imx8qxp secure boot keys

rakesh3 — Sun, 29 Oct 2023 07:44:50 GMT

HI team,

I am using the imx8qxp-mek board, i was going through the below doc.

https://github.com/nxp-imx/uboot-imx/blob/lf_v2023.04/doc/imx/ahab/introduction_ahab.txt

I have a doubt on some points.

If i amusing the below configuration while generating the keys and certificate.

$ ./ahab_pki_tree.sh
...
Do you want to use an existing CA key (y/n)?: n
Do you want to use Elliptic Curve Cryptography (y/n)?: y
Enter length for elliptic curve to be used for PKI tree:
Possible values p256, p384, p521: p384
Enter the digest algorithm to use: sha384
Enter PKI tree duration (years): 5
Do you want the SRK certificates to have the CA flag set? (y/n)?: y

then I am getting the below cert.

release/crts$ ls
CA1_sha256_prime256v1_v3_ca_crt.der

SGK3_1_sha256_prime256v1_v3_usr_crt.der

SRK2_sha256_prime256v1_v3_ca_crt.der
CA1_sha256_prime256v1_v3_ca_crt.pem

SGK3_1_sha256_prime256v1_v3_usr_crt.pem

SRK2_sha256_prime256v1_v3_ca_crt.pem
SGK1_1_sha256_prime256v1_v3_usr_crt.der

SGK4_1_sha256_prime256v1_v3_usr_crt.der

SRK3_sha256_prime256v1_v3_ca_crt.der
SGK1_1_sha256_prime256v1_v3_usr_crt.pem

SGK4_1_sha256_prime256v1_v3_usr_crt.pem

SRK3_sha256_prime256v1_v3_ca_crt.pem
SGK2_1_sha256_prime256v1_v3_usr_crt.der

SRK1_sha256_prime256v1_v3_ca_crt.der

SRK4_sha256_prime256v1_v3_ca_crt.der
SGK2_1_sha256_prime256v1_v3_usr_crt.pem

SRK1_sha256_prime256v1_v3_ca_crt.pem

SRK4_sha256_prime256v1_v3_ca_crt.pem

So, as per the document,

- Generating SRK Table and SRK Hash in Linux 64-bit machines:
- In i.MX 8/8x family, the expected SRK HASH is of 512 bit.

$ cd ../crts/
$ ../linux64/bin/srktool -a -s sha384 -t SRK_1_2_3_4_table.bin \
-e SRK_1_2_3_4_fuse.bin -f 1 -c \
SRK1_sha384_secp384r1_v3_usr_crt.pem,\
SRK2_sha384_secp384r1_v3_usr_crt.pem,\
SRK3_sha384_secp384r1_v3_usr_crt.pem,\
SRK4_sha384_secp384r1_v3_usr_crt.pem

my doubts:

1) mentioned as expected SRK HASH is of 512 bit then why in command using sha384 ? Is this correct ?

2) If I am using the CA flag then we are getting the certificate as SRK1_sha256_prime256v1_v3_ca_crt.pem not SRK1_sha384_secp384r1_v3_usr_crt.pem then in this case we should use this crt SRK<num>_sha256_prime256v1_v3_ca_crt.pem with this command ../linux64/bin/srktool ?

3) If i have created the SRK hash table/fuse.bin using sha384 then we need to check the srk table with below cmd.

$ od -t x4 --endian=big SRK_1_2_3_4_fuse.bin
0000000 01b04697 0253376b 2066fe56 aaef9a91
0000020 e62e09d8 14fb7e36 d5b38d05 0982edab
0000040 7ada6576 2f6b4f59 1fd9347e 46e7305d
0000060 46e34bf0 89780bd1 c809e714 a17e2f4e

$ sha256sum SRK_1_2_3_4_table.bin
01b046970253376b2066fe56aaef9a91\
e62e09d814fb7e36d5b38d050982edab\
7ada65762f6b4f591fd9347e46e7305d\
46e34bf089780bd1c809e714a17e2f4e\
SRK_1_2_3_4_table.bin

Please clearify these doubts before I flash the keys in EEPROM

Regards,

Re: imx8qxp secure boot keys

Harvey021 — Wed, 01 Nov 2023 08:02:50 GMT

1) Yes, That is correct.

2) One is with PKI tree including a subordinate SGK key, the other is not. By the way, Which version of CST are you using?

3) - In i.MX 8/8x family, the expected SRK HASH is of 512 bits. that means SRK HASH is 512bits generating with SRK tool in i.MX8/8X. against to that, In i.MX 8ULP/9x, the expected SRK HASH is of 256 bit. SRK HASH will be burned to fuse of SoC.

Best regards

Harvey

Re: imx8qxp secure boot keys

rakesh3 — Wed, 01 Nov 2023 13:32:34 GMT

Hi @Harvey021 ,

thanks for reply,

I am using the CST version 3.1.0 (i.MX High Assurance Boot Reference Code Signing Tool (nxp.com))

Is this version fine ?

I have fused the keys to Soc. But getting some ahab events.

Could you please have a look into my this ticket.

https://community.nxp.com/t5/i-MX-Processors/imx8qxp-mek-kernel-signing/m-p/1746343#M214706

If possible could you please give some inputs on this query also.

Since I am following the below doc and it seems straight forward but got stuck in ahab status. Please suggest some input on this.

https://github.com/nxp-imx/uboot-imx/blob/lf_v2023.04/doc/imx/ahab/guides/mx8_mx8x_spl_secure_boot.txt

Regards,

topic Re: imx8qxp secure boot keys in i.MX Processors

imx8qxp secure boot keys

Re: imx8qxp secure boot keys

Re: imx8qxp secure boot keys