Cypress PSoC 64 Secure Boot Manual page 23

For evaluation purposes, the "Secure Boot" SDK provides the following assets to easily provision
your device:
1. A development Cypress Authorization JWT token (cy_auth); this authorizes a development HSM
keypair which is used by your PC to provision the chip.
2. A development OEM authorization JWT token (rot_auth); this authorizes a development RoT
keypair which can be used to sign your assets, such as image keys and policies.
In addition, the SDK provides tools to do the following:
1. Generate image keys
2. Form provisioning packets
3. Scripts to run the entrance exam and provisioning process on you development PC
Once the chip has been provisioned with the Public Image key, it will only boot images signed by the
associated Private key. Optionally, the image can be encrypted if the Boot and Upgrade policy
specifies it.
The signing and encryption process is a post build script provided by the "Secure Boot" SDK. The
build and encrypt/signing flow for a CY8CPROTO-064B0S3 target using ModusToolbox software
make process is shown below.
Figure 4-2. Build and Encrypt/Signing Flow
Image private key path Image private key path
Encryption key path Encryption key path
App size, version App size, version
CY8CPROTO-064B0S3 PSoC 64 "Secure Boot" Prototyping Kit Guide, Doc. # 002-29505 Rev. *B
Standard ModusToolbox Standard ModusToolbox
Output hex files Output hex files
Adds MCUBoot Adds MCUBoot
Headers/trailers, pad based Headers/trailers, pad based
policy_file policy_file
Yes Yes
Encrypt Upgrade Encrypt Upgrade
Running Code on PSoC 64 "Secure Boot" MCUs
Build flow, Build flow,
on policy on policy
Encrypt? Encrypt? Sign images Sign images
No No
Sign images Sign images
Image Image
"CySecureTools" API "CySecureTools" API
example.hex example.hex
Signed, Boot image(Slot#0) Signed, Boot image(Slot#0)
example_upgrade.hex example_upgrade.hex
Signed, Upgrade image(Slot#1) Signed, Upgrade image(Slot#1)
Encrypt = No Encrypt = No
example.hex example.hex
Signed, Boot image(Slot#0) Signed, Boot image(Slot#0)
example_enc_upgrade.hex example_enc_upgrade.hex
Encrypted & Signed, Upgrade Encrypted & Signed, Upgrade
Image(Slot#1) Image(Slot#1)
Encrypt = Yes Encrypt = Yes
22