encrypted_boot.txt 1.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243
  1. 1. Setup U-Boot Image for Encrypted Boot
  2. ----------------------------------------
  3. An authenticated U-Boot image is used as starting point for
  4. Encrypted Boot. The image is encrypted by i.MX Code Signing
  5. Tool (CST). The CST replaces only the image data of
  6. u-boot-dtb.imx with the encrypted data. The Initial Vector Table,
  7. DCD, and Boot data, remains in plaintext.
  8. The image data is encrypted with a Encryption Key (DEK).
  9. Therefore, this key is needed to decrypt the data during the
  10. booting process. The DEK is protected by wrapping it in a Blob,
  11. which needs to be appended to the U-Boot image and specified in
  12. the CSF file.
  13. The DEK blob is generated by an authenticated U-Boot image with
  14. the dek_blob cmd enabled. The image used for DEK blob generation
  15. needs to have the following configurations enabled in Kconfig:
  16. CONFIG_IMX_HAB=y
  17. CONFIG_CMD_DEKBLOB=y
  18. Note: The encrypted boot feature is only supported by HABv4 or
  19. greater.
  20. The dek_blob command then can be used to generate the DEK blob of
  21. a DEK previously loaded in memory. The command is used as follows:
  22. dek_blob <DEK address> <Output Address> <Key Size in Bits>
  23. example: dek_blob 0x10800000 0x10801000 192
  24. The resulting DEK blob then is used to construct the encrypted
  25. U-Boot image. Note that the blob needs to be transferred back
  26. to the host.Then the following commands are used to construct
  27. the final image.
  28. cat u-boot-dtb.imx csf-u-boot.bin > u-boot-signed.imx
  29. objcopy -I binary -O binary --pad-to <blob_dst> --gap-fill=0x00 \
  30. u-boot-signed.imx u-boot-signed-pad.bin
  31. cat u-boot-signed-pad.imx DEK_blob.bin > u-boot-encrypted.imx
  32. NOTE: u-boot-signed.bin needs to be padded to the value
  33. equivalent to the address in which the DEK blob is specified
  34. in the CSF.