topic Re: Secure Boot selecting key types and sizes in i.MX Processors

Secure Boot selecting key types and sizes

ThomasGu — Thu, 04 Sep 2025 15:06:10 GMT

As there is currently heated debate about which cryptographic methods will still be secure in the future, the question arises as to what keys should be used for Secure Boot.
Currently we have i.MX8M Plus (HAB4) and i.MX8 QuadMax (AHAB).
Questions:

Is it possible to mix key types (e.g. 2 RSA keys and 2 EC keys)?
Which key types should be used to ensure the security of Secure Boot over the next 10 years?

Thanks in Advance
Thomas

Re: Secure Boot selecting key types and sizes

Harvey021 — Mon, 08 Sep 2025 03:49:42 GMT

Would suggest to choose key length, at least, 3K for RSA and 384 for ECC for help. Our HAB/AHAB architecture based on PKI tree to generate key and certificate with one type of key.

Regards

Harvey

Re: Secure Boot selecting key types and sizes

ThomasGu — Wed, 10 Sep 2025 11:21:24 GMT

Hi Harvey

thanks a lot.
Are there any reasons not to use RSA 4096 or ECC-P521? Seems to be supported for i.MX8Plus and QuadMax.

Best Regards
Thomas

Re: Secure Boot selecting key types and sizes

Harvey021 — Thu, 11 Sep 2025 02:00:39 GMT

hi @ThomasGu

Yes, the key length supported. To consider the key security, so I mentioned, at least, to choose 3k and p384. instead of 2k and p256.

Regards

Harvey