]> git.baikalelectronics.ru Git - uboot.git/commit
common: SCP03 control (enable and provision of keys)
authorJorge Ramirez-Ortiz <jorge@foundries.io>
Sun, 14 Feb 2021 15:27:23 +0000 (16:27 +0100)
committerTom Rini <trini@konsulko.com>
Sat, 13 Mar 2021 18:14:52 +0000 (13:14 -0500)
commit743a4e7604e2f0fe165e68b231e55dc136f0e592
tree5c65dcc0a679d5f82e7bb274d0f45ce4b70809f3
parentb61255c69ba6059de823cba26b5184f373ee6129
common: SCP03 control (enable and provision of keys)

This Trusted Application allows enabling SCP03 as well as provisioning
the keys on TEE controlled secure element (ie, NXP SE050).

All the information flowing on buses (ie I2C) between the processor
and the secure element must be encrypted. Secure elements are
pre-provisioned with a set of keys known to the user so that the
secure channel protocol (encryption) can be enforced on the first
boot. This situation is however unsafe since the keys are publically
available.

For example, in the case of the NXP SE050, these keys would be
available in the OP-TEE source tree [2] and of course in the
documentation corresponding to the part.

To address that, users are required to rotate/provision those keys
(ie, generate new keys and write them in the secure element's
persistent memory).

For information on SCP03, check the Global Platform HomePage and
google for that term [1]
[1] globalplatform.org
[2] https://github.com/OP-TEE/optee_os/
    check:
    core/drivers/crypto/se050/adaptors/utils/scp_config.c

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Simon Glass <sjg@chromium.org>
common/Kconfig
common/Makefile
common/scp03.c [new file with mode: 0644]
include/scp03.h [new file with mode: 0644]
include/tee/optee_ta_scp03.h [new file with mode: 0644]