i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hi Team, We are currently working on importing a private key to an i.MX95 device following the guidelines in application note AN14898. Environment & References: Target Device: i.MX95 Demo Application: imx_sec_apps/imx-ele-apps SPSDK Version: Latest standard toolset Activities Completed So Far: Installed Python, pip, and the SPSDK toolset. Successfully built both the Host and Device applications. Copied device/bin/ele_key_import and device/scripts/run_test_on_board.sh to our target i.MX95 hardware. Executed the device-side flow to generate nxp_prod_ka_puk.bin. Transferred nxp_prod_ka_puk.bin back to our host environment. Generated SRK keys (secp384r1) using the SPSDK utility according to the SPSDK Documentation since we do not have final production keys yet. Generated the signed_msg.bin on the host side using the standard key import template (with the -k parameter set to secp384r1). Transferred the generated signed_msg.bin to the i.MX95 hardware. Command used to generate signed message: nxpimage signed-msg export -c key_exchange_temp.yaml -w assets Attached key_exchange_temp.yaml for reference. When running run_test_on_board.sh on the i.MX95 target device, all files are found, but the EdgeLock Enclave rejects the signature on the signed message block.Here is our target terminal log: nxp_prod_ka_puk.bin exists. oem_public_key.pem exists. signed_msg.bin exists. Hello, World! Jul 16 2026:06:54:40 9547bbd Signed Message: 728 bytes 02d802890200000000000000b8000000000000000000000000000000000000000000000000000000000000000000000000000000e6a7000000004701000000000000000000000000000000004707000000454c45090102090000000000920001010000000040000009010008000000000100000000000070577819deccdf2670d801e8f4291d3539081da49b1e1b63d55039e5993242b30f0000000000000000000000000000000000000000000000000000000000000000011c029000001000b40100000000000000a4015a01000000d7340143e14c00270102000030003000c2a99777d1fc00dc7e14d3d43ac3f68a44d9b52c882d3c09eac0db7fac1901242576bac6143785e5815db546e385d81000000000000000000000000000000000e14c00270102000030003000e358e1159c0cb645e7059c1b04b49e39b3563167472507278245d4dee439dd32e7ce3da413e397cbd7959cf147d25c2300000000000000000000000000000000e14c00270102000030003000482fb4f1ceb6e266221b0a13dbbb04c637a1c238b76b108397e98eb4557cafb2075036e05b9a0ee4fa6aa09a5f3951e500000000000000000000000000000000e14c00270102000030003000c93a6b4881ae912da31da8249e4f58473eb88cc1dc46f5ec6d363dc52b8a5c12c91e711ad726153d382dabbe6bef27cc000000000000000000000000000000000068005d00000000a5e31e11bfb02c62756d9d3ba5152768e5bea9aab8f3f13ccf3bd287a0438e9708088cafc5671e2aaf1bc3b413457b6a59a691dcef672fa65dac12ed328effac963c41ec0200b0a9acf67e0f2755f752872f77d2c20d6987f80e8008ac26de3d006800d800000000f4cf9cc965b3643d5dc5c5070a506196649daf898d328afd18e88eb9ece96e39646bf6385b9d42e1fc2f93f07f66e9c8c914becef9394c0c3cf549766483c7f94b6a9325bea51b79280eb76484e064637570c0ef7387ec0ffb8398ec36966c3a00000000 OEM Import PUK: 65 bytes 0451c46d24d30864c5275c634a3a339949654b34c0a4f294a8c107c504360ff4b55044918b71b16109a7bbfba8fbcf49b91720ad8e9c0109e6b2eed8f6a504ab64 hsm_open_session success hsm_open_key_store_service success hsm_open_key_management_service success SAB Error: SAB CMD [0x47] Resp [0x1829] - Invalid Signature in SIGNED message. hsm_key_exchange failed err:0xfe Key exchange failed: 254 Any insight on resolving this signature verification issue for the i.MX95 would be greatly appreciated. Thanks, Ankit Agrawal Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hi @Ankit_Agrawal
I am wondering if you burn SRKH after SRK generation. for necessary sign.yaml file please check my attached file.
Please try below command (precondition is you should have flash.bin: bootloader of system) to generate SRKH.
nxpimage ahab sign -c sign.yaml -b flash.bin -o flash_directsign.bin -fs outputs output will be as below.
Jessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.pngJessie_Lee_0-1786699088609.png
and from the ouputs folder, you could see bcf file(ahab_oem0_srk0_hash_nxpele.bcf).
you could follow below fuse command (index 128 ~143) that you need to fuse for SRKH.
