For secure devices, the process is
illustrated in Figure 5-5, and includes the following steps:
- Create X.509 certificate (1a).
- Populate certificate extension fields: write image load address and
value of the Magic Number from the unencrypted image (1b).
- Populate image SW version (1c).
- Encrypt (AES-256-CBC) binary image using derived 256-bit Symmetric Key
(2).
- Compute hash (SHA-512) of encrypted image (3a), and write the digest
value to the certificate (3b).
- Public key is written into the certificate. This can be RSA based
public key information.
- Whole certificate is hashed (SHA-512) (4a), encrypted with private
key (4b) using RSA and signature is inserted back into certificate (4c).
Note: When creating a binary image for an HS-FS
device, only step 1 is required. Optionally, binary image hashing (step 5) can be performed
to verify image integrity.
TI provides reference scripts and tools for certificate
generation and boot image creation in the HSM/Security software package provided through
TI Secure
Resources.
ROM bootloader
supports only RSA4K, SHA512 and AES-CBC-256.