Show Contents

# Sign and encrypt U-Boot images

Once a device is deployed on the field, follow these steps to sign and encrypt a new U-Boot image to boot on the deployed device:

1. Configure the signature process using the following environment variables:
   - CONFIG_SIGN_KEYS_PATH: (Mandatory) The path to the PKI tree. A new PKI tree is generated if an empty path is specified.
   - CONFIG_KEY_INDEX: (Optional) Default value is 0. Index of the key to use for signatures.
   - NO_DCD: (Optional) Remove device configuration data from the signed images. This produces a signed U-Boot image able to boot via USB. See Recover your device.
   - CONFIG_UNLOCK_SRK_REVOKE: (Optional) If defined, the signed U-Boot can revoke keys on a closed device.
   - ENABLE_ENCRYPTION: (Optional) If defined, the signed images are encrypted.
   - CONFIG_DEK_PATH: (Mandatory if ENABLE_ENCRYPTION is defined, otherwise ignored) The path to the data encryption key. If the file does not exist, a random 256-bit file is generated.

> The following example sets up the environment to generate signed U-Boot images with key index 3:

>     export CONFIG_SIGN_KEYS_PATH="/path/to/keys"
>     export CONFIG_KEY_INDEX="3"

>     # In order to encrypt the images, export the following:
>     #export ENABLE_ENCRYPTION="y"
>     #export CONFIG_DEK_PATH="/path/to/keys/dek.bin"

> You can also define these variables in a file .config located in the current path:

>     .config

>     CONFIG_SIGN_KEYS_PATH="/path/to/keys"
>     CONFIG_KEY_INDEX="3"

>     # In order to encrypt the images, also add the following:
>     #export ENABLE_ENCRYPTION="y"
>     #export CONFIG_DEK_PATH="/path/to/keys/dek.bin"

1. Execute the trustfence-sign-uboot.sh script with the input file (U-Boot image to be signed) as the first parameter and the output file (signed and possibly encrypted U-Boot image) as the second parameter:

>     user:~/standalone-sign$ trustfence-sign-uboot.sh u-boot.imx u-boot-signed.imx
>     Using existing PKI tree
>     Signed image ready: u-boot-signed.imx

> The tool will also generate the SRK_efuses.bin file for the PKI tree used.

© 2018 Digi International Inc. All rights reserved.
Sign and encrypt U-Boot images updated on 24 January 2018 10:35:38 AM