# This configuration file is for the offline secure boot content certificate generation tool # cert_sb_content_util.py (Content Certificate Generation Tool - CCGT). # # The available parameters in this configuration file are the following # • [KEY-CFG] : Mandatory header. # The internal non-configurable header. # • cert-keypair : Mandatory parameter. # The file holding the RSA keypair for signing this certificate, in PEM format. # • cert-keypair-pwd : Optional. If omitted the tool prompts for direct input. # The passphrase file for the keypair file, in .txt format. # • load-verify-scheme : Mandatory parameter. # The SW image verification scheme. Supported schemes are: # - 0 : Load and verify from flash to memory. # - 1 : Full hash verification in Flash, with no loading to memory. # - 2 : Verify in memory. # - 3 : Load from flash. # Note: Option 3 is not recommended and is not allowed in Secure LCS. # • crypto-type : Mandatory parameter. # The cryptographic verification and decryption mode: # - 0 : Both AES and hash are calculated on the plain image. # - 1 : AES is calculated on the plain image, and the hash is calculated on the encrypted image. # Note: We recommend that you use the first mode. # • aes-ce-id : Mandatory parameter. # The ID of the key used for encryption, matching the entity that signed the certificate chain: # - 0 : None. # - 1 : Kceicv (ICV). # - 2 : Kce (OEM). # • aes-enc-key : Optional. Can be omitted if no encryption is needed. # The text file containing the encryption key for the authenticated SW images: Kce or Kceicv. # The contents of this file are comma-separated hex Bytes ("0x12,0x34 …") ending with "." # • images-table : Mandatory parameter. # The text file containing the list of SW image files to be processed. Each line refers to a single image, # with the following parameters: <32b mem load addr> <32b flash store addr> <32b image max size> # # Notes: # - If using loading scheme option 1, the memory address is 0xffffffff (nonexisting address). # - If using loading scheme option 2, the storage address is 0xffffffff (non-existing address). # - If encryption is used, an output file named _enc.bin is created for each encrypted image. # • nvcounter-val : Mandatory parameter. # The NV counter value: # - 0..64 : The ICV counter. # - 0..96 : The OEM counter. # - 0..160 : The full counter, if OEM and ICV are a single entity. # • cert-pkg : Mandatory parameter. # The content certificate package in binary format. [CNT-CFG] cert-keypair = key/OEMSBContent.pem cert-keypair-pwd = key/oem_keys_pass.pwd load-verify-scheme = 1 crypto-type = 0 aes-ce-id = 0 aes-enc-key = key/kce.txt images-table = ../build/images/images.txt nvcounter-val = 0 cert-pkg = ../cert/OEMSBContent.crt