

Had this development board and the Project Zero worked as intended; the on-board led and button service functions properly.(Default : Unsecure build configuration)

Requirement is I want to change the current BIM to Secure_BIM. The following changes were made to enable Secure Boot :

  1. Imported the ccs bim_onchip_LP_CC2652R7_nortos_ticlang project and changed the build configuration to Release.
  2. Using the key_generate.py script, I generated a new key pair and edited the bim_onchip_main.c file to change the public keys and signer information.
  3. Imported the project_zero_LP_CC2652R7_tirtos7_ticlang project (Release:Active) and changed the SYS_Config to enable OAD BLE Security. Used the Ti private key to generate the signature.

When I load this bim and project zero application to launchpad, it works well. What I expected was that the projectzero application would get rejected because the private key used to generate the signature of the application was one that Ti provided and the public key used in bim was a newly generated key.

Is this procedure to enable secure boot correct?

One more query is Why is the signature value different for each build ( project_zero_LP_CC2652R7_tirtos_ticlang(Active-Release)), even though the private-public key pair and application are the same?

Could you help?

Thanks & Regards,

  • 0
    TI__Mastermind 44500 points

    Hello,

    I have assigned your thread to a relevant expert. In the meantime, could you share which SDK version you are using? Are there any modifications made to the project zero application code as well as the modifications you mentioned?

    Best Regards,

    Jan

  • 0 in reply to Jan
    Prodigy 50 points

    Hi,

    SDK Version - 6.30.01.03

    The above said changes were made. There were no changes made to the application code. 

    Regards

    Gayathri

  • 0 in reply to Gayathri GP
    TI__Mastermind 25810 points

    Hey Gayathri,

    In what order were these operations done? Project_zero contains a post build step that automatically invokes the oad_image_tool with the stored private.pem file. If the new private.pem file was generated first and then project_zero was rebuilt, then the keys will match and it should work like you have observed.

    Gayathri GP said:
    One more query is Why is the signature value different for each build ( project_zero_LP_CC2652R7_tirtos_ticlang(Active-Release)), even though the private-public key pair and application are the same?

    I'm not too familiar with this, I would recommend taking a look at the oad_image_tool inside the SDK (tools/common/oad) as the source of the tool is available. The answer is likely there.

  • 0 in reply to Ammar N
    Prodigy 50 points

    Hi Ammar,

    Yes, I agree that during the post build step, it automatically invokes the oad_image_tool with the stored private.pem file.

    Now I replaced the private.pem file in the path C:\ti\simplelink_cc13xx_cc26xx_sdk_6_30_01_03\tools\common\oad\private.pem with the newly generated private key while leaving the public.pem file in the path C:\ti\simplelink_cc13xx_cc26xx_sdk_6_30_01_03\tools\common\oad\public.pem as such.

    My doubt is I am not setting the new public key anywhere when building the image:

    then how this signature validation passed and the application runs. How is the newly generated public key obtained?

    Ammar  said:
    I'm not too familiar with this, I would recommend taking a look at the oad_image_tool inside the SDK (tools/common/oad) as the source of the tool is available. The answer is likely there.

    If I make some changes in the oad_image_tool.py file inside the SDK (tools/common/oad), will they get reflected in the building process? If not, could you please tell me which portion of the application code is invoking the oad_image_tool.py file and also how to do an application from the source?

  • 0 in reply to Gayathri GP
    TI__Mastermind 25810 points

    Hello,

    In the screenshot above, you show the eccKey.pubX/Y, which are used during pairing. The keys used to sign the image for an OAD are separate. I apologize if I misunderstood what you meant here, I thought I would clarify anyway.

    Gayathri GP said:
    If I make some changes in the oad_image_tool.py file inside the SDK (tools/common/oad), will they get reflected in the building process? If not, could you please tell me which portion of the application code is invoking the oad_image_tool.py file and also how to do an application from the source?

