Message Verification in System Configuration Area
SCA is in the first two sectors (8 KB in total; address: 0x0020_0000 to 0x0020_2000; the address for GR551x is 0x0100_0000 to 0x0100_2000) of Flash memory. It stores flags and other system configuration parameters used during system boot.
This chapter introduces the process for verifying HMAC in the SCA of GR5xx SoCs.
For details about SCA, refer to the developer guide of the specific GR5xx SoC.
HMAC Verification Process
When SCA is updated in security mode through GProgrammer or other tools, HMAC in SCA will be updated synchronously. In secure boot, GR5xx SoC first verifies HMAC in SCA. The system will proceed with the secure boot process (decryption and signature verification) if verification succeeds; otherwise, the system will enter DFU mode.
An HMAC verification process is shown in Figure 2.
To perform HMAC verification,
- Read SCA data (encrypted data).
- Start HMAC calculation (HMAC-SHA256) on the SCA data (expect the HMAC data of the SCA) with HMAC keys in eFuse.
- Compare the calculation result with the HMAC data of the SCA. If the two are the same, the verification succeeds.
