i.MX91 EdgeLock Enclave key wrap or export?

[chris_boger]

On the i.MX91 EdgeLock Enclave, is there a way to export secret or private keys from one unique instance to another?

NXP's PKCS#11 C_WrapKey()/C_UnwrapKey() both return CKR_FUNCTION_NOT_SUPPORTED, inferring that there is no way to wrap an opaque key with an opaque key.

There's also hsm_blob_unblob(). Does this use a device-unique KEK or can I program a common KEK on multiple instances?

[yipingwang]

1. No, secret or private keys can't be exported, only public key can be exported.

2. not supported

3. hsm_blob_unblob() does not use a user-programmable or shared KEK. Instead, the blob mechanism relies on an internally derived KEK that is bound to device-specific secrets and contextual parameters.