- Forums
- Product Forums
- General Purpose MicrocontrollersGeneral Purpose Microcontrollers
- i.MX Forumsi.MX Forums
- QorIQ Processing PlatformsQorIQ Processing Platforms
- Identification and SecurityIdentification and Security
- Power ManagementPower Management
- Wireless ConnectivityWireless Connectivity
- RFID / NFCRFID / NFC
- Advanced AnalogAdvanced Analog
- MCX Microcontrollers
- S32G
- S32K
- S32V
- MPC5xxx
- Other NXP Products
- S12 / MagniV Microcontrollers
- Powertrain and Electrification Analog Drivers
- Sensors
- Vybrid Processors
- Digital Signal Controllers
- 8-bit Microcontrollers
- ColdFire/68K Microcontrollers and Processors
- PowerQUICC Processors
- OSBDM and TBDML
- S32M
- S32Z/E
-
- Solution Forums
- Software Forums
- MCUXpresso Software and ToolsMCUXpresso Software and Tools
- CodeWarriorCodeWarrior
- MQX Software SolutionsMQX Software Solutions
- Model-Based Design Toolbox (MBDT)Model-Based Design Toolbox (MBDT)
- FreeMASTER
- eIQ Machine Learning Software
- Embedded Software and Tools Clinic
- S32 SDK
- S32 Design Studio
- GUI Guider
- Zephyr Project
- Voice Technology
- Application Software Packs
- Secure Provisioning SDK (SPSDK)
- Processor Expert Software
- Generative AI & LLMs
-
- Topics
- Mobile Robotics - Drones and RoversMobile Robotics - Drones and Rovers
- NXP Training ContentNXP Training Content
- University ProgramsUniversity Programs
- Rapid IoT
- NXP Designs
- SafeAssure-Community
- OSS Security & Maintenance
- Using Our Community
-
- Cloud Lab Forums
-
- Knowledge Bases
- ARM Microcontrollers
- i.MX Processors
- Identification and Security
- Model-Based Design Toolbox (MBDT)
- QorIQ Processing Platforms
- S32 Automotive Processing Platform
- Wireless Connectivity
- CodeWarrior
- MCUXpresso Suite of Software and Tools
- MQX Software Solutions
- RFID / NFC
- Advanced Analog
-
- NXP Tech Blogs
- Home
- :
- i.MX Security
- :
- Knowledge Base
- :
- Potential issues with Secure boot automation (Security Reference Design)
Potential issues with Secure boot automation (Security Reference Design)
- Subscribe to RSS Feed
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
Potential issues with Secure boot automation (Security Reference Design)
Potential issues with Secure boot automation (Security Reference Design)
1. Symptoms
Since Q1-25 BSP release, the usage of SPSDK for code signing has been introduced. The devices that support V2X images may face an issue while signing using the signing automation due to the fact the SPSDK release available during Q1-25 release is 2.6.x which does re-signing of V2X containers using OEM keys which are already signed by NXP.
Affected Devices: i.MX 95 , i.MX 943, i.MX 8/8X
Affected SPSDK version: Any version before SPSDK 3.0.0.
1. Solution
The issue has been fixed in SPSDK 3.0.0 onwards but automation has not been tested with SPSDK 3.0.0 onwards. Please apply/port the 0001-Pull-request-2506-feat-ahab-Skip-signing-of-V2X-cont.patch patch attached here, in versions before SPSDK 3.0.0 and rebuild the SPSDK tool.
Now, the secure boot automation can be used to sign the affected devices' images properly.
2. Symptoms
Since Q1-25 BSP release, the usage of SPSDK for code signing has been introduced. Starting from SPSDK 3.0.0 the "signature_provider" has been renamed to "signer" . This will cause secure boot automation to fail.
2. Solution
Please use SPSDK version lower than 3.0.0 to rectify this issue. Eventually this change will be integrated into secure boot automation.
3. Symptoms
The image signing process fails for a boot image that is constructed with AHAB v2 container format. This is due to the fact that the nxp-cst-signer tool release v2.0 requires the container header version to be 0x00.
Affected Devices: i.MX 95 B0, i.MX 943.
3. Solution
The issue can be resolved by ignoring the version number check in nxp-cst-signer release v2.0. The corresponding patch 0001-Ignore-version-number-due-to-updated-contianer-forma.patch is attached to the post.
This issue will be fixed and integrated in next release of nxp-cst-signer.
4. Symptoms
The imx-mkimage release lf-6.12.3-1.0.0 and SPSDK release 3.0.0 are known to have an issue with secure boot automation for images that are built with AHAB v2.0 container format due to the fact that neither the imx-mkimage tool correctly set the "Signature Format Header version" of the OEM container nor does the SPSDK modify this version when signing the image. SPSDK fails to sign the image due to this reason and reports invalid signature header version when verbose option (-vv) is enabled.
4. Solution
The patch "0001-add-signature-blk-version.patch" to resolve this issue in imx-mkimage is attached. The patch will be integrated in imx-mkimage Q3 '25 release.
