i.MX95: EdgeLock Enclave Key Import Error - SAB CMD [0x47] Resp [0x1829] (Invalid Signature)

[Ankit_Agrawal]

Hi Team,

We are currently working on importing a private key to an i.MX95 device following the guidelines in application note AN14898.

Environment & References:

• Target Device: i.MX95
• Demo Application: imx_sec_apps/imx-ele-apps
• SPSDK Version: Latest standard toolset

Activities Completed So Far:

1. Installed Python, pip, and the SPSDK toolset.
2. Successfully built both the Host and Device applications.
3. Copied device/bin/ele_key_import and device/scripts/run_test_on_board.sh to our target i.MX95 hardware.
4. Executed the device-side flow to generate nxp_prod_ka_puk.bin.
5. Transferred nxp_prod_ka_puk.bin back to our host environment.
6. Generated SRK keys (secp384r1) using the SPSDK utility according to the SPSDK Documentation since we do not have final production keys yet.
7. Generated the signed_msg.bin on the host side using the standard key import template (with the -k parameter set to secp384r1).
8. Transferred the generated signed_msg.bin to the i.MX95 hardware.
   Command used to generate signed message:
   nxpimage signed-msg export -c key_exchange_temp.yaml -w assets
   Attached key_exchange_temp.yaml for reference.
   
   
9. When running run_test_on_board.sh on the i.MX95 target device, all files are found, but the EdgeLock Enclave rejects the signature on the signed message block.Here is our target terminal log:
   
   

   nxp_prod_ka_puk.bin exists.
   oem_public_key.pem exists.
   signed_msg.bin exists.
   Hello, World! Jul 16 2026:06:54:40 9547bbd
   Signed Message: 728 bytes
   02d802890200000000000000b8000000000000000000000000000000000000000000000000000000000000000000000000000000e6a7000000004701000000000000000000000000000000004707000000454c45090102090000000000920001010000000040000009010008000000000100000000000070577819deccdf2670d801e8f4291d3539081da49b1e1b63d55039e5993242b30f0000000000000000000000000000000000000000000000000000000000000000011c029000001000b40100000000000000a4015a01000000d7340143e14c00270102000030003000c2a99777d1fc00dc7e14d3d43ac3f68a44d9b52c882d3c09eac0db7fac1901242576bac6143785e5815db546e385d81000000000000000000000000000000000e14c00270102000030003000e358e1159c0cb645e7059c1b04b49e39b3563167472507278245d4dee439dd32e7ce3da413e397cbd7959cf147d25c2300000000000000000000000000000000e14c00270102000030003000482fb4f1ceb6e266221b0a13dbbb04c637a1c238b76b108397e98eb4557cafb2075036e05b9a0ee4fa6aa09a5f3951e500000000000000000000000000000000e14c00270102000030003000c93a6b4881ae912da31da8249e4f58473eb88cc1dc46f5ec6d363dc52b8a5c12c91e711ad726153d382dabbe6bef27cc000000000000000000000000000000000068005d00000000a5e31e11bfb02c62756d9d3ba5152768e5bea9aab8f3f13ccf3bd287a0438e9708088cafc5671e2aaf1bc3b413457b6a59a691dcef672fa65dac12ed328effac963c41ec0200b0a9acf67e0f2755f752872f77d2c20d6987f80e8008ac26de3d006800d800000000f4cf9cc965b3643d5dc5c5070a506196649daf898d328afd18e88eb9ece96e39646bf6385b9d42e1fc2f93f07f66e9c8c914becef9394c0c3cf549766483c7f94b6a9325bea51b79280eb76484e064637570c0ef7387ec0ffb8398ec36966c3a00000000

   OEM Import PUK: 65 bytes
   0451c46d24d30864c5275c634a3a339949654b34c0a4f294a8c107c504360ff4b55044918b71b16109a7bbfba8fbcf49b91720ad8e9c0109e6b2eed8f6a504ab64

   hsm_open_session success
   hsm_open_key_store_service success
   hsm_open_key_management_service success

   SAB Error: SAB CMD [0x47] Resp [0x1829] - Invalid Signature in SIGNED message.

   hsm_key_exchange failed err:0xfe
   Key exchange failed: 254
   
   Any insight on resolving this signature verification issue for the i.MX95 would be greatly appreciated.

   Thanks,
   Ankit Agrawal

[rakhyoung]

@Jessie_Lee 

It is reported that things are not working as shown below. Is it possible to get some support?
--------------------------------------------------------------------------------------------------------------
However, when I execute the command to perform the fuse operation, I encounter the error below.
I tried resetting the hardware too, but I'm still facing the same issue. Do you have any ideas on why this might be happening?

@Ankit_Agrawal 
Feel free to provide additional explanation if necessary.

