AHAB signing with RSA keys (SPSDK)

This example is the RSA version of the AHAB usage example. The steps are the same, with two differences: the four Super Root Key (SRK) keys are RSA, and the SRK certificate profile must use an RSA-PSS Signature Algorithm. Only the RSA-specific parts are shown here — for the full walkthrough (authentication, getting the SRK table and hash, building the payload, signing, downloading and verifying) follow the EC example and substitute the profile and product below.

Token handling in these examples

The signing-tool commands below use -n test.ini - a config file created with config-init that references a token_file rather than embedding a token, so no token appears on the command line. See Reference Client › Usage for how to create it and for the secure token-input forms (-t @file, -t @-).

The SRK certificate profile (RSA-PSS)

For RSA, the SRK certificate profile must use an RSA-PSS Signature Algorithm — 13 (SHA256), 14 (SHA384) or 15 (SHA512). A ready-made profile is given in (A)HAB SPSDK SRK profile for RSA-PSS keys.

Warning

RSA SRKs require an RSA-PSS profile. If you use an ordinary (non-PSS) RSA profile by mistake, the SRK hash on the signed image will not match the one fused into the device, and the device will reject the image.

Add the profile and note its ID:

(venv) $ signing-tool -n test.ini profile \
    add -F srk-rsapss-endentity.yaml -N "AHAB SPSDK SRK Profile (RSA-PSS)" -T END
{
    "id": "a1c2e3f4-5678-49ab-90cd-1234567890ef",
    "profile_name": "AHAB SPSDK SRK Profile (RSA-PSS)",
    "profile_type": 1,
    "profile_yaml": "<base64 of the profile yaml>"
}
Profile added. Profile ID: a1c2e3f4-5678-49ab-90cd-1234567890ef

The product (RSA keys)

The product is the same SRK-only product as in the EC example, but the four SRK certificates use an RSA key type (RSA2048, RSA3072 or RSA4096) and point at the RSA-PSS profile. Replace $RSAPSSPROFILEID with the profile ID above.

{
    "name": "TEST for i.mx9 (RSA)",
    "description": "AHAB SPSDK signing product, RSA keys",
    "productType": "Production",
    "enabled": true,
    "caInfo": [
        { "CN": "SRK0", "description": "SRK for i.MX9 AHAB", "useCase": "HABCA", "profileID": "$RSAPSSPROFILEID", "keyType": "RSA4096", "certificateType": "ROOT" },
        { "CN": "SRK1", "description": "SRK for i.MX9 AHAB", "useCase": "HABCA", "profileID": "$RSAPSSPROFILEID", "keyType": "RSA4096", "certificateType": "ROOT" },
        { "CN": "SRK2", "description": "SRK for i.MX9 AHAB", "useCase": "HABCA", "profileID": "$RSAPSSPROFILEID", "keyType": "RSA4096", "certificateType": "ROOT" },
        { "CN": "SRK3", "description": "SRK for i.MX9 AHAB", "useCase": "HABCA", "profileID": "$RSAPSSPROFILEID", "keyType": "RSA4096", "certificateType": "ROOT" }
    ],
    "productConfigItems": [
        { "name": "FusemapType", "value": "IMXAHAB" },
        { "name": "AHABDigest", "value": "sha256" }
    ],
    "productOperations": [
        {
            "name": "AHAB SPSDK signing",
            "description": "AHAB image signing via SPSDK, RSA keys",
            "operationType": "SignSPSDK",
            "approvalRule": {
                "name": "Test rule",
                "description": "Rule used for the TEST product",
                "allowedGroups": ["$WRITERGROUP"],
                "approvalGroups": ["$APPROVERGROUP"],
                "blanketGroups": []
            }
        }
    ]
}

This product generates four RSA4096 key pairs in the CloudHSM (one per SRK).

Signing

Signing is identical to the EC example: build the tar.gz payload (request.json + the SPSDK configuration file + the image), submit it with SignSPSDK, approve the request, and download the signed container. See Building the signing payload and the stages that follow it.