Secure Binary 3.1
SB 3.1 is an evolution of the SB 2 format. The configuration is done in a similar way as a master boot image by configuration file in YAML or JSON. BD files are no longer used, commands are supplied in the configuration file.
Example of use
nxpimage: nxpimage sb31 export "sb3_config.yaml
Supported commands
List of SB 3.1 supported commands
Command |
Command Description |
lpc55s3x |
kw45xx |
k32w1xx |
|---|---|---|---|---|
erase |
Performs a flash erase of the given address range. The erase will be rounded up to the sector size. |
YES |
YES |
YES |
load |
If set, then the data to write immediately follows the range header. The length field contains the actual data length |
YES |
YES |
YES |
execute |
Address is the jump-to address. No further processing of SB after jump, ROM do not expect to return. |
YES |
YES |
YES |
call |
Address is address to jump. However, the state machine should expect a return to the next statement to continue processing the SB file |
NO |
NO |
NO |
programFuses |
Address is OTP index of fuses to be programmed (Check the reference manual for more information). Values is a comma separated list of 32bit values. |
YES |
YES |
YES |
programIFR |
The startAddress will be the address into the IFR region, length will be in number of bytes to write to IFR region. The data to write to IFR region at the given address will immediately follow the header |
YES |
YES |
YES |
loadCMAC |
If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating cmac from loaded data and storing on address known by ROM decided based on startAddress. |
YES |
YES |
YES |
copy |
Used for copying data from one place to another. 32 bytes fixed size. |
YES |
NO |
NO |
loadHashLocking |
If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating hash of the data and storing the value in the last 64 bytes of the loaded data, which are reserved for it. |
YES |
YES |
YES |
loadKeyBlob |
Wrapped key blob immediately follows the range key blob header. The length field contains the actual data length. |
YES |
NO |
NO |
configureMemory |
Configure memory. |
YES |
NO |
NO |
fillMemory |
Used for filling of the memory range by same repeated int32 pattern. |
YES |
YES |
YES |
checkFwVersion |
Used to execute check of provided counter value with value stored in specified monotonous counter in device. If values are not same, SB file is rejected. |
YES |
YES |
YES |
Supported configuration options
SecureBinary31 for k32w1xx
firmwareVersion([‘number’, ‘string’]): Version of application image firmware.rootCertificateEllipticCurve(string): Elliptic curve type used for root key. Must be one of:['secp256r1', 'secp384r1'].iskCertificateEllipticCurve(string): Elliptic curve type used for ISK key. Must be one of:['secp256r1', 'secp384r1'].binaryCertificateBlock(string): Optionally the certificate could be defined as a pre-generated binary block. In case that is defined, all other configuration for certification block is omitted expect the ‘signingCertificatePrivateKeyFile’ or ‘iskSignProvider’.useIsk(boolean): Enable ISK type of signature certification. Unused when ‘binaryCertificateBlock’ is defined.mainRootCertPrivateKeyFile(string): Path to Main root Certification Private Key. Unused when ‘binaryCertificateBlock’ is defined.signingCertificateFile(string): Path to Signing Certificate. Unused when ‘binaryCertificateBlock’ is defined.signingCertificateConstraint([‘string’, ‘number’]): Signing certificate constrain number. Unused when ‘binaryCertificateBlock’ is defined. Default:0.signCertData(string): Path to Signing Certificate data. Unused when ‘binaryCertificateBlock’ is defined.signingCertificatePrivateKeyFile(string): ISK Certificate private key used to sign certificate. It can be replaced by signProvider key.iskSignProvider(string): Signature provider configuration in format ‘type=<sp_type>;= ; = ”. rootCertificate0File(string): Root certificate file index 0.rootCertificate1File(string): Root certificate file index 1.rootCertificate2File(string): Root certificate file index 2.rootCertificate3File(string): Root certificate file index 3.mainRootCertId([‘number’, ‘string’]): Index