cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Observer
Observer
495 Views
Registered: ‎10-24-2019

Using SSBL to authenticate linux partition

Jump to solution

Dear Community

While reading the document XAPP1175 (Secure Boot of Zynq-7000 SoC) I stumbled over a statement that I don't know if it's correct or if I just don't understand how it was ment. On page 10 under the topic "Boot Flow" it says: "Using the FSBL to load Linux partitions allows the user to specify whether each partition is encrypted or authenticated."

My question: Shouldn't that also be possible when I use a SSBL (e.g. U-Boot) ? Otherwise how could I ensure the complete chain of trust if it wouldn't be possible to auth. all partitions if a SSBL is used to load the linux partitions?

And if it is possible to authenticate & decrypt the linux partitions with a SSBL, can the SSBL also make use of the internal AES/HMAC engine to do so?

 

Thanks in advance,

Nico

0 Kudos
1 Solution

Accepted Solutions
Highlighted
Xilinx Employee
Xilinx Employee
442 Views
Registered: ‎10-11-2011

I think there are two possible flows here.

You can have the FSBL load all the authenticated partititons (u-boot and Linux) and then handoff to u-boot which will be handing-off to Linux.

OR

You can have the FSBL, authenticating and handing off to u-boot and then u-boot authenticating and hadnding off to Linux.

In both cases you need to "trust" your DDR because both u-boot and Linux are "external" to zynq-7000 and therefore exposed to attacks.

-------------------------------------------------------------------------
Don’t forget to reply, kudo, and accept as solution.
-------------------------------------------------------------------------

View solution in original post

3 Replies
Highlighted
Xilinx Employee
Xilinx Employee
443 Views
Registered: ‎10-11-2011

I think there are two possible flows here.

You can have the FSBL load all the authenticated partititons (u-boot and Linux) and then handoff to u-boot which will be handing-off to Linux.

OR

You can have the FSBL, authenticating and handing off to u-boot and then u-boot authenticating and hadnding off to Linux.

In both cases you need to "trust" your DDR because both u-boot and Linux are "external" to zynq-7000 and therefore exposed to attacks.

-------------------------------------------------------------------------
Don’t forget to reply, kudo, and accept as solution.
-------------------------------------------------------------------------

View solution in original post

Highlighted
Observer
Observer
400 Views
Registered: ‎10-24-2019

Do you know if U-Boot also utilizes the built in AES/HMAC engine to decrypt/authenticate? Or is this done in Software?

0 Kudos
Highlighted
Observer
Observer
371 Views
Registered: ‎10-24-2019

What are the reasons why I should choose one or the other variant? I see the difference in the process flow, but I don't see any differences in security or performance. Is it possible that the code for the FSBL might become too big for the OCM?

0 Kudos