![NXP Semiconductors LPC43Sxx Скачать руководство пользователя страница 100](http://html1.mh-extra.com/html/nxp-semiconductors/lpc43sxx/lpc43sxx_user-manual_1721827100.webp)
UM10503
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2015. All rights reserved.
User manual
Rev. 2.1 — 10 December 2015
100 of 1441
NXP Semiconductors
UM10503
Chapter 7: LPC43Sxx Boot ROM for secure parts
a. Use a 128-bit key to encrypt the image using Cypher Block Chaining (CBC)
encryption and an initialization vector of 0101010... (binary). After the first block of
data, each following (plain-text) block is XORed with the previous encrypted block
of data. For details, see
.
b. Create a header using
Table 74 “Boot image header description”
with a dummy
hash size. The actual hash size is calculated after encryption of the image and this
header.
c. Encrypt the header using CBC and an initialization vector of 0.
d. Use CMAC to create a hash code and calculate the hash size of the combined
encrypted header and image. See
.
e. Update the header with the calculated hash size.
f. Encrypt header as before using CBC and an initialization vector of 0.
2. On the LPC43Sxx, program the encryption key into the OTP memory bank 1 using the
API function aes_ProgramKey1 (see
).
Remark:
The encryption key itself is scrambled in OTP memory bank 1 for added
security.
3. Select boot mode. See
4. On parts with on-chip flash, JTAG access is not disabled. Therefore, set the
appropriate CRP level in the flash memory to disable JTAG access.
On flashless parts, JTAG access is disabled automatically once the key is
programmed in OTP memory bank 1.
5. Reset the LPC43xx, and the part boots securely from the specified boot source. See
Figure 27 “Boot flow for encrypted images (flashless parts)”
Remark:
To test the secure boot flow, you can create a secure image with a key of all
zeros using the steps above and omitting programming the key into the OTP memory. The
part then boots after reset using the zero-encrypted image.