    The oad image tool takes in certain parameters as input, so if you do not change this structure then yes, the tool is invoked automatically so you shouldn't need to modify the project properties. 

  • 0 in reply to Ammar N
    Prodigy 50 points
    Hello,
    Secure Boot had two phases
    1) Signature generation
    The signature of the application is generated; here the private key is used, which is not embedded in the device.
    2) Signature Validation
    Validate the signature; here the public key is used, which is stored in the flash with integrity protection. The public key shown above is the public key stored in flash for signature validation during execution.
    Secure boot is a feature of this device. I want to evaluate the secure boot feature of this before developing the application. For that I am using  the example PROJECT ZERO application with security feature enabled. What I expected was that the PROJECT ZERO application would get rejected due to key pair mismatch (using Private key of Texas for signature generation and Public key of customer for signature validation).
    Could you please explain the procedure to enable secure boot in PROJECT ZERO application?  Is the procedure to enable secure boot I mentioned above correct?
    Reference used :
    https://www.ti.com/lit/swra651
     
  • 0 in reply to Gayathri GP
    TI__Mastermind 25810 points

    Hey Gayathri,

    Sorry for the delay. The above steps should work. One key difference I spotted is that you've used bim_onchip, whereas project_zero is an off-chip OAD example project. I've tested the instructions using bim_offchip, and verified that the device does not boot into the image after changing the keys as you've described.

    Some other notes I'd like to make: the step to define OAD_BLE_SECURITY in SysConfig is not needed for secure boot. What this does is enable encrypted permissions on the Bluetooth LE profile (does not have much to do with the boot procedure, rather it requires an encrypted connection to start the OAD). The project is already configured for security by enabling the SECURITY predefined symbol.

  • 0 in reply to Ammar N
    Prodigy 50 points

    Hi Ammar

    How do you ensure that the device does not boot into the image after changing the keys? I loaded bim_offchip and project_zero onto the board, and now also the SimpleLink Starter app shows the project zero application and I can toggle the onboard LEDs. Why is it so?

  • 0 in reply to Gayathri GP
    TI__Mastermind 25810 points

    Hey Gayathri,

    Here are the steps I followed:

    1. Import bim_off chip and build the Release configuration.
    2. Import project_zero and build the project.
    3. Flash both the bim and project_zero's _oad.bin to the board. 
      1. At this point, this build of project_zero is expected to boot correctly and behave as intended.
    4. Copy project_zero's _oad.bin file and rename it.
    5. Navigate to the oad_image_tool directory, save a copy of the existing private/public.pem files and rerun the key_generate.py script.
      1. At this point, you have new keys.
    6. Copy the new keys to bim_offchip_main.c so the BIM can verify against the new keys.
    7. Rebuild the bim_offchip example.
    8. Flash the newly build bim_offchip example and the original (saved in step 4) project_zero binary file.
      1. At this point, the bim offchip keys do not match the keys used to build the project_zero binary file so I do not expect project_zero to boot correctly.
    Gayathri GP said:
    I loaded bim_offchip and project_zero onto the board, and now also the SimpleLink Starter app shows the project zero application and I can toggle the onboard LEDs. Why is it so?

    If the BIM project boots into project_zero, I suspect the keys matched up when the BIM checked against them. If the BIM does not boot into the image, you will not even be able to discover project_zero with a mobile phone (or observe the UART display in a terminal window).

    Please ensure you are flashing the _oad.bin file that is generated post build by the oad_image_tool.

  • 0 in reply to Ammar N
    Prodigy 50 points

    Hi Ammar,

    Thank you so much for the support; it worked.

    Here I used the Ti provided private key for signature generation and the customer generated public key for Validation, so the boot got aborted.

