i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature)

[Ankit_Agrawal]

Hi Team,

We are currently working on importing a private key to an i.MX95 device following the guidelines in application note AN14898.

Environment & References:

• Target Device: i.MX95
• Demo Application: imx_sec_apps/imx-ele-apps
• SPSDK Version: Latest standard toolset

Activities Completed So Far:

1. Installed Python, pip, and the SPSDK toolset.
2. Successfully built both the Host and Device applications.
3. Copied device/bin/ele_key_import and device/scripts/run_test_on_board.sh to our target i.MX95 hardware.
4. Executed the device-side flow to generate nxp_prod_ka_puk.bin.
5. Transferred nxp_prod_ka_puk.bin back to our host environment.
6. Generated SRK keys (secp384r1) using the SPSDK utility according to the SPSDK Documentation since we do not have final production keys yet.
7. Generated the signed_msg.bin on the host side using the standard key import template (with the -k parameter set to secp384r1).
8. Transferred the generated signed_msg.bin to the i.MX95 hardware.
   Command used to generate signed message:
   nxpimage signed-msg export -c key_exchange_temp.yaml -w assets
   Attached key_exchange_temp.yaml for reference.
   
   
9. When running run_test_on_board.sh on the i.MX95 target device, all files are found, but the EdgeLock Enclave rejects the signature on the signed message block.Here is our target terminal log:
   
   

   nxp_prod_ka_puk.bin exists.
   oem_public_key.pem exists.
   signed_msg.bin exists.
   Hello, World! Jul 16 2026:06:54:40 9547bbd
   Signed Message: 728 bytes
   02d802890200000000000000b8000000000000000000000000000000000000000000000000000000000000000000000000000000e6a7000000004701000000000000000000000000000000004707000000454c45090102090000000000920001010000000040000009010008000000000100000000000070577819deccdf2670d801e8f4291d3539081da49b1e1b63d55039e5993242b30f0000000000000000000000000000000000000000000000000000000000000000011c029000001000b40100000000000000a4015a01000000d7340143e14c00270102000030003000c2a99777d1fc00dc7e14d3d43ac3f68a44d9b52c882d3c09eac0db7fac1901242576bac6143785e5815db546e385d81000000000000000000000000000000000e14c00270102000030003000e358e1159c0cb645e7059c1b04b49e39b3563167472507278245d4dee439dd32e7ce3da413e397cbd7959cf147d25c2300000000000000000000000000000000e14c00270102000030003000482fb4f1ceb6e266221b0a13dbbb04c637a1c238b76b108397e98eb4557cafb2075036e05b9a0ee4fa6aa09a5f3951e500000000000000000000000000000000e14c00270102000030003000c93a6b4881ae912da31da8249e4f58473eb88cc1dc46f5ec6d363dc52b8a5c12c91e711ad726153d382dabbe6bef27cc000000000000000000000000000000000068005d00000000a5e31e11bfb02c62756d9d3ba5152768e5bea9aab8f3f13ccf3bd287a0438e9708088cafc5671e2aaf1bc3b413457b6a59a691dcef672fa65dac12ed328effac963c41ec0200b0a9acf67e0f2755f752872f77d2c20d6987f80e8008ac26de3d006800d800000000f4cf9cc965b3643d5dc5c5070a506196649daf898d328afd18e88eb9ece96e39646bf6385b9d42e1fc2f93f07f66e9c8c914becef9394c0c3cf549766483c7f94b6a9325bea51b79280eb76484e064637570c0ef7387ec0ffb8398ec36966c3a00000000

   OEM Import PUK: 65 bytes
   0451c46d24d30864c5275c634a3a339949654b34c0a4f294a8c107c504360ff4b55044918b71b16109a7bbfba8fbcf49b91720ad8e9c0109e6b2eed8f6a504ab64

   hsm_open_session success
   hsm_open_key_store_service success
   hsm_open_key_management_service success

   SAB Error: SAB CMD [0x47] Resp [0x1829] - Invalid Signature in SIGNED message.

   hsm_key_exchange failed err:0xfe
   Key exchange failed: 254
   
   Any insight on resolving this signature verification issue for the i.MX95 would be greatly appreciated.

   Thanks,
   Ankit Agrawal

[Richard_Kim]

Hello @Ankit_Agrawal,

Our internal team is reviewing your issue and will update you accordingly.

In the meantime, please review the case below, which is similar to the issue you are encountering.

The suggested solution is to verify that the fuse_version matches correctly.

https://community.nxp.com/t5/i-MX-Processors/hsm-import-key-returns-with-0xF0-Bad-Signature/td-p/216...

Thank you.

