SWCU195A December 2024 – May 2025 CC2744R7-Q1 , CC2745P10-Q1 , CC2745R10-Q1 , CC2745R7-Q1 , CC2755R10
Secure Boot supports the following three authentication methods:
No Authentication
To configure this option, set scfg.secBootCfg.policyCfg.authMethod = SCFG_POLICY_NO_AUTH
Note that under this option, Secure Boot is disabled, so no image verification occurs. Refer to the Execution Flow diagram above, in which System ROM transfers control to the specified address in CCFG instead. Refer to the CCFG configuration chapter for additional details.
Signature
To configure this option, set scfg.secBootCfg.policyCfg.authMethod = SCFG_POLICY_SIGNATURE
In this mode, Secure Boot will perform signature verification of the target image (Application or Secondary Secure Bootloader, depending on the request specified when invoking HapiSbSetId()) each time the device boots.
Hash Lock
To configure this option, set scfg.secBootCfg.policyCfg.authMethod = SCFG_POLICY_HASH_LOCK
In this mode, Secure Boot will perform signature verification only once when the target image is to be executed for the first time, and store a SHA256 hash of the entire target image in the VLOG region. Refer to the Antirollback section for more details.
In subsequent device boots, Secure Boot will compute a SHA256 hash of the target image and compare it with the stored SHA256 hash in the VLOG region. If there is a match between the hashes, Secure Boot will allow the target image to be booted.
The advantage of this option is that System ROM will transfer control to the target image in less time than in Signature mode, as performing a SHA256 hash is significantly faster than performing a signature verification operation.