AES encryption is a self-authenticating algorithm with a symmetric key, meaning that the key to encrypt is the same as the one to decrypt. This key must be protected as it is secret (hence storage to the internal key space). There is an alternative form of authentication in the form of Rivest-Shamir-Adleman (RSA). RSA is an asymmetric algorithm, meaning that the key to verify is not the same key used to sign. Authentication requires a pair of keys.
- You sign with a Secret or Private Key
- Use a Public Key to verify
This public key does not need to be protected, and does not need special secure storage. This form of authentication works with encryption to provide both authenticity and confidentiality. You can use RSA with either encrypted or unencrypted partitions.
RSA not only has the advantage of using a public key, it also has the advantage of authenticating prior to decryption. The system must store the hash of the RSA public key in the eFUSE. AMD SoC devices authenticate the partition data before sending it to the AES decryption engine. You can use this method to help prevent attacks on the decryption engine. It ensures the partition data is authentic before any decryption.
In AMD SoCs, two pairs of public and secret keys are used - primary and secondary. The function of the primary public/secret key pair is to authenticate the secondary public/secret key pair. The function of the secondary key is to sign/verify partitions.
The first letter of the acronyms used to describe the keys is either P for primary or S for secondary. The second letter of the acronym used to describe the keys is either P for public or S for secret. There are four possible keys:
- PPK = Primary Public Key
- PSK = Primary Secret Key
- SPK = Secondary Public Key
- SSK = Secondary Secret Key
Bootgen can create a authentication certificate in two ways:
- Supply the PSK and SSK. The system calculates the SPK signature on the fly using these two inputs.
- Supply the PPK and SSK and the SPK signature as inputs. Use this in cases where the PSK is unknown.
The system hashes the primary key and stores it in the eFUSE. This hash is compared against the hash of the primary key stored in the boot image by the FSBL. The standalone driver provided with Vitis can write this hash to the PS eFUSE memory.
The following is an example BIF file:
image:
{
[pskfile]primarykey.pem
[sskfile]secondarykey.pem
[bootloader,authentication=rsa] fsbl.elf
[authentication=rsa]uboot.elf
}For device-specific authentication information, see the following: