topic CST support for API based HSM in i.MX Processors

CST support for API based HSM

jbhaijy — Thu, 03 Aug 2023 14:07:40 GMT

Hi,

We are using i.MX8mini & trying to understand the CST tool to sign the images. Below are my questions,

Does CST(cst-3.3.1 or 3.3.2) tool have inbuilt support to connect to API based HSM to get the image signed?

CST tool ------> API server -----> Digicert HSM

2. Does pre-built cst-3.3.2 have default built in support to communicate with HSM? or do we need to rebuild again the cst-3.3.2 for CST-HSM?

3. Can we build the cst-3.3.2 tool natively without using the docker file? What are the steps or guidelines?

4. Can we use the CST tool to access the remote HSM which is not in our network? Like DigiCert HSM?

5. We have proven signing PKI structure for i.MX6, can we use the same PKI key's & cert for i.MX8(i.e. CA, SRK, IMG & CSF)?

Thanks

Re: CST support for API based HSM

Bio_TICFSL — Fri, 04 Aug 2023 14:35:40 GMT

Hello,

1) No,

2) You may have it allready, check cst-3.3.2/code/back_end-hsm

3) yes you can build it but there is no step guide.

The following works for me on Linux,

Extract cst-3.3.2.tgz
Change into ./cst-3.3.2/code/cst and run: bash -c "OSTYPE=linux64 make rel_bin"
Change into ./cst-3.3.2/code/back_end-engine/src and run:
1. sed -i 's#^ROOT :=.*#ROOT := ../../cst/code#g' ./Makefile
2. sed -i 's#^FRONTEND :=.*#FRONTEND := $(ROOT)/obj.linux$(BITNESS)/libfrontend.a#g' ./Makefile
3. bash -c "OSTYPE=linux64 make"

The cst binary for the HSM is now ./cst-3.3.2/code/back_end-engine/src/cst

4) I don't think so

5) Yes you can.

Regards

Re: CST support for API based HSM

jbhaijy — Mon, 07 Aug 2023 12:06:14 GMT

@Bio_TICFSL Thanks for reply.

I don't see back_end-hsm anywhere in the cst-3.3.2 directory. But I see cst, hab_log_parser, srktool binaries under cst-3.3.2/linux64/bin. Just wanted to confirm are these binaries have support to interface with HSM?