i.MX ProcessorsのトピックRe: Use the same key for CSF and IMG?

Use the same key for CSF and IMG?

tonywh — Tue, 09 Feb 2021 16:05:09 GMT

I'm making a product with secure boot. My company has CA -> Intermediate key -> Product key. I plan to program the Intermediate key in SRK0. Can I use the Product key as both CSF key and IMG key for secure boot? Is there any reason it might be inadvisable to do this?

Thanks,

Tony

Re: Use the same key for CSF and IMG?

Bio_TICFSL — Tue, 09 Feb 2021 17:35:19 GMT

Hello tonyhw,

HAB 4.1.2 or later introduces the fast authentication feature, which allows the user to have the SRK authenticate, the CSF and IMG. Customer need choose 'n' for below question when generating PKI tree with CST tools: Do you want the SRK certificates to have the CA flag set? (y/n)?: n If Fast Authentication is what is really needed – i.MX 6UL supports it. Please refer to the following for some additional information “Secure Boot i.MX 6 & HAB 4.1.2”

< https://community.nxp.com/message/644308 >

For normal authentication, CSF public key is used to authenticate CSF commands and IMG public key is used to authenticate image, they are installed in separate key slots of internal public key store. It isn't possible to apply the same certificate for CSF and IMG.

Regards

Re: Use the same key for CSF and IMG?

tonywh — Wed, 10 Feb 2021 09:44:35 GMT

Sorry I put this in the wrong place.

Re: Use the same key for CSF and IMG?

tonywh — Wed, 10 Feb 2021 09:45:01 GMT

Thanks for the response. Perhaps I need to clarify our requirement a bit more. We have to use the Intermediate key in SRK to satisfy key rotation and product life requirements. What I want to know is whether we can install the same key into the key slots for the CSF public key and the IMG public key.

Thanks,

Tony

Re: Use the same key for CSF and IMG?

Bio_TICFSL — Thu, 11 Feb 2021 14:39:46 GMT

Hi,

Sorry is not possible.

Regards

Re: Use the same key for CSF and IMG?

mprt42 — Wed, 15 May 2024 11:40:19 GMT

Hi @Bio_TICFSL

can you elaborate a bit more on that?

I briefly compared the relevant parts of the hab4_pki_tree script and could not see anything that looks different between the generation of the IMG and CSF keys/certs.

So what's the issue with simply reusing the same key for both?

...
[Install CSFK]
  File = CSF1_1_sha256_4096_65537_v3_usr_crt.pem

[Authenticate CSF]

[Install Key]
  Verification index = 0
  Target Index = 2
  File = CSF1_1_sha256_4096_65537_v3_usr_crt.pem
...

In general, what's the reason for having seperate keys for CSF and IMG in the first place?
(I know there is the fast authenticatio mechanism, but I want to understand the potential security implications)

Thanks!