Append appropriate
PASSWORD
(SEC_ZONEx_UNENC_PWD)
to the payload at the end of the
PAYLOAD
Update
firmware or data
(PAYLOAD)
PASSWORD
Update
firmware or data
(PAYLOAD)
Append appropriate PASSWORD
(JTAG_SWD_LOCK_UNENC_PWD,
SEC_ZONEx_UNENC_PWD) to the
payload at the end of the PAYLOAD
Update
firmware or data
(PAYLOAD)
PASSWORD
AES-CBC encryption
for password incorporated data using
AESKEY
(JTAG_SWD_LOCK_AES_SECKEYS,
SEC_ZONEx_AES_SECKEYS)
Special care to be taken to encrypt
password last.
Encrypted
firmware or data
(ENCPAYLOAD)
Update
firmware or data
(PAYLOAD)
Device Security
320
SLAU356I – March 2015 – Revised June 2019
Copyright © 2015–2019, Texas Instruments Incorporated
System Controller A (SYSCTL_A)
The JTAG and SWD Lock parameters: JTAG_SWD_LOCK_AES_INIT_VECT,
JTAG_SWD_LOCK_AES_SECKEYS and JTAG_SWD_LOCK_UNENC_PWD act as master set of
parameters for the device. Hence, they can also be used to perform a data/firmware update to the device
IP protected regions along with the other flash main memory regions of the device.
Figure 5-3. Data Setup for Encrypted Update
5.8.5.4
In-Field Updates: Secure Device With IP Protection Enabled
Firmware or data load to a IP protected secure zone is done by invoking the BSL and then subsequently
by invoking the boot-override mode of the device. The update could be either of the following categories:
1. Unencrypted update
2. Encrypted update
Flexibility is provided to the user to choose between an encrypted update (AES256-CBC enc 128-
bit password authenticated) or unencrypted update (authenticated by a 128-bit password) for a particular
IP protected secure zone. The use of an encrypted or unencrypted update is controlled by the user
securing the IP protected zone at the time of IP protection setup. IP protected secure zones set up with
unencrypted updates can only be updated using unencrypted update. Similarly, IP protected secure zones
setup with encrypted updates can only be updated using the encrypted update.
5.8.5.4.1 Unencrypted Update: IP Protected Device
The unencrypted update of an IP protected secure zone uses a password-based mechanism to ensure
that a valid user is trying to update a secure area. To use this mode:
1. The user appends the 128-bit password to the end of the data to be updated (see
). The
password must be the same as the SEC_ZONEx_UNENC_PWD provided when setting up the IP
Protected secure zone.
Figure 5-4. Data Setup for IP Protected Secure Zone Unencrypted Update