topic Re: HAB SRK revoke in i.MX Processors

HAB SRK revoke

yosri_c — Thu, 11 Dec 2025 11:34:45 GMT

Hello NXP Support,

I'm using an RT1176 board with HABv4 (CST 4.0.1). I currently have my image signed using SRK1, but I need to switch to using SRK2 instead. (we're trying to test the image with SRK2 before revoking SRK1)

In my current CSF file, I have:

text

[Install SRK]
File = "..\..\crts\SRK_1_2_3_4_table.bin"
Source index = 0

[Install CSFK]
File = "CSF1_1_sha256_secp256r1_v3_usr_crt.pem"

[Authenticate CSF]

[Install Key]
Verification index = 0
Target index = 2
File = "IMG1_1_sha256_secp256r1_v3_usr_crt.pem"

[Authenticate Data]
Verification index = 2
Engine = CAAM
Engine Configuration = 0
Blocks = 0x80000000 0x0 0x8000 "BOOT.bin"

Could you please explain:

What is the simplest way to change from SRK1 to SRK2?
What changes do I need to make in my CSF file?
Do I only need to change the Source index in [Install SRK] from 0 to 1?

Thank you for your help.

Re: HAB SRK revoke

yosri_c — Thu, 11 Dec 2025 14:38:34 GMT

i tried changing

[Install SRK]
File = "SRK_1_2_3_4_table.bin"
Source index = 1

[Install CSFK]
File = "CSF2_1_sha256_secp256r1_v3_usr_crt.pem"

[Install Key]
Verification index = 0
Target index = 2
File = "IMG2_1_sha256_secp256r1_v3_usr_crt.pem"

to eventually use SRK 2 but i get these events

Re: HAB SRK revoke

Bio_TICFSL — Fri, 12 Dec 2025 14:02:39 GMT

Hello,

Yes, the simplest way to change from using SRK1 to SRK2 is to modify the Source index parameter in the [Install SRK] section of your CSF file from 0 to 1.

In your current CSF file:
```
[Install SRK]
File = "..\..\crts\SRK_1_2_3_4_table.bin"
Source index = 0
```

You should change this to:
```
[Install SRK]
File = "..\..\crts\SRK_1_2_3_4_table.bin"
Source index = 1
```

The Source index parameter determines which key in the SRK table will be used. Index 0 corresponds to SRK1, index 1 to SRK2, and so on.

You will also need to reference the appropriate certificate files for CSF2 and IMG2 instead of CSF1 and IMG1 in your CSF file, replacing:
- "CSF1_1_sha256_secp256r1_v3_usr_crt.pem" with "CSF2_1_sha256_secp256r1_v3_usr_crt.pem"
- "IMG1_1_sha256_secp256r1_v3_usr_crt.pem" with "IMG2_1_sha256_secp256r1_v3_usr_crt.pem"

This approach allows you to test using SRK2 before permanently revoking SRK1.

Regards

Re: HAB SRK revoke

yosri_c — Fri, 19 Dec 2025 09:59:51 GMT

@Bio Thank you for your previous clarifications.

I have a critical follow-up regarding the security logic and the SRK migration process during a firmware update.

Our Current Scenario: Normal Boot: The device boots using SRK1 (Index 0). The chain of trust is fully established: ROM -> Bootloader (SRK1) -> Application (SRK1).

Firmware Update: While the system is running under the trust of SRK1, we download a new full image (BS + App) into SDRAM, signed with SRK2 (Index 1).

Verification: The currently running Bootloader calls hab_rvt.authenticate_image() to verify the new image in SDRAM.

My questions are:

1. Regarding runtime SRK switching: Can you confirm that the HAB library allows the execution of a new [Install SRK] command with Source index = 1 (SRK2) within the same power cycle, even if SRK1 was used for the initial boot?

2. Regarding revocation in the same cycle: Would it be possible, during this update process, to revoke SRK1 (by burning the SRK_REVOKE eFuse), then install SRK2 and perform the verification of the new RAM image, all within the same power cycle? Thank you

Re: HAB SRK revoke

yosri_c — Tue, 23 Dec 2025 10:20:11 GMT

@Bio_TICFSL

can you assist please , anything would be helpful

Thank you