topic Re: About secure boot KPI keys in i.MX Processors

About secure boot KPI keys

changbaoma — Thu, 29 Oct 2020 03:59:51 GMT

When generate KPI keys tree used in secure boot by hab4_pki_tree.sh.

What is the maximum years of the PKI tree keys duration？

What would happen if this max duration is expired？

Re: About secure boot KPI keys

Yuri — Thu, 29 Oct 2020 04:32:51 GMT

@changbaoma
Hello,

look at the following:

https://community.nxp.com/t5/i-MX-Processors/HABv4-and-certificate-expiring-date/m-p/1058869

https://community.nxp.com/t5/i-MX-Processors/Secure-Boot-CST-3-0-1-the-validity-period-of-the-corresponding/m-p/804587

Regards,
Yuri.

Re: About secure boot KPI keys

changbaoma — Thu, 29 Oct 2020 07:56:11 GMT

Hi, Yuri

I have read your post above, but also confuse me.

What is the maximum duration can i set? 10 years? or 1000 years? or more?

If the KPI keys are valid for 10 years, can the current generated KPI keys be used to sign a new image after 10 years? Or i must to generated new KPI keys at that time.

Re: About secure boot KPI keys

Yuri — Thu, 29 Oct 2020 09:37:05 GMT

Use 10 year - no need to modify the keys after this period.

~Yuri.

Re: About secure boot KPI keys

changbaoma — Thu, 29 Oct 2020 10:00:31 GMT

Our customs may use our products 50 years，even 200 years.

During this period, we need to do equipment maintenance all the time, and will still upgrade and re-sign zImage.

can we input 200 (years) even 1000 years? @Yuri

Re: About secure boot KPI keys

Yuri — Fri, 30 Oct 2020 03:45:45 GMT

@changbaoma
Hello,

Customers can try to input 200 or 1000 years.
Note: i.MX devices are qualified for 10 - 15 years on continuous operation.

Regards,
Yuri.