MCIMX6S5EVM10ACR 用户编程技术手册 - NXP（恩智浦）

SRK Revocation on i.MX 6 Series

2. Overview

HAB authentication is based on public key cryptography using the RSA algorithm in which image data

is signed offline using a series of private keys. The resulting signed image data is then verified on the

i.MX processor using the corresponding public keys. This key structure is known as a PKI tree. Super

Root Keys, or SRK, are components of the PKI tree. HAB relies on a table of the public SRKs to be

hashed and placed in fuses on the target. The Freescale Code Signing Tool, CST, is used in this guide to

generate the HABv4 signatures for images using the PKI tree data and SRK table. On the target, HAB

evaluates the SRK table included in the signature by hashing it and comparing the result to the SRK fuse

values. If the SRK verification is successful, this establishes the root of trust, and the remainder of the

3. Code signing example

The following sections detail the step by step process to securely boot an i.MX 6 Series part with

HABv4. After completing the steps, the image will have a valid HABv4 signature attached and the part

will be “closed”. Once “closed”, the part will only execute signed images.