Repository navigation
feat(linux): Add ECDSA Signing Guide for k3 devices #802
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| .. _u-boot-ecdsa-signing: | ||
|
|
||
| ############################################# | ||
| ECDSA signing for K3 devices | ||
|
Check warning on line 4 in source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst
|
||
| ############################################# | ||
|
|
||
| The SDK signs boot images with an RSA key by default. This page only lists what changes to use an ECDSA key instead on K3 devices (AM62, AM64, AM65, J721E, J722S, J784S4, etc.). For the full signing procedure, follow the original guides linked in each section. | ||
|
Check warning on line 7 in source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst
|
||
|
|
||
| Any ECDSA curve supported by OpenSSL can be used (for example secp256r1, secp384r1, secp521r1). P-384 (secp384r1) is recommended. The FIT signature algorithm is ``sha512,ecdsa`` regardless of the curve. | ||
|
Check warning on line 9 in source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst
|
||
|
|
||
| .. _ecdsa-key-gen: | ||
|
|
||
| ************************** | ||
| Generate ECDSA keys | ||
|
Check warning on line 14 in source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst
|
||
| ************************** | ||
|
|
||
| Generate the key and certificate with the same names the RSA setup already uses, so nothing else needs renaming: | ||
|
|
||
| .. code-block:: console | ||
|
|
||
| openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out custMpk.key | ||
| openssl req -new -x509 -key custMpk.key -out custMpk.crt -days 3650 -subj "/CN=Custom ECDSA Key" | ||
|
|
||
| Use ``openssl ecparam -list_curves`` to see the other curves available. | ||
|
|
||
| .. _ecdsa-boot-images: | ||
|
|
||
| *************************** | ||
| Sign boot images | ||
| *************************** | ||
|
|
||
| For tiboot3.bin, tispl.bin and u-boot.img, binman picks the key from ``arch/arm/mach-k3/keys/``. Replace the existing RSA files with your ECDSA ones: | ||
|
|
||
| .. code-block:: console | ||
|
|
||
| cp custMpk.key arch/arm/mach-k3/keys/custMpk.pem | ||
| cp custMpk.crt arch/arm/mach-k3/keys/custMpk.crt | ||
|
|
||
| No devicetree or config changes are needed. Build as described in :ref:`top-level-makefile`. | ||
|
|
||
| .. _ecdsa-kernel-fitimage: | ||
|
|
||
| *************************** | ||
| Sign kernel fitImage | ||
| *************************** | ||
|
|
||
| Follow the `U-Boot K3 FIT signature signing guide <https://docs.u-boot.org/en/v2026.04/board/ti/k3.html#fit-signature-signing>`__, with these differences: | ||
|
|
||
| #. Change the algorithm in the ``signature-1`` node of your ``fitImage.its``. Keep ``key-name-hint = "custMpk"``: | ||
|
|
||
| .. code-block:: dts | ||
|
|
||
| signature-1 { | ||
| algo = "sha512,ecdsa"; | ||
| key-name-hint = "custMpk"; | ||
| sign-images = "kernel", "fdt"; | ||
| }; | ||
|
|
||
| #. Put your ECDSA ``custMpk.key`` and ``custMpk.crt`` in the keys directory you pass to ``mkimage -k``. | ||
|
|
||
| #. Rebuild U-Boot after generating the fitImage, so the updated ``dt.dtb`` with the public key is packed into u-boot.img. | ||
|
|
||
| Check the result with ``mkimage -l fitImage``; the signature section should show ``sha512,ecdsa``. | ||
|
|
||
| .. ifconfig:: CONFIG_part_family in ('AM62LX_family') | ||
|
|
||
| .. _ecdsa-uboot-fit: | ||
|
|
||
| .. rubric:: Sign U-Boot FIT | ||
|
|
||
| On AM62Lx, u-boot.img is a signed FIT image. Change the algorithm on the FIT configuration node in the board ``*-binman.dtsi``. Keep ``key-name-hint = "custMpk"``: | ||
|
|
||
| .. code-block:: dts | ||
|
|
||
| signature { | ||
| algo = "sha512,ecdsa"; | ||
| key-name-hint = "custMpk"; | ||
| sign-images = "firmware", "loadables", "fdt"; | ||
| }; | ||
|
|
||
| Replace ``custMpk.key``, ``custMpk.pem`` and ``custMpk.crt`` in ``arch/arm/mach-k3/keys/`` with your ECDSA key and certificate, then rebuild U-Boot. Check the result with ``mkimage -l u-boot.img``. | ||
|
|
||
| .. _ecdsa-see-also: | ||
|
|
||
| ******** | ||
| See also | ||
| ******** | ||
|
|
||
| - :ref:`foundational-secure-boot` - complete secure boot documentation | ||
| - :ref:`top-level-makefile` - top-level build instructions | ||
| - `FIT signature signing - U-Boot K3 documentation <https://docs.u-boot.org/en/v2026.04/board/ti/k3.html#fit-signature-signing>`__ | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.