Re: [isar-cip-core] Kconfig: Add additional features to security image

From: Jan Kiszka <jan.kiszka@siemens.com>
To: Sai.Sathujoda@toshiba-tsip.com, cip-dev@lists.cip-project.org
Cc: dinesh.kumar@toshiba-tsip.com, kazuhiro3.hayashi@toshiba.co.jp
Subject: Re: [isar-cip-core] Kconfig: Add additional features to security image
Date: Tue, 11 Jul 2023 18:09:26 +0200	[thread overview]
Message-ID: <36842105-2853-624d-eec2-98e81108acd3@siemens.com> (raw)
In-Reply-To: <20230711133838.437045-1-Sai.Sathujoda@toshiba-tsip.com>

On 11.07.23 15:38, Sai.Sathujoda@toshiba-tsip.com wrote:
> From: Sai <Sai.Sathujoda@toshiba-tsip.com>
> 
> From IEC certification perspective, a security image is needed which has the
> below features along with security customizations.
> 1. Data encryption (CR4.1)
> 2. Secure boot (EDR 3.14)
> 3. SWupdate (NDR 3.10)
> 
> Signed-off-by: Sai <Sai.Sathujoda@toshiba-tsip.com>
> ---
>  Kconfig | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/Kconfig b/Kconfig
> index 94e807a..a9c3425 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -171,6 +171,9 @@ config KAS_INCLUDE_IMAGE_FORMAT
>  
>  config IMAGE_SECURITY
>  	bool "Security extensions"
> +	select IMAGE_DATA_ENCRYPTION
> +	help
> +	  This enables security customizations, data encryption, Secureboot and SWupdate, all in need for IEC certification perspective.
>  
>  config KAS_INCLUDE_SECURITY
>  	string

I rather think kas/opt/security.yml should include
kas/opt/encrypt-partitions.yml and any other kas option needed.

Jan

-- 
Siemens AG, Technology
Competence Center Embedded Linux