MCUBoot Hardware Key Hash for application sign verification

[Sathishkumar-rk]

Hi Team,

I want to use the Hardware Key Mechanism for application sign verification from MCUBoot.

From forum MCUBOOT Hardware Key found details about mechanism. But in the document there is option to retrieve hash value using boot_retrieve_public_key_hash API, which we need to write our own.

I'm using iMXRT1160_EVK board for my development, Is there any fuse option available to store hash value or what are option to store hash value and then MCUBoot can retrieve it when doing authentication process?

Mainly we need the code reference to access efuse/non-volatile memory registers from MCUBoot for iMXRT1160_EVK board.

Hi @DerekSnell @danieldegrasse can you give your thoughts on above request and help us to access the efuse/non-volatile registers. Referred forms regarding Hardware Key retrieve and found below link TFM

Regards,
Sathishkumar K

[DerekSnell]

Hi @Sathishkumar-rk ,

Yes, you can use the OTP fuses in the RT1160 for storing a hash like this. The RT1160 Fusemap documents some fuses for general purpose use in your application, which you can use to store this hash. The table below shows these fuse locations, and for more details refer to the Fusemap chapter in the RT1160 Reference Manual.

You can read these fuses at runtime using register reads. For example, the two lines below read the 64-bit UNIQUE_ID fuses. For using the On-Chip OTP (OCOTP) Controller peripheral, the MCUXpresso SDK has an OCOTP example for the RT1160 EVK.

    propertyStore->UniqueDeviceId.uid[0] = OCOTP->FUSEN[16].FUSE;
    propertyStore->UniqueDeviceId.uid[1] = OCOTP->FUSEN[17].FUSE;

For programming the fuses with your hash, you can use NXP's Secure Provisioning Tool.

Best regards

[Sathishkumar-rk]

@DerekSnell Thanks for the update regarding general register for hardware key hash. Sorry, for the late response i was diverted to other feasibility work on RT1160_evk_cm7. I will check by tomorrow and get back to you.

Thanks again.

[Sathishkumar-rk]

Hi @DerekSnell

I was checking the OCOTP controller to read the general purpose register, while looking iMXRT1160 reference manual found some details regarding register fuse map address field in OCOTP control register. It says we can read the fuse till fuse143 (800h to 1040h).

while trying to read apart from this address range I'm getting Could not read fuse data error in debug console.

Is there any configuration setting I'm missing OCOTP control register?

[DerekSnell]

Hi @Sathishkumar-rk ,

This GitHub discussion is focused on Zephyr. If you have an SOC-specific question that is not related to Zephyr, I suggest you post your questions on NXP's Community forum. The support engineers there are focused on the different SOC families, and can probably provide better assistance than expecting an answer here. For the RT1xxx series, you can create a post at https://community.nxp.com/t5/i-MX-RT/bd-p/imxrt. Best regards

[Sathishkumar-rk]

@DerekSnell Thanks for the community link, and I will raise the ticket in NXP community.