From 0df464e91350670491641a4b9e7c389de5d0f305 Mon Sep 17 00:00:00 2001 From: Atharv Dubey Date: Tue, 29 Sep 2026 14:52:21 +0530 Subject: [PATCH] feat(linux): Add ECDSA Signing Guide for k3 devices Add a new page in the U-Boot user guide documenting how to switch K3 boot images from RSA to ECDSA signing. This covers the standalone ti-u-boot build flow placing the ECDSA Key in the appropiate folders and lists the steps to enable signing for boot images & fit sigining. Signed-off-by: Atharv Dubey --- .../U-Boot/UG-ECDSA-Signing.rst | 91 +++++++++++++++++++ .../U-Boot/Users-Guide.rst | 1 + 2 files changed, 92 insertions(+) create mode 100644 source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst diff --git a/source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst b/source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst new file mode 100644 index 000000000..7b640432c --- /dev/null +++ b/source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst @@ -0,0 +1,91 @@ +.. _u-boot-ecdsa-signing: + +############################################# +ECDSA signing for K3 devices +############################################# + +The SDK signs boot images with an RSA key by default. This page only lists what changes to use an ECDSA key instead on K3 devices (AM62, AM64, AM65, J721E, J722S, J784S4, etc.). For the full signing procedure, follow the original guides linked in each section. + +Any ECDSA curve supported by OpenSSL can be used (for example secp256r1, secp384r1, secp521r1). P-384 (secp384r1) is recommended. The FIT signature algorithm is ``sha512,ecdsa`` regardless of the curve. + +.. _ecdsa-key-gen: + +************************** +Generate ECDSA keys +************************** + +Generate the key and certificate with the same names the RSA setup already uses, so nothing else needs renaming: + +.. code-block:: console + + openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out custMpk.key + openssl req -new -x509 -key custMpk.key -out custMpk.crt -days 3650 -subj "/CN=Custom ECDSA Key" + +Use ``openssl ecparam -list_curves`` to see the other curves available. + +.. _ecdsa-boot-images: + +*************************** +Sign boot images +*************************** + +For tiboot3.bin, tispl.bin and u-boot.img, binman picks the key from ``arch/arm/mach-k3/keys/``. Replace the existing RSA files with your ECDSA ones: + +.. code-block:: console + + cp custMpk.key arch/arm/mach-k3/keys/custMpk.pem + cp custMpk.crt arch/arm/mach-k3/keys/custMpk.crt + +No devicetree or config changes are needed. Build as described in :ref:`top-level-makefile`. + +.. _ecdsa-kernel-fitimage: + +*************************** +Sign kernel fitImage +*************************** + +Follow the `U-Boot K3 FIT signature signing guide `__, with these differences: + +#. Change the algorithm in the ``signature-1`` node of your ``fitImage.its``. Keep ``key-name-hint = "custMpk"``: + + .. code-block:: dts + + signature-1 { + algo = "sha512,ecdsa"; + key-name-hint = "custMpk"; + sign-images = "kernel", "fdt"; + }; + +#. Put your ECDSA ``custMpk.key`` and ``custMpk.crt`` in the keys directory you pass to ``mkimage -k``. + +#. Rebuild U-Boot after generating the fitImage, so the updated ``dt.dtb`` with the public key is packed into u-boot.img. + +Check the result with ``mkimage -l fitImage``; the signature section should show ``sha512,ecdsa``. + +.. _ecdsa-uboot-fit: + +******************************** +Sign U-Boot FIT +******************************** + +When u-boot.img is a signed FIT image, change the algorithm on the FIT configuration node in your board's ``*-binman.dtsi``. Keep ``key-name-hint = "custMpk"``: + +.. code-block:: dts + + signature { + algo = "sha512,ecdsa"; + key-name-hint = "custMpk"; + sign-images = "firmware", "loadables", "fdt"; + }; + +Replace ``custMpk.key``, ``custMpk.pem`` and ``custMpk.crt`` in ``arch/arm/mach-k3/keys/`` with your ECDSA key and certificate, then rebuild U-Boot. Check the result with ``mkimage -l u-boot.img``. + +.. _ecdsa-see-also: + +******** +See also +******** + +- :ref:`foundational-secure-boot` - complete secure boot documentation +- :ref:`top-level-makefile` - top-level build instructions +- `FIT signature signing - U-Boot K3 documentation `__ diff --git a/source/linux/Foundational_Components/U-Boot/Users-Guide.rst b/source/linux/Foundational_Components/U-Boot/Users-Guide.rst index 7f073245a..3f465fb83 100644 --- a/source/linux/Foundational_Components/U-Boot/Users-Guide.rst +++ b/source/linux/Foundational_Components/U-Boot/Users-Guide.rst @@ -32,6 +32,7 @@ User's Guide UG-Thermal UG-Splash-Screen UG-Secure-Boot + UG-ECDSA-Signing UG-Keywriter-Lite UG-Keywriter UG-Programming-OTPs