HAB - fast authentication or not?

[AlexeyT]

Hello dear all.

I am trying to bring up HAB authentication for Windows Embedded Compact bootloader (eboot).

Just soved the issue with call HAB ROM to check for its status and events so now I am ready to proceed for the next stage.

So I installed CST, read the docs and started generating keys but I am not sure whether I need/can use fast authentication or not.

My goal is to make iMX chip only load signed EBOOT, remaining security checks are done (implemented) by using Microsoft authentication security libraries.

So I am not going to authenticate anythyng else with iMX6, just EBOOT and I really want it to be done in the simplest possible way.

Can I use fast authentication for such a case or not?

I read that it is supported not in all iMX6 chips so assuming I need to use various iMX6 chips in various products but want keep the same

executable running on all platforms I can't use fast path, right?

Alternatively, if I use normal authentication and get all those keys generated (IMG and CSF etc.) can it prevent me from just checking my EBOOT with iMX6

and leaving any other authentication done by using MS libraries?

Any other suggestions would be nice as well.

Thanks and sorry for (possibly) bad english.

Alexey

[igorpadykov · Accepted solution]

Hi Alexey

Fast Authentication supported by HAB 4.1.2 and later (only MX6SX, MX6UL and MX7D)

reduces the number of keys required to sign the image from two to one and

minimum number of RSA operations from four to two (25ms to 12.5ms typically),

examples can be found on

https://community.freescale.com/docs/DOC-275249

Best regards

igor

-----------------------------------------------------------------------------------------------------------------------

Note: If this post answers your question, please click the Correct Answer button. Thank you!

-----------------------------------------------------------------------------------------------------------------------