- Target Device: i.MX95
- Demo Application: imx_sec_apps/imx-ele-apps
- SPSDK Version: Latest standard toolset
- Installed Python, pip, and the SPSDK toolset.
- Successfully built both the Host and Device applications.
- Copied device/bin/ele_key_import and device/scripts/run_test_on_board.sh to our target i.MX95 hardware.
- Executed the device-side flow to generate nxp_prod_ka_puk.bin.
- Transferred nxp_prod_ka_puk.bin back to our host environment.
- Generated SRK keys (secp384r1) using the SPSDK utility according to the SPSDK Documentation since we do not have final production keys yet.
- Generated the signed_msg.bin on the host side using the standard key import template (with the -k parameter set to secp384r1).
- Transferred the generated signed_msg.bin to the i.MX95 hardware.
Command used to generate signed message:
nxpimage signed-msg export -c key_exchange_temp.yaml -w assets
Attached key_exchange_temp.yaml for reference. - When running run_test_on_board.sh on the i.MX95 target device, all files are found, but the EdgeLock Enclave rejects the signature on the signed message block.Here is our target terminal log:
nxp_prod_ka_puk.bin exists.
oem_public_key.pem exists.
signed_msg.bin exists.
Hello, World! Jul 16 2026:06:54:40 9547bbd
Signed Message: 728 bytes
02d802890200000000000000b8000000000000000000000000000000000000000000000000000000000000000000000000000000e6a7000000004701000000000000000000000000000000004707000000454c45090102090000000000920001010000000040000009010008000000000100000000000070577819deccdf2670d801e8f4291d3539081da49b1e1b63d55039e5993242b30f0000000000000000000000000000000000000000000000000000000000000000011c029000001000b40100000000000000a4015a01000000d7340143e14c00270102000030003000c2a99777d1fc00dc7e14d3d43ac3f68a44d9b52c882d3c09eac0db7fac1901242576bac6143785e5815db546e385d81000000000000000000000000000000000e14c00270102000030003000e358e1159c0cb645e7059c1b04b49e39b3563167472507278245d4dee439dd32e7ce3da413e397cbd7959cf147d25c2300000000000000000000000000000000e14c00270102000030003000482fb4f1ceb6e266221b0a13dbbb04c637a1c238b76b108397e98eb4557cafb2075036e05b9a0ee4fa6aa09a5f3951e500000000000000000000000000000000e14c00270102000030003000c93a6b4881ae912da31da8249e4f58473eb88cc1dc46f5ec6d363dc52b8a5c12c91e711ad726153d382dabbe6bef27cc000000000000000000000000000000000068005d00000000a5e31e11bfb02c62756d9d3ba5152768e5bea9aab8f3f13ccf3bd287a0438e9708088cafc5671e2aaf1bc3b413457b6a59a691dcef672fa65dac12ed328effac963c41ec0200b0a9acf67e0f2755f752872f77d2c20d6987f80e8008ac26de3d006800d800000000f4cf9cc965b3643d5dc5c5070a506196649daf898d328afd18e88eb9ece96e39646bf6385b9d42e1fc2f93f07f66e9c8c914becef9394c0c3cf549766483c7f94b6a9325bea51b79280eb76484e064637570c0ef7387ec0ffb8398ec36966c3a00000000OEM Import PUK: 65 bytes
0451c46d24d30864c5275c634a3a339949654b34c0a4f294a8c107c504360ff4b55044918b71b16109a7bbfba8fbcf49b91720ad8e9c0109e6b2eed8f6a504ab64hsm_open_session success
hsm_open_key_store_service success
hsm_open_key_management_service successSAB Error: SAB CMD [0x47] Resp [0x1829] - Invalid Signature in SIGNED message.
hsm_key_exchange failed err:0xfe
Thanks,
Key exchange failed: 254
Any insight on resolving this signature verification issue for the i.MX95 would be greatly appreciated.
Ankit Agrawal
I am wondering if you burn SRKH after SRK generation. for necessary sign.yaml file please check my attached file.
Please try below command (precondition is you should have flash.bin: bootloader of system) to generate SRKH.
nxpimage ahab sign -c sign.yaml -b flash.bin -o flash_directsign.bin -fs outputs
output will be as below.
and from the ouputs folder, you could see bcf file(ahab_oem0_srk0_hash_nxpele.bcf).
you could follow below fuse command (index 128 ~143) that you need to fuse for SRKH.
