HAB SRK revoke

[yosri_c]

Hello NXP Support,

I'm using an RT1176 board with HABv4 (CST 4.0.1). I currently have my image signed using SRK1, but I need to switch to using SRK2 instead. (we're trying to test the image with SRK2 before revoking SRK1)

In my current CSF file, I have:

text 

[Install SRK]
File = "..\..\crts\SRK_1_2_3_4_table.bin"
Source index = 0

[Install CSFK]
File = "CSF1_1_sha256_secp256r1_v3_usr_crt.pem"

[Authenticate CSF]

[Install Key]
Verification index = 0
Target index = 2
File = "IMG1_1_sha256_secp256r1_v3_usr_crt.pem"

[Authenticate Data]
Verification index = 2
Engine = CAAM
Engine Configuration = 0
Blocks = 0x80000000 0x0 0x8000 "BOOT.bin"

Could you please explain:

1. What is the simplest way to change from SRK1 to SRK2?

2. What changes do I need to make in my CSF file?

3. Do I only need to change the Source index in [Install SRK] from 0 to 1?

Thank you for your help.

[Bio_TICFSL]

Hello,

Yes, the simplest way to change from using SRK1 to SRK2 is to modify the Source index parameter in the [Install SRK] section of your CSF file from 0 to 1.

In your current CSF file:
```
[Install SRK]
File = "..\..\crts\SRK_1_2_3_4_table.bin"
Source index = 0
```

You should change this to:
```
[Install SRK]
File = "..\..\crts\SRK_1_2_3_4_table.bin"
Source index = 1
```

The Source index parameter determines which key in the SRK table will be used. Index 0 corresponds to SRK1, index 1 to SRK2, and so on.

You will also need to reference the appropriate certificate files for CSF2 and IMG2 instead of CSF1 and IMG1 in your CSF file, replacing:
- "CSF1_1_sha256_secp256r1_v3_usr_crt.pem" with "CSF2_1_sha256_secp256r1_v3_usr_crt.pem"
- "IMG1_1_sha256_secp256r1_v3_usr_crt.pem" with "IMG2_1_sha256_secp256r1_v3_usr_crt.pem"

This approach allows you to test using SRK2 before permanently revoking SRK1.

Regards

[yosri_c]

@Bio Thank you for your previous clarifications.

I have a critical follow-up regarding the security logic and the SRK migration process during a firmware update.

Our Current Scenario: Normal Boot: The device boots using SRK1 (Index 0). The chain of trust is fully established: ROM -> Bootloader (SRK1) -> Application (SRK1).

Firmware Update: While the system is running under the trust of SRK1, we download a new full image (BS + App) into SDRAM, signed with SRK2 (Index 1).

Verification: The currently running Bootloader calls hab_rvt.authenticate_image() to verify the new image in SDRAM.

My questions are:

1. Regarding runtime SRK switching: Can you confirm that the HAB library allows the execution of a new [Install SRK] command with Source index = 1 (SRK2) within the same power cycle, even if SRK1 was used for the initial boot?

2. Regarding revocation in the same cycle: Would it be possible, during this update process, to revoke SRK1 (by burning the SRK_REVOKE eFuse), then install SRK2 and perform the verification of the new RAM image, all within the same power cycle? Thank you

[yosri_c]

@Bio_TICFSL 

can you assist  please , anything would be helpful 

Thank you 

[yosri_c]

i tried changing 

[Install SRK]
File = "SRK_1_2_3_4_table.bin"
Source index = 1

[Install CSFK]
File = "CSF2_1_sha256_secp256r1_v3_usr_crt.pem"

[Install Key]
Verification index = 0
Target index = 2
File = "IMG2_1_sha256_secp256r1_v3_usr_crt.pem"  

to eventually use SRK 2 but i get these events 

yosri_c_1-1765463880990.png