[参考译文] SK-AM62B-P1：构建 OTP Keywriter 时是否可实现配置文件=释放？

您好！

[报价用户 id="632835" url="~/support/processors-group/processors/f/processors-forum/1444129/sk-am62b-p1-building-otp-keywriter-with-profile-release-possible "]但是、插入两组 键(SMEK、SMPK、BMEK、BMPK)时、 primary_cert.bin 的大小超过5400字节的长度。

您可能无法使用正确的 OpenSSL 版本、因为使用用户指南中提到的工具版本、对证书生成进行一次性测试(一次对所有内容进行编程)。

下面是 OpenSSL v1.1.x 的证书生成日志、显示5400字节内主证书和辅助证书的大小、供参考。

❯ ./gen_keywr_cert.sh -t tifek/ti_fek_public.pem --msv 0xC0FFE -s-def --smek-def -b-def --bmek-def --keycnt 2 --keyrev 1
# Using MSV[19:0]: 0x000C0FFE
INFO: Using default SMPK for programming
INFO: Using default SMEK for programming
INFO: Using default BMPK for programming
INFO: Using default BMEK for programming
# Using Key Count: 0x00000003
# Using Key Rev: 0x00000001
Generating Dual signed certificate!!
GEN: AES256 key generated, since not provided
# encrypt aes256 key with tifek public part
# encrypt SMPK-priv signed aes256 key(hash) with tifek public part
# encrypt smpk-pub hash using aes256 key
writing RSA key
# encrypt smek (sym key) using aes256 key
# encrypt BMPK-priv signed aes256 key(hash) with tifek public part
# encrypt bmpk-pub hash using aes256 key
writing RSA key
# encrypt bmek (sym key) using aes256 key
1668    secondary_cert.bin
5383    primary_cert.bin
7051    ../../x509cert/final_certificate.bin
# SHA512 Hashes of keys are stored in verify_hash.csv for reference..

此致、

Prashant

感谢快速的答复-我要重复这个。

我们使用的是 OpenSSL 3.0.15、且借助您所引用的证书创建命令、我们得到 primary_cert.bin 的字节为5414

# encrypt bmek (sym key) using aes256 key
1701    secondary_cert.bin
5414    primary_cert.bin
7115    ../../x509cert/final_certificate.bin
# SHA512 Hashes of keys are stored in verify_hash.csv for reference..