I have successfully introduced secure boot with HAB on an i.MX 8M Mini. The signature of the SPL and the U-Boot FIT image, I do with the NXP code signing tool, where I followed all the recommendations of the documentation. I use fast authentication, why the verification index in the CSF file is always Zero.
Following CSF file (here for the SPL) works well and no HAB events are found:
[Header]
Version = 4.3
Hash Algorithm = sha256
Engine = CAAM
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS
[Install SRK]
# Index of the key location in the SRK table to be installed
File = "crts/SRK_1_2_3_4_table.bin"
Source index = 0
[Install NOCAK]
# Key used to authenticate the CSF data
File = "crts/SRK1_sha256_2048_65537_v3_usr_crt.pem"
[Authenticate CSF]
[Unlock]
# Leave Job Ring and DECO master ID registers Unlocked
Engine = CAAM
Features = MID
[Authenticate Data]
# Key slot index used to authenticate the image data
Verification index = 0
# Authenticate Start Address, Offset, Length and file
Blocks = 0x7e0fc0 0x0 0x39a00 "imx-boot"
However, the second, third, and fourth super root key (SRK) are not working. I can find several HAB events from the U-Boot console. Here is the according CSF file for the second key:
[Header]
Version = 4.3
Hash Algorithm = sha256
Engine = CAAM
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS
[Install SRK]
# Index of the key location in the SRK table to be installed
File = "crts/SRK_1_2_3_4_table.bin"
Source index = 1
[Install NOCAK]
# Key used to authenticate the CSF data
File = "crts/SRK2_sha256_2048_65537_v3_usr_crt.pem"
[Authenticate CSF]
[Unlock]
# Leave Job Ring and DECO master ID registers Unlocked
Engine = CAAM
Features = MID
[Authenticate Data]
# Key slot index used to authenticate the image data
Verification index = 0
# Authenticate Start Address, Offset, Length and file
Blocks = 0x7e0fc0 0x0 0x39a00 "imx-boot"
Any suggestions, why this is not working apart from badly burned fuses, which is not the case?
PS: I know, there is a similar question here https://community.nxp.com/t5/i-MX-Processors/iMX6SoloX-fast-authentication-uImage-signing/m-p/628126..., but no valid answer is given in my opinion.
