Which devices support OP-TEE with CAAM Black Key?

[kunisuzaki]

The code to support NXP iMX CAAM Black Key is included in OP-TEE OS.
#5990

I want to use CAAM Black Key.
Could you tell me which devices support OP-TEE with CAAM Black Key?

[sahilnxp]

@kunisuzaki Every CAAM enabled device has support for black keys, but that is available only for Asymmetric Crypto.
Moreover, you can check which platforms has Asymmetric Crypto supported by looking at crypto.mk

[kunisuzaki]

＠sahilnxp
Thank you for your quick response.
It’s great to hear that every CAAM-enabled device supports black keys.
We typically use the Armadillo board developed by the Japanese company Atmark Techno.
Unfortunately, the OP-TEE version it supports is limited to 3.5.
Could you recommend a CAAM-enabled board that supports a more recent version of OP-TEE?

Also, I’ve heard that CAAM black keys become available only after secure boot is enabled. Is that correct?

[sahilnxp]

@kunisuzaki All platforms which are listed in here https://github.com/OP-TEE/optee_os/blob/master/core/arch/arm/plat-imx/conf.mk supports recent versions of OP-TEE.
You can pick one that's suits your need, just make sure for that board CFG_NXP_CAAM is enabled.
Any specific crypto algorithm you are looking for ?

CAAM black keys can work without Secure boot enabled also.

[kunisuzaki]

＠sahilnxp
Thank you for the list — I’ll choose one from it. If possible, I’d like to use a signing key.

According to the Armadillo homepage, CAAM black keys are available when secure boot is enabled:
https://manual.atmark-techno.com/armadillo-x2/armadillo-base-os-security-guide_ja-1.6.0/ch05.html
The page is written in Japanese, but you can use a translator.
Section 5.6.1 states: “Secure boot is required to fully utilize the Black key.”

Is there a key or function when secure boot is enabled?

[sahilnxp]

AFAIK, we can use Black keys without Secure boot enabled also.

Is there a key or function when secure boot is enabled?

Can you please elaborate on this one ?

[kunisuzaki]

Is there a key or function when secure boot is enabled?

Can you please elaborate on this one ?

I would like to obtain evidence that OP-TEE is running with Secure Boot enabled.
The best option would be if there is a key that becomes accessible only after Secure Boot is completed.
Are there any other suitable methods to verify this?