S32K312 Secureboot Authentication When changing to a different FBL while Secureboot is enabled, the META Data values generated via the HMAC Key change. As the FBL is changed, the HSE needs to recalculate the META Data using the HMAC Key; however, because the HMAC Key is deleted due to the new FBL, recalculating the META Data becomes impossible. Consequently, a reset occurs due to a verification failure at the FBL, making it impossible to launch the application. Is there a way to re-authenticate the changed FBL using the HMAC Key, thereby allowing both the FBL and the application to run normally? When running the HSE_SRV_ID_SMR_ENTRY_INSTALL service, HseResponse returns 0xA5AA5317. This corresponds to the following definition: #define HSE_SRV_RSP_KEY_EMPTY ((hseSrvResponse_t)0xA5AA5317UL) This indicates that the key is empty. (As I asked previously, I suspect this response appears because that region has been erased.) I have checked the smrEntry values. When I set a breakpoint at the point where SecureBootState is 0, I confirmed that smrEntry was entirely 0. When I set a breakpoint at the return point where Fota_S32k3_SecureBootProcess ends, I confirmed that the values appeared. At the time of return, the SecureBootState value was 1. I would greatly appreciate it if you could guide me on how to inject the key or otherwise resolve this issue. 1) When a breakpoint is set at if(SecureBootState == 0) / Result: smrEntry = 0 2) A breakpoint at return secureBootProcessResult, the last part of the Fota_S32k3_SecureBootProcess function Re: S32K312 Secureboot Authentication All cryptographic keys declared within the NVM and RAM key catalogs, except for the key type HSE_KEY_TYPE_SHE, can be provisioned (i.e. initialized and updated) by the host via a key import service, defined by the structure hseImportKeySrv_t. The SHE keys is provisioned by the host via services hseSheLoadKeySrv_t or hseSheLoadPlainKeySrv_t.The keys can be installed in plain or encrypted text as shown in the above figure, in the demo all keys are installed in plain text. Do you try the reference code about S32K344_Update_NVM_keys_related_test at \S32K3_HSE_DemoExamples\? # Update NVM keys. ## 1. Objective The main purpose of this example is to a import symmetric key and AES GMAC generate keys. ## 2. Procedure The steps followed to achieve this are: 1. Format Key Catalogs. 2. Declare the HMAC key info that will update initial version. 3. Declare a key container. 4. Copy the key info to the key container. 5. Copy the key data in the container. 6. *You can add any other data to the container*. 7. Import in RAM a copy of the AES provision key to sign the container using the HSE. 8. Sign the container and generate GMAC ## 3. Hardware This example requires the following hardware in order to properly execute: - S32K344-EVB or S32K344-CVB. - If using S32K344-CVB, then an external debugger is also required (PEmicro Multilink rev. C). Re: S32K312 Secureboot Authentication Hi @jeongwoo
It seems that the primary issue currently blocking further progress is that we do not know whether the HMAC key is still available.
As a first step, could you please confirm whether you have performed the check I suggested previously and what the result was?
“To confirm if the key is erased or not, you can use service HSE_SRV_ID_GET_KEY_INFO, structure struct hseGetKeyInfoSrv_t. Using this service, you will get information in hseKeyInfo_t, so you can check the state of key.”
Once we have confirmed the state of the key, we can proceed with the next steps. If the key is missing or has been erased, we can try to install it again. Alternatively, you could also attempt to install the key directly using the same procedure that was originally used during provisioning and see whether the operation succeeds.
Regards,
Lukas Re: S32K312 Secureboot Authentication A key can be imported or update by HSE service HSE_SRV_ID_IMPORT_KEY.
Take a look at these tables in HSE Firmware reference manual rev. 2.7:
Table 47. Key provisioning usage when importing a key in an empty slot in the NVM key catalog
Table 48. Key provisioning usage when updating a key (non-empty slot) in the NVM Key Catalog
This explains when a key can be imported in plain and when authentication and encryption is needed.
If a key slot is empty and you have SU rights, a key can be imported in plain without authentication. If a key slot is not empty (you are updating a key) and you have SU rights, authentication is mandatory and encryption is optional.
With user rights only, authentication and encryption is always mandatory regardless of fact that a slot is empty or not.
S32K344_Update_NVM_keys_related_test example only shows, how to prepare and sign a key container which is needed for authenticated key import. But the key is not imported in this example.
Import of a key is shown in S32K344_AES_EncryptDecrypt, for example. Used API for AES key is LoadAesKey in this project. For HMAC, there’s LoadHmacKey API. This can be used for import of HMAC key in plain without authentication or encryption. Re: S32K312 Secureboot Authentication If Crypto driver is used, a key can be imported using API Crypto_43_HSE_KeyElementSet and Crypto_43_HSE_KeySetValid.
You can check RTD SW example like this one (or similar, depending or RTD version you have):
c:\NXP\SW32K3_S32M27x_RTD_R23-11_7.0.0_QLP02\eclipse\plugins\Crypto_43_HSE_TS_T40D34M70I0R0\examples\S32DS\S32K3XX\Crypto_43_HSE_SymmetricPrimitives_S32K388\
There’s no API to request super user rights in Crypto module.
The procedure is described in section “8.5 Request for Super User rights” in HSE firmware reference manual rev. 2.7.
You can also follow function Grant_SuperUser_Rights() in file hse_crypto.c which can be found in HSE DemoExamples package:
https://www.nxp.com/webapp/Download?colCode=S32K3_HSE_DemoExamples
Regards,
Lukas Re: S32K312 Secureboot Authentication Hello Lukas I defined and called the HSE_SRV_ID_GET_KEY_INFO API you mentioned in Crypto_hse.c. However, the If statement in GetKeyInfo is not entered, so I am unable to reference the KeyInfo value. If the key is missing or has been erased, you can try installing it again. Alternatively, could you guide me on how to install the key directly using the same procedure used during provisioning and verify if that operation succeeds? I proceeded by importing a new HSE and adding a different FBL in the Life-Cycle In-Field. How can I obtain SU privileges?
View full article
