User Manual DA16200 Security Tool UM-WI-025 Abstract This User Manual gives instructions on how to implement and use the Security Tool of DA16200. UM-WI-025 DA16200 Security Tool Contents Abstract ................................................................................................................................................ 1 Contents ............................................................................................................................................... 2 Figures .................................................................................................................................................. 4 Tables ................................................................................................................................................... 5 Terms and Definitions ......................................................................................................................... 5 References ........................................................................................................................................... 5 1 DA16200 Security .......................................................................................................................... 6 1.1 Security Engine ..................................................................................................................... 6 1.2 H/W Components .................................................................................................................. 6 1.3 S/W Architecture ................................................................................................................... 7 2 Security Features .......................................................................................................................... 8 2.1 Security Services .................................................................................................................. 8 2.1.1 Secure Boot ........................................................................................................... 8 2.1.2 Secure Debug ........................................................................................................ 8 2.1.3 Secure Asset ......................................................................................................... 8 2.2 Secret Keys ........................................................................................................................... 8 2.2.1 HUK (Device Key) .................................................................................................. 8 2.2.2 Platform Key (Krtl) ................................................................................................. 8 2.2.3 Chip Master (CM) Keys ......................................................................................... 9 2.2.4 Device Master (DM) Key........................................................................................ 9 2.3 RoT ........................................................................................................................................ 9 2.4 OTP Memory ....................................................................................................................... 10 2.5 Life Cycle States (LCS) ....................................................................................................... 12 2.5.1 CM LCS ............................................................................................................... 12 2.5.2 DM LCS ............................................................................................................... 12 2.5.3 Secure LCS ......................................................................................................... 13 2.5.4 RMA LCS ............................................................................................................. 13 2.6 Boot Services ...................................................................................................................... 14 2.6.1 Secure Boot ......................................................................................................... 14 2.6.2 Secure Boot Flow ................................................................................................ 15 2.6.3 Secure Debug ...................................................................................................... 19 2.7 Device Provisioning ............................................................................................................. 21 2.8 Secure Asset ....................................................................................................................... 21 2.8.1 API for Secure Assets .......................................................................................... 21 2.8.2 Secure Storage .................................................................................................... 23 2.8.3 Secure NVRAM ................................................................................................... 27 3 Security Tool ................................................................................................................................ 30 3.1 Role Selection ..................................................................................................................... 31 3.2 Secure Production ................................................................................................................... 33 3.2 Key Renewal ....................................................................................................................... 36 3.3 Secure Boot ........................................................................................................................ 37 User Manual Revision 1.6 15-May-2020 2 of 44 © 2020 Dialog Semiconductor UM-WI-025 DA16200 Security Tool 3.4 Secure Debug ..................................................................................................................... 38 3.5 Secure RMA ........................................................................................................................ 39 3.6 Remove Secrets .................................................................................................................. 40 Revision History ................................................................................................................................ 43 User Manual Revision 1.6 15-May-2020 3 of 44 © 2020 Dialog Semiconductor UM-WI-025 DA16200 Security Tool Figures Figure 1: Block Diagram of DA16200 Security Engine ......................................................................... 6 Figure 2: DA16200 Security SW Architecture ....................................................................................... 7 Figure 3: Life Cycle States (LCS) Transitions ..................................................................................... 12 Figure 4: General Structure of a Certification ...................................................................................... 14 Figure 5: The 3-Certificates Chain ...................................................................................................... 15 Figure 6: Secure Boot Flow ................................................................................................................. 15 Figure 7: Overall Certificate-Verification Process................................................................................ 16 Figure 8: Certification Contents in SW Images ................................................................................... 17 Figure 9: Certification Contents in DA16200 ....................................................................................... 18 Figure 10: Three-Level SD Certificate Scheme................................................................................... 19 Figure 11: The Encryption Process of Secure Asset .......................................................................... 22 Figure 12: Top Window of the Security Tool ....................................................................................... 30 Figure 13: Secure Boot and Secure Debug Menus ............................................................................ 32 Figure 14: Request the Soc-ID in Secure Debug ................................................................................ 32 Figure 15: Prevent Accidental Removal of Secret Keys in Secure Production ................................... 34 Figure 16: Warning to Prevent Accidental Removal Secret Keys in Key Renewal ............................. 36 Figure 17: Debug Certificate of Secure Debug Menu ......................................................................... 37 Figure 18: Window to Enter SoC ID in Secure Debug ........................................................................ 38 Figure 19: Window to Enter SoC ID in RMA ....................................................................................... 39 Figure 20: Warning to Prevent Unwanted Removal of Secret Keys in Secure RMA .......................... 41 Figure 21: Remove Secret Keys in Secure RMA ................................................................................ 41 User Manual Revision 1.6 15-May-2020 4 of 44 © 2020 Dialog Semiconductor UM-WI-025 DA16200 Security Tool Tables Table 1: Configuration Data & Key in OTP Memory ........................................................................... 10 Table 2: CM-Programmed Flags ........................................................................................................