S32K312 Secureboot Authentication

[jeongwoo]

When changing to a different FBL while Secureboot is enabled, the META Data values ​​generated via the HMAC Key change. As the FBL is changed, the HSE needs to recalculate the META Data using the HMAC Key; however, because the HMAC Key is deleted due to the new FBL, recalculating the META Data becomes impossible. Consequently, a reset occurs due to a verification failure at the FBL, making it impossible to launch the application. Is there a way to re-authenticate the changed FBL using the HMAC Key, thereby allowing both the FBL and the application to run normally? 

When running the HSE_SRV_ID_SMR_ENTRY_INSTALL service, HseResponse returns 0xA5AA5317. This corresponds to the following definition:

#define HSE_SRV_RSP_KEY_EMPTY ((hseSrvResponse_t)0xA5AA5317UL)

This indicates that the key is empty. (As I asked previously, I suspect this response appears because that region has been erased.)

I have checked the smrEntry values. When I set a breakpoint at the point where SecureBootState is 0, I confirmed that smrEntry was entirely 0. When I set a breakpoint at the return point where Fota_S32k3_SecureBootProcess ends, I confirmed that the values appeared. At the time of return, the SecureBootState value was 1.

I would greatly appreciate it if you could guide me on how to inject the key or otherwise resolve this issue.

1) When a breakpoint is set at if(SecureBootState == 0) / Result: smrEntry = 0

2) A breakpoint at return secureBootProcessResult, the last part of the Fota_S32k3_SecureBootProcess function

[db16122]

All cryptographic keys declared within the NVM and RAM key catalogs, except for the key type HSE_KEY_TYPE_SHE, can be provisioned (i.e. initialized and updated) by the host via a key import service, defined by the structure hseImportKeySrv_t.
The SHE keys is provisioned by the host via services hseSheLoadKeySrv_t or hseSheLoadPlainKeySrv_t.The keys can be installed in plain or encrypted text as shown in the above figure, in the demo all keys are installed in plain text.

Do you try the reference code about S32K344_Update_NVM_keys_related_test at \S32K3_HSE_DemoExamples\?

# Update NVM keys.

## 1. Objective

The main purpose of this example is to a import symmetric key and AES GMAC generate keys.

## 2. Procedure

The steps followed to achieve this are:

1. Format Key Catalogs.

2. Declare the HMAC key info that will update initial version.

3. Declare a key container.

4. Copy the key info to the key container.

5. Copy the key data in the container.

6. *You can add any other data to the container*.

7. Import in RAM a copy of the AES provision key to sign the container using the HSE.

8. Sign the container and generate GMAC

## 3. Hardware

This example requires the following hardware in order to properly execute:

- S32K344-EVB or S32K344-CVB.

- If using S32K344-CVB, then an external debugger is also required (PEmicro Multilink rev. C).

[lukaszadrapa]

Hi @jeongwoo 

It seems that the primary issue currently blocking further progress is that we do not know whether the HMAC key is still available.

As a first step, could you please confirm whether you have performed the check I suggested previously and what the result was?

“To confirm if the key is erased or not, you can use service HSE_SRV_ID_GET_KEY_INFO, structure struct hseGetKeyInfoSrv_t. Using this service, you will get information in hseKeyInfo_t, so you can check the state of key.”

Once we have confirmed the state of the key, we can proceed with the next steps. If the key is missing or has been erased, we can try to install it again. Alternatively, you could also attempt to install the key directly using the same procedure that was originally used during provisioning and see whether the operation succeeds.

Regards,

Lukas