Crypto D100 User's Guide

Browse online or download User's Guide for Tablets Crypto D100. Crypto D100 User`s guide [en] User Manual

  • Download
  • Add to my manuals
  • Print
  • Page
    / 31
  • Table of contents
  • BOOKMARKS
  • Rated. / 5. Based on customer reviews
Page view 0
Freescale Semiconductor
Application Note
© Freescale Semiconductor, Inc., 2012, 2013. All rights reserved.
1 Introduction
1.1 Purpose
The purpose of this application note is to explain how to
perform a secure boot on i.MX28 applications processors
with High Assurance Boot version 4 (HAB v4). This
includes steps on how to generate signed images and
configure the IC to run securely using freely available tools
provided by Freescale.
Executing trusted and authentic code on an applications
processor starts with secure boot provided by the on-chip
boot ROM. The i.MX family of applications processors
provides this capability with the High Assurance Boot
(HAB) component of the on-chip ROM. HAB provides
services to the ROM to authenticate software that executes
immediately after ROM, which is usually a bootloader, using
Document Number: AN4555
Rev. 1, 05/2013
Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. i.MX28 security architecture overview . . . . . . . . . . . . 4
3. Designing for code signing . . . . . . . . . . . . . . . . . . . . . 8
4. Signed U-Boot and Linux kernel example . . . . . . . . 17
5. Encrypted boot and Elftosb . . . . . . . . . . . . . . . . . . . . 22
6. Manage the electrical fuses . . . . . . . . . . . . . . . . . . . . 23
7. Development and debug tips . . . . . . . . . . . . . . . . . . . 25
8. Example CSF text files for reference . . . . . . . . . . . . 26
9. Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Secure Boot with i.MX28 HAB Version 4
Page view 0
1 2 3 4 5 6 ... 30 31

Summary of Contents

Page 1 - 1 Introduction

Freescale SemiconductorApplication Note© Freescale Semiconductor, Inc., 2012, 2013. All rights reserved. 1 Introduction1.1 PurposeThe purpose of this

Page 2 - 1.2 Scope

Secure Boot with i.MX28 HAB Version 4, Rev. 110 Freescale Semiconductor Designing for code signingthe boot image,” which discusses how the IVT is used

Page 3 - Introduction

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 11 Designing for code signing3.1.4 Image layoutWhen performing a secure boot on a

Page 4 - 1.5 References

Secure Boot with i.MX28 HAB Version 4, Rev. 112 Freescale Semiconductor Designing for code signingThe IVT can appear anywhere before, in between or af

Page 5 - 2.2 Boot flow

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 13 Designing for code signingFigure 5. Typical memory layout of a signed imageThe

Page 6 - 6 Freescale Semiconductor

Secure Boot with i.MX28 HAB Version 4, Rev. 114 Freescale Semiconductor Designing for code signingThe first CSF in the boot sequence must contain an I

Page 7 - Freescale Semiconductor 7

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 15 Designing for code signing../linux/srktool –h 4 –t SRK_1_2_3_4_table.bin –e SR

Page 8 - 3 Designing for code signing

Secure Boot with i.MX28 HAB Version 4, Rev. 116 Freescale Semiconductor Designing for code signing /* reserve this area to store HAB related data suc

Page 9 - 3.1.1 Image Vector Table

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 17 Signed U-Boot and Linux kernel example // Absolute address of the Boot

Page 10 - 3.1.3 Command Sequence File

Secure Boot with i.MX28 HAB Version 4, Rev. 118 Freescale Semiconductor Signed U-Boot and Linux kernel exampleFigure 6. Players in the generation of s

Page 11 - 3.1.4 Image layout

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 19 Signed U-Boot and Linux kernel exampleThe HAB data is generated using the code

Page 12 - 12 Freescale Semiconductor

Secure Boot with i.MX28 HAB Version 4, Rev. 12 Freescale Semiconductor Introductiondigital signatures. HAB provides a mechanism to establish a root of

Page 13 - 3.2 Generating the HAB data

Secure Boot with i.MX28 HAB Version 4, Rev. 120 Freescale Semiconductor Signed U-Boot and Linux kernel example4.1 Sample boot descriptor file used for

Page 14 - ./hab4_pki_tree.sh

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 21 Signed U-Boot and Linux kernel example // Load and call u_boot - ELF ARM im

Page 15 - Designing for code signing

Secure Boot with i.MX28 HAB Version 4, Rev. 122 Freescale Semiconductor Encrypted boot and Elftosb //----------------------------------------------

Page 16

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 23 Manage the electrical fusesThe package contains executable elftosb.exe for Win

Page 17

Secure Boot with i.MX28 HAB Version 4, Rev. 124 Freescale Semiconductor Manage the electrical fusesOn Windows (Keygen.exe), cryptographically secure R

Page 18

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 25 Development and debug tipsThe otp_burner.py script uses the binary SRK hash fi

Page 19

Secure Boot with i.MX28 HAB Version 4, Rev. 126 Freescale Semiconductor Example CSF text files for reference /* Display HAB Failure events */

Page 20

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 27 Example CSF text files for reference Engine Configuration = 0 Certificat

Page 21

Secure Boot with i.MX28 HAB Version 4, Rev. 128 Freescale Semiconductor Example CSF text files for reference[Install CSFK] File = "../crts/CSF

Page 22 - 5 Encrypted boot and Elftosb

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 29 Example CSF text files for reference# Sign entire linux_prep image# Sign entir

Page 23 - 6 Manage the electrical fuses

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 3 Introduction1.4 Definitions, acronyms, and abbreviationsTable 1. Definitions, a

Page 24 - 24 Freescale Semiconductor

Secure Boot with i.MX28 HAB Version 4, Rev. 130 Freescale Semiconductor Revision history9 Revision history Table 2 provides a revision history for thi

Page 25 - 7 Development and debug tips

Document Number: AN4555Rev. 105/2013Information in this document is provided solely to enable system and software implementers to use Freescale produc

Page 26 - 8.1 U-boot CSF example

Secure Boot with i.MX28 HAB Version 4, Rev. 14 Freescale Semiconductor i.MX28 security architecture overview1.5 ReferencesThe references listed below

Page 27 - 8.2 Linux_prep CSF example

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 5 i.MX28 security architecture overviewThe HAB library, embedded in the processor

Page 28 - 8.3 Linux_kernel CSF example

Secure Boot with i.MX28 HAB Version 4, Rev. 16 Freescale Semiconductor i.MX28 security architecture overviewFigure 1. Secure boot flow from device2.3

Page 29 - 8.4 Boot_prep CSF example

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 7 i.MX28 security architecture overviewFigure 2 gives an example of a typical PKI

Page 30 - 9 Revision history

Secure Boot with i.MX28 HAB Version 4, Rev. 18 Freescale Semiconductor Designing for code signingThe arrows in Figure 3 show the authentication flow.

Page 31 - How to Reach Us:

Secure Boot with i.MX28 HAB Version 4, Rev. 1Freescale Semiconductor 9 Designing for code signingis defined in the High Assurance Boot Version 4 Appli

Comments to this Manuals

No comments