How to check the sercure boot key matched?

[yang_wang-wy]

Hello Sir,

Currently, I am checking the secure boot feature on the imx8dx processer. I met some issues which need your help.

Background: I got the `cst-3.2.0` from the website of NXP and follow the document of uboot to generate the `SRK_1_2_3_4_fuse.bin` and `SRK_1_2_3_4_table.bin` and also include the pem files.

My questions

1. Is there any command or script that I could verify if the keys are matched which I generated in local?
2. I use the pem and `SRK_1_2_3_4_table.bin` to sign my container and also down the `SRK_1_2_3_4_fuse.bin` into the hardware fuse area. but I got two seco events. my bootcontainer contains the spl and uboot and other nxp necessary files. I only signed once. Do you know what is the reason or help to point some issues.

U-Boot# ahab_status
Lifecycle: 0x0020, NXP closed
SECO Event[0] = 0x0087F000
CMD = AHAB_AUTH_CONTAINER_REQ (0x87)
IND = AHAB_BAD_SIGNATURE_IND (0xF0)
SECO Event[1] = 0x0087EE00
CMD = AHAB_AUTH_CONTAINER_REQ (0x87)
IND = AHAB_NO_AUTHENTICATION_IND (0xEE)

my understanding is that the 0x0087f000 is caused by my key is unmatched so I ask the Q1

and the 0x0087EE00 is caused by I only signed once in my container. but due to all the spl and uboot files are in one image How to sign the two files?

[Yuri]

@yang_wang-wy 
Hello,

  I've sent You some comments via e-mail.

Regards,
Yuri.

[yang_wang-wy]

Hello Yuri,

Many thanks for your document which is very helpful, I also have one question that I saw all about the document in the boot container sing offset is 0x400 and 0x590. 
But why my imx-boot container log is the 0x400 and 0x510 no matter I change the B0 or C0. Is it caused by which file changed or others?

[yang_wang-wy]

Offsets = 0x400 0x510 is my offset of sign image

[Yuri]

@yang_wang-wy 
Hello,

  CSF file should match the values printed out by mkimage.

# Offsets = Container header Signature block (printed out by mkimage)
Offsets = 0x400 0x590

  in Your case - 0x510 if mkimage provides it.

Regards,
Yuri.