S32N55 HSE2 — CRS(APP) Domain Secure Debug Authentication using ADKP

EddiePark — Fri, 26 Jun 2026 13:05:55 GMT

We are working on Secure Debug authentication for the S32N55 platform and have successfully implemented FSS domain debug authorization using ADKP (HSE_OTP_FOEM_ADKP_ATTR_ID) via SDC-600.

We are now trying to extend this to the CRS domain (HSE_DEBUG_DOMAIN_APP = 0x1B) and have the following questions:

---

[Q1] Is ADKP usable for CRS domain Secure Debug authentication?

After provisioning ADKP via HSE_OTP_FOEM_ADKP_ATTR_ID, is it possible to use the same ADKP for CRS domain (APP) Secure Debug authentication via HSE_DEBUG_CMD_APP_CHALLENGE?

---

[Q2] Does SetOwnerDebugKeyMap() need to be called separately per MU (FSS MU vs CRS MU)?

Per the RM description of hseOwnerDebugKeyMapConfig_t:
"This service is called for each installed device owner individually from an owning MU.
HSE FW assumes the owner identity based on the MU this service request is sent to."

Our current implementation calls SetOwnerDebugKeyMap() (HSE_SRV_ID_DEBUG_KEY_MAPPING) only through FSS MU (MU0), mapping aOwnerAuthRef[0] = HSE_OTP_KEY_FOEM_ADKP.

- Is a separate SetOwnerDebugKeyMap() call required through the CRS MU for CRS domain authentication?
- If so, which MU number should be used for the CRS domain on S32N55?

---

[Q3] Does SetOwnerDebugKeyMap() need to be called on every boot?

The RM states:
"Only the numOfAuthorizationRefEntries and numOfAuthenticationRefEntries are logged,
rest of the entries are ignored."

This implies the key mapping is volatile and not stored in NVM. Does this mean SetOwnerDebugKeyMap() must be called on every boot (after SU rights are granted) for both FSS and CRS domains?

---

[Q4] Correct keyRef value for APP_CHALLENGE

In hseDebugAuthorizeStartCmd_t, the keyRef field references the index mapped via hseOwnerDebugKeyMapConfig_t. Since we map aOwnerAuthRef[0] = HSE_OTP_KEY_FOEM_ADKP, we send keyRef = 0x00 for CRS domain authentication. Is this correct?

---

[Q5] Response size and packet structure for APP_CHALLENGE

Per hseDebugAuthorizeProofProvCmd_t byte map, the packet structure is always 32 bytes (2 packets x 8 words). HSE_CR_APP_RESPONSE_SIZE = 16U vs HSE_CR_FSS_OR_HSE_RESPONSE_SIZE = 32U.

For APP_CHALLENGE, should the host send:
- 16 bytes of AES-encrypted response + 16 bytes of zero padding = 32 bytes total?
- Or only 16 bytes?

Currently, after sending FLAG_START + DebugSignalMap(4 bytes) + Response(16 bytes) + FLAG_END, HSE2 does not respond and T32 hangs waiting indefinitely. When we send 32 bytes (16-byte response + 16-byte zero padding), we observe the same hang.

---

For reference:
- Sherpa_Cdd_AllocateChannel() always allocates MU0 (FSS)
- SetOwnerDebugKeyMap(): aOwnerAuthRef[0] = HSE_OTP_KEY_FOEM_ADKP (0x00000302), called with SU rights
- crs_auth.cmm: DEBUG_TARGET=0x1B, OID=0xFF*16, keyRef=0x00
- AUTH_MODE_REQ passes successfully (HSE_DEBUG_WAITING_RESPONSE_TO_CHG received)
- Challenge received: 32 bytes
- After sending Response, no ACK (0x4A4A4A4A) received from HSE2

Please see the attached CMM script and log for reference.

Thank you in advance.

topic S32N55 HSE2 — CRS(APP) Domain Secure Debug Authentication using ADKP in S32G

S32N55 HSE2 — CRS(APP) Domain Secure Debug Authentication using ADKP