i.MX91 EdgeLock Enclave key wrap or export?

chris_boger — Tue, 26 May 2026 17:55:04 GMT

On the i.MX91 EdgeLock Enclave, is there a way to export secret or private keys from one unique instance to another?

NXP's PKCS#11 C_WrapKey()/C_UnwrapKey() both return CKR_FUNCTION_NOT_SUPPORTED, inferring that there is no way to wrap an opaque key with an opaque key.

There's also hsm_blob_unblob(). Does this use a device-unique KEK or can I program a common KEK on multiple instances?

Re: i.MX91 EdgeLock Enclave key wrap or export?

yipingwang — Fri, 29 May 2026 01:42:30 GMT

1. No, secret or private keys can't be exported, only public key can be exported.

2. not supported

3. hsm_blob_unblob() does not use a user-programmable or shared KEK. Instead, the blob mechanism relies on an internally derived KEK that is bound to device-specific secrets and contextual parameters.

topic Re: i.MX91 EdgeLock Enclave key wrap or export? in i.MX Processors

i.MX91 EdgeLock Enclave key wrap or export?

Re: i.MX91 EdgeLock Enclave key wrap or export?