[Jessie_Lee]

from @Ankit_Agrawal  , there was fastboot entering issue. 

@rakhyoung  Do you mean you are also having issue to enter fastboot ?

did you try to  below command..? that I shared.. above?  what is error when you try to below fastboot 0 at uboot stage? 

step#1. when you boot device, stop at u-boot console , run 

u-boot=> fastboot 0

BRs

jessie

[Ankit_Agrawal]

Hello @Jessie_Lee 
Sorry for the delayed response.
I successfully managed to stop at the U-Boot console on the device side. However, when trying to fuse the key from the host side using the following command:
nxpele -f mimx9596 -p /dev/ttyUSB1 batch outputs/ahab_oem2_srk0_hash_nxpele.bcf
I encountered the following error:

I tried resetting the hardware too, but I'm still facing the same issue. Do you have any ideas on why this might be happening?

Thanks,
Ankit

[Jessie_Lee]

HI @Ankit_Agrawal 

Could you please share all step log from fastboot entering at uboot (console), execute spsdk by host side?

I believe you entered fastboot thru uboot. right?

please share all steps (fastboot entering, ahab event check , try to fuse.. etc on host side log).

It would be helpful to see all logs thru files not snapshot. 

BRs

jessie

[Jessie_Lee]

Hi @Ankit_Agrawal 

I checked with your BSP team and fastboot is removed from default u-boot.

So, you could not use fastboot mode directly to fuse SRK.

Instead of SPSDK tool for burning SRK, you could use one of below method. As I know your team already use fuse_access application to handle fuse access (read/write) at kernel level.  any method could be okay to burn your srk.  

BRs

jessie

[Ankit_Agrawal]

Hi @Jessie_Lee ,

Thank you very much for your continued guidance and support as we navigate our integration.

We reviewed the proposed procedure and steps for the i.MX95 Secure Enclave, but because the suggested methods require pre-build or static configuration, they will not be feasible for our current architecture. Our implementation strictly requires provisioning and managing keys at run time.

Could you let us know if there is an alternative approach or a dedicated Runtime Import Key API available to meet our requirements?

For context, the Import Key API is mandatory for our implementation due to two specific use cases:

• Runtime Certificate Installation: During the flow, the application receives an encrypted contract certificate and private key. After decrypting this on the application side, the private key must be dynamically imported or stored into the Secure environment at run time.
• Testing and Validation: For our current development and verification phase, we need to inject existing, pre-generated test keys (such as Contract Certificates, and Root Certificate keys) into the application-side Secure environment to validate the end-to-end communication flow and message signatures.

We would appreciate your insights on how we can achieve this dynamic injection without a pre-build setup cycle.

Best Regards,
Ankit

[Jessie_Lee]

Hi @Ankit_Agrawal 

To move further about the way of key import feature, May I ask your current status? Does it work on your side now with our current method? 

To review your request for changing the way of key import feature , we need to understand firstly Other end side environment.  could you help us to understand your side situation ? 

We need to understand "end to end protection" is secure enough

For example,   

* How other end generate this encrypted contract certificate and private key?

* Or How the encrypted key of the blob is generated in LG/GM side? 

* Could you please provide GM spec or GM spec numbers on this part? 

then we can understand your concept and discuss with our security core team to support such way.  

BRs

Jessie 

[Ankit_Agrawal]

Hello @Jessie_Lee ,

Please find attached logs for the fastboot entry, the host-side steps to check events and fuses, and the debug log file.

Thanks,
Ankit

[Jessie_Lee]

HI @Ankit_Agrawal 

From your attached log, I could not find A core's uboot console log. (target board) when you enter fastboot on uboot console,   Could you please check this? Please share full uboot log from POR

 it seems that SPSDK detect uboot console by "=>" character. 

What's your boot delay value(check by uboot command "printenv bootdelay")? Or can you add the bootdelay with uboot command "setenv bootdelay 3; saveenv" and try again?

BRs

jessie

[Ankit_Agrawal]

Hello @Jessie_Lee ,

Please find the attached logs. I have performed the steps as suggested by you.

[Jessie_Lee]

Hi @Ankit_Agrawal 

I am wondering if you check your uboot log for fastboot entering .

Below is part of your log  and it show "unknown command" log. this fastboot is u-boot community feature which NXP's BSP also has but not in your SW env. 

You need to discuss with your BSP team if BSP team remove this function. 

BTW, NXP shared Updated ELE/V2X FW recently but your FW seems to be not latest. 

Please discuss with your security internal team to sync up the FW version.  (btw, this FW version is not related with fastboot feature enablement or not) 

BRs

jessie

BRs

jessie

[Richard_Kim]

Hello @Ankit_Agrawal,

Our internal team is reviewing your issue and will update you accordingly.

In the meantime, please review the case below, which is similar to the issue you are encountering.

