1962722_en-US

[#1]

PUF set key operation fails (PUF_SetUserKey), even after a correct enroll and start

Hi all,

I'm writing a Secure Boot for a client, who chose to use the PUF (Physically Unclonable Function) hardware to encrypt some custom user keys.

The board I'm using is a NXP i.MX RT1172 (MIMXRT1172AVM8A), and I'm debugging using the MCUXpresso IDE (v11.9.1 [Build 2170] [2024-04-19]) and a Segger J-Link to connect with the hardware.
I burned the PUF_ENABLE bit fuse using the MCUXpresso Secure Provisioning Tool so that the PUF operations are enabled.

In my custom Boot program, I call PUF_Init,  then PUF_Enroll (it will be done just the first time, at the production end of line, when its PUF Activation Code is not yet stored on the flash memory), PUF_Deinit + PUF_Init (to "restart" the PUF after the enroll), and finally PUF_Start.
All the above calls return with a success status.

At this point (with the PUF initialized and started), I'd like to save a customer key (that will be passed to the Boot program only during the production end-of-line process): I call PUF_SetUserKey, but this call fails.
I followed the call into the PUF driver function, and I saw that it failed because the SET KEY operation is not allowed:

/* check if SET KEY is allowed */
if (0x0u == (base->ALLOW & PUF_ALLOW_ALLOWSETKEY_MASK))
{
    return kStatus_Fail;
}

Why is that?
Should I do something else before calling the PUF_SetUserKey function?

Thank you very much in advance for any help you will provide (even document references or links where to find more information).
Best regards

Re: PUF set key operation fails (PUF_SetUserKey), even after a correct enroll and start

I realized that because of a stupid problem a file was not saved and in the end, the function PUF_BlockSetKey() was called BEFORE the PUF_SetUserKey instead of being called AFTER it.

I solved the problem of course by requiring PUF_BlockSetKey() to be called after the PUF_SetUserKey.

I'm keeping this post for future reference if anyone finds a similar problem.

Note: two functions block the ENROLL operation and SET KEY operation respectively (PUF_BlockEnroll() and PUF_BlockSetKey()), so please be sure to call those only after the PUF main operations.