topic Re: Generate NVM key returns HSE_SRV_RSP_INVALID_PARAM in S32K

Generate NVM key returns HSE_SRV_RSP_INVALID_PARAM

kerti1 — Tue, 13 May 2025 12:14:42 GMT

Hi,

I previously implemented CMAC generation and verification using a RAM key (hardcoded in the application), and it worked successfully. Now, I'm trying to switch to using a key generated by the HSE and stored in the NVM key catalog. However, when I attempt to generate the key, I receive the response HSE_SRV_RSP_INVALID_PARAM.

What could be the possible reasons for this error? Do I need to explicitly store the key in NVM after generation, or does the HSE handle that internally?

I've attached relevant code and images. Any guidance would be appreciated.

Re: Generate NVM key returns HSE_SRV_RSP_INVALID_PARAM

lukaszadrapa — Wed, 14 May 2025 09:43:41 GMT

Hi @kerti1

I can't see problem in the parameters.

1. Could you try to disable data cache to confirm it is not cache issue?

2. How does your NVM key catalog look like? Is the KeyHandle correct?

HSE_SRV_ID_KEY_GENERATE service stores the key to NVM catalog, it's not done by user. The NVM key must be empty when calling the service (it must be erased if it is not empty) and SuperUser rights are needed.

Regards,

Lukas

Re: Generate NVM key returns HSE_SRV_RSP_INVALID_PARAM

kerti1 — Wed, 14 May 2025 10:04:24 GMT

Hi @lukaszadrapa ,

Thanks for the response. Just now I was able to generate the NVM keys. Yes, I always disable the Data cache.

2. How does your NVM key catalog look like? Is the KeyHandle correct?

As you suggested, It is the issue of the NVM key catalog. I changed to the attached below.

The NVM key must be empty when calling the service (it must be erased if it is not empty) and SuperUser rights are needed.

I have superuser rights. How would i know that the NVM key is empty or not? If not how to erase it ?. I would be helpful if i get to know these.

Re: Generate NVM key returns HSE_SRV_RSP_INVALID_PARAM

lukaszadrapa — Wed, 14 May 2025 12:24:11 GMT

All keys in RAM and in NVM are empty after catalog formatting. Easiest option to check if a key is empty or not: try to use such key. In your case, you can try to calculate CMAC over a few bytes. If the key is empty, you will get response HSE_ SRV_ RSP_ KEY_ EMPTY.

A key can be erased by HSE_SRV_ID_ERASE_KEY service:

Take a look at hseEraseKeySrv_t in HSE Service API reference manual for details.

Regards,

Lukas