| AAD |
Azure Active Directory |
| AHAB |
Advanced High Assurance Boot |
| AES |
Advanced Encryption Standard |
| Ansible |
Ansible is an open-source software provisioning, configuration management, and application-deployment tool enabling infrastructure as code. |
| Ansible Vault |
Ansible encrypted storage. |
| API |
Application Programming Interface |
| Approval rule |
Per-operation rule naming which identity-provider groups may submit a request and which may approve it. A blanket group is auto-approved, which is how unattended CI signs. |
| Artifactory |
JFrog Enterprise Universal Repository Manager |
| AWS |
Amazon Web Services |
| Blanket group |
A group named in an approval rule whose submissions are approved automatically, without a second person. Used for CI pipelines; it bypasses two-person review, so scope it narrowly. |
| Bootgen |
AMD/Xilinx tool and image format for Zynq and Zynq UltraScale+ boot images. |
| CA |
Certificate Authority |
| CI/CD |
Combined practices of continuous integration, continuous delivery, and continuous deployment. |
| CP |
Certificate Policy is a named set of rules that indicates the applicability of a certificate to a particular community and class of application with common security requirements. For example, a particular CP might indicate the applicability of a type of certificate to the authentication of parties engaging in business-to-business transactions for the trading of goods or services within a given price range. rfc3647 |
| CPS |
Certificate Practice Statement is a statement of the practices that a certification authority employs in issuing, managing, revoking, and renewing or re-keying certificates. rfc3647 |
| CRA |
EU Cyber Resilience Act (Regulation (EU) 2024/2847), which sets mandatory cybersecurity requirements for products with digital elements. |
| CRL |
Certificate Revocation List — the published list of certificates revoked before their expiry. |
| CSF |
Command Sequence File (Used in HAB) |
| CSR |
Certificate Signing Request — a request containing a public key and subject details, submitted to a CA to be signed into a certificate. |
| CST |
NXP Code Signing Tool. Command-line tool used to sign HAB (i.MX6/7/8M) and, legacy, AHAB images. |
| Docker |
Docker is a tool designed to make it easier to create, deploy, and run applications by using containers. Containers allow a developer to package up an application with all of the parts it needs, such as libraries and other dependencies, and deploy it as one package. |
| EC |
Elliptic Curve |
| ECDSA |
Elliptic Curve Digital Signature Algorithm |
| EFK |
Elasticsearch, Fluentd, and Kibana for logging. |
| Escrow |
A controlled key-recovery path. Superseded on the platform by the export paths described in key custody and export. |
| EST |
Enrollment over Secure Transport (RFC 7030), the protocol used for automated device certificate enrollment. |
| Extractable |
A platform flag on an encryption key token allowing that key to be wrapped out of the platform online. Valid only on encryption keys — the platform rejects it on signing keys. |
| FIT |
Flattened Image Tree — the U-Boot multi-component image format, which supports signatures over its constituent images. |
| Fluentd |
An open-source data collector for unified logging layer. |
| Fusemap |
The set of values to be burned into a device's one-time-programmable fuses, such as an SRK hash or an AES key. |
| Golang |
Golang is a statically typed, compiled programming language designed at Google. |
| HA |
High Availability. |
| HAB |
High Assurance Boot |
| HKDF |
HMAC Key Derivation function |
| HMAC |
Keyed-hash message authentication code (HMAC) is a specific type of message authentication code involving a cryptographic hash function and a secret cryptographic key. |
| HSM |
A Hardware Security Module (HSM) is a physical computing device that safeguards and manages digital keys for strong authentication and provides crypto processing. |
| HW |
Hardware |
| IDevID |
Initial Device Identifier — a long-lived device identity certificate installed during manufacturing (IEEE 802.1AR). See Trusted device identities. |
| IMG |
Image signing certificate in HAB |
| IoT |
The Internet of things (IoT) is the extension of Internet connectivity into physical devices and everyday objects. |
| IP |
Intellectual Property |
| ISG |
Installation and Setup Guide |
| IV |
Initialization Vector |
| Jenkins |
Open source automation server www.jenkins.io |
| JWE |
JSON Web Encryption rfc7516 |
| KEK |
Key Encryption Key |
| Kubernetes(K8s) |
Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. |
| K8s cluster |
Set of virtual machines implementing the K8 system. |
| LDevID |
Local Device Identifier — an operationally issued device identity certificate, typically enrolled in the field against an IDevID (IEEE 802.1AR). See Trusted device identities. |
| MCUboot |
MCUboot — a secure bootloader for 32-bit microcontrollers. |
| MS Graph |
Microsoft Graph is the gateway to data and intelligence in Microsoft 365. |
| Nginx |
Nginx [engine x] is an HTTP and reverse proxy server, a mail proxy server, and a generic TCP/UDP proxy server. |
| OCI |
The Open Container Initiative (OCI) is a Linux Foundation project, started in June 2015 by Docker, to design open standards for operating-system-level virtualization (software containers), most importantly Linux containers. |
| PKI |
Public Key Infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store & revoke digital certificates and manage public-key encryption. |
| Product |
The central configuration object in the platform: the keys, PKI and operations belonging to one device, product family or use case. |
| Product operation |
A callable action on a product — for example a signing or encryption operation — with its own key token and approval rule. |
| Prometheus |
Prometheus is an open-source system monitoring and alerting toolkit. |
| R&D |
Research and Development |
| RAUC |
Robust Auto-Update Controller — an update framework for embedded Linux, using signed update bundles. |
| REST |
Representational State Transfer (REST) |
| RSA |
RSA (Rivest–Shamir–Adleman) is one of the first public-key cryptosystems. |
| RSA-PSS |
RSA signature scheme with PSS padding. Required for RSA AHAB SRK certificates signed via SPSDK. |
| SBOM |
Software Bill of Materials — an inventory of the components in a product, required for CRA vulnerability handling. |
| SBSFU |
Secure Boot and Secure Firmware Update — STMicroelectronics' secure boot framework. |
| SGK |
Subordinate key of the SRK key and is used to verify signatures across product software. |
| signing-tool |
The reference client — a Python CLI published on PyPI that drives every platform operation from a desktop or CI/CD. |
| SPSDK |
NXP Secure Provisioning SDK. Tool used by the platform to sign AHAB boot containers (the SignSPSDK operation). |
| SRK |
Super Root Key. A key pair (RSA or elliptic-curve) that forms the start of the boot-time authentication chain. |
| SRK Hash |
Hash value of the SRK table. |
| Sub-CA |
Subordinate Certificate Authority |
| SW |
Software |
| TLS |
Transport Layer Security |
| Truststore |
A CA trust list uploaded to the platform, used to validate mTLS, EST or provisioning client certificates. |
| UML |
Unified Modeling Language |
| X.509 |
X.509 is a standard defining the format of public key certificates. rfc5280 |
| YAML |
(a recursive acronym for "YAML Ain't Markup Language") is a human-readable data-serialization language. |
| # |
Commands prefixed with this are run as root |
| $ |
Commands prefixed with this are run as user |