5.2.1 Customer Key Payload for CMAC Authentication Mode

The customer key payload bundle can be generated using sam_gen_keypayload.py from the Secure SAM-BA® Cipher tool suite.

Note that no license is required to use the tool with SAM9X7 Series devices.

Use the following command:

sam_gen_keypayload.py  --device_pub sam9x70_public_key.pem --config sam9x70_cstm_keys.yaml -o cstm_keys_payload_sam9x70.cip

Where sam9x70_public_key.pem is the SAM9X7 Series ROM code public key shared with the Secure SAM-BA Cipher tool suite, and sam9x70_cstm_keys.yaml is the customer key file in yaml format as follows:

chip_type: sam9x70
image_type: secure
security:
  cipher:
    type: AES
    iv_data: data:0123456789abcdef0123456789abcdef
    key_data: data:cafecafecafecafecafecafecafecafecafecafecafecafecafecafecafecafe
  signature:
    type: CMAC_AES
    key_data: data:00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff

Optionally, the customer key can be converted from the old format to the new format of the secure_sam_ba_cipher.py tool with the convert-key-file command as follows:

secure_sam_ba_cipher.py convert-key-file -d sam9x70 -k sam9x70_cstm_keys.txt -o sam9x70_cstm_keys_new_format.yaml

For more details, refer to the Secure SAM-BA Cipher documentation. See References.