How to revert Platform SCP03 keys back to default using se05x_TP_PlatformSCP03keys.c?

[Uc_S]

Hello NXP Community,

I am working with the SE051 secure element and would like to ask how to properly revert the Platform SCP03 keys back to their default values using the Plug and Trust Middleware.

What I have done so far:

1. I modified demos/se05x/se05x_RotatePlatformSCP03Keys/se05x_TP_PlatformSCP03keys.c by commenting out the key reversion section (between doc:start:revert-scp03-keys and doc:end:revert-scp03-keys).
2. I built and executed the application on my setup.
3. The execution was successful, showing the message: "Congratulations !!! Key Rotation Successful!!!!"
4. To verify the key change, I updated /tmp/SE05X/plain_scp.txt with the new key value (0x4041... for ENC, MAC, and DEK) and successfully connected via ssscli connect.
5. Subsequent operations (ssscli generate rsa, ssscli set aes, and ssscli se05x readidlist) were all completed successfully, confirming that keys were written and IDs were retrieved without issues.
6. Now, I would like to restore the Platform SCP03 keys back to the default keys (defined in sss/ex/inc/ex_sss_tp_scp03_keys.h).

Could anyone guide me on how to modify se05x_TP_PlatformSCP03keys.c or what the correct process is to perform this key reversion?

Environment:

• Board: MCIMX8M-WEVK with OM-SE051ARD
• Plug and Trust MW Version: v04.07.01
• OP-TEE OS Version: 3.19.0
• Linux Kernel: 6.1.151
• OEF ID: A8FA

Any advice or code pointers would be greatly appreciated.

[Kan_Li]

Hi @Uc_S ,

Rotating the Platform SCP03 keys back to the default values is only possible when the current keys are known, as a successfully authenticated SCP03 session is required before any key update (PutKey) command can be issued to the SE051.

If the current keys have been lost or forgotten, it is not possible to authenticate to the SE051 and perform the key rotation. There is no backdoor or override mechanism — this is by design to preserve the security model of the device.

Additionally, a factory reset does not help, as Platform SCP03 keys are explicitly unaffected by the factory reset procedure.

In this situation, the only option is to replace the SE051 with a new device that still carries the default NXP-provisioned keys.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[Uc_S]

@Kan_Li 

Thank you for the clarification.

In my case, the current keys are known (0x4041... for ENC, MAC, and DEK), and I can successfully establish an SCP03 session using these keys via ssscli.

Since I have the current keys available to authenticate, could you please provide details on how to modify se05x_TP_PlatformSCP03keys.c to perform the key rotation back to the default values?

Specifically, I would like to know:

• Which variables or macros should be updated with the current keys (0x4041...) for authentication during session setup.
• Which variables or structures should hold the target default key values (ex_sss_tp_scp03_keys.h) for the PutKey operation.

Any code snippets or specific line references in se05x_TP_PlatformSCP03keys.c (or related boot/auth headers) would be greatly appreciated.

[Kan_Li]

Hi @Uc_S ,

If you just need to rotate the keys back to the default, the nano-package example is the recommended simpler path — only the three scp03_* arrays (current keys for auth) and the three NEW_scp03_* arrays (default keys as target) need to be updated, and the revert call within ex_se05x_rotate_scp03_keys() needs to be commented out. Please refer to the following for details.

Change 1 — Set the current keys (used to open the SCP03 session)

Lines 38–43 are the auth keys passed to ex_set_scp03_keys(). Replace the placeholder 0xABCD... values with your current keys (0x4041...

uint8_t scp03_enc_key[AES_KEY_LEN_nBYTE] = {
    0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
    0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F };

uint8_t scp03_mac_key[AES_KEY_LEN_nBYTE] = {
    0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
    0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F };

uint8_t scp03_dek_key[AES_KEY_LEN_nBYTE] = {
    0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
    0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F };

c

Change 2 — Set the NEW target keys (the default SE051C A8FA keys)

Lines 45–50 are the keys that will be written into the SE051 via PutKey. Replace the 0x4041... placeholder with the SE051C OEF A8FA default values:

uint8_t NEW_scp03_enc_key[AES_KEY_LEN_nBYTE] = {
    0xbf, 0xc2, 0xdb, 0xe1, 0x82, 0x8e, 0x03, 0x5d,
    0x3e, 0x7f, 0xa3, 0x6b, 0x90, 0x2a, 0x05, 0xc6 };

uint8_t NEW_scp03_mac_key[AES_KEY_LEN_nBYTE] = {
    0xbe, 0xf8, 0x5b, 0xd7, 0xba, 0x04, 0x97, 0xd6,
    0x28, 0x78, 0x1c, 0xe4, 0x7b, 0x18, 0x8c, 0x96 };

uint8_t NEW_scp03_dek_key[AES_KEY_LEN_nBYTE] = {
    0xd8, 0x73, 0xf3, 0x16, 0xbe, 0x29, 0x7f, 0x2f,
    0xc9, 0xc0, 0xe4, 0x5f, 0x54, 0x71, 0x06, 0x99 };

c

Change 3 — Comment out the revert block

In ex_se05x_rotate_scp03_keys(), comment out lines 85–90 so the code does a single rotation only (current → default) and does not try to rotate back again:

/* -- Comment out the revert block below -- */
// SMLOG_I("Reverting SCP03 keys(version - %02x) to OLD KEYS \n", KEY_VERSION);
// ret = ex_se05x_change_keys(&se05x_session, &scp03_enc_key[0], &scp03_mac_key[0], &scp03_dek_key[0]);
// if (ret != 0) {
//     SMLOG_E("Error in ex_se05x_change_keys \n");
//     return 1;
// }

c

 

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------