Clarification on STM32MP257 Secure Boot and Firmware Encryption Behavior
I am working on secure boot and firmware encryption on a custom STM32MP257F board based on the STM32MP257F-DK.
I have already provisioned the encryption key material into OTP and am testing encryption through Yocto using ENCRYPT_ENABLE = "1", with a 128-bit key for FSBL and a 256-bit key for FIP.
I noticed that when I use the correct encryption keys, the board boots successfully.
When I use a wrong key, flash fails with a decryption error.
But when I remove the encryption settings from local.conf, the board still boots even though the keys are already provisioned in OTP.
I want to understand why this happens. I thought that once the encryption keys are provisioned, the board should not boot without the correct keys.
Could someone please clarify a few things?
- Is it normal for the board to boot with an unencrypted image even after the encryption keys are provisioned into OTP?
- Does provisioning the keys into OTP only store the keys, or is there a way to enforce encryption at boot?
- What is the recommended way to ensure that the board boots only with properly encrypted and authenticated firmware?