    Ammar, can I use the customer generated private key for signature generation and the Ti provided public key for validation by simply changing the existing private/public.pem files in this path: "ti\simplelink_cc13xx_cc26xx_sdk_6_30_01_03\tools\common\oad".  I have tried this now. It's booting, not rejecting; are there any other changes I have to make rather than changing  the keys in this path.

    regards

    Gayathri G P

  • 0 in reply to Gayathri GP
    TI__Mastermind 25810 points

    Hey Gayathri,

    Gayathri GP said:
    Ammar, can I use the customer generated private key for signature generation and the Ti provided public key for validation by simply changing the existing private/public.pem files in this path: "ti\simplelink_cc13xx_cc26xx_sdk_6_30_01_03\tools\common\oad".

    I'm not sure I follow what you are saying here. The public/private keys are paired together and cannot be interchanged. That is, the private key is generated first and then the public key is essentially a derivative of the private key. If you mismatch the provided TI public key with an incorrect private key, the keys will not match and will fail a signature check.

    key_generate.py generates a private public key pair that must be used together. You are free to modify the key files using your own method. private.pem is critical to be passed in to the post build step of the project (don't worry, the default examples already invoke it for you). The public key should be modified in the bim_offchip_main.c file (i.e. the public.pem file is mainly there as a record that contains the public key information and is not invoked anywhere).

    Hope this clarifies things.

  • 0 in reply to Ammar N
    Prodigy 50 points

    Hi Ammar,

    Let me clarify. My query is :

    Case 1: I followed the steps you posted.

    1) Generated customer-specific keys and pasted the public key into bim_offchip_main.c.

    2) Build the projects.

    a) At this point, the bim offchip keys do not match the keys used to build the project_zero binary file (Ti private key), so project_zero didn't boot.

    It worked as intended, the boot aborted (Customer Public Key and Ti Private Key)

    Case 2

    1) Rebuild project_zero with the new previously generated customer private key, keeping the bim_offchip same as in case 1:no changes made.

    a) This is done by overwriting the private.pem file in "ti\simplelink_cc13xx_cc26xx_sdk_6_30_01_03\tools\common\oad" with the newly generated private key in  the path "ti\si mplelink_cc13xx_cc26xx_sdk_6_30_01_03\tools\common\oad\key_generate".

    It's also worked as intended, the boot continued 

    Case 3

    1) Rebuild the project_zero only with the Ti private key pair, keeping the bim_offchip same as in case 1:no changes made (Customer Public Key and Ti Private Key).

    Not as expected, the boot continued: expected boot abort.  Why ?

    (When I rebuild both project_zero and bim_offchip it will work as intended)

    Hope this clarifies things.

    Ammar said:
    key_generate.py generates a private public key pair that must be used together. You are free to modify the key files using your own method. private.pem is critical to be passed in to the post build step of the project (don't worry, the default examples already invoke it for you). The public key should be modified in the bim_offchip_main.c file (i.e. the public.pem file is mainly there as a record that contains the public key information and is not invoked anywhere).

    How is the signature of an application image is generated in the post build step of the project  (here tool is automatically invoked)? Please elaborate on the signature generation steps using oad_image tool.

    Why is the signature value different for each build ( project_zero_LP_CC2652R7_tirtos_ticlang(Active-Release)), even though the private-public key pair and application are the same? Theoretically, signature value should be the same if we do not change anything.

    Build 1

    Build 2

  • 0 in reply to Gayathri GP
    TI__Mastermind 25810 points

    Hello,

    Unfortunately I'm not able to reproduce the behavior in case 3. I would ensure the correct private.pem file is being used to generate the project_zero binary file. You can do this by going to the Project Properties in CCS> Build>Steps>Post-build steps:

    Gayathri GP said:
    Why is the signature value different for each build ( project_zero_LP_CC2652R7_tirtos_ticlang(Active-Release)), even though the private-public key pair and application are the same? Theoretically, signature value should be the same if we do not change anything.

    Signing is part of the ECDSA algorithm. The signature will change each time the signing algorithm is run as it takes in a random number and a hash value to compute the signature. It is not a correct assumption that the signature will remain the same if the keys and image are identical.

  • +1 in reply to Ammar N
    Prodigy 50 points

    Thank you Ammar, for the support. It worked.