i.MX ProcessorsのトピックSecure debug on i.MX93 with NXP keys

Secure debug on i.MX93 with NXP keys

danielgloeckner — Thu, 30 Jul 2026 18:44:57 GMT

The current version of the nxpdebugmbox tool from the SPSDK has a parameter --nxp-keys that is described as "Use the ROM NXP keys to authenticate."

Does this mean that NXP can unlock secure debug on all devices?

If yes, is there any fuse to restrict secure debug to the OEM SRK keys?

Re: Secure debug on i.MX93 with NXP keys

AldoG — Thu, 30 Jul 2026 22:03:46 GMT

Hello,

No, NXP cannot unlock secure debug on OEM devices with --nxp-keys.

The --nxp-keys flag only authenticates the NXP/ELE internal debug domain (using ROM-embedded NXP keys). The OEM SoC debug domain (Cortex-A55, M33, etc.) is completely separate and can only be unlocked with the OEM's own SRK keys.

No additional fuse is needed to enforce this, it is architectural by design. Once the device is in OEM_CLOSED lifecycle with the OEM SRK hash fused, the ELE hardware enforces that NXP keys have zero authority over the OEM debug domain.

Best regards/Saludos,
Aldo.

Re: Secure debug on i.MX93 with NXP keys

danielgloeckner — Thu, 30 Jul 2026 22:22:26 GMT

But if you have control over the ELE, you have access to the DDR memory and can monitor the inputs and outputs of all crypto operations requested by the OEM domain from the ELE domain. You can decrypt all ELE blobs and have therefore access to all secret data stored on the device. And unless writing to DDR memory is prevented, you can inject code into the OEM domain.