A small C program to read/write OTP registers for use with LUKS #67

New Issue

PeterSurda · 2024-01-26T03:57:09+01:00

PeterSurda commented

2024-01-26 03:57:09 +01:00

In raspberry pi documentation it says that OTP registers 56-63 can store a user-defined 256 bit private key. It's not really a TPM, but in combination with secure boot, access to it can be restricted. It can be used in combination with secure boot to have a non-interactive LUKS unlock, at least in theory because there doesn't appear to be tooling available to do this. The key can be extracted by using vcgencmd otp_dump. If you look at the source, you'll see how to use it (read and write the bytes) in C. It would be great if there was a small C tool to do these two things:

generate a pseudorandom 256 bit value and store it in the OTP (maybe require an interactive confirmation for extra protection)
read and dump it in a format usable for cryptsetup luksOpen

In [raspberry pi documentation](https://github.com/raspberrypi/documentation/blob/develop/documentation/asciidoc/computers/raspberry-pi/otp-bits.adoc#otp-registers-on-non-bcm2712-devices) it says that OTP registers 56-63 can store a user-defined 256 bit private key. It's not really a TPM, but in combination with secure boot, access to it can be restricted. It can be used in combination with secure boot to have a non-interactive LUKS unlock, at least in theory because there doesn't appear to be tooling available to do this. The key can be extracted by using `vcgencmd otp_dump`. If you look at the source, you'll see how to use it (read and write the bytes) in C. It would be great if there was a small C tool to do these two things: - generate a pseudorandom 256 bit value and store it in the OTP (maybe require an interactive confirmation for extra protection) - read and dump it in a format usable for `cryptsetup luksOpen`

lee.miller was assigned by PeterSurda

2024-01-26 03:57:09 +01:00

PeterSurda commented

2024-02-12 11:49:45 +01:00

This isn't in C but maybe it's sufficient or can be adjusted: https://github.com/raspberrypi/usbboot/blob/master/tools/rpi-otp-private-key