Debug authentication Response for MCXW72

[Surdej]

I am trying to unlock the debug port on the MCXW72. Unlocking it with the MCUXpresso Secure Provisioning Tool works correctly, but I am attempting to unlock the port using my own application based on the Debug Credential (DC), the DCK private key, and the DAC received from the device.

The documentation is very unclear in this area (and in some places even incorrect).

As I understand it, the DAR consists of:

DAR = DC + AB + UUID (from DAC) + Signature

(Figure 50 in the Reference Manual shows the UUID and AB fields in the wrong order.)

I would like to calculate the Signature using OpenSSL, however I cannot determine exactly what data should be signed:

a) DC + CV (from DAC)

b) DC + AB + CV (from DAC)

c) DC + AB + UUID (from DAC) + CV (from DAC)

or something else entirely?

The documentation states that the signature binds the DAR to the challenge vector (CV), but it does not clearly specify the exact byte sequence that must be hashed and signed. Could you please clarify the precise data that is used to generate the DAR signature?

[marek-trmac]

Hi @Surdej 

Secure Provisioning Tool is built on top of Secure Provisioning SDK, see https://spsdk.readthedocs.io/en/latest/

This is open source so you can find the answers there.