Hi,
I'm attempting to revoke an SRK key and after some research I am left with a few questions.
1) CSF in SPL vs. FIT
To keep it simple let's say the image flash.bin consists of two sub-images, namely csf_spl.bin and csf_fit.bin. The former contains U-Boot SPL, the latter contains U-Boot proper, and both contain their own distinct command sequence files.
When the CPU starts, the ROM firstly starts to execute the (CSF) commands configured for the corresponding image. If in csf_spl.bin SRK revocation is enabled, will SRK_REVOKE_LOCK remain unlocked when eventually csf_fit.bin executes, or do I also need to unlock it in csf_fit.bin to revoke an SRK key in i.e. U-Boot or Linux?
2) Revoke procedure
I've scrolled through the HAB code signing tool users guide Rev 3.1.0 09/2018 and page 47/48 states "HAB or AHAB authenticates the SRK using the SRK hash (SRK_HASH) fuses. HAB4 or AHAB allows revocation of individual keys within the SRK table using the SRK revocation (SRK_REVOKE) fuses."
However, the table below states that in HAB4 the "Revocations" argument is "not present" for the Install SRK block.
Without this setting it seems that we are required to update the boot loader twice, once to enable SRK revocation and to revoke the key, and once to disable SRK revocation.
Is this attribute available in the HABv4 ROM (version 4.3)?
If so, do I need to add the Unlock section before the Install SRK section?
And if SRK_REVOKE_LOCK is sticky and I need the Unlock section, can I re-enable the lock in csf_fit.bin to prohibit SRK revocations in the insecure world (i.e. U-Boot and Linux)?
3) Keys to use
Except for a Japanese site, all examples on the internet show how to sign a binary with SRK1/IMG1/CSF1, but when I want to revoke a key I need a different setup. Am I correct to assume I must configure SRK2/IMG2/CSF2 as described below in all CSFs?
# Only showing relevant sections to keep the example on point
[Install SRK]
File = "SRK_1_2_3_4_table.bin"
# Use SRK2
Source index = 1
[Install CSFK]
# CSF2 automatically checked with SRK2
File = "CSF2_1_sha256_4096_65537_v3_usr_crt.pem"
[Install Key]
# Keep "Verification index" and "Target Index" as-is, as they're not relevant
# for SRK/IMG validation
Verification index = 0
Target Index = 2
# IMG2 automatically checked with SRK2
File = "IMG2_1_sha256_4096_65537_v3_usr_crt.pem"
