i.MX ProcessorsのトピックRe: HAB4 Secure Boot Keys Stored on YubiKey 5 Nano

HAB4 Secure Boot Keys Stored on YubiKey 5 Nano

Mihajlo — Wed, 06 Aug 2025 15:18:25 GMT

Hello everyone,

Has anyone tried/succeeded to store public and private keys for i.MX8-MP platform secure boot on YubiKey 5 Nano device?

I'm using CST version 3.1.0 and so far signing and secure booting are successful, but the keys (created by hab4_pki_tree script) are being kept alongside the code, i.e. in the source tree.

The whole system image (bootloader, kernel, filesystem) is being build under Yocto 3.0

To make everything more secure, the idea is to have keys stored on YubiKey5 Nano.

The questions are:

1. Is it at all possible to use YubiKey 5 Nano for that purpose?

AFAIK, paths to public keys are in .csf file used by CST, and CST then finds private key by itself, given that the keys are named properly and that keys and crts folders are on the same level. I couldn't find a way to give path/command to be used by CST in order to fetch keys from YubiKey 5 Nano

2. It the answer to 1) is yes, then should OpenPGP or PIV application for YubiKey 5 Nano be used?

Thanks a lot in advance.

Re: HAB4 Secure Boot Keys Stored on YubiKey 5 Nano

AldoG — Sat, 09 Aug 2025 00:44:22 GMT

Hello,

Unfortunately I do not have experience using Yubikey, so I cannot be completely sure if this can be used or not but will double check, as far as I know from your description you want to create a signed image with keys stored in the Yubikey, is this correct?

Best regards/Saludos,
Aldo.

Re: HAB4 Secure Boot Keys Stored on YubiKey 5 Nano

Mihajlo — Mon, 11 Aug 2025 09:35:19 GMT

Yes, that's exactly the case.

The work so far is based on this example from Variscite:

https://variwiki.com/index.php?title=High_Assurance_Boot_MX8&release=RELEASE_HARDKNOTT_V2.3_DART-MX8M-PLUS

and now the final goal is to remove keys from source tree where they are now and use them from a more secure location, i.e.
YubiKey.

So far I have only found one application where keys are used from YubiKey, but unfortunately, that's YubiKey HSM, not YubiKey 5 Nano, and IMHO, those two probably have different firmware and support different key access(es):

https://www.thegoodpenguin.co.uk/blog/i-mx-code-signing-using-a-yubihsm-2-hardware-token-from-yubico/

Re: HAB4 Secure Boot Keys Stored on YubiKey 5 Nano

AldoG — Tue, 12 Aug 2025 18:11:20 GMT

Hello,

I have contacted internal expert team, they do confirm that this should be doable and that it can be used.

Unfortunately as I said before I do not have much experience with yubikey for providing more details on the how.

Best regards/Saludos,
Aldo.

Re: HAB4 Secure Boot Keys Stored on YubiKey 5 Nano

Mihajlo — Mon, 18 Aug 2025 06:36:55 GMT

Yes, that's absolutely correct.

At the moment, and as a proof of concept, the keys are integral part of source tree used in Yocto 3.0 build, but we would like to have them stored only on YubiKey 5 Nano.

Mihajlo

Re: HAB4 Secure Boot Keys Stored on YubiKey 5 Nano

Mihajlo — Wed, 20 Aug 2025 07:32:05 GMT

NOTE: Repeating this reply so it could be easy to follow the conversation.

Yes, that's exactly the case.

The work so far is based on this example from Variscite:

https://variwiki.com/index.php?title=High_Assurance_Boot_MX8&release=RELEASE_HARDKNOTT_V2.3_DART-MX8...

and now the final goal is to remove keys from source tree where they are now and use them from a more secure location, i.e.
YubiKey.

So far I have only found one application where keys are used from YubiKey, but unfortunately, that's YubiKey HSM, not YubiKey 5 Nano, and IMHO, those two probably have different firmware and support different key access(es):

https://www.thegoodpenguin.co.uk/blog/i-mx-code-signing-using-a-yubihsm-2-hardware-token-from-yubico...