RE: [cip-dev] [isar-cip-core] Kconfig: Add additional features to security image

From: <Sai.Sathujoda@toshiba-tsip.com>
To: <cip-dev@lists.cip-project.org>
Cc: <dinesh.kumar@toshiba-tsip.com>, <kazuhiro3.hayashi@toshiba.co.jp>
Subject: RE: [cip-dev] [isar-cip-core] Kconfig: Add additional features to security image
Date: Wed, 12 Jul 2023 05:11:22 +0000	[thread overview]
Message-ID: <OSAPR01MB49455B886FB98BD977456C36C236A@OSAPR01MB4945.jpnprd01.prod.outlook.com> (raw)
In-Reply-To: <36842105-2853-624d-eec2-98e81108acd3@siemens.com>

Hi Jan.

We chose this approach because the kas-menu will help user to understand what features are included in the image when security extensions is selected. Your suggestion is also good.

Do you think there are any drawbacks in modifying kas-menu approach, Jan.

Thanks & Regards,
Sai Ashrith (T S I P)

-----Original Message-----
From: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> On Behalf Of Jan Kiszka via lists.cip-project.org
Sent: Tuesday, July 11, 2023 9:39 PM
To: ashrith sai(ＴＳＩＰ) <Sai.Sathujoda@toshiba-tsip.com>; cip-dev@lists.cip-project.org
Cc: dinesh kumar(ＴＳＩＰ TMIEC ODG Porting) <dinesh.kumar@toshiba-tsip.com>; hayashi kazuhiro(林 和宏 ＤＭＥ ○ＤＩＧ□ＭＰＳ○ＭＰ４) <kazuhiro3.hayashi@toshiba.co.jp>
Subject: Re: [cip-dev] [isar-cip-core] Kconfig: Add additional features to security image

On 11.07.23 15:38, Sai.Sathujoda@toshiba-tsip.com wrote:
> From: Sai <Sai.Sathujoda@toshiba-tsip.com>
> 
> From IEC certification perspective, a security image is needed which 
> has the below features along with security customizations.
> 1. Data encryption (CR4.1)
> 2. Secure boot (EDR 3.14)
> 3. SWupdate (NDR 3.10)
> 
> Signed-off-by: Sai <Sai.Sathujoda@toshiba-tsip.com>
> ---
>  Kconfig | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/Kconfig b/Kconfig
> index 94e807a..a9c3425 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -171,6 +171,9 @@ config KAS_INCLUDE_IMAGE_FORMAT
>  
>  config IMAGE_SECURITY
>  	bool "Security extensions"
> +	select IMAGE_DATA_ENCRYPTION
> +	help
> +	  This enables security customizations, data encryption, Secureboot and SWupdate, all in need for IEC certification perspective.
>  
>  config KAS_INCLUDE_SECURITY
>  	string

I rather think kas/opt/security.yml should include kas/opt/encrypt-partitions.yml and any other kas option needed.

Jan

--
Siemens AG, Technology
Competence Center Embedded Linux