topic Re: otpmk in OEM_OPEN state in i.MX Processors

otpmk in OEM_OPEN state

gilmoreat — Thu, 10 Jul 2025 18:04:14 GMT

I am looking through the security manual for the iMX8QM and I am struggling to understand how the OTPMK changes between the OEM_OPEN and the OEM_CLOSED state.

- Is the OTPMK used when the chip is in the OEM_OPEN state unique for each chip (i.e two i.MX8QM will have different OTPMK even in the OEM_OPEN state)?

- Is there a way from linux or u-boot to check what the the security state is? (Trusted, Secure, Non-Secure, etc.)

- If we needed to move to OEM_CLOSED, what does that processes look like for a linux/yocto based system?

Thanks,

Allan

Re: otpmk in OEM_OPEN state

JosephAtNXP — Thu, 10 Jul 2025 19:38:58 GMT

Hi,

Thank you for your interest in NXP Semiconductor products,

This is the guide for secure boot and it also contains the U-boot command that returns the closed or open state depending on the SoC.

Regards

Re: otpmk in OEM_OPEN state

gilmoreat — Thu, 10 Jul 2025 20:03:01 GMT

Hi Joseph,

Thanks for the quick reply! Do you know if the OTPMK using in the OEM_OPEN state is unique per chip? We are using the iMX8QM and we would like to make sure that two of our device do not share the same key.

Re: otpmk in OEM_OPEN state

JosephAtNXP — Mon, 14 Jul 2025 20:12:03 GMT

Hi,

Keys are always 0 in fresh devices, you can burn unique keys to each one of your chips.

Regards

Re: otpmk in OEM_OPEN state

gilmoreat — Mon, 14 Jul 2025 21:59:45 GMT

Hi Joseph,

This seems to conflict directly with this previous post: https://community.nxp.com/t5/i-MX-Processors/OTPMK-on-iMX8QM/m-p/1346985

After digging through the MRM and the SRM for the i.MX8QM, I don't see any method to set the OTPMK.

Back to my original question, Does the OTPMK change between OEM_OPEN and OEM_CLOSED state and is the key unique for each chip when in the OEM_OPEN state?

Re: otpmk in OEM_OPEN state

JosephAtNXP — Tue, 15 Jul 2025 01:33:17 GMT

Hi,

You are correct, the last contradicts, I thought you were discussing SRK keys for signing secure boot.

OTPMK is a key unique to every chip, on SECO devices, such as the i.MX 8/8X family, a unique OTP Master Key (OTPMK) is used to encrypt and wrap the DEK in a blob. NXP provides the available U-Boot port with the capability of using these private keys through SECO firmware.

It doesn't change between an open and a closed device.

Regards.