The Chain of Trust of CC35xx to enable
trusted bootloader vendor activities (setup the system for trusted application
execution, vendor IP programming and system initial secured working point setup) is
established as follows:
- TI’s 1st stage boot (BL1) – immutable ROM by TI contains public keys to
authenticate:
- TI’s 2nd stage Bootloader – signed by TI and authenticated by dedicated
TI immutable public key o TI’s Connectivity Radio Testing public key –
signed by TI and authenticated by dedicated TI immutable public key
- TI’s 2nd stage boot (BL2) – updatable boot validates vendor public keys against
a production line installed ROT and uses them to authenticate:
- Vendor image: BL2 matches OTP containing the hash of the vendor public
key (as the vendor ROT installed during production line activation) with
the hash of the public key provided with the vendor image on flash.
- Unique per-device authenticated debug actions (optional): For secured
debug purposes, the vendor needs to provide BL2 with a signed debug
request (unique per device ) through the Debug I/F. BL2 matches OTP
containing the hash of the vendor public key installed during activation
with the hash of the public key provided with an authenticated debug
request provided by the vendor over the debug I/F. If this validation
matches and signature authentication of the request passes successfully,
TI bootloader will ensure the debug interface of the device will be open
for the vendor. Alternatively, BL2 also supports a separate debug public
key, such that BL2 matches OTP containing the hash of the vendor debug
public key with the hash of the public key provided with an
authenticated debug request provided by the vendor over a debug I/F.
Note: For development purposes, signature authentication can be
bypassed through special OTP programming. It is not recommended to deploy such
devices.