Hello
I am using AES CBC to transmit data from the DA14683 and I would like to prepare my code for secured mode. I do understand from documentation that in order to set AES keys, I do need to:
- enable OTP for reading
- use DMA channel 7 to transfer keys from OTP to AES KEY 64 registers
- disable OTP
- launch AES on my data
I whish to get more insight about hw_aes_hash_store_keys function that I am currently using to prepare AES coprocessor. It sets key expansion and prepare key bytes before transfering it to the AES registers.
- Does the keys stored in OTP need to be prepared ? Do I simply need to copy them from OTP to AES registers ?
- Do I need to call hw_aes_hash_store_keys() function before launching DMA Channel 7 so it sets key expansion ? key transfer in this function shall fail; is this going to end in a hardware fault in secured mode ? Do I need to reimplement that function so it only sets parameters, prepare key but do not effectively load keys ?
In other words can you give me some insights on how to set the DA14683 ready for secured mode (please do not answer by redirecting me to tutorials) ?
Thank you in advance
Best Regards
STH
Question n°2 that seems to be quite linked to the Q n°1 : what about crypto_hmac_sha256() in secured mode ? It looks like this function only achieve cpu key transfers and it does not use DMA at all.
Subsidiary question : have you tested secured mode and ciphering/hmac in production ?
Thank you
Hi Bob,
The hw_aes_hash_store_keys() store AES keys in AES/HASH engine memory. This function stores the keys used for AES encryption/decryption in AES/HASH engine memory. If key expansion is performed by the engine, then aes_keys should contain only the base key. Otherwise it should contain all the expanded keys. The tutorial online
If the security feature has been enabled, then the stored keys cannot be read by the application. If the secure boot flash is disabled, then yes, it’s possible.
The keys stored in the OTP can only be accessed by the secured DMA channel 7. After the key’s generation, you should store them into the secured area of the OTP.
More information on the secure boot can be found on the tutorial online and the datasheet.
Thanks, PM_Dialog
thinks!
Hello
Thank you for your answer.
- I do understand that otp memory contains keys used directly by the aes module. If ciphering algorithm requires key expansion, then all keys must be stored in aes_keys.
- I do understand that keys stored in OTP can not be read by cpu when in secured mode. They can only be transfered using DMA.
- Does the actual board support package implement this DMA transfer ? From my understanding, no.
- >我要重新实现hw_aes_hash_store_keys ()to use key expansion in secured mode ? I am using AES CBC and transmitted data is decoded using openssl.
- You did not answered my question about crypto_hmac_sha256().
- From my understanding, I can not use keys stored in OTP to use HMAC in secured mode. It means that HMAC feature can not get its keys from JTAG/mkimage production tools.
--> Can you confirm ?
Thank you in advance
Best Regards
STH
Hello
I am planning to use symmetric keys introduced in the system by initial_flash / jtag / otp / suota_loader_secured set of software.
If I do replace hw_aes_hash_store_keys () function to have keys loaded by DMA channel 7:
- I understand that I need to manually set "key expansion" settings in the same way hw_aes_hash_store_keys does
- The next statement seems to relate to byte swapping. If I understand well, it is related to little endian to big endian conversion.
Can you confirm to me DMA channel 7 settings to properly load a key into AES coprocessor from OTP ? are there any specific bytes order conversion to perform ? if yes in which cases ?
Thank you in advance
Best Regards
STH