Security Manuals

Scarthgap

Table of Contents

• 1. Introduction
• 2. SECURIphy Overview
  • 2.1. Short Crypto Refresher
  • 2.2. Recommended Security Requirements
• 3. Enable SECURIphy
  • 3.1. Distro securiphy and securiphy-vendor
  • 3.2. Distro securiphy-provisioning and securiphy-vendor-provisioning
  • 3.3. The different machines for TI K3 controller
  • 3.4. Enable SECURIphy Features in your own Distro
• 4. Secure Boot
  • 4.1. Chain of Trust
  • 4.2. Boot Process
  • 4.3. Image Signing
  • 4.4. Flattened Image Tree (FIT)
  • 4.5. Configuration Class for Signing images
  • 4.6. Building a signed image
• 5. Activate Secure Boot on the Device
  • 5.1. eMMC Boot Partition to Enable Boot
  • 5.2. Activate Secure Boot for NXP SOC
  • 5.3. Activate Secure Boot for TI K3 SOC
  • 5.4. Next Steps after Activation of Secure Boot
  • 5.5. Key Revocation
• 6. Kernel Module Signing
  • 6.1. Enable kernel module signing facility
• 7. Device Tree Overlay and Secure Boot
  • 7.1. Device Tree Overlay for i.MX6UL and i.MX6
  • 7.2. Device Tree Overlay for the other NXP source
• 8. Secure Key Storage
  • 8.1. NXP i.MX CAAM
  • 8.2. Trusted Execution Environment: OP-TEE
  • 8.3. Trusted Platform Module (TPM) 2.0
  • 8.4. Kernel Key Retention Service for filesystem Encryption
  • 8.5. Cryptographic Token Interface PKCS#11
• 9. Secure Storage
  • 9.1. Filesystem with Integrity vs Authenticated filesystem
  • 9.2. Requirements for Filesystem Encryption
  • 9.3. Boot Process Flow
  • 9.4. Starting the Build Process
  • 9.5. Setup Secure Storage on your Device
• 10. Hardening of the System
• 11. Physical security
  • 11.1. Secure JTAG
  • 11.2. Disable Serial Downloader
  • 11.3. Force Internal Boot
  • 11.4. Disable Boot from External Memory
• 12. Keys and Certificates Management
  • 12.1. Public Key Infrastructure Tree (PKI tree)
  • 12.2. PHYTEC Development Keys (phytec-dev-ca)
  • 12.3. Create Your Own PKI Tree
  • 12.4. Create NXP AHAB / HABV4 Keys
  • 12.5. Create TI K3 keys
  • 12.6. Create Kernel FIT-Image key
  • 12.7. Create Kernel Module Signing key
  • 12.8. Create rauc update certificates
• 13. Security Vulnerabilities
  • 13.1. CycloneDX SBOM
• 14. SoC specific configuration tools
  • 14.1. NXP UUU (Universal Update Utility) -Tool
  • 14.2. Snagboot recover and reflashing tool
  • 14.3. partup - the system initialization program
  • 14.4. NXP i.MX6 and i.MX8M MNP eFuse tool crucible
  • 14.5. NXP i.MX9 EdgeLock Enclave (ELE) tools
  • 14.6. TPM Infineon Firmware Update Tool

Kirkstone

Table of Contents

• 1. Introduction
• 2. SECURIphy Overview
  • 2.1. Short Crypto Refresher
  • 2.2. Recommended Security Requirements
• 3. Enable Security
  • 3.1. Distro ampliphy-secure and ampliphy-vendor-secure
  • 3.2. Distro ampliphy-provisioning and ampliphy-vendor-provisioning
  • 3.3. The different machines for TI K3 controller
  • 3.4. Enable Security Features in your own Distro
• 4. Secure Boot
  • 4.1. Chain of Trust
  • 4.2. Boot Process
  • 4.3. Image Signing
  • 4.4. Flattened Image Tree (FIT)
  • 4.5. Configuration Class for Signing images
  • 4.6. Building a signed image
• 5. Activate Secure Boot on the Device
  • 5.1. eMMC Boot Partition to Enable Boot
  • 5.2. Activate Secure Boot for NXP SOC
  • 5.3. Activate Secure Boot for TI K3 SOC
  • 5.4. Next Steps after Activation of Secure Boot
  • 5.5. Key Revocation
• 6. Kernel Module Signing
  • 6.1. Enable kernel module signing facility
• 7. Device Tree Overlay and Secure Boot
  • 7.1. Device Tree Overlay for i.MX6UL and i.MX6
  • 7.2. Device Tree Overlay for the other NXP source
• 8. Secure Key Storage
  • 8.1. NXP i.MX CAAM
  • 8.2. Trusted Execution Environment: OP-TEE
  • 8.3. Trusted Platform Module (TPM) 2.0
  • 8.4. Kernel Key Retention Service for filesystem Encryption
  • 8.5. Cryptographic Token Interface PKCS#11
• 9. Secure Storage
  • 9.1. Filesystem with Integrity vs Authenticated filesystem
  • 9.2. Requirements for Filesystem Encryption
  • 9.3. Boot Process Flow
  • 9.4. Starting the Build Process
  • 9.5. Setup Secure Storage on your Device
• 10. Hardening of the System
• 11. Physical security
  • 11.1. Secure JTAG
  • 11.2. Disable Serial Downloader
  • 11.3. Force Internal Boot
  • 11.4. Disable Boot from External Memory
• 12. Keys and Certificates Management
  • 12.1. Public Key Infrastructure Tree (PKI tree)
  • 12.2. PHYTEC Development Keys (phytec-dev-ca)
  • 12.3. Create Your Own PKI Tree
  • 12.4. Create NXP AHAB / HABV4 Keys
  • 12.5. Create TI K3 keys
  • 12.6. Create Kernel FIT-Image key
  • 12.7. Create Kernel Module Signing key
  • 12.8. Create rauc update certificates