Secure Boot Fuse programming I have a question regarding SRK hash fuse protection and secure boot on the i.MX RT1024. The SRK hash is 256 bits, stored across eight 32-bit OCOTP fuse words. Since OTP fuses can only be programmed from 0 to 1, some bits in the expected SRK hash will intentionally remain 0. My concern is that, even after programming all eight SRK hash words correctly, an unintended or unauthorized write could change an intentionally zero bit to 1. This would permanently modify the stored SRK hash and cause HAB authentication to fail. Could you please clarify the following? SRK hash write protection: On the i.MX RT1024, does programming SEC_CONFIG to enable closed mode prevent further programming of the SRK hash fuse words (OCOTP addresses 0x18–0x1F)? Dedicated lock mechanism: Is there a separate fuse or hardware mechanism to permanently prevent further modification of the SRK hash after provisioning? If so, could you please specify the relevant fuse addresses and the procedure to enable this protection? Protection of intentional zero bits: If an SRK hash bit is 0 in the expected hash, what prevents that bit from being unintentionally or maliciously programmed to 1 after the device has been provisioned? Re: Secure Boot Fuse programming Hi @Abhay2080 ,
Thanks for your questions!
1. Closed mode only tells the ROM to reject images that fail HAB authentication. It does not write-protect OTP fuse. The SRK hash words can still be programmed after the device is closed.
2. Based on internal feedback, SRK_LOCK must not be used on the RT1024, as it can prevent the ROM from correctly reading the SRK hash and cause boot failure. Therefore, we cannot recommend a fuse address or programming procedure for permanently locking this region.
Within the RT10xx series, only the RT1010 supports the LOCK function. For the RT11xx series, fuses are generally programmed on a word-by-word basis, and they incorporate ECC protection; therefore, there is no need to worry about bit 0 being altered again.
Please check AN12800 for more details.
3. Closed mode alone does not prevent these bits from being programmed to 1. The recommended mitigation is runtime access control and privilege separation: restrict access to the OCOTP programming registers to trusted privileged code and prevent ordinary application code from accessing them. This reduces the risk of unintended or unauthorized programming; it is not a permanent fuse write lock.
I hope this clarification helps!
Best regards, Gavin
View full article