2405146_en-US

是

i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature)

Hi Team,

We are currently working on importing a private key to an i.MX95 device following the guidelines in application note AN14898.

Environment & References:

Target Device: i.MX95
Demo Application: imx_sec_apps/imx-ele-apps
SPSDK Version: Latest standard toolset

Activities Completed So Far:

Installed Python, pip, and the SPSDK toolset.
Successfully built both the Host and Device applications.
Copied device/bin/ele_key_import and device/scripts/run_test_on_board.sh to our target i.MX95 hardware.
Executed the device-side flow to generate nxp_prod_ka_puk.bin.
Transferred nxp_prod_ka_puk.bin back to our host environment.
Generated SRK keys (secp384r1) using the SPSDK utility according to the SPSDK Documentation since we do not have final production keys yet.
Generated the signed_msg.bin on the host side using the standard key import template (with the -k parameter set to secp384r1).
Transferred the generated signed_msg.bin to the i.MX95 hardware.
Command used to generate signed message:
nxpimage signed-msg export -c key_exchange_temp.yaml -w assets
Attached key_exchange_temp.yaml for reference.
When running run_test_on_board.sh on the i.MX95 target device, all files are found, but the EdgeLock Enclave rejects the signature on the signed message block.Here is our target terminal log:

nxp_prod_ka_puk.bin exists.
oem_public_key.pem exists.
signed_msg.bin exists.
Hello, World! Jul 16 2026:06:54:40 9547bbd
Signed Message: 728 bytes
02d802890200000000000000b8000000000000000000000000000000000000000000000000000000000000000000000000000000e6a7000000004701000000000000000000000000000000004707000000454c45090102090000000000920001010000000040000009010008000000000100000000000070577819deccdf2670d801e8f4291d3539081da49b1e1b63d55039e5993242b30f0000000000000000000000000000000000000000000000000000000000000000011c029000001000b40100000000000000a4015a01000000d7340143e14c00270102000030003000c2a99777d1fc00dc7e14d3d43ac3f68a44d9b52c882d3c09eac0db7fac1901242576bac6143785e5815db546e385d81000000000000000000000000000000000e14c00270102000030003000e358e1159c0cb645e7059c1b04b49e39b3563167472507278245d4dee439dd32e7ce3da413e397cbd7959cf147d25c2300000000000000000000000000000000e14c00270102000030003000482fb4f1ceb6e266221b0a13dbbb04c637a1c238b76b108397e98eb4557cafb2075036e05b9a0ee4fa6aa09a5f3951e500000000000000000000000000000000e14c00270102000030003000c93a6b4881ae912da31da8249e4f58473eb88cc1dc46f5ec6d363dc52b8a5c12c91e711ad726153d382dabbe6bef27cc000000000000000000000000000000000068005d00000000a5e31e11bfb02c62756d9d3ba5152768e5bea9aab8f3f13ccf3bd287a0438e9708088cafc5671e2aaf1bc3b413457b6a59a691dcef672fa65dac12ed328effac963c41ec0200b0a9acf67e0f2755f752872f77d2c20d6987f80e8008ac26de3d006800d800000000f4cf9cc965b3643d5dc5c5070a506196649daf898d328afd18e88eb9ece96e39646bf6385b9d42e1fc2f93f07f66e9c8c914becef9394c0c3cf549766483c7f94b6a9325bea51b79280eb76484e064637570c0ef7387ec0ffb8398ec36966c3a00000000
OEM Import PUK: 65 bytes
0451c46d24d30864c5275c634a3a339949654b34c0a4f294a8c107c504360ff4b55044918b71b16109a7bbfba8fbcf49b91720ad8e9c0109e6b2eed8f6a504ab64
hsm_open_session success
hsm_open_key_store_service success
hsm_open_key_management_service success
SAB Error: SAB CMD [0x47] Resp [0x1829] - Invalid Signature in SIGNED message.
hsm_key_exchange failed err:0xfe
Key exchange failed: 254

Any insight on resolving this signature verification issue for the i.MX95 would be greatly appreciated.
Thanks,
Ankit Agrawal

Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature)

Hi @Ankit_Agrawal

I am wondering if you burn SRKH after SRK generation. for necessary sign.yaml file please check my attached file.

