I am running Linux on iMX233, an ARM CPU with hardware-accelerated AES engine. The AES key can be programmed permanently into the chip ROM (OTP). This key is not directly accessible by software. Programs just invokes the engine and it performs encryption/decryption on the given data block using the internal key and returns back the result to the program. This feature is not implemented into iMX kernel as a standard Linux crypto device. Instead, a properietary IOCTL exists for accessing this feature.
What do you suggest as the best practice for data encryption based on this feature?
- Is there a data encryption tool that can support such a feature out of the box?
- or should I develop custom kernel crypto device driver and use dm-crypt or loop-aes? Is it possible at all when no key can be supplied externally to the algorithm?
- or should I develop custom user space code?