> Markdown version of https://docs.laavat.io/exampleflows/spsdk-ahab-rsa-signing/ from the LAAVAT PKI and Signing Platform documentation. All pages: https://docs.laavat.io/llms.txt

# AHAB signing with RSA keys (SPSDK)

This example is the RSA version of the [AHAB usage example](https://docs.laavat.io/exampleflows/ahabsigning/).
The steps are the same, with two differences: the four Super Root Key (SRK) keys
are RSA, and the SRK certificate profile **must** use an RSA-PSS Signature
Algorithm. Only the RSA-specific parts are shown here — for the full walkthrough
(authentication, getting the SRK table and hash, building the payload, signing,
downloading and verifying) follow the EC example and substitute the profile and
product below.

> **Note: Token handling in these examples**
> The `signing-tool` commands below use `-n test.ini` - a config file created with `config-init` that references
> a `token_file` rather than embedding a token, so no token appears on the command line. See [Reference Client ›
> Usage](https://docs.laavat.io/democlient/usage/) for how to create it and for the secure token-input forms (`-t @file`, `-t @-`).

## The SRK certificate profile (RSA-PSS)

For RSA, the SRK certificate profile must use an RSA-PSS Signature Algorithm —
`13` (SHA256), `14` (SHA384) or `15` (SHA512). A ready-made profile is given in
[(A)HAB SPSDK SRK profile for RSA-PSS keys](https://docs.laavat.io/usage/productguide/pki-examples/#ahab-spsdk-srk-profile-for-rsa-pss-keys).

> **Warning**
> RSA SRKs require an RSA-PSS profile. If you use an ordinary (non-PSS) RSA
> profile by mistake, the SRK hash on the signed image will not match the one
> fused into the device, and the device will **reject the image**.

Add the profile and note its ID:

```bash
(venv) $ signing-tool -n test.ini profile \
    add -F srk-rsapss-endentity.yaml -N "AHAB SPSDK SRK Profile (RSA-PSS)" -T END
{
    "id": "a1c2e3f4-5678-49ab-90cd-1234567890ef",
    "profile_name": "AHAB SPSDK SRK Profile (RSA-PSS)",
    "profile_type": 1,
    "profile_yaml": "<base64 of the profile yaml>"
}
Profile added. Profile ID: a1c2e3f4-5678-49ab-90cd-1234567890ef
```

## The product (RSA keys)

The product is the same SRK-only product as in the EC example, but the four SRK
certificates use an RSA key type (`RSA2048`, `RSA3072` or `RSA4096`) and point at
the RSA-PSS profile. Replace `$RSAPSSPROFILEID` with the profile ID above.

```json
{
    "name": "TEST for i.mx9 (RSA)",
    "description": "AHAB SPSDK signing product, RSA keys",
    "productType": "Production",
    "enabled": true,
    "caInfo": [
        { "CN": "SRK0", "description": "SRK for i.MX9 AHAB", "useCase": "HABCA", "profileID": "$RSAPSSPROFILEID", "keyType": "RSA4096", "certificateType": "ROOT" },
        { "CN": "SRK1", "description": "SRK for i.MX9 AHAB", "useCase": "HABCA", "profileID": "$RSAPSSPROFILEID", "keyType": "RSA4096", "certificateType": "ROOT" },
        { "CN": "SRK2", "description": "SRK for i.MX9 AHAB", "useCase": "HABCA", "profileID": "$RSAPSSPROFILEID", "keyType": "RSA4096", "certificateType": "ROOT" },
        { "CN": "SRK3", "description": "SRK for i.MX9 AHAB", "useCase": "HABCA", "profileID": "$RSAPSSPROFILEID", "keyType": "RSA4096", "certificateType": "ROOT" }
    ],
    "productConfigItems": [
        { "name": "FusemapType", "value": "IMXAHAB" },
        { "name": "AHABDigest", "value": "sha256" }
    ],
    "productOperations": [
        {
            "name": "AHAB SPSDK signing",
            "description": "AHAB image signing via SPSDK, RSA keys",
            "operationType": "SignSPSDK",
            "approvalRule": {
                "name": "Test rule",
                "description": "Rule used for the TEST product",
                "allowedGroups": ["$WRITERGROUP"],
                "approvalGroups": ["$APPROVERGROUP"],
                "blanketGroups": []
            }
        }
    ]
}
```

This product generates four RSA4096 key pairs in the CloudHSM (one per SRK).

## Signing

Signing is identical to the EC example: build the `tar.gz` payload
(`request.json` + the SPSDK configuration file + the image), submit it with
`SignSPSDK`, approve the request, and download the signed container. See
[Building the signing payload](https://docs.laavat.io/exampleflows/ahabsigning/#building-the-signing-payload) and
the stages that follow it.