Castles Technology Co., Ltd.
Confidential • All Right Reserved.
Pg.
37
generated by the manufacturer as “unsigned kernel CAP(s)” and call the
kernel CAP files “signed” by the user later as “signed kennel CAP(s)”.
Notes:
1. The kernel modules are encrypted by a random-generated 3DES key,
which is retrieved from the Key Encryption Block of the CAP by ULD
Manufacturer Key Encryption Key, not directly encrypted by ULD RSA
Key.
2.
The “sign” action via ULD User Keys actually is done by” the second
encryption”. “The second encryption” is done by using the random-
generated 3DES key, which is encrypted by ULD User Key Encryption
Key, to perform Triple DES encryption again on the cipher data segment
of the kernel CAP files. This ensures that the system cannot retrieve the
correct data from the kernel CAPs without the user permission.
CAP Generator
ULD Manufacturer
Keys
Kernel Module
Unsigned Kernel
CAPs
CAP Signing Tool
ULD User Keys
Unsigned Kernel
CAPs
Signed Kernel CAPs
