topic key injection in S32K

key injection

yahyatarek — Wed, 08 Apr 2026 12:27:33 GMT

I have two questions regarding key injection in the S32K388:

1. When I create an NVM Key Catalog of type AES and then call Crypto_43_HSE_Ipw_FormatKeyCatalogs to format it, I receive the error HSE_SRV_RSP_NOT_ALLOWED. The crypto driver documentation indicates that non-SHE types can be added after SHE types. Is it permissible, therefore, to configure an AES key catalog within the NVM Key Catalog?

2. When attempting to set a plaintext key inside a RAM catalog of type SHE, I receive the error HSE_SRV_RSP_INVALID_PARAM. However, the operation passes when setting a plaintext key in a RAM catalog of type AES. The documentation suggests the main difference between AES and SHE RAM catalogs is their size, and I configured both with a 128-key size. Why is the operation successful for AES but not for SHE?

Re: key injection

lukaszadrapa — Wed, 08 Apr 2026 15:55:21 GMT

Hi @yahyatarek

1. Yes, you can have AES key in the NVM catalog.
There’s a set of rules how the catalog should be configured. This can be found in section “6.1.5 Key catalog” in HSE Firmware Reference Manual rev. 2.7.
There’s an example of NVM catalog on page 105 and there’s a list of reasons why the service can fail (page 106).

2. There are specific rules for SHE keys. This is described in section “6.3 Key management: SHE keys”. In short, SHE keys must be mapped to key group 0 and the group owner must be HSE_KEY_OWNER_ANY. Extended SHE keys must be mapped to key groups 1 – 4. If SHE keys are not used, you can map any keys to these groups.
You can have only one SHE RAM key which must be mapped to group 0 in RAM catalog. There’s an example in “6.3.4 Declaration example”:

hseKeyGroupCfgEntry_t my_RAM_key_catalog[] = {
/* SHE keys */ {HSE_MU0_MASK, HSE_KEY_OWNER_ANY, HSE_KEY_TYPE_SHE, 1, 128}, /* RAM_KEY */
{0, 0, 0, 0, 0}
};

If this doesn’t help, please share your configuration of the catalogs.

Regards,
Lukas

Re: key injection

yahyatarek — Sun, 12 Apr 2026 12:15:56 GMT

Hello @lukaszadrapa , thanks for your help. I just reviewed the section describing the NVM catalog, and it seems there are no major changes between us. I have attached my configuration; the only change is the key owner. I tried configuring it as 'ANY' or 'Custom,' but both failed during key formatting.

Re: key injection

yahyatarek — Thu, 16 Apr 2026 09:39:55 GMT

Hello @lukaszadrapa , this is just a reminder that the configuration I shared is currently a blocker for me. If there are any incorrect configuration, could you please tell me which ones need fixing?

Re: key injection

lukaszadrapa — Thu, 16 Apr 2026 13:54:50 GMT

Hi @yahyatarek

I'm sorry, for some reason, I didn't get notification about your previous message from the system.

NVM AES key cannot use HSE_KEY_OWNER_ANY. This is reserved for RAM keys and for SHE keys. Just change it to HSE_KEY_OWNER_CUST or to HSE_KEY_OWNER_OEM depending on your needs and it will work as expected.

Regards,

Lukas