Doc ID024209 Rev 2

9/30

AN4240

Secure Boot procedure

3

Secure Boot procedure

The CSE module allows authentication boot code in flash. This sentence is misunderstood

because the CSE is not intended to be used to encrypt the code flash content.

The Secure Boot procedure starts when the System Status and Configuration Module

(SSCM) releases a SECURE_BOOT command. After that the CSE module downloads from

the internal secure flash the firmware and the valid keys.

Note:

The device must be previously configured with valid cryptographic keys in order to issue a

Secure Boot.

The sequence to authenticate Boot Code is as follows:

1) program the code flash with the boot code.

This implies that the boot code includes the start address and length parameters at address

RCHW+4 and RCHW+8 as shown in Table 1:

In this case the boot code starts at 0x10 and CSE authenticates 4 KB of code.

2) Program valid cryptographic keys (BOOT_MAC_KEY) into secure flash

3) Reset the device twice; the first time CSE calculates the BOOT_MAC over the indentified

boot code and stores this value in the secure flash, the second time CSE compares the

BOOT_MAC with the previous one stored in the secure flash. If they match then CSE sets

Secure Boot OK bit (CSE.SR[BOK]=1).

After this procedure, keys marked as Boot Protected are used by application code. On

subsequent booting, provided BOOT_MAC_KEY and the code flash are not erased, CSE

calculates a MAC over the identified boot code. If the output value matches the value stored

in secure flash (BOOT_MAC).

Figure 5. represents this process.

Table 1. Secure boot example structure to add at the start of boot sectorr

Address

Content

Comment

0x0

0x015A

Reset Configuration Half Word

0x4

0x10

Start Address for BOOT_MAC calculation

0x8

0x1000

Length of code to be authenticated in bytes (4KB)

0xC

–

Skipped for 64bit boundary

0x10

Code starts here

First address of code