Title: Disaster Recovery on the Alpha Board
Author: Paul Selkirk
Date: 2017-05-13 00:30
Category: AlphaBoard
This page covers a few likely (hopefully unlikely) oh-noes.
You can upload new firmware through the bootloader. On power-up or reset,
the bootloader flashes the blue LED for 10 seconds. During that time, start
cryptech_upload:
$ cryptech_upload --firmware --user wheel
PIN: <your-wheel-pin>
Well, now you've done it. You'll need to buy an ST-LINK programmer.
See UsingSTLink.
If you're staring at this thing for the first time, or if you ran
keystore erase, then you have no PIN. Believe it or not, this is the
best case scenario. Log in as wheel with the default PIN
YouReallyNeedToChangeThisPINRightNowWeAreNotKidding, and you should be
able to reset the PINs.
If you forgot the PIN, I feel sorry for you. The only way out of this is
via ST-LINK. The easiest way is to debug with gdb, set a breakpoint on
hal_rpc_login, and issue the gdb command return 0.
As shipped, the Alpha doesn't include a battery backup for the Master Key
Memory. So if power is interrupted, the MKM is wiped. (Also, if we had
tamper protection more sophisticated than a Panic Button, it would wipe
the MKM when you opened the case to install the ST-LINK cable.)
Sorry, there's nothing that can be done about that. All your keys are
still in flash memory, but encrypted with the KEK, which is now gone.
(Unless you used the masterkey unsecure set command to store the KEK in
unprotected flash memory, but you wouldn't do that, would you?)
