Using cst-3.1.0 with i.MX6ULL

[JohnKlug]

Is this the current i.MX6 Linux High Assurance Boot (HAB) User's Guide?

The doc is labeled:

Document Number: IMX6HABUG
Rev L3.10.53_1.1.0-ga, 01/2015

In the document is a link, which caused me to download cst-3.1.0.

Now in the document they say how to answer questions from hab4_pki_tree.sh.

In hab4_pki_tree.sh, it asks if I want to use elliptical curve cryptography.  Is this compatible with the current i.MX6ULL?  In the document from 2015 it says:

• For question prompt, enter "n", "2048", "10", "4" one by one.

This must be out of date, since cst-3.1.0 says it is from September 2018 in the release notes.

The elliptical curve cryptography possibilities are:

Possible values p256, p384, p521: 

I notice the release notes in cst-3.1.0 do not discuss Elliptical curve cryptography, nor does the 2015 HAB User Guide.

Also, is there a discussion of how the HAB layout is affected by NAND flash?  How does it fit with the U-Boot NANDBCB command with the FCB and DBBT's? NANDBCB in U-Boot is writing two uImages, four FCB's and four DBBT's.

[igorpadykov]

Hi John

from team:

-----------------

please download the latest CST from nxp.com for latest documentation and enablement.

I am not sure I understand the NAND question, the HAB supported image looks the similar to regular NAND image except that the IVT is modified to have a CSF pointer in it, and the image is extended to add the certs and signature information in it.

-----------------

Best regards
igor

[JohnKlug]

How does one get the latest cst?  I am assuming this is how one gets it (from a 2015 Freescale i.MX 6 Linux High Assurance Boot (HAB) User's Guide):

"https://www.freescale.com/webapp/sps/download/license.jsp?colCode=IMX_CST_TOOL" 

Do you know if there is one after 3.1.0?

Also, is there an up to date document to replace the 2015 Freescale i.MX 6 Linux High Assurance Boot (HAB) User's Guide?

It has been suggested to use:

https://boundarydevices.com/high-assurance-boot-hab-dummies/ 

If I follow this, I see that Elliptical is turned off.  The answer to question:

Enter key length in bits for PKI tree: 4096

Is this correct for the i.MX6?

I see the following in section 8 of i.MX6 ULL Applications Processor Reference Manual pg 333:

The RSA key sizes supported are 1024, 2048, and 3072 bits.

But in the HAB Code Signing Tool User's Guide (3.1.0) it says:

For HAB4 1024, 2048, 3072 and 4096-bit RSA keys are supported.

Is the i.MX6 ULL HAB 4, and does it implement 4096 bit RSA codes?

What I am seeing when I follow Boundary Devices HAB for Dummies instructions is the same as here:

https://community.nxp.com/t5/i-MX-Processors/iMX6-HAB-Problem/m-p/357380 

But I am answering 'y' to the question mentioned in the post:

Do you want the SRK certificates to have the CA flag set? (y/n)?: y

[igorpadykov]

one can look at "Code Signing Tools" on link:

https://www.nxp.com/design/software/embedded-software/i-mx-software:IMX-SW

For "Boundary Devices HAB for Dummies instructions" issues suggest to create new thread

with full description of problem.

Best regards
igor

[JohnKlug]

That is a start.  I will break this down into multiple questions.