Secure Boot on i.MX8M - Multiple SRKs throughout the boot process

[cdboutin]

Hi,

We are currently looking at our options for implementing Secure Boot on our platform which uses the i.MX8MM SoC. Something that will have implications as to how we will manage our keys is the following. If we want to use the HAB for verifying both the boot loader and the Kernel FIT Image, can the two authentication states use keys that are certified by different SRKs? The AN4581 document says : "Only one SRK can be used per reset cycle. All keys must be generated from the same SRK". However, I wonder, does this relate to the fact that both CSF and IMG keys must be certified using the same SRK during a given image (boot stage) authentication? Or does the statement has broader implications in the sense that all verification stages during the whole boot process must be done using keys that all link to the same SRK?

Thanks a lot for your time!

[cdboutin]

@kef2, @Harvey021 , thanks a lot for your responses. 

[Harvey021]

Hi @cdboutin 

can the two authentication states use keys that are certified by different SRKs?

No, the same SRK must be used for extending root of trust. The secure boot process starts with ROM authenticating the first image in the boot flow which is typically a bootloader such as U-Boot, Second Program Loader (SPL) or a custom implementation, Kernel. Once the root of trust is established, the HABv4 API can be leveraged to authenticate additional images, extending the secure boot chain.

Best regards

Harvey

[kef2 · Accepted solution]

As I understand it, it is a single assurance chain for all images used in boot, so single SRK for u-boot and all further hab_auth_img calls until reset. 

• Or does the statement has broader implications in the sense that all verification stages during the whole boot process must be done using keys that all link to the same SRK?

Yes. Just try it with different SRK indexes for U-Boot and FIT or kernel on not yet closed device. You'll get HAB errors.

[cdboutin]

Hi,

Anybody has insight?

Thanks