topic Re: Even if SuperRootKey differ, in Open-Mode, we can see No HAB Event. in i.MX Processors

Even if SuperRootKey differ, in Open-Mode, we can see No HAB Event.

george — Mon, 10 Aug 2015 03:46:37 GMT

Dear All,

We certified Code using cst-2.3.1.

It is working correctly in Open-Mode and Closed-Mode.

However, we have one question.

The device which burned different SuperRootKey is not boot in Closed-Mode-Configuration.

However, Also on the device which burned different SuperRootKey in Open-Mode-Configuration, we can see No HAB Event.

I can understand boot also on device which burned different SuperRootKey in Open-Mode-Configuration, and I think that it has some HAB Event.

However, it does not have HAB Event.

Is this the correct behavior?

Best Regards,

George

Re: Even if SuperRootKey differ, in Open-Mode, we can see No HAB Event.

Yuri — Mon, 10 Aug 2015 05:35:32 GMT

George, hello !

As known (app note AN4581), the first step, performed by HAB, during secure boot
is to install the SRK. The boot ROM calculates SHA-256 hash of the SRK table, attached
to the binary CSF data, and checks it, using the reference value from the OTP fuses.
So, SRK modifying will provide HAB issues.

Please check carefully all stage of HAB usage in Your case. Please refer to the

following

“Mx6 HAB (High Assurance Boot)”

https://community.freescale.com/docs/DOC-96451

Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: Even if SuperRootKey differ, in Open-Mode, we can see No HAB Event.

george — Wed, 19 Aug 2015 14:37:57 GMT

Dear Yuri,

Sorry, late reply.

We check setting for HAB again.

Thanks,

George

Re: Even if SuperRootKey differ, in Open-Mode, we can see No HAB Event.

george — Thu, 20 Aug 2015 18:37:14 GMT

Dear Yuri,

I found the following descriptions in AN4581 which you showed.

Doesn't this mean that our experience was the correct behavior?

---------

7 Troubleshooting

7.1 SRK Authentication for i.MX 6 Series in Open Configuration

There is a known limitation about the verification of the SRK table in the ROM of i.MX 6 Series devices.

In these devices, the intent was to only verify the SRK table hash, when the SRK fuse field was non-zero

for Open configuration. However, for i.MX 6 Series in Open configuration, the HAB always skips the

verification of the SRK table, regardless of whether the SRK fuse field has been provisioned or not.

This means that it is necessary to ensure that the SRK field is correctly programmed, prior to moving the

i.MX 6 Series security configuration to Closed. It is highly recommended to use the srktool included as

part of the CST release. The byte ordering of the SRK table hash value should be correct to ensure proper

operation.

NOTE

Failing to follow the steps in provisioning the SRK hash eFuses correctly

results in a device that will not boot in Closed configuration.

---------

Best Regards,

George

Re: Even if SuperRootKey differ, in Open-Mode, we can see No HAB Event.

Yuri — Fri, 21 Aug 2015 08:54:39 GMT

Correct.

Re: Even if SuperRootKey differ, in Open-Mode, we can see No HAB Event.

george — Fri, 21 Aug 2015 09:02:13 GMT

Hi Yuri,

Thank you for the reply.

BR,

George