Please try below command (precondition is you should have flash.bin: bootloader of system) to generate SRKH.

nxpimage ahab sign -c sign.yaml -b flash.bin -o flash_directsign.bin -fs outputs
output will be as below.

and from the ouputs folder, you could see bcf file(ahab_oem0_srk0_hash_nxpele.bcf).

you could follow below fuse command (index 128 ~143) that you need to fuse for SRKH.

# nxpele AHAB SRKH fuses programming script
# Generated by SPSDK 3.4.0
# Family: mimx9596, Revision: latest

# Value: 0xCCC0605919B6400771CF88A002FB6BF27DFA9CE09BAD94516DD7E4D399369A8FF5A6A1A671809DF4A71A7CB208B4EDC009CDF3FF25EC074DECBBEE8300D5D44C
# Description: SHA512 hash digest of hash of four SRK keys
# Grouped register name: SRKH

# OTP ID: OEM_SRKH0, Value: 0x5960C0CC
write-fuse --index 128 --data 0x5960C0CC
# OTP ID: OEM_SRKH1, Value: 0x0740B619
write-fuse --index 129 --data 0x740B619
# OTP ID: OEM_SRKH2, Value: 0xA088CF71
write-fuse --index 130 --data 0xA088CF71
# OTP ID: OEM_SRKH3, Value: 0xF26BFB02
write-fuse --index 131 --data 0xF26BFB02
# OTP ID: OEM_SRKH4, Value: 0xE09CFA7D
write-fuse --index 132 --data 0xE09CFA7D
# OTP ID: OEM_SRKH5, Value: 0x5194AD9B
write-fuse --index 133 --data 0x5194AD9B
# OTP ID: OEM_SRKH6, Value: 0xD3E4D76D
write-fuse --index 134 --data 0xD3E4D76D
# OTP ID: OEM_SRKH7, Value: 0x8F9A3699
write-fuse --index 135 --data 0x8F9A3699
# OTP ID: OEM_SRKH8, Value: 0xA6A1A6F5
write-fuse --index 136 --data 0xA6A1A6F5
# OTP ID: OEM_SRKH9, Value: 0xF49D8071
write-fuse --index 137 --data 0xF49D8071
# OTP ID: OEM_SRKH10, Value: 0xB27C1AA7
write-fuse --index 138 --data 0xB27C1AA7
# OTP ID: OEM_SRKH11, Value: 0xC0EDB408
write-fuse --index 139 --data 0xC0EDB408
# OTP ID: OEM_SRKH12, Value: 0xFFF3CD09
write-fuse --index 140 --data 0xFFF3CD09
# OTP ID: OEM_SRKH13, Value: 0x4D07EC25
write-fuse --index 141 --data 0x4D07EC25
# OTP ID: OEM_SRKH14, Value: 0x83EEBBEC
write-fuse --index 142 --data 0x83EEBBEC
# OTP ID: OEM_SRKH15, Value: 0x4CD4D500
write-fuse --index 143 --data 0x4CD4D500

you could use below command to burn SRKH

nxpele -f mimx9596 batch outputs\ahab_oem0_srk0_hash_nxpele.bcf

If you burn the SRKH already but failed with below invalid singing, please share the singed_message.bin to us. with your SRKH (including srk output all).

Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature)

Hello @Ankit_Agrawal,

Our internal team is reviewing your issue and will update you accordingly.

In the meantime, please review the case below, which is similar to the issue you are encountering.

The suggested solution is to verify that the fuse_version matches correctly.

https://community.nxp.com/t5/i-MX-Processors/hsm-import-key-returns-with-0xF0-Bad-Signature/td-p/216...

Thank you.

Best Regards,

Richard