of certificate that is used as a main. If not defined, the certificate matching private key will be selected.mainCertChainId([‘number’, ‘string’]): Caution! This property is kept here for backwards compatibility with old schemas. Use mainRootCertId instead.family(string): MCU family name. Must be one of:['k32w1xx', 'kw45xx', 'lpc55s3x'].containerKeyBlobEncryptionKey(string): Path to PCK/NPK key in plain hex string format.isNxpContainer(boolean): Internal usage only, used for generating SB files with NXP content e.g. provisioning firmware, sentinel firmware…kdkAccessRights(number): Accepted values are 0, 1, 2 and 3. Value used as key properties for key derivation process, more details can be found in CSSv2 manual. Must be one of:[0, 1, 2, 3].containerConfigurationWord([‘string’, ‘number’]): Flag value in SB3.1 manifest, not used by silicons with LPC55S3x ROM. Value can be kept 0, or it can be removed from the configuration file.description(string): Description up to 16 characters, longer will be truncated. Stored in SB3.1 manifest.commands(array): Secure Binary v3.1 commands block, list of all possible options - Modify it according to your application.Items
# =========== YAML template SecureBinary31 for k32w1xx ===========
# ----------------------------------------------------------------------------------------------------
# == SecureBinary31 for k32w1xx ==
# ----------------------------------------------------------------------------------------------------
firmwareVersion: 0 # [Optional], Firmware version; Version of application image firmware.
rootCertificateEllipticCurve: secp256r1 # [Conditionally required], Type of elliptic curve of root key; Elliptic curve type used for root key; Possible options:['secp256r1', 'secp384r1']
iskCertificateEllipticCurve: secp256r1 # [Conditionally required], Type of elliptic curve of ISK key; Elliptic curve type used for ISK key; Possible options:['secp256r1', 'secp384r1']
binaryCertificateBlock: my_isk_cert.bin # [Conditionally required], Binary Certificate; Optionally the certificate could be defined as a pre-generated binary block. In case that is defined, all other configuration for certification block is omitted expect the 'signingCertificatePrivateKeyFile' or 'iskSignProvider'
useIsk: false # [Conditionally required], Use ISK for signature certification; Enable ISK type of signature certification. Unused when 'binaryCertificateBlock' is defined
mainRootCertPrivateKeyFile: main_cert_prv_key.pem # [Conditionally required], Main root Certification Private Key; Path to Main root Certification Private Key. Unused when 'binaryCertificateBlock' is defined
signingCertificateFile: sign_cert.pem # [Conditionally required], Signing Certificate; Path to Signing Certificate. Unused when 'binaryCertificateBlock' is defined
signingCertificateConstraint: 0 # [Optional], Signing certificate constrain number. Unused when 'binaryCertificateBlock' is defined
signCertData: sign_cert.bin # [Optional], Signing Certificate data; Path to Signing Certificate data. Unused when 'binaryCertificateBlock' is defined
signingCertificatePrivateKeyFile: isk_prv_key.pem # [Optional], ISK Certificate private key used to sign certificate. It can be replaced by signProvider key.
iskSignProvider: type=file;file_path=my_isk_prv_key.pem # [Optional], ISK Signature Provider; Signature provider configuration in format 'type=<sp_type>;<key1>=<value1>;<key2>=<value2>".
rootCertificate0File: my_certificate0.pub # [Conditionally required], Root Certificate File 0; Root certificate file index 0.
rootCertificate1File: my_certificate1.pub # [Optional], Root Certificate File 1; Root certificate file index 1.
rootCertificate2File: my_certificate2.pub # [Optional], Root Certificate File 2; Root certificate file index 2.
rootCertificate3File: my_certificate3.pub # [Optional], Root Certificate File 3; Root certificate file index 3.
mainRootCertId: 0 # [Conditionally required], Main Certificate Index; Index of certificate that is used as a main. If not defined, the certificate matching private key will be selected.
family: CHOOSE_FROM_TABