Unable to decrypt FIP on STM32MP13

[arifbalik]

I have followed the wiki to create my encryption keys;

https://wiki.st.com/stm32mpu/wiki/How_to_perform_Secure_Boot_from_Distribution_Package#Creating_encryption_key_for_STM32MP13--STM32MP21--STM32MP23_and_STM32MP25

 

Which suggest creating two keys for TF-A and FIP encryption.

 

But then in the same page it suggest we only load the encryption key for TF-A to OTP registers (i can not fit the FIP key into OTP anyways)

 

After i build my image with the following config;

 

 SIGN_KEY = "../keys/privateKey00.pem"
 SIGN_KEY_stm32mp13 = "../keys/privateKey00.pem"
 EXTERNAL_KEY_CONF = "1"
 SIGN_KEY_PASS = "pass pass pass pass pass pass pass pass"
 SIGN_ENABLE = "1"
 SIGN_TOOL = "/bin/STM32_SigningTool_CLI"

 ENCRYPT_ENABLE = "1"
 ENCRYPT_FSBL_KEY = "../keys/stm32mp_encryption_key.bin"
 ENCRYPT_FSBL_KEY_stm32mp13 = "../keys/stm32mp_encryption_key.bin"
 ENCRYPT_FIP_KEY = "../keys/stm32mp_encryption_key_256bits.bin"
 ENCRYPT_FIP_KEY_stm32mp13 = "../keys/stm32mp_encryption_key_256bits.bin"

 

I get this error;

 

NOTICE: CPU: STM32MP135F Rev.Y
NOTICE: Model: EGate Rev D
NOTICE: Bootrom authentication succeeded
NOTICE: Reset reason (0x34):
NOTICE: BL2: v2.10-stm32mp1-r1.0(release):lts-v2.10.5-dirty(7c229848)
NOTICE: BL2: Built : 16:19:31, Jun 28 2024
NOTICE: TRUSTED_BOARD_BOOT support enabled
ERROR: File decryption failed (4)
ERROR: BL2: Failed to load image id 4 (-2)

 

Which makes sense because I assume TF-A uses the key in the OTP to decrypt the image, which would fail.

 

When I try to encrypt FIP using the same key as TF-A I get the following error;

 

| CMD> encrypt_fw \
| --key <my-key> \
| --nonce 1234567890abcdef12345678 \
| --fw-enc-status 0 \
| --in /yocto/build/tmp-glibc/work/egate_revd-oe-linux-gnueabi/fip-stm32mp/6.0/recipe-sysroot/optee/tee-header_v2-stm32mp135f-dk-custom-mx-optee.bin \
| --out /yocto/build/tmp-glibc/work/egate_revd-oe-linux-gnueabi/fip-stm32mp/6.0/recipe-sysroot/optee/tee-header_v2-stm32mp135f-dk-custom-mx-optee_Encrypted.bin
| ERROR: Unsupported key size: 32
| [TOOLS ERROR]: ENCTOOL optee header error

 

When I completely skip encryption and only use signed binaries I get yet another error;

 

NOTICE: CPU: STM32MP135F Rev.Y 
NOTICE: Model: EGate Rev D 
NOTICE: Bootrom authentication succeeded 
NOTICE: Reset reason (0x34): 
NOTICE: BL2: v2.10-stm32mp1-r1.0(release):lts-v2.10.5-dirty(7c229848) 
NOTICE: BL2: Built : 16:19:31, Jun 28 2024 
NOTICE: TRUSTED_BOARD_BOOT support enabled 
ERROR: BL2: Failed to load image id 4 (-5) 

 

Any suggestions?

[arifbalik]

My tf-a binary dump;

 

STM32_SigningTool_CLI -dump build/tmp-glibc/deploy/images/egate-revd/arm-trusted-firmware/tf-a-stm32mp135f-dk-custom-mx-optee-programmer-usb_Signed.stm32 
 -------------------------------------------------------------------
 STM32 Signing Tool v2.19.0 
 -------------------------------------------------------------------

 
Header description:

 Magic: 0x53544d32
 Signature: 04 17 61 e8 bf d6 13 9d 33 cf 94 ac ac 66 9d 68 b6 05 5b 48 c9 5e 01 34 0c f2 a9 2b de 4d 03 ef 
 27 a0 e2 18 9d 53 f2 82 96 df f6 78 5b eb 07 de 43 4a fa 5f 85 2e 4c 35 83 d8 be 72 62 49 ff b5 
 Checksum: 0x7da8d7
 Header version: 0x20000
 Size: 0x179e0
 Load address: 0x2ffe0000
 Entry point: 0x2ffe5000
 Image version: 0x0
 Extension: 0x80000001

 ECDSA : 256 
 
Authentication header detected:
 Type: 0x53540002
 Size: 0x154
 Key index: 0x0
 Key number: 0x8
 ECDSA Algo: 0x1
 ECDSA pub key: 45 c4 98 50 f7 4b f5 33 67 c1 bf 52 dc 2a 28 f0 2e 89 07 6a b2 8e 24 1f df 8f 75 48 80 da 1e f5 
 21 64 26 d8 53 d6 ac b1 f7 38 b0 d5 e3 2d a2 b7 2a 18 16 96 ab 72 4d 2a 17 87 25 aa 62 32 08 fa 
 
 Key 0: 0c 83 ca 35 5e 04 f8 5f 91 36 a6 54 7d 26 4b 44 f7 07 b3 3c a7 e8 e7 d9 58 bd fc 50 be 55 a6 f2 
 Key 1: 39 74 65 5e 76 e5 0b a5 6a 02 60 c2 3b e7 61 d6 bd c8 17 42 89 cf 56 19 c2 32 0f 18 a6 70 c3 bc 
 Key 2: be 0b 2f ff ef 9b 31 11 71 a1 97 ef 8a 72 3c 0f 91 60 56 ee 04 07 ba 3c 34 42 b2 9c 70 38 96 8c 
 Key 3: 27 db 2a 44 1b b2 af c2 7d 59 c7 38 da 9a 66 d3 80 9c be 99 97 63 f5 13 6c 98 a9 e3 49 60 89 17 
 Key 4: de 58 04 6f 77 15 54 2f 19 9d a2 13 c2 f5 9c 31 4f be 15 cd 51 a8 14 c1 81 aa 61 6b b6 e4 85 d9 
 Key 5: e6 61 12 23 10 a6 72 d4 9a fa 93 cf c4 57 14 d1 be f1 0f 9e f0 bc 45 89 19 27 53 d3 f6 0a 55 5c 
 Key 6: 0b 87 c6 72 fb 14 da f3 2c ea 8f 44 5c 1d 37 86 c1 61 7f 4b e7 29 26 7f 8e 51 dd 6a 6b 75 d1 1a 
 Key 7: fd 61 59 63 b5 d7 b6 ba 59 13 ce 83 91 bc d2 fe 2b 48 62 eb 5a df 5f 00 48 73 b3 0c 1e 15 a2 76 
 
Pad header detected:
 Type: 0x5354ffff
 Size: 0x2c
 Padding values: 02 1c f2 fa 14 a0 d0 03 1e 93 9e 7a dc 78 78 88 a2 23 1b 0f d8 37 54 d8 21 6e 0b db d6 0c 69 
 01 79 61 ab ad 

 

and fip info;

 

build/tmp-glibc/sysroots-components/x86_64/tf-a-tools-native/usr/bin/fiptool info build/tmp-glibc/deploy/images/egate-revd/fip/fip-stm32mp135f-dk-custom-mx-optee-emmc_Signed.bin
Secure Payload BL32 (Trusted OS): offset=0x240, size=0x1C, cmdline="--tos-fw"
Secure Payload BL32 Extra1 (Trusted OS Extra1): offset=0x25C, size=0x8BFE0, cmdline="--tos-fw-extra1"
Non-Trusted Firmware BL33: offset=0x8C23C, size=0x115BC8, cmdline="--nt-fw"
FW_CONFIG: offset=0x1A1E04, size=0x236, cmdline="--fw-config"
HW_CONFIG: offset=0x1A203A, size=0xC530, cmdline="--hw-config"
Trusted key certificate: offset=0x1AE56A, size=0x283, cmdline="--trusted-key-cert"
Trusted OS Firmware key certificate: offset=0x1AE7ED, size=0x22B, cmdline="--tos-fw-key-cert"
Non-Trusted Firmware key certificate: offset=0x1AEA18, size=0x22E, cmdline="--nt-fw-key-cert"
Trusted Boot Firmware BL2 certificate: offset=0x1AEC46, size=0x2C9, cmdline="--tb-fw-cert"
Trusted OS Firmware content certificate: offset=0x1AEF0F, size=0x2E2, cmdline="--tos-fw-cert"
Non-Trusted Firmware content certificate: offset=0x1AF1F1, size=0x255, cmdline="--nt-fw-cert"
STM32MP CONFIG CERT: offset=0x1AF446, size=0x286, cmdline="--stm32mp-cfg-cert"

[arifbalik]

For those who faced a similar problem, I was unable to use 128-bit key, so i burned a 256-bit key to custom otp fuses and modified tf-a source and device tree to use it.