topic Re: IMX93 - AHAB SecureBoot - SRK TABLE in i.MX Processors

IMX93 - AHAB SecureBoot - SRK TABLE

il_ciancio — Tue, 01 Apr 2025 15:34:21 GMT

Hello NXP experts,

I am studying AHAB SecureBoot on IMX93 processor, and I am using CST tool in order to generate certifcates.

A lot of example shows a PKI tree generation with 4 leafs (SRKn, n from 1 to 4).

After the generation, I have to generate the SRK_Table and the SRK_TableFuse.

The SRK_Table is appended on the image, and after I have to flash SRK_TableFuse into eFuse.

CST Tool generates SRK_TableFuse as 16 words, but on the reference manual I have 16 fuse (OES_SRKHy with Y from 0 to 15), but some of them are RESERVED,

can I flash also these eFuses (fuse from 8 to 15)?
More over, Can I generate a SRK Table with only one certificate for my target?

Thanks a lot!

Re: IMX93 - AHAB SecureBoot - SRK TABLE

il_ciancio — Wed, 02 Apr 2025 10:13:01 GMT

Hello,

about the SRK table to be fused, i have found an error during the generation.

The correct command with CST tools for IMX9 is showed in:

uboot-imx/doc/imx/ahab/introduction_ahab.txt at lf_v2024.04 · nxp-imx/uboot-imx
In i.MX 8ULP/9x, the expected SRK HASH is of 256 bit.
- $ cd ../crts/
- $ ../linux64/bin/srktool -a -d sha256 -s sha384.

Why is there -s sha384 (-s, --sign_digest) ?

Re: IMX93 - AHAB SecureBoot - SRK TABLE

Harvey021 — Wed, 02 Apr 2025 10:25:25 GMT

Hello @il_ciancio

can I flash also these eFuses (fuse from 8 to 15)?

-> No, please have a reference 9x_secure_boot for i.MX93

Can I generate a SRK Table with only one certificate for my target?

-> In AHAB, it requires always 4 SRKs.

Regards

Harvey

Re: IMX93 - AHAB SecureBoot - SRK TABLE

il_ciancio — Thu, 10 Apr 2025 10:25:07 GMT

In the example from git, the certificates were generated with sha384!