5.2.2 Customer Key Payload for RSA Authentication Mode

For RSA Authentication mode, the root CA public key SHA 512-bit digest must be provisioned on the device. Based on this digest, the ROM code will check the integrity of the certificate chain appended at the end of the bootstrap or embedded application image. If the root CA public key’s 512-bit hash matches the provisioned hash, the ROM code confirms the certificate chain authenticity and uses the public key of the last certificate in the chain to verify the image’s signature. If not, the ROM code rejects the image.

The Secure SAM-BA® Cipher suite helps compute the public key’s SHA 512-bit hash for a self-signed root CA in DER (Distinguished Encoding Rules) binary format. The resulting digest is signed and ciphered with a ROM code public key.

The customer key payload bundle can be generated using the sam_gen_keypayload.py script.

Note that no license is required to use the tool with SAM9X7 Series devices.

Use the following command:

sam_gen_keypayload.py -l sam9x70_license.txt -pk sam9x70_license_priv_key.pem -k sam9x70_cstm_keys_new_format.yaml -o cstm_keys_msg_new_format.cip

Where sam9x70_cstm_keys_new_format.yaml is the customer key file in yaml format.

chip_type: sam9x70
image_type: secure
security:
  cipher:
    type: AES
    iv_data: data:0123456789abcdef0123456789abcdef
    key_data: data:cafecafecafecafecafecafecafecafecafecafecafecafecafecafecafecafe
  signature:
    type: RSA
    key_data: file:ca/root_ca/private/root_ca.key
    certificates: [ file:ca/RSA2048sha512/ca/root_ca.der ]

For more details, refer to the Secure SAM-BA Cipher documentation. See References.