topic Re: testEcAttestationChain&testRsaAttestationChain Failed in Other NXP Products

testEcAttestationChain&testRsaAttestationChain Failed

wenbo_he — Wed, 15 Jan 2020 07:50:33 GMT

Dear NXP's expert,

I am running though the Android GTS test packages and getting a number of failures.

testEcAttestationChain&testRsaAttestationChain Failed.

I have got the googlekey file attest_keyboxes.xxx-nxp.output.

My question is how to make it work on the device?

Could you please give me some guidance documents.

Thanks in advanced !

B.R.

Re: testEcAttestationChain&testRsaAttestationChain Failed

nxf45548 — Thu, 30 Jan 2020 18:01:27 GMT

To assist you properly, can you please let us know the part number that you are using.

Re: testEcAttestationChain&testRsaAttestationChain Failed

wenbo_he — Tue, 18 Feb 2020 07:12:50 GMT

Hardware : Freescale i.MX6 Quad/DualLite (Device Tree)

Re: testEcAttestationChain&testRsaAttestationChain Failed

joanxie — Thu, 20 Feb 2020 05:53:10 GMT

I found this link, maybe customer can check google key first,

https://www.itread01.com/content/1541408407.html

Re: testEcAttestationChain&testRsaAttestationChain Failed

wenbo_he — Mon, 24 Feb 2020 09:40:15 GMT

Dear Joan,

I've got the attestation "keybox" from Google.
I want to know how to flash the attestation keys to device i.MX6.

Thanks.

Re: testEcAttestationChain&testRsaAttestationChain Failed

joanxie — Tue, 25 Feb 2020 08:27:56 GMT

it seems that you need refer to the security user guide which is under NDA, so you need to get NDA first

Re: testEcAttestationChain&testRsaAttestationChain Failed

wenbo_he — Tue, 25 Feb 2020 09:15:31 GMT

Dear Joan,

I found some program attestation key commands from Android_User's_Guide.pdf,
which is downloaded from https://community.nxp.com/servlet/JiveServlet/download/1267028-1-465427/Android_User%27s_Guide.pdf
content as following,
8.11 Key attestation
Fastboot commands are provided to provision the attestation keys and certificates. Make sure the secure storage is properlyinitialized for Trusty OS:
• Set RSA private key:
fastboot stage <path-to-rsa-private-key>
fastboot oem set-rsa-atte-key

Unfortunately, the above command is not supported on imx6.
Could you tell me if the method in the security user guide is the same as the above?
If not, how can I apply for the NDA?

Thanks.

Re: testEcAttestationChain&testRsaAttestationChain Failed

joanxie — Fri, 28 Feb 2020 06:10:28 GMT

for NDA, you need to contact local representative or create a case in salesforce:
Distributor Network | NXP

https://community.nxp.com/docs/DOC-329745