# nxpele AHAB SRKH fuses programming script # Generated by SPSDK 3.4.0 # Family: mimx9596, Revision: latest
# Value: 0xCCC0605919B6400771CF88A002FB6BF27DFA9CE09BAD94516DD7E4D399369A8FF5A6A1A671809DF4A71A7CB208B4EDC009CDF3FF25EC074DECBBEE8300D5D44C # Description: SHA512 hash digest of hash of four SRK keys # Grouped register name: SRKH
# OTP ID: OEM_SRKH0, Value: 0x5960C0CC write-fuse --index 128 --data 0x5960C0CC # OTP ID: OEM_SRKH1, Value: 0x0740B619 write-fuse --index 129 --data 0x740B619 # OTP ID: OEM_SRKH2, Value: 0xA088CF71 write-fuse --index 130 --data 0xA088CF71 # OTP ID: OEM_SRKH3, Value: 0xF26BFB02 write-fuse --index 131 --data 0xF26BFB02 # OTP ID: OEM_SRKH4, Value: 0xE09CFA7D write-fuse --index 132 --data 0xE09CFA7D # OTP ID: OEM_SRKH5, Value: 0x5194AD9B write-fuse --index 133 --data 0x5194AD9B # OTP ID: OEM_SRKH6, Value: 0xD3E4D76D write-fuse --index 134 --data 0xD3E4D76D # OTP ID: OEM_SRKH7, Value: 0x8F9A3699 write-fuse --index 135 --data 0x8F9A3699 # OTP ID: OEM_SRKH8, Value: 0xA6A1A6F5 write-fuse --index 136 --data 0xA6A1A6F5 # OTP ID: OEM_SRKH9, Value: 0xF49D8071 write-fuse --index 137 --data 0xF49D8071 # OTP ID: OEM_SRKH10, Value: 0xB27C1AA7 write-fuse --index 138 --data 0xB27C1AA7 # OTP ID: OEM_SRKH11, Value: 0xC0EDB408 write-fuse --index 139 --data 0xC0EDB408 # OTP ID: OEM_SRKH12, Value: 0xFFF3CD09 write-fuse --index 140 --data 0xFFF3CD09 # OTP ID: OEM_SRKH13, Value: 0x4D07EC25 write-fuse --index 141 --data 0x4D07EC25 # OTP ID: OEM_SRKH14, Value: 0x83EEBBEC write-fuse --index 142 --data 0x83EEBBEC # OTP ID: OEM_SRKH15, Value: 0x4CD4D500 write-fuse --index 143 --data 0x4CD4D500
you could use below command to burn SRKH
nxpele -f mimx9596 batch outputs\ahab_oem0_srk0_hash_nxpele.bcf
If you burn the SRKH already but failed with below invalid singing, please share the singed_message.bin to us. with your SRKH (including srk output all).
Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hello @Ankit_Agrawal,
Our internal team is reviewing your issue and will update you accordingly.
In the meantime, please review the case below, which is similar to the issue you are encountering.
The suggested solution is to verify that the fuse_version matches correctly.
https://community.nxp.com/t5/i-MX-Processors/hsm-import-key-returns-with-0xF0-Bad-Signature/td-p/2163777
Thank you.
Best Regards,
Richard Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hi @Jessie_Lee , Thanks for the information. We have located the flash.bin file and are able to perform the necessary steps to generate the SRKH. After generating the SRKH, we need to fuse it to the hardware. To perform the fuse operation, the hardware/board must be in Fastboot mode. Could you please help us switch the device to Fastboot mode? While attempting to fuse the keys, we are encountering the following error: Ankit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.pngAnkit_Agrawal_0-1787636692485.png It appears that the device is not currently in Fastboot mode. Any guidance on how to enable Fastboot mode on the board would be greatly appreciated. Thanks, Ankit Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hi @Ankit_Agrawal
Please follow up below steps to burn SRK using SPSDK
step#1. when you boot device, stop at u-boot console , run
u-boot=> fastboot 0
step#2. In SPSDK console , you must there is no ahab events) using below command.
nxpele -f mimx9596 get-events
step#3. If there is no event, you could burn SRK key now in SPSDK console.
nxpele -f mimx9596 batch outputs\ahab_oem2_srk0_hash_nxpele.bcf
BRs
jessie
Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) @Jessie_Lee It is reported that things are not working as shown below. Is it possible to get some support? -------------------------------------------------------------------------------------------------------------- However, when I execute the command to perform the fuse operation, I encounter the error below. I tried resetting the hardware too, but I'm still facing the same issue. Do you have any ideas on why this might be happening? rakhyoung_0-1789101296622.pngrakhyoung_0-1789101296622.pngrakhyoung_0-1789101296622.pngrakhyoung_0-1789101296622.pngrakhyoung_0-1789101296622.pngrakhyoung_0-1789101296622.pngrakhyoung_0-1789101296622.pngrakhyoung_0-1789101296622.pngrakhyoung_0-1789101296622.png @Ankit_Agrawal Feel free to provide additional explanation if necessary. Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) from @Ankit_Agrawal , there was fastboot entering issue.
