User`s guide

Secure Boot with i.MX28 HAB Version 4, Rev. 1
14 Freescale Semiconductor
Designing for code signing
The first CSF in the boot sequence must contain an Install SRK command to install a single SRK from the
SRK Table provided. Also, it must contain an Install CSFK command to install the CSF key prior to CSF
authentication. Subsequent CSFs in the boot sequence do not require Install SRK and Install CSFK
commands. Every CSF must contain an Authenticate CSF command to authenticate the CSF contents
using the CSF key.
To facilitate well-formed CSF generation, Freescale provides a reference Code Signing Tool
(IMX_CST_TOOL) for the creation of the CSF data necessary to perform a secure boot. The CST release
package is available at freescale.com as shown in the list of references.
The binary output from the CST consists of the following components:
• CSF commands interpreted by HAB
• SRK Table and corresponding fuse pattern
• Public key certificates
• CSF Signature
• One or more Image signatures
NOTE
Prior to continuing with examples described below see the CST User’s
Guide available in the above mentioned package to obtain a better
understanding of the code signing process and how to use the CST.
3.2.2 Generating keys and the Super Root Key (SRK) Table
To begin, HAB code signing keys are required. The CST provides scripts to generate the required private
keys and public key certificates. In addition to the keys a SRK table must also be generated.
The following steps illustrate how the keys and SRK Table can be generated:
1. Generating HAB code signing keys—To generate the standard code signing keys for HAB run the
following command:
./hab4_pki_tree.sh
The resulting private keys will be placed in the keys directory of the CST and the corresponding
X.509 certificates will be placed in the crts directory. The private keys are stored in password
protected files in PKCS#8 format but care must be taken to ensure that the confidentiality of these
keys is maintained.
For details on key generation with the CST, see HAB CST User Guide.
2. Generating an SRK Table—The SRK Table is constructed from up to four public SRKs. A
cryptographic hash of this table is generated by the CST for provisioning to the SRK_HASH field
in OTP fuses during manufacturing. At boot time an Install SRK CSF command specifies the
location of the SRK Table in memory as well as the index of the SRK to use for authenticating the
remaining keys.
To generate an SRK Table the CST provides the srktool, which requires X.509v3 public key
certificates for the SRKs as inputs. The following is an example to generate an SRK Table with
four keys: