topic imx93: SRK revocation in i.MX Processors

imx93: SRK revocation

mothacehe — Wed, 13 Mar 2024 09:09:00 GMT

Hello,

I am trying to perform key revocation on my closed imx93 board.

My CSF file looks like:

[Header]
Target = AHAB
Version = 1.0

[Install SRK]
File = "../cst-3.4.0/crts/SRKtable.bin"
Source = "../cst-3.4.0/crts/SRK2_sha384_secp384r1_v3_usr_crt.pem"
Source index = 1
Source set = OEM
Revocations = 0x1

[Authenticate Data]
File = "spl.bin"
Offsets = 0x400 0x490

The idea is to sign with SRK2 and revoke SRK1 (0x1 bitmask). Booting from that image works fine, but I can still also boot from an image signed with SRK1.

Is there anything else that needs to be done in order to revoke SRK1?

Thanks,

Mathieu

Re: imx93: SRK revocation

Harvey021 — Tue, 19 Mar 2024 09:59:54 GMT

check if missing the step ahab_commit 0x10

Regards

Harvey

Re: imx93: SRK revocation

mothacehe — Thu, 21 Mar 2024 12:52:29 GMT

That worked thanks. I had to add support for ahab_commit mainline though: https://lists.denx.de/pipermail/u-boot/2024-March/548873.html