Encrypt and Sign Linux zImage with HABv4

jmmorenog — Thu, 21 Mar 2024 08:52:04 GMT

I am getting the following error when encrypting and signing linux image:

Calling authenticate_image in ROM
ivt_offset = 0x2670000
start = 0x40000000
bytes = 0x2672020

Secure boot enabled

HAB Configuration: 0xcc, HAB State: 0x99

--------- HAB Event 1 -----------------
event data:
0xdb 0x00 0x14 0x45 0x33 0x18 0xc0 0xff
0xca 0x00 0x0c 0x00 0x01 0xc5 0x1d 0x00
0x00 0x00 0x16 0x88

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_SIGNATURE (0x18)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_SW (0xFF)

--------- HAB Event 2 -----------------
event data:
0xdb 0x00 0x14 0x45 0x33 0x18 0xc0 0xff
0xca 0x00 0x0c 0x00 0x01 0xc5 0x1d 0x00
0x00 0x00 0x16 0x88

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_SIGNATURE (0x18)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_SW (0xFF)

Authenticate Image Fail, Please check

There isn't much information in this events... The csf used are:

To encrypt ->

[Header]
Version = 4.5
Hash Algorithm = sha256
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS
Engine = CAAM

[Install SRK]
# Index of the key location in the SRK table to be installed
File = "/../crts/SRK_1_2_3_4_table.bin"
Source index = 0

[Install CSFK]
# Key used to authenticate the CSF data
File = "/../crts/CSF1_1_sha256_4096_65537_v3_usr_crt.pem"

[Authenticate CSF]

[Unlock]
# Leave Job Ring and DECO master ID registers Unlocked
Engine = CAAM
Features = MID

[Install Key]
# Key slot index used to authenticate the key to be installed
Verification index = 0
# Target key slot in HAB key store where key will be installed
Target Index = 2
# Key to install
File = "/../crts/IMG1_1_sha256_4096_65537_v3_usr_crt.pem"

[Authenticate Data]
# Key slot index used to authenticate the image data
Verification index = 2
# Authenticate Start Address, Offset, Length and file
Blocks = 0x42670000 0x02670000 0x00000020 "./Image_pad_ivt"

[Install Secret Key]
Verification Index = 0
Target Index = 0
Key = "dek_kernel.bin"
Key Length = 128
Blob Address = 0x42672020

[Decrypt Data]
Verification Index = 0
Mac Bytes = 16
Blocks = 0x40000040 0x00000040 0x0266ffc0 "./Image_pad_ivt"

To sign ->

[Header]
Version = 4.3
Hash Algorithm = sha256
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS
Engine = CAAM

[Install SRK]
# Index of the key location in the SRK table to be installed
File = "/../crts/SRK_1_2_3_4_table.bin"
Source index = 0

[Install CSFK]
# Key used to authenticate the CSF data
File = "/../crts/CSF1_1_sha256_4096_65537_v3_usr_crt.pem"

[Authenticate CSF]

[Unlock]
# Leave Job Ring and DECO master ID registers Unlocked
Engine = CAAM
Features = MID

[Install Key]
# Key slot index used to authenticate the key to be installed
Verification index = 0
# Target key slot in HAB key store where key will be installed
Target Index = 2
# Key to install
File = "/../crts/IMG1_1_sha256_4096_65537_v3_usr_crt.pem"

[Authenticate Data]
# Key slot index used to authenticate the image data
Verification index = 2
# Authenticate Start Address, Offset, Length and file
Blocks = 0x40000000 0x0 0x02670020 "./Image_pad_ivt"
[Install Secret Key]
Verification Index = 0
Target Index = 0
Key = "dek_kernel_dummy.bin"
Key Length = 128
Blob Address = 0x42672020

[Decrypt Data]
Verification Index = 0
Mac Bytes = 16
Blocks = 0x40000040 0x00000040 0x0266ffc0 "./Image_pad_ivt_dummy"

I find really strange the ENG used. Any ideas why Im getting this error?. I checked the binaries and it seems all right

topic Encrypt and Sign Linux zImage with HABv4 in i.MX Processors

Encrypt and Sign Linux zImage with HABv4