docs/design/trusted-board-boot.rst

11 Arm DEN0006D. It should be used in conjunction with the :ref:`Firmware Update
18 are used to establish trust in the next layer of components, and so on, in a
23 -  The set of firmware images in use on this platform.
43    the ``HASH_ALG`` build option, with sha256 as default) is stored in the
48 -  The BL1 image, on the assumption that it resides in ROM so cannot be
51 The remaining components in the CoT are either certificates or boot loader
69 extension fields in the `X.509 v3`_ certificates.
71 The next sections now present specificities of each default CoT provided in
82 is involved in signing every BL3x Key Certificate.
94    secure world images (SCP_BL2, BL31 and BL32). The public part is stored in
95    one of the extension fields in the trusted key certificate.
100    non-secure world image (BL33). The public part is stored in one of the
101    extension fields in the trusted key certificate.
107    in one of the extension fields in the corresponding key certificate.
109 The following images are included in the CoT:
264 BL1 and BL2 code, and in tool code on the host build machine. The feature is
265 enabled through use of specific build flags as described in
268 On the host machine, a tool generates the certificates, which are included in
269 the FIP along with the boot loader images. These certificates are loaded in
271 Authentication module included in TF-A.
274 described in the following sections.
279 The authentication framework included in TF-A provides support to implement
281 implement the boot requirements specified in the
284 More information about the authentication framework can be found in the
292 and keys as inputs and generates the certificates (in DER format) required to
293 establish the CoT. The input keys must either be a file in PEM format or a
294 PKCS11 URI in case a HSM is used. New keys can be generated by the tool in
298 The certificates are also stored individually in the output build directory.
300 The tool resides in the ``tools/cert_create`` directory. It uses the OpenSSL SSL
302 library that is required is given in the :ref:`Prerequisites` document.
310 The authenticated encryption framework included in TF-A provides support to
313 R060_TBBR_FUNCTION as specified in the `Trusted Board Boot Requirements (TBBR)`_
324 The encrypted firmwares are also stored individually in the output build
327 The tool resides in the ``tools/encrypt_fw`` directory. It uses OpenSSL SSL
329 Instructions for building and using the tool can be found in the