Re: Secure Data Encryption on board without TPM support ( AM62P)

[Ayush Gupta <a-gupta4@ti.com>]

On 6/3/25 07:16, Jan Kiszka wrote:
> Hi Ayush,
>
> On 02.06.25 20:03, Gupta, Ayush wrote:
>> Dear CIP Development Team,
>>
>> I am currently working on enabling encrypted storage for the TI’s AM62P
>> platform, which, as per current hardware capabilities, does not include
>> TPM support.
>>
>> To address this, I have implemented a working initramfs-crypt-hook-
>> nontpm (link provided at the end)  solution that removes TPM
>> dependencies. It utilizes a keyfile embedded directly into the initramfs
>> for unlocking encrypted partitions during boot. The initramfs itself is
>> considered secure as it is protected by verified boot (Secure Boot is
>> enabled on the platform).

> That should be integrity protected but no longer secret, no? Physical
> attackers should then be able to retrieve the initramfs from the device
> and, thus, also read out the data encryption key. From there on...

You are absolutely right- the keyfile can be extracted by a physical 
attackers as it is not encrypted.
We should find a more secure key. Thanks for highlighting the issue.

>
>> I would like to know if this is an acceptable and secure approach from
>> the CIP security perspective for boards without TPM support.
>> Additionally, are there any recommended alternatives or best practices
>> for strengthening this method in scenarios where TPM support is not
>> available?
>>
>> Looking forward to your guidance.
>>

> Did you already study how we are exploiting fTPM on the AM65x?
> https://github.com/siemens/meta-iot2050/
>
> Jan
>
Not explored this fully - but will check this out also. Me and the team 
are also trying something more on that.
We will reach out to you if we need any further clarifications.

Again thanks for suggesting this repo!

Ayush