HI team,
I am using the imx8qxp-mek board, i was going through the below doc.
https://github.com/nxp-imx/uboot-imx/blob/lf_v2023.04/doc/imx/ahab/introduction_ahab.txt
I have a doubt on some points.
If i amusing the below configuration while generating the keys and certificate.
$ ./ahab_pki_tree.sh
...
Do you want to use an existing CA key (y/n)?: n
Do you want to use Elliptic Curve Cryptography (y/n)?: y
Enter length for elliptic curve to be used for PKI tree:
Possible values p256, p384, p521: p384
Enter the digest algorithm to use: sha384
Enter PKI tree duration (years): 5
Do you want the SRK certificates to have the CA flag set? (y/n)?: y
then I am getting the below cert.
release/crts$ ls
CA1_sha256_prime256v1_v3_ca_crt.der
SGK3_1_sha256_prime256v1_v3_usr_crt.der
SRK2_sha256_prime256v1_v3_ca_crt.der
CA1_sha256_prime256v1_v3_ca_crt.pem
SGK3_1_sha256_prime256v1_v3_usr_crt.pem
SRK2_sha256_prime256v1_v3_ca_crt.pem
SGK1_1_sha256_prime256v1_v3_usr_crt.der
SGK4_1_sha256_prime256v1_v3_usr_crt.der
SRK3_sha256_prime256v1_v3_ca_crt.der
SGK1_1_sha256_prime256v1_v3_usr_crt.pem
SGK4_1_sha256_prime256v1_v3_usr_crt.pem
SRK3_sha256_prime256v1_v3_ca_crt.pem
SGK2_1_sha256_prime256v1_v3_usr_crt.der
SRK1_sha256_prime256v1_v3_ca_crt.der
SRK4_sha256_prime256v1_v3_ca_crt.der
SGK2_1_sha256_prime256v1_v3_usr_crt.pem
SRK1_sha256_prime256v1_v3_ca_crt.pem
SRK4_sha256_prime256v1_v3_ca_crt.pem
So, as per the document,
- Generating SRK Table and SRK Hash in Linux 64-bit machines:
- In i.MX 8/8x family, the expected SRK HASH is of 512 bit.
$ cd ../crts/
$ ../linux64/bin/srktool -a -s sha384 -t SRK_1_2_3_4_table.bin \
-e SRK_1_2_3_4_fuse.bin -f 1 -c \
SRK1_sha384_secp384r1_v3_usr_crt.pem,\
SRK2_sha384_secp384r1_v3_usr_crt.pem,\
SRK3_sha384_secp384r1_v3_usr_crt.pem,\
SRK4_sha384_secp384r1_v3_usr_crt.pem
my doubts:
1) mentioned as expected SRK HASH is of 512 bit then why in command using sha384 ? Is this correct ?
2) If I am using the CA flag then we are getting the certificate as SRK1_sha256_prime256v1_v3_ca_crt.pem not SRK1_sha384_secp384r1_v3_usr_crt.pem then in this case we should use this crt SRK<num>_sha256_prime256v1_v3_ca_crt.pem with this command ../linux64/bin/srktool ?
3) If i have created the SRK hash table/fuse.bin using sha384 then we need to check the srk table with below cmd.
$ od -t x4 --endian=big SRK_1_2_3_4_fuse.bin
0000000 01b04697 0253376b 2066fe56 aaef9a91
0000020 e62e09d8 14fb7e36 d5b38d05 0982edab
0000040 7ada6576 2f6b4f59 1fd9347e 46e7305d
0000060 46e34bf0 89780bd1 c809e714 a17e2f4e
$ sha256sum SRK_1_2_3_4_table.bin
01b046970253376b2066fe56aaef9a91\
e62e09d814fb7e36d5b38d050982edab\
7ada65762f6b4f591fd9347e46e7305d\
46e34bf089780bd1c809e714a17e2f4e\
SRK_1_2_3_4_table.bin
Please clearify these doubts before I flash the keys in EEPROM
Regards,
Rk