Best Regards,

Richard

[Jessie_Lee]

Hi @Ankit_Agrawal 

I am wondering if you burn SRKH  after SRK generation.  for necessary sign.yaml file please check my attached file. 

Please try below command (precondition is you should have flash.bin: bootloader of system) to generate SRKH.  

nxpimage ahab sign -c sign.yaml -b flash.bin -o flash_directsign.bin -fs outputs
output will be as below.

Jessie_Lee_0-1786699088609.png

and from the ouputs folder, you could see bcf file(ahab_oem0_srk0_hash_nxpele.bcf). 

you could follow below fuse command  (index 128 ~143) that you need to fuse for SRKH. 

# nxpele AHAB SRKH fuses programming script
# Generated by SPSDK 3.4.0
# Family: mimx9596, Revision: latest

# Value: 0xCCC0605919B6400771CF88A002FB6BF27DFA9CE09BAD94516DD7E4D399369A8FF5A6A1A671809DF4A71A7CB208B4EDC009CDF3FF25EC074DECBBEE8300D5D44C
# Description: SHA512 hash digest of hash of four SRK keys
# Grouped register name: SRKH

# OTP ID: OEM_SRKH0, Value: 0x5960C0CC
write-fuse --index 128 --data 0x5960C0CC
# OTP ID: OEM_SRKH1, Value: 0x0740B619
write-fuse --index 129 --data 0x740B619
# OTP ID: OEM_SRKH2, Value: 0xA088CF71
write-fuse --index 130 --data 0xA088CF71
# OTP ID: OEM_SRKH3, Value: 0xF26BFB02
write-fuse --index 131 --data 0xF26BFB02
# OTP ID: OEM_SRKH4, Value: 0xE09CFA7D
write-fuse --index 132 --data 0xE09CFA7D
# OTP ID: OEM_SRKH5, Value: 0x5194AD9B
write-fuse --index 133 --data 0x5194AD9B
# OTP ID: OEM_SRKH6, Value: 0xD3E4D76D
write-fuse --index 134 --data 0xD3E4D76D
# OTP ID: OEM_SRKH7, Value: 0x8F9A3699
write-fuse --index 135 --data 0x8F9A3699
# OTP ID: OEM_SRKH8, Value: 0xA6A1A6F5
write-fuse --index 136 --data 0xA6A1A6F5
# OTP ID: OEM_SRKH9, Value: 0xF49D8071
write-fuse --index 137 --data 0xF49D8071
# OTP ID: OEM_SRKH10, Value: 0xB27C1AA7
write-fuse --index 138 --data 0xB27C1AA7
# OTP ID: OEM_SRKH11, Value: 0xC0EDB408
write-fuse --index 139 --data 0xC0EDB408
# OTP ID: OEM_SRKH12, Value: 0xFFF3CD09
write-fuse --index 140 --data 0xFFF3CD09
# OTP ID: OEM_SRKH13, Value: 0x4D07EC25
write-fuse --index 141 --data 0x4D07EC25
# OTP ID: OEM_SRKH14, Value: 0x83EEBBEC
write-fuse --index 142 --data 0x83EEBBEC
# OTP ID: OEM_SRKH15, Value: 0x4CD4D500
write-fuse --index 143 --data 0x4CD4D500

you could use below command to burn SRKH

nxpele -f mimx9596 batch outputs\ahab_oem0_srk0_hash_nxpele.bcf

If you burn the SRKH already but failed with below invalid singing, please share the singed_message.bin to us.  with your SRKH (including srk output all). 

[Ankit_Agrawal]

Hi @Jessie_Lee ,

Thanks for the information.
We have located the flash.bin file and are able to perform the necessary steps to generate the SRKH.
After generating the SRKH, we need to fuse it to the hardware. To perform the fuse operation, the hardware/board must be in Fastboot mode. Could you please help us switch the device to Fastboot mode?

While attempting to fuse the keys, we are encountering the following error:

Ankit_Agrawal_0-1787636692485.png

It appears that the device is not currently in Fastboot mode. Any guidance on how to enable Fastboot mode on the board would be greatly appreciated.

Thanks, 
Ankit

[Jessie_Lee]

Hi @Ankit_Agrawal 

Please follow up below steps to burn SRK using SPSDK

step#1. when you boot device, stop at u-boot console , run 

u-boot=> fastboot 0

step#2.  In SPSDK console , you must there is no ahab events) using below command.

nxpele -f mimx9596 get-events 

step#3. If there is no event,  you could burn SRK key now in SPSDK console.

nxpele -f mimx9596 batch outputs\ahab_oem2_srk0_hash_nxpele.bcf

BRs

jessie