The suggested solution is to verify that the fuse_version matches correctly.

https://community.nxp.com/t5/i-MX-Processors/hsm-import-key-returns-with-0xF0-Bad-Signature/td-p/216...

Thank you.

Best Regards,

Richard

[Jessie_Lee]

Hi @Ankit_Agrawal 

I am wondering if you burn SRKH  after SRK generation.  for necessary sign.yaml file please check my attached file. 

Please try below command (precondition is you should have flash.bin: bootloader of system) to generate SRKH.  

nxpimage ahab sign -c sign.yaml -b flash.bin -o flash_directsign.bin -fs outputs
output will be as below.

and from the ouputs folder, you could see bcf file(ahab_oem0_srk0_hash_nxpele.bcf). 

you could follow below fuse command  (index 128 ~143) that you need to fuse for SRKH. 

# nxpele AHAB SRKH fuses programming script
# Generated by SPSDK 3.4.0
# Family: mimx9596, Revision: latest

# Value: 0xCCC0605919B6400771CF88A002FB6BF27DFA9CE09BAD94516DD7E4D399369A8FF5A6A1A671809DF4A71A7CB208B4EDC009CDF3FF25EC074DECBBEE8300D5D44C
# Description: SHA512 hash digest of hash of four SRK keys
# Grouped register name: SRKH

# OTP ID: OEM_SRKH0, Value: 0x5960C0CC
write-fuse --index 128 --data 0x5960C0CC
# OTP ID: OEM_SRKH1, Value: 0x0740B619
write-fuse --index 129 --data 0x740B619
# OTP ID: OEM_SRKH2, Value: 0xA088CF71
write-fuse --index 130 --data 0xA088CF71
# OTP ID: OEM_SRKH3, Value: 0xF26BFB02
write-fuse --index 131 --data 0xF26BFB02
# OTP ID: OEM_SRKH4, Value: 0xE09CFA7D
write-fuse --index 132 --data 0xE09CFA7D
# OTP ID: OEM_SRKH5, Value: 0x5194AD9B
write-fuse --index 133 --data 0x5194AD9B
# OTP ID: OEM_SRKH6, Value: 0xD3E4D76D
write-fuse --index 134 --data 0xD3E4D76D
# OTP ID: OEM_SRKH7, Value: 0x8F9A3699
write-fuse --index 135 --data 0x8F9A3699
# OTP ID: OEM_SRKH8, Value: 0xA6A1A6F5
write-fuse --index 136 --data 0xA6A1A6F5
# OTP ID: OEM_SRKH9, Value: 0xF49D8071
write-fuse --index 137 --data 0xF49D8071
# OTP ID: OEM_SRKH10, Value: 0xB27C1AA7
write-fuse --index 138 --data 0xB27C1AA7
# OTP ID: OEM_SRKH11, Value: 0xC0EDB408
write-fuse --index 139 --data 0xC0EDB408
# OTP ID: OEM_SRKH12, Value: 0xFFF3CD09
write-fuse --index 140 --data 0xFFF3CD09
# OTP ID: OEM_SRKH13, Value: 0x4D07EC25
write-fuse --index 141 --data 0x4D07EC25
# OTP ID: OEM_SRKH14, Value: 0x83EEBBEC
write-fuse --index 142 --data 0x83EEBBEC
# OTP ID: OEM_SRKH15, Value: 0x4CD4D500
write-fuse --index 143 --data 0x4CD4D500

you could use below command to burn SRKH

nxpele -f mimx9596 batch outputs\ahab_oem0_srk0_hash_nxpele.bcf

If you burn the SRKH already but failed with below invalid singing, please share the singed_message.bin to us.  with your SRKH (including srk output all). 

[Ankit_Agrawal]

Hi @Jessie_Lee ,

Thanks for the information.
We have located the flash.bin file and are able to perform the necessary steps to generate the SRKH.
After generating the SRKH, we need to fuse it to the hardware. To perform the fuse operation, the hardware/board must be in Fastboot mode. Could you please help us switch the device to Fastboot mode?

While attempting to fuse the keys, we are encountering the following error:

It appears that the device is not currently in Fastboot mode. Any guidance on how to enable Fastboot mode on the board would be greatly appreciated.

Thanks, 
Ankit

[Jessie_Lee]

Hi @Ankit_Agrawal 

Please follow up below steps to burn SRK using SPSDK

step#1. when you boot device, stop at u-boot console , run 

u-boot=> fastboot 0

step#2.  In SPSDK console , you must there is no ahab events) using below command.

nxpele -f mimx9596 get-events 

step#3. If there is no event,  you could burn SRK key now in SPSDK console.

nxpele -f mimx9596 batch outputs\ahab_oem2_srk0_hash_nxpele.bcf

BRs

jessie