CC3220SF: Secure File Encryption on Gang Image

YOUNG LIN

Part Number: CC3220SF
Other Parts Discussed in Thread: UNIFLASH

Hi,

We have a board with CC3220SF on it, during the fabrication process, the firmware programming process is performed by an external company (PCB assembler).

I'd like to use gang image for the production, but inside the FW project (UNIFLASH project), we have put a private key as a secure file (with vendor file token set in UNIFLASH, not public read). So my question is about the secure file encryption in the gang image:

If we send the gang image to the external company, is there any way they can extract the secure file (secure file with file token set, not public read) from the gang image?
Is the secure file also encrypted in the gang image? because I know that the secure file is well encrypted on the flash (https://e2e.ti.com/support/wireless-connectivity/wifi/f/968/t/738660?CC3220-SF-file-encryption-on-the-external-flash), but I'd like to confirm if it is also encrypted in the gang image before programming.

Thanks and regards,

over 5 years ago

0 Jan D over 5 years ago

Guru 80285 points

Hi,

And why you not create encrypted image (see swru469 at chapter 6.7.1)?

Jan

0 Kobi Leibovitch over 5 years ago in reply to Jan D

TI__Guru 63006 points

That's right. You should encrypt the image as described in chapter 6.7.1 to make sure the content is kept private.

Br,

Kobi

0 YOUNG LIN over 5 years ago in reply to Kobi Leibovitch

Intellectual 395 points

Thanks Jan and Kobi for the quick response,

We're going to encrypt the gang image, but we still need to provide the AES128 key to the external company to program the image, so I still have the question: is the secure file encrypted inside the gang image?

Thank you very much,

Regards,

0 Jan D over 5 years ago in reply to YOUNG LIN

Guru 80285 points

Hi,

That key is not necessary for programming image. Key is mandatory for a activation of image. Activation image can be done later during your manufacturing. Will be all production steps done outside your facility?

Jan

0 Kobi Leibovitch over 5 years ago in reply to Jan D

TI__Guru 63006 points

Even if you activate the device at the 3rd party facility, the activation itself should be supervised by someone trusted (from your company).

The key should not be exposed (should be used by the trusted person only).

This would prevent compromising the IP and counterfeiting (i.e. over-building of the product) by the manufacturer.

Br,

Kobi

Wi-Fi

Wi-Fi forum

CC3220SF: Secure File Encryption on Gang Image