5.1 Provisioning Customer Keys

The ROM code Secure Monitor for SAM9X7 Series supports basic commands to provision the device with customer keys. The customer symmetric key and initialization vector, used to encrypt the boot image or embedded application along with the symmetric key if the CMAC authentication mode is selected, or the SHA 512 bits of the root CA public key if the RSA authentication mode is selected, are encrypted using a ROM code secret key. They form the “customer key payload”. This is used as a parameter in the customer key payload command from the ROM code Secure Monitor:

sam-ba -p secure --device sam9x70:0:1 –m write_customer_key_payload:cstm_key_payload_sam9x70.cip

Figure 5-1. Writing the Customer Key Payload

This is all that needs to be done to provision the device.