Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running Linux on iMX233, an ARM CPU with hardware-accelerated AES engine. The AES key can be programmed permanently into the chip ROM (OTP). This key is not directly accessible by software. Programs just invokes the engine and it performs encryption/decryption on the given data block using the internal key and returns back the result to the program. This feature is not implemented into iMX kernel as a standard Linux crypto device. Instead, a properietary IOCTL exists for accessing this feature.

What do you suggest as the best practice for data encryption based on this feature?

  • Is there a data encryption tool that can support such a feature out of the box?
  • or should I develop custom kernel crypto device driver and use dm-crypt or loop-aes? Is it possible at all when no key can be supplied externally to the algorithm?
  • or should I develop custom user space code?
  • ...
share|improve this question
@frostschutz, you misread. The ioctl doesn't return the key; it encrypts or decrypts the data you give it using the hidden key. This doesn't reveal the key unless you can accomplish a chosen plaintext attack on AES. – cjm Mar 29 '13 at 2:38
What do your end-users want to do with this HSM? How many pieces of software will use the device? What is the expected lifecycle of the device and how generic do you want the solution to be? – Deer Hunter Mar 29 '13 at 5:48
"Should I develop userspace code?" It looks like you already did: fadishei.wordpress.com/2013/03/20/… So where is the problem? – goldilocks Mar 29 '13 at 10:51
@goldilocks, Yes I developed some basic code but not a complete data encryption tool. That should be my last resort and I wanted to know whether a better (preferably standard) approach exists. – Hamid Fadishei Apr 3 '13 at 7:22
@DeerHunter, This is a portable device sending sensor data from users locations to a server. I don't want anyone be able to fake or sniff data. (Answers to your questions: Nothing directly/One/5 Years/Preferably as generic as I can use standard available data encryption tools – Hamid Fadishei Apr 3 '13 at 7:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.