UM10503
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2012. All rights reserved.
User manual
Rev. 1.3 — 6 July 2012
38 of 1269
NXP Semiconductors
UM10503
Chapter 5: LPC43xx Boot ROM
5.3.2 AES capable parts
AES capable parts will normally always boot from a secure (encrypted) image and use
CMAC authentication. However a special development mode allows booting from a plain
text image. This development mode is active when the AES key has not been
programmed. In this case the AES key consists of all zeros.
Remark:
Once the key is programmed (to a non-zero value) in the OTP, the development
mode is terminated and JTAG access is disabled.
5.3.3 Boot image header format
AES capable products with a programmed AES key will always boot from a secure image
and use CMAC authentication. A secure image should always include a header.
Non-AES capable products may boot from an image with header or execute directly from
the boot source if the boot source is memory mapped (see
). When no valid
header is found then the CPU will try to execute code from the first location of the memory
mapped boot source. The user should take care that this location contains executable
code, otherwise a hard fault exception will occur. This exception jumps to a while(1) loop.
The image must be preceded by a header that has the layout described in
Non-encrypted images may omit the header.
Table 20.
Boot image header use
Boot source
Memory mapped
Header required
USART0
no
yes
SPIFI
yes
no
EMC 8-bit
yes
no
EMC 16-bit
yes
no
EMC 32-bit
yes
no
USB0
no
yes
USB1
no
yes
SPI (SSP)
no
yes
USART3
no
yes
Table 21.
Boot image header description
Address
Name
Description
size [bits]
5:0
AES encryption active
0x25 (100101): AES encryption active
0x1A (011010): AES encryption not active
all other values: invalid image
6
7:6
HASH_ACTIVE
Indicates whether a hash is used:
00: CMAC hash is used, value is
HASH_VALUE
01: reserved
10: reserved
11: no hash is used
2
13:8
RESERVED
11...11 (binary)
6