@rakhyoung Do you mean you are also having issue to enter fastboot ?
did you try to below command..? that I shared.. above? what is error when you try to below fastboot 0 at uboot stage?
step#1. when you boot device, stop at u-boot console , run
u-boot=> fastboot 0
BRs
jessie
Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hello @Jessie_Lee Sorry for the delayed response. I successfully managed to stop at the U-Boot console on the device side. However, when trying to fuse the key from the host side using the following command: nxpele -f mimx9596 -p /dev/ttyUSB1 batch outputs/ahab_oem2_srk0_hash_nxpele.bcf I encountered the following error: Screenshot from 2026-09-13 21-29-30.pngScreenshot from 2026-09-13 21-29-30.pngScreenshot from 2026-09-13 21-29-30.pngScreenshot from 2026-09-13 21-29-30.pngScreenshot from 2026-09-13 21-29-30.pngScreenshot from 2026-09-13 21-29-30.pngScreenshot from 2026-09-13 21-29-30.png I tried resetting the hardware too, but I'm still facing the same issue. Do you have any ideas on why this might be happening? Thanks, Ankit Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hello @Jessie_Lee , Please find attached logs for the fastboot entry, the host-side steps to check events and fuses, and the debug log file. Thanks, Ankit Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) HI @Ankit_Agrawal
From your attached log, I could not find A core's uboot console log. (target board) when you enter fastboot on uboot console, Could you please check this? Please share full uboot log from POR
it seems that SPSDK detect uboot console by "=>" character.
What's your boot delay value(check by uboot command "printenv bootdelay")? Or can you add the bootdelay with uboot command "setenv bootdelay 3; saveenv" and try again?
BRs
jessie
Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) HI @Ankit_Agrawal
Could you please share all step log from fastboot entering at uboot (console), execute spsdk by host side?
I believe you entered fastboot thru uboot. right?
please share all steps (fastboot entering, ahab event check , try to fuse.. etc on host side log).
It would be helpful to see all logs thru files not snapshot.
BRs
jessie Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hello @Jessie_Lee , Please find the attached logs. I have performed the steps as suggested by you. Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hi @Ankit_Agrawal
I am wondering if you check your uboot log for fastboot entering .
Below is part of your log and it show "unknown command" log. this fastboot is u-boot community feature which NXP's BSP also has but not in your SW env.
You need to discuss with your BSP team if BSP team remove this function.
BTW, NXP shared Updated ELE/V2X FW recently but your FW seems to be not latest.
Please discuss with your security internal team to sync up the FW version. (btw, this FW version is not related with fastboot feature enablement or not)
Jessie_Lee_0-1789613044617.pngJessie_Lee_0-1789613044617.png
BRs
jessie
BRs
jessie
Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hi @Ankit_Agrawal
I checked with your BSP team and fastboot is removed from default u-boot.
So, you could not use fastboot mode directly to fuse SRK.
Instead of SPSDK tool for burning SRK, you could use one of below method. As I know your team already use fuse_access application to handle fuse access (read/write) at kernel level. any method could be okay to burn your srk.
Jessie_Lee_0-1789713874158.png
BRs
jessie
Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hi @Jessie_Lee , Thank you very much for your continued guidance and support as we navigate our integration. We reviewed the proposed procedure and steps for the i.MX95 Secure Enclave, but because the suggested methods require pre-build or static configuration, they will not be feasible for our current architecture. Our implementation strictly requires provisioning and managing keys at run time. Could you let us know if there is an alternative approach or a dedicated Runtime Import Key API available to meet our requirements? For context, the Import Key API is mandatory for our implementation due to two specific use cases: Runtime Certificate Installation: During the flow, the application receives an encrypted contract certificate and private key. After decrypting this on the application side, the private key must be dynamically imported or stored into the Secure environment at run time. Testing and Validation: For our current development and verification phase, we need to inject existing, pre-generated test keys (such as Contract Certificates, and Root Certificate keys) into the application-side Secure environment to validate the end-to-end communication flow and message signatures. We would appreciate your insights on how we can achieve this dynamic injection without a pre-build setup cycle. Best Regards, Ankit Re: i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature) Hi @Ankit_Agrawal
To move further about the way of key import feature, May I ask your current status? Does it work on your side now with our current method?
To review your request for changing the way of key import feature , we need to understand firstly Other end side environment. could you help us to understand your side situation ?
We need to understand "end to end protection" is secure enough
For example,
* How other end generate this encrypted contract certificate and private key?
* Or How the encrypted key of the blob is generated in LG/GM side?
* Could you please provide GM spec or GM spec numbers on this part?
then we can understand your concept and discuss with our security core team to support such way.
BRs
Jessie
View full article