Skip to content

Signing and Encryption

When the product is created, there are one or many different operations which can be performed. E.g. RAUC signing, signing of digest or FIT signing.

Below is the generic process for imagesigning:

  • First, the AWS S3 presigned URL is obtained from the Solution.
  • Using the URL the payload is uploaded to the AWS S3 bucket.
  • S3 provides an ETag in successful upload.
  • The imagesigning request with relevant info, productid, and product operationid and the ETag is created to the Solution.
  • Depending on the Approval rule, the request might require approval
  • Once approved, the request is processed.
  • Client is polling the request until the state is either success or failure
  • In a successful case, the AWS S3 presigned URL is provided, and the result can be downloaded.

This upload/download process applies to content of any size, up to the 5 GiB that S3 accepts in a single upload. Individual operations may still impose their own limits — notably the AES-GCM modes, which encrypt in a single pass: 4 GiB for the AES-GCM-*-PSKEK modes and for software-protected keys, and 16 KB for a plain AES-GCM-* mode with an HSM-backed key. See AES image encryption.

Digest signing

Add a digest for signing. The digest needs to be b64 encoded raw binary digest. Approve if needed. You may use the -O command line flag to save the signature directly into a file. The output signature is automatically decoded into binary form.

# you can get the suitable form of the digest with the following
sha256sum myfile.bin | cut -d" " -f1 | xxd -r -p | base64

# Send the request
(venv) $ signing-tool -n test.ini imagesigning add DigestSigning \
    -P b508d600-977a-46f4-9070-5cf56646bae1 --operid f7a29d80-7df4-4546-bea7-201d199acb1d \
    -p "NA+2NhI/XlnojS1iY8yoo6+9YdOu1Fo6BnGk6KLZCuo=" -O signeddig.test -H SHA256
{
    "call_back_url": null,
    "description": "digest signing request",
    "id": "40297ad0-5ba1-4d9c-b262-3591fcc6ac46",
    "id_product": "b508d600-977a-46f4-9070-5cf56646bae1",
    "id_product_operation": "f7a29d80-7df4-4546-bea7-201d199acb1d",
    "name": "Digest signing request",
    "payload": {
        "id": null,
        "metadata": [
            {
                "name": "Version",
                "value": "1.0"
            }
        ],
        "name": "Signing payload",
        "s3_url": null,
        "service_provided_parameters": null
    },
    "state": 1
}
Image signing request sent. Request ID: 40297ad0-5ba1-4d9c-b262-3591fcc6ac46 state: Created
Polling for request
File Downloaded
(venv) $

Should you need to retrieve the signature again from a given request. You can do the following:

(venv) $ signing-tool -n test.ini imagesigning get \
    -I 40297ad0-5ba1-4d9c-b262-3591fcc6ac46 -O signed.bin
{
    "call_back_url": null,
    "description": "digest signing request",
    "id": "40297ad0-5ba1-4d9c-b262-3591fcc6ac46",
    "id_product": "b508d600-977a-46f4-9070-5cf56646bae1",
    "id_product_operation": "f7a29d80-7df4-4546-bea7-201d199acb1d",
    "name": "Digest signing request",
    "payload": {
        "id": "336d0c78-59f0-44c5-95d5-e2e6b3c07b7a",
        "metadata": [
            {
                "name": "Version",
                "value": "1.0"
            }
        ],
        "name": "Signing payload",
        "s3_url": "<redacted>",
        "service_provided_parameters": []
    },
    "state": 16
}
Downloading signed binary to: signed.bin

File Downloaded
(venv) $

(A)HAB signing using detached digest

Similar to digest signing, you may use the -O flag here to have the client automatically download the result if no approval is required.

CSF signing:

(venv) $ signing-tool -n test.ini imagesigning add SignHABCSF \
    -P b508d600-977a-46f4-9070-5cf56646bae1 --operid f7ae0503-5a6d-47b6-bfc2-6decc5557dec \
    -H SHA256 -p "NA+2NhI/XlnojS1iY8yoo6+9YdOu1Fo6BnGk6KLZCuo=" -O habout.test
{
    "call_back_url": null,
    "description": "digest signing request",
    "id": "7a61bf36-4776-4bdb-a9ba-dfe72fa4b871",
    "id_product": "b508d600-977a-46f4-9070-5cf56646bae1",
    "id_product_operation": "f7ae0503-5a6d-47b6-bfc2-6decc5557dec",
    "name": "automated request",
    "payload": {
        "id": null,
        "metadata": [
            {
                "name": "Version",
                "value": "1.0"
            }
        ],
        "name": "Signing payload",
        "s3_url": null,
        "service_provided_parameters": null
    },
    "state": 1
}
Image signing request sent. Request ID: 7a61bf36-4776-4bdb-a9ba-dfe72fa4b871, state: Created
Polling for request

File Downloaded
(venv) $

IMG signing:

(venv) $ signing-tool -n test.ini imagesigning add SignHABIMG \
    -P b508d600-977a-46f4-9070-5cf56646bae1 --operid 1c3c9edd-a71a-42f2-8b76-04ce59b355c3 \
    -H SHA256 -p "NA+2NhI/XlnojS1iY8yoo6+9YdOu1Fo6BnGk6KLZCuo=" -O habout.test
{
    "call_back_url": null,
    "description": "digest signing request",
    "id": "76466f78-c3a8-4c77-8876-3c5e4e9fadf1",
    "id_product": "b508d600-977a-46f4-9070-5cf56646bae1",
    "id_product_operation": "1c3c9edd-a71a-42f2-8b76-04ce59b355c3",
    "name": "automated request",
    "payload": {
        "id": null,
        "metadata": [
            {
                "name": "Version",
                "value": "1.0"
            }
        ],
        "name": "Signing payload",
        "s3_url": null,
        "service_provided_parameters": null
    },
    "state": 1
}
Image signing request sent. Request ID: 76466f78-c3a8-4c77-8876-3c5e4e9fadf1, state: Created
Polling for request
File Downloaded

SGK signing:

(venv) $ signing-tool -n test.ini imagesigning add SignAHAB \
    -P b508d600-977a-46f4-9070-5cf56646bae1 --operid 1c3c9edd-a71a-42f2-8b76-04ce59b355c3 \
    -H SHA256 -p "NA+2NhI/XlnojS1iY8yoo6+9YdOu1Fo6BnGk6KLZCuo=" -O habout.test
{
    "call_back_url": null,
    "description": "digest signing request",
    "id": "76466f78-c3a8-4c77-8876-3c5e4e9fadf1",
    "id_product": "b508d600-977a-46f4-9070-5cf56646bae1",
    "id_product_operation": "1c3c9edd-a71a-42f2-8b76-04ce59b355c3",
    "name": "automated request",
    "payload": {
        "id": null,
        "metadata": [
            {
                "name": "Version",
                "value": "1.0"
            }
        ],
        "name": "Signing payload",
        "s3_url": null,
        "service_provided_parameters": null
    },
    "state": 1
}
Image signing request sent. Request ID: 76466f78-c3a8-4c77-8876-3c5e4e9fadf1, state: Created
Polling for request
File Downloaded

Please refer to the digest signing section should you need to retrieve the output of a request again.

SPSDK AHAB signing

AHAB boot containers for i.MX8QXP and i.MX9 devices are signed with the SignSPSDK operation, which runs NXP's Secure Provisioning SDK. Instead of a single binary, the request carries a small compressed archive (the image, a short SPSDK configuration file, and a request.json that names them). Both elliptic-curve (EC) and RSA keys are supported. See SPSDK signing for the full instructions and examples.

Note that SignAHAB above is a different operation: it signs only a hash (digest) with the AHAB SGK key, not a whole image.