IMX93 - AHAB SecureBoot - SRK TABLE

[il_ciancio]

Hello NXP experts,

I am studying AHAB SecureBoot on IMX93 processor, and I am using CST tool in order to generate certifcates.

A lot of example shows a PKI tree generation with 4 leafs (SRKn, n from 1 to 4).

After the generation, I have to generate the SRK_Table and the SRK_TableFuse.

The SRK_Table is appended on the image, and after I have to flash SRK_TableFuse into eFuse.

CST Tool generates SRK_TableFuse as 16 words, but on the reference manual I have 16 fuse (OES_SRKHy with Y from 0 to 15), but some of them are RESERVED,

1. can I flash also these eFuses (fuse from 8 to 15)?
2. More over, Can I generate a SRK Table with only one certificate for my target?

Thanks a lot!

[Harvey021 · Accepted solution]

Hello @il_ciancio 

can I flash also these eFuses (fuse from 8 to 15)?

-> No, please have a reference 9x_secure_boot for i.MX93

Can I generate a SRK Table with only one certificate for my target?

-> In AHAB, it requires always 4 SRKs.

Regards

Harvey

[il_ciancio]

Hello, 

about the SRK table to be fused, i have found an error during the generation.

The correct command with CST tools for IMX9 is showed in:

• uboot-imx/doc/imx/ahab/introduction_ahab.txt at lf_v2024.04 · nxp-imx/uboot-imx
• In i.MX 8ULP/9x, the expected SRK HASH is of 256 bit.
  • $ cd ../crts/
  • $ ../linux64/bin/srktool -a -d sha256 -s sha384.

Why is there -s sha384  (-s, --sign_digest) ?

[il_ciancio]

In the example from git, the certificates were generated with sha384!