Secure Boot on i.MX8M - Multiple SRKs throughout the boot process

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Secure Boot on i.MX8M - Multiple SRKs throughout the boot process

Jump to solution
744 Views
cdboutin
Contributor I

Hi,

We are currently looking at our options for implementing Secure Boot on our platform which uses the i.MX8MM SoC. Something that will have implications as to how we will manage our keys is the following. If we want to use the HAB for verifying both the boot loader and the Kernel FIT Image, can the two authentication states use keys that are certified by different SRKs? The AN4581 document says : "Only one SRK can be used per reset cycle. All keys must be generated from the same SRK". However, I wonder, does this relate to the fact that both CSF and IMG keys must be certified using the same SRK during a given image (boot stage) authentication? Or does the statement has broader implications in the sense that all verification stages during the whole boot process must be done using keys that all link to the same SRK?

Thanks a lot for your time!

Tags (1)
0 Kudos
1 Solution
650 Views
kef2
Senior Contributor IV

As I understand it, it is a single assurance chain for all images used in boot, so single SRK for u-boot and all further hab_auth_img calls until reset. 

  • Or does the statement has broader implications in the sense that all verification stages during the whole boot process must be done using keys that all link to the same SRK?

Yes. Just try it with different SRK indexes for U-Boot and FIT or kernel on not yet closed device. You'll get HAB errors.

View solution in original post

0 Kudos
4 Replies
614 Views
cdboutin
Contributor I

@kef2@Harvey021 , thanks a lot for your responses. 

0 Kudos
631 Views
Harvey021
NXP TechSupport
NXP TechSupport

Hi @cdboutin 

can the two authentication states use keys that are certified by different SRKs?

No, the same SRK must be used for extending root of trust. The secure boot process starts with ROM authenticating the first image in the boot flow which is typically a bootloader such as U-Boot, Second Program Loader (SPL) or a custom implementation, Kernel. Once the root of trust is established, the HABv4 API can be leveraged to authenticate additional images, extending the secure boot chain.

 

Best regards

Harvey

0 Kudos
651 Views
kef2
Senior Contributor IV

As I understand it, it is a single assurance chain for all images used in boot, so single SRK for u-boot and all further hab_auth_img calls until reset. 

  • Or does the statement has broader implications in the sense that all verification stages during the whole boot process must be done using keys that all link to the same SRK?

Yes. Just try it with different SRK indexes for U-Boot and FIT or kernel on not yet closed device. You'll get HAB errors.

0 Kudos
658 Views
cdboutin
Contributor I

Hi,

Anybody has insight?

Thanks

0 Kudos