yair/u-boot-tk1-som
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

imx6: Added DEK blob generator command

Browse Source 
Freescale's SEC block has built-in Data Encryption
Key(DEK) Blob Protocol which provides a method for
protecting a DEK for non-secure memory storage.
SEC block protects data in a data structure called
a Secret Key Blob, which provides both confidentiality
and integrity protection.
Every time the blob encapsulation is executed,
a AES-256 key is randomly generated to encrypt the DEK.
This key is encrypted with the OTP Secret key
from SoC. The resulting blob consists of the encrypted
AES-256 key, the encrypted DEK, and a 16-bit MAC.

During decapsulation, the reverse process is performed
to get back the original DEK. A caveat to the blob
decapsulation process,  is that the DEK is decrypted
in secure-memory and can only be read by FSL SEC HW.
The DEK is used to decrypt data during encrypted boot.

Commands added
--------------
  dek_blob - encapsulating DEK as a cryptgraphic blob

Commands Syntax
---------------
  dek_blob src dst len

    Encapsulate and create blob of a len-bits DEK at
    address src and store the result at address dst.

Signed-off-by: Raul Cardenas <Ulises.Cardenas@freescale.com>
Signed-off-by: Nitin Garg <nitin.garg@freescale.com>

Signed-off-by: Ulises Cardenas <ulises.cardenas@freescale.com>

Signed-off-by: Ulises Cardenas-B45798 <Ulises.Cardenas@freescale.com>
This commit is contained in:
Raul Cardenas
2015-02-27 11:22:06 -06:00
committed by Stefano Babic
parent b5cd10b911
commit 0200020bc2
12 changed files with 492 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/crypto/fsl/desc.h
View File

@@ -12,11 +12,18 @@
#ifndef DESC_H
#define DESC_H
#define KEY_BLOB_SIZE 32
#define MAC_SIZE 16
/* Max size of any CAAM descriptor in 32-bit words, inclusive of header */
#define MAX_CAAM_DESCSIZE 64
/* Size of DEK Blob descriptor, inclusive of header */
#define DEK_BLOB_DESCSIZE 9
/* Block size of any entity covered/uncovered with a KEK/TKEK */
#define KEK_BLOCKSIZE 16
/*
* Supported descriptor command types as they show up
* inside a descriptor command word.
@@ -272,6 +279,13 @@
#define LDLEN_SET_OFIFO_OFFSET_SHIFT 0
#define LDLEN_SET_OFIFO_OFFSET_MASK (3 << LDLEN_SET_OFIFO_OFFSET_SHIFT)
/*
* AAD Definitions
*/
#define AES_KEY_SHIFT 8
#define LD_CCM_MODE 0x66
#define KEY_AES_SRC (0x55 << AES_KEY_SHIFT)
/*
* FIFO_LOAD/FIFO_STORE/SEQ_FIFO_LOAD/SEQ_FIFO_STORE
* Command Constructs
@@ -418,6 +432,7 @@
#define OP_PCLID_MASK (0xff << 16)
/* Assuming OP_TYPE = OP_TYPE_UNI_PROTOCOL */
#define OP_PCLID_SECMEM 0x08
#define OP_PCLID_BLOB (0x0d << OP_PCLID_SHIFT)
#define OP_PCLID_SECRETKEY (0x11 << OP_PCLID_SHIFT)
#define OP_PCLID_PUBLICKEYPAIR (0x14 << OP_PCLID_SHIFT)