Issue with Importing Key Buffer into HSM on iMX93 EVK Board

[mallikarjuna]

Hi, 

I have successfully cross-compiled the Secure Enclave userspace library for the ELE-HSM platform targeting the i.MX93 evk board, following the build steps provided  in the official documentation.

imx-secure-enclave/README at lf-6.12.20_2.0.0 · nxp-imx/imx-secure-enclave · GitHub

I also compiled and ran the ELE-HSM test application (hsm_test.c) as outlined in the test source

imx-secure-enclave/test/hsm/hsm_test.c at lf-6.12.20_2.0.0 · nxp-imx/imx-secure-enclave · GitHub

We aim to import key buffer into HSM module,  I have reviewed the test_import_key(...) function in the following file 

imx-secure-enclave/test/common/test_importkey.c at lf-6.12.20_2.0.0 · nxp-imx/imx-secure-enclave · G...

To test the import, I'm calling the test_import_key() function from the hsm_test.c application with the flag value HSM_OP_IMPORT_KEY_INPUT_ELE_TLV, as shown below:

import_key_id = test_key_import(key_mgmt_hdl, key_store_hdl, HSM_OP_IMPORT_KEY_INPUT_ELE_TLV);

According to the test_import_key function definition, when the flag HSM_OP_IMPORT_KEY_INPUT_ELE_TLV is set, the function reads data from the file /usr/share/se/test_vectors/psa/ele_aes_test.blob and imports that data into the HSM. However, the operation fails with the following error:

SAB Error: SAB CMD [0x4f] Resp [0x429] - MU sanity check failed / Invalid parameters.

Failure[04] in HSM Import Key API.

Tried, HSM_OP_IMPORT_KEY_FLAGS_STRICT_OPERATION flag also, still facing same issue. 

We have not modified the test_import_key() function or its associated files. We are simply calling this function to import the key, but the operation fails. please find attached file for more logs.

Question 1: Could you help identify the exact cause of the above failure when calling the hsm_import_key API?

Question 2: Has anyone successfully verified the functionality of the hsm_import_key API? If so, could you provide a step-by-step guide on importing the key buffer into the HSM, particularly focusing on which variables in the op_import_key_args_t structure need to be set for a successful import?

[Harvey021]

Hi,

This failure is probably caused by the use of test blob. If you need to implement key import, you need to do key exchange and generate a blob and then import key.

Regards

Harvey

[HH_Mov]

Hello,

I also am trying to get the key import part working, using the test code from imx-secure-enclave as a reference. (Note: It also provides the "key_exchange_test_hkdf_expand" which provide some insights/handles in the required key-exchange actions)

@mallikarjuna

: Did you find a solution or even better an example/guide that also explains the relationship between the key-exchange results and the generation of the blob ? 

@Harvey021 All manuals together probably explain it somewhere, but the information seems a bit scattered throughout. Since this seems a typical use-case for the HSM, a complete guide/example would save much time. Is there such an example/guide somewhere ?

Regards

[HH_Mov]

(Update)

In the "EdgeLock Secure Enclave i.MX 93 A1 User Guide (FW version v2.0.2)" combining the information from "4.4.16.3 EdgeLock Secure Enclave option" and "5.2.5 How to import an OEM key with EdgeLock Secure Enclave HSM" seems to provide the best example so far.