Embedded Intel Atom® Processors
Technological Conversations about Intel Atom® Hardware, Software, Firmware, Graphics
1187 Discussions

Using Bay Trail TXE for secure key wrapping

FYoun1
New Contributor I
4,757 Views

Hi All,

I am looking for a way to take advantage of the hardware root of trust provided by the TXE to securely store platform keys. In the E3800 datasheet, under Section 22 titled "Intel Trusted Execution Engine (TXE)", "Chip Unique Key encryption key wrapping of other platform keys (Flash)" is listed as a supported feature by the firmware. This is exactly what we need in our application. However, we cannot find any documentation on how to enable this functionality. I'm hoping that someone in this forum will be able to point me to the right direction.

I had originally hoped to get this functionality via Intel PTT and TPM2.0. However, in another thread, Josue helped me discover that the Bay Trail-I E3845 SoC does not actually support PTT over TXE. So I'm back to asking this more fundamental question of just how to enable hardware key wrapping using TXE.

Thanks, Fred Young

0 Kudos
12 Replies
Josue_C_Intel
Employee
2,533 Views

Hi Fred

We are working this case, we will let you know any update as soon as possible.

Regards.

Josue.

0 Kudos
Josue_C_Intel
Employee
2,533 Views

Hi Fred

What is the current TXE firmware version installed on the system?

Regards.

Josue.

0 Kudos
FYoun1
New Contributor I
2,533 Views

Hi Josue,

Regarding the TXE firmware version; we've tried version 1.0.2.1067 from BAY_TRAIL_FSP_KIT_GOLD3.tgz and version 1.1.0.1089 from 543843_BYT_I_DUAL_BOOT_TXE_KIT_GOLD_RELEASE_1.1.0.1089.tar.

 

Fred Young

0 Kudos
Josue_C_Intel
Employee
2,533 Views

Hi Fred

Please check https://software.intel.com/en-us/blogs/2012/09/25/how-to-enable-an-intel-trusted-execution-technology-capable-server How to Enable an Intel® Trusted Execution Technology Capable Server

And make sure to enable TXT Technology in system configuration.

We will upload the Document Number: 515108 Bay Trail T/I Platform, Manufacturing Recommendation for Intel® Trusted Execution Engine (Intel® TXE) Firmware, Guidelines and Recommendations to EDC Library, we will let you know as soon as the file is available.

Best Regards.

Josue.

0 Kudos
FYoun1
New Contributor I
2,533 Views

Hi Josue,

I don't think TXT applies to Bay Trail SoCs. Also, we already have document 515108_ByTti_TXEMfgRecomm_Rev1p2.pdf; that just tells us how to use the manufacturing tools but not about how to accomplish key wrapping.

Thanks, Fred Young

0 Kudos
Josue_C_Intel
Employee
2,533 Views

Hi Fred

We have found Document # 543572 Intel® TXE Slim FW and tools for Intel® Atom™ Processor, E3800 (Bay Trail-I) Product Family.

From section 2.5 Intel® TXE Setting Checker Tool. This tool retrieves and displays information about some of the Intel® TXE settings, the Intel® TXE FW version, and the FW capability on the platform.

From section 6 Intel® TXEInfo. This tool Intel TXEInfo provide a simple test to check whether the Intel® TXE FW is alive or not.

We will let you know as soon as the tool is available in EDC Library.

Regards.

Josue.

0 Kudos
Josue_C_Intel
Employee
2,533 Views

Hi Fred

 

While we're waiting for 543572 to be uploaded you may find document # 527101 helpful .

https://www-ssl.intel.com/content/www/us/en/secure/intelligent-systems/privileged/bay-trail/atom-e3800-m-d-i-soc-linux-txe-firmware-guide.html Intel® Atom™ Processor E3800 Product Family/ Intel® Celeron® Processor N2920/J1900– Linux System Tools for Intel® Trusted Execution Engine Firmware

 

https://www-ssl.intel.com/content/www/us/en/secure/intelligent-systems/privileged/bay-trail/atom-e3800-m-d-i-soc-linux-txe-firmware-guide.html User Guide

Regards.

Josue.

0 Kudos
FYoun1
New Contributor I
2,533 Views

Hi Josue,

We understand that Bay Trail E3845 (Bay Trail I) has a number of Field programmable fuses that can be set by certain tools provided by Intel.

The Intel Trusted Execution Engine Bring-Up Guide, 515108_ByTti_TXEMfgRecomm_Rev1p2.pdf, lists the "Fuse file IDs" that can be specified in the FPF configuration file, for example, OEM_KEY_HASH_1.

We would like to know if there are unused fuses in Bay Trail that could be used to store other OEM-specific information.

Thanks, Fred Young

0 Kudos
Josue_C_Intel
Employee
2,533 Views

Hi Fred

 

Document https://www-ssl.intel.com/content/www/us/en/secure/embedded/nda/products/bay-trail/atom-e3800-txe-slim-fw-and-tools.html # 543572 Intel® TXE Slim FW and tools for Intel® Atom™ Processor, https://www-ssl.intel.com/content/www/us/en/secure/embedded/nda/products/bay-trail/atom-e3800-txe-slim-fw-and-tools.html E3800 (Bay Trail-I) Product Family is now available in EDC Library.

 

We still working in your thread, please stay tuned.

 

Best Regards.

Josue.

 

0 Kudos
Natalie_Z_Intel
Employee
2,533 Views

FYI, FredYoung - we added a user guide to the EDC, http://www.intel.com/content/www/us/en/secure/embedded/nda/products/bay-trail/atom-e3800-m-d-t-soc-txe-firmware-guide.html Bay Trail-M/D/T SoC - System Tools for Intel® Trusted Execution Engine Firmware. It is classified as Intel Confidential.

0 Kudos
Josue_C_Intel
Employee
2,533 Views

Hello Fred Young

There is no reference to additional fuses that could be used to store other OEM-specific information.

As mentioned in section 2.1.7 FPF Programming

"This fuse is one time programmable inside Bay Trail SoC ... and should not be change after manufacturing and shipment."

Best Regards,

Josue.

0 Kudos
Reply