HAB4 Secure Boot Keys Stored on YubiKey 5 Nano

[Mihajlo]

Hello everyone,

Has anyone tried/succeeded to store public and private keys for i.MX8-MP platform secure boot on YubiKey 5 Nano device?

I'm using CST version 3.1.0 and so far signing and secure booting are successful, but the keys (created by hab4_pki_tree script) are being kept alongside the code, i.e. in the source tree.

The whole system image (bootloader, kernel, filesystem) is being build under Yocto 3.0

To make everything more secure, the idea is to have keys stored on YubiKey5 Nano.

The questions are: 

1. Is it at all possible to use YubiKey 5 Nano for that purpose?

     AFAIK, paths to public keys are in .csf file used by CST, and CST then finds private key by itself, given that the keys are named properly and that keys and crts folders are on the same level. I couldn't find a way to give path/command to be used by CST in order to fetch keys from YubiKey 5 Nano

2. It the answer to 1) is yes, then should OpenPGP or PIV application for YubiKey 5 Nano be used?

Thanks a lot in advance.

[Mihajlo]

Yes, that's absolutely correct.

At the moment, and as a proof of concept, the keys are integral part of source tree used in Yocto 3.0 build, but we would like to have them stored only on YubiKey 5 Nano.

Mihajlo

[Mihajlo]

Yes, that's exactly the case.

The work so far is based on this example from Variscite:

https://variwiki.com/index.php?title=High_Assurance_Boot_MX8&release=RELEASE_HARDKNOTT_V2.3_DART-MX8...

and now the final goal is to remove keys from source tree where they are now and use them from a more secure location, i.e.
YubiKey.

So far I have only found one application where keys are used from YubiKey, but unfortunately, that's YubiKey HSM, not YubiKey 5 Nano, and IMHO, those two probably have different firmware and support different key access(es):

https://www.thegoodpenguin.co.uk/blog/i-mx-code-signing-using-a-yubihsm-2-hardware-token-from-yubico...

[AldoG]

Hello,

I have contacted internal expert team, they do confirm that this should be doable and that it can be used.

Unfortunately as I said before I do not have much experience with yubikey for providing more details on the how.

Best regards/Saludos,
Aldo.

[AldoG]

Hello,

Unfortunately I do not have experience using Yubikey, so I cannot be completely sure if this can be used or not but will double check, as far as I know from your description you want to create a signed image with keys stored in the Yubikey, is this correct?

Best regards/Saludos,
Aldo.

[Mihajlo]

NOTE: Repeating this reply so it could be easy to follow the conversation.

Yes, that's exactly the case.

The work so far is based on this example from Variscite:

https://variwiki.com/index.php?title=High_Assurance_Boot_MX8&release=RELEASE_HARDKNOTT_V2.3_DART-MX8...

and now the final goal is to remove keys from source tree where they are now and use them from a more secure location, i.e.
YubiKey.

So far I have only found one application where keys are used from YubiKey, but unfortunately, that's YubiKey HSM, not YubiKey 5 Nano, and IMHO, those two probably have different firmware and support different key access(es):

https://www.thegoodpenguin.co.uk/blog/i-mx-code-signing-using-a-yubihsm-2-hardware-token-from-yubico...