topic CST Tool with HSM Keys in i.MX Processors

CST Tool with HSM Keys

rohith_chinnasw — Thu, 18 Oct 2018 16:58:13 GMT

I got the CST 3.0.1 tool and compile in windows. The adapt_layer_openssl.c file says to modify it for HSM implementations but its not clear whether cst can be used when the keys are already generated in HSM and OpenSSL is not involved with Keys. Note that we have a separate API to integrate with HSM by sending the hash and retrieve the signature, but not sure if that can be adapted with CST tool.

Re: CST Tool with HSM Keys

Yuri — Thu, 25 Oct 2018 08:36:39 GMT

Hello,

Our CST implementation is not intended for HSM using.

Generally customers can refer to Appendix B (Replacing the CST Backend Implementation)

of “CST_UG.pdf” for some recommendations how to implement own solution.

Recent CST (3.1.0) may be loaded, using the following link:

https://www.nxp.com/webapp/Download?colCode=IMX_CST_TOOL

Have a great day,

Yuri

------------------------------------------------------------------------------

Note: If this post answers your question, please click the Correct Answer

button. Thank you!

Re: CST Tool with HSM Keys

rohith_chinnasw — Thu, 25 Oct 2018 16:08:26 GMT

Thanks Yuri. I will try on 3.1.0 version. I saw the guide but it wasnt clear on whether we can use the pregenerated keys or we need to use OpenSSL to create those HSM keys.

Also is a similar reference available for mkimage tool(to customize with HSM)?

Re: CST Tool with HSM Keys

Yuri — Fri, 26 Oct 2018 03:42:06 GMT

Hello,

Please create request \ ticket for more considerations.

Support|NXP

Regards,

Yuri.

Re: CST Tool with HSM Keys

jbhaijy — Tue, 15 Aug 2023 16:42:15 GMT

Hi @rohith_chinnasw

Did your CST tool able to communicate with HSM through the API's? Have you done any changes in CST tool to communicate with HSM?

I am also working on same concept where CST tool should able to communicate with remote HSM through the standard vendor API's like DigiCert API. DigiCert have their own API's to communicate with HSM which is possible to call the API's from the simple script along with hash value & get the it signed from HSM.

I don't whether this can be possible with CST tool? If you can share your experience, that will be helpful for me.

Thanks.