Secure debug on i.MX93 with NXP keys

[danielgloeckner]

The current version of the nxpdebugmbox tool from the SPSDK has a parameter --nxp-keys that is described as "Use the ROM NXP keys to authenticate."

Does this mean that NXP can unlock secure debug on all devices?

If yes, is there any fuse to restrict secure debug to the OEM SRK keys?

[AldoG]

Hello,

No, NXP cannot unlock secure debug on OEM devices with --nxp-keys.

The --nxp-keys flag only authenticates the NXP/ELE internal debug domain (using ROM-embedded NXP keys). The OEM SoC debug domain (Cortex-A55, M33, etc.) is completely separate and can only be unlocked with the OEM's own SRK keys.

No additional fuse is needed to enforce this, it is architectural by design. Once the device is in OEM_CLOSED lifecycle with the OEM SRK hash fused, the ELE hardware enforces that NXP keys have zero authority over the OEM debug domain.

Best regards/Saludos,
Aldo.

[danielgloeckner]

But if you have control over the ELE, you have access to the DDR memory and can monitor the inputs and outputs of all crypto operations requested by the OEM domain from the ELE domain. You can decrypt all ELE blobs and have therefore access to all secret data stored on the device. And unless writing to DDR memory is prevented, you can inject code into the OEM domain.