# nxpele AHAB SRKH fuses programming script
# Generated by SPSDK 3.4.0
# Family: mimx9596, Revision: latest
# Value: 0xCCC0605919B6400771CF88A002FB6BF27DFA9CE09BAD94516DD7E4D399369A8FF5A6A1A671809DF4A71A7CB208B4EDC009CDF3FF25EC074DECBBEE8300D5D44C
# Description: SHA512 hash digest of hash of four SRK keys
# Grouped register name: SRKH
# OTP ID: OEM_SRKH0, Value: 0x5960C0CC
write-fuse --index 128 --data 0x5960C0CC
# OTP ID: OEM_SRKH1, Value: 0x0740B619
write-fuse --index 129 --data 0x740B619
# OTP ID: OEM_SRKH2, Value: 0xA088CF71
write-fuse --index 130 --data 0xA088CF71
# OTP ID: OEM_SRKH3, Value: 0xF26BFB02
write-fuse --index 131 --data 0xF26BFB02
# OTP ID: OEM_SRKH4, Value: 0xE09CFA7D
write-fuse --index 132 --data 0xE09CFA7D
# OTP ID: OEM_SRKH5, Value: 0x5194AD9B
write-fuse --index 133 --data 0x5194AD9B
# OTP ID: OEM_SRKH6, Value: 0xD3E4D76D
write-fuse --index 134 --data 0xD3E4D76D
# OTP ID: OEM_SRKH7, Value: 0x8F9A3699
write-fuse --index 135 --data 0x8F9A3699
# OTP ID: OEM_SRKH8, Value: 0xA6A1A6F5
write-fuse --index 136 --data 0xA6A1A6F5
# OTP ID: OEM_SRKH9, Value: 0xF49D8071
write-fuse --index 137 --data 0xF49D8071
# OTP ID: OEM_SRKH10, Value: 0xB27C1AA7
write-fuse --index 138 --data 0xB27C1AA7
# OTP ID: OEM_SRKH11, Value: 0xC0EDB408
write-fuse --index 139 --data 0xC0EDB408
# OTP ID: OEM_SRKH12, Value: 0xFFF3CD09
write-fuse --index 140 --data 0xFFF3CD09
# OTP ID: OEM_SRKH13, Value: 0x4D07EC25
write-fuse --index 141 --data 0x4D07EC25
# OTP ID: OEM_SRKH14, Value: 0x83EEBBEC
write-fuse --index 142 --data 0x83EEBBEC
# OTP ID: OEM_SRKH15, Value: 0x4CD4D500
write-fuse --index 143 --data 0x4CD4D500
you could use below command to burn SRKH
nxpele -f mimx9596 batch outputs\ahab_oem0_srk0_hash_nxpele.bcf
If you burn the SRKH already but failed with below invalid singing, please share the singed_message.bin to us. with your SRKH (including srk output all).
Hello @Ankit_Agrawal,
The suggested solution is to verify that the fuse_version matches correctly.
Thank you.
Best Regards,
Richard
Hi @Jessie_Lee ,
Thanks for the information.
We have located the flash.bin file and are able to perform the necessary steps to generate the SRKH.
After generating the SRKH, we need to fuse it to the hardware. To perform the fuse operation, the hardware/board must be in Fastboot mode. Could you please help us switch the device to Fastboot mode?
While attempting to fuse the keys, we are encountering the following error:
It appears that the device is not currently in Fastboot mode. Any guidance on how to enable Fastboot mode on the board would be greatly appreciated.
Thanks,
Ankit
Please follow up below steps to burn SRK using SPSDK
step#1. when you boot device, stop at u-boot console , run
u-boot=> fastboot 0
step#2. In SPSDK console , you must there is no ahab events) using below command.
nxpele -f mimx9596 get-events
step#3. If there is no event, you could burn SRK key now in SPSDK console.
nxpele -f mimx9596 batch outputs\ahab_oem2_srk0_hash_nxpele.bcf
BRs
jessie
@Jessie_Lee
It is reported that things are not working as shown below. Is it possible to get some support?
--------------------------------------------------------------------------------------------------------------
However, when I execute the command to perform the fuse operation, I encounter the error below.
I tried resetting the hardware too, but I'm still facing the same issue. Do you have any ideas on why this might be happening?
@Ankit_Agrawal
Feel free to provide additional explanation if necessary.
from @Ankit_Agrawal , there was fastboot entering issue.
@rakhyoung Do you mean you are also having issue to enter fastboot ?
did you try to below command..? that I shared.. above? what is error when you try to below fastboot 0 at uboot stage?
step#1. when you boot device, stop at u-boot console , run
u-boot=> fastboot 0
BRs
jessie
Hello @Jessie_Lee
Sorry for the delayed response.
I successfully managed to stop at the U-Boot console on the device side. However, when trying to fuse the key from the host side using the following command:
nxpele -f mimx9596 -p /dev/ttyUSB1 batch outputs/ahab_oem2_srk0_hash_nxpele.bcf
I encountered the following error:
I tried resetting the hardware too, but I'm still facing the same issue. Do you have any ideas on why this might be happening?
Thanks,
Ankit
Hello @Jessie_Lee ,
Please find attached logs for the fastboot entry, the host-side steps to check events and fuses, and the debug log file.
Thanks,
Ankit
From your attached log, I could not find A core's uboot console log. (target board) when you enter fastboot on uboot console, Could you please check this? Please share full uboot log from POR
it seems that SPSDK detect uboot console by "=>" character.
What's your boot delay value(check by uboot command "printenv bootdelay")? Or can you add the bootdelay with uboot command "setenv bootdelay 3; saveenv" and try again?
BRs
jessie
Could you please share all step log from fastboot entering at uboot (console), execute spsdk by host side?
I believe you entered fastboot thru uboot. right?
please share all steps (fastboot entering, ahab event check , try to fuse.. etc on host side log).
It would be helpful to see all logs thru files not snapshot.
BRs
jessie
Hello @Jessie_Lee ,
Please find the attached logs. I have performed the steps as suggested by you.
I am wondering if you check your uboot log for fastboot entering .
Below is part of your log and it show "unknown command" log. this fastboot is u-boot community feature which NXP's BSP also has but not in your SW env.
You need to discuss with your BSP team if BSP team remove this function.
BTW, NXP shared Updated ELE/V2X FW recently but your FW seems to be not latest.
Please discuss with your security internal team to sync up the FW version. (btw, this FW version is not related with fastboot feature enablement or not)
BRs
jessie
BRs
jessie