Re: [PATCH 4/5] doc: imx: ahab: add i.MX93 secure boot guide

Hi Simon,

On 8/14/26 23:23, Simon Glass wrote:

[..]
>> +See the introduction_ahab.txt document for the PKI tree generation
>> +procedure (ahab_pki_tree tool) and for the SRK Table generation
>> +(srktool, use the SHA256 variant for i.MX93).
> 
> Just to check - the default key material the etype uses is
> 'sha384_secp384r1' (see KEY_NAME in nxp_imx93cst.py), so telling the
> reader to use the SHA256 srktool variant looks inconsistent with what
> CST is then asked to sign with. Can you confirm which srktool hash
> flag matches the shipped default, and align this sentence with it?
> 

I'll probably remove this mention, as I don't think it's really 
necessary, but to clarify, there are two different checksums at play here:
     - The SRK table checksum: the i.MX93 only supports SHA256, so when 
generating the table with srktool, the user must specify this algorithm.
     - The signature/key checksum: the i.MX93 supports multiple key 
algorithms (RSA, ECDSA, ...), each with its own associated digest.

So in my sentence, "use the SHA256 srktool variant" refers to the first 
case, whereas the default key name ("sha384_secp384r1") refers to the 
second, i.e. the digest associated with that specific key algorithm.

Best regards,
Jérémie
-- 
Jérémie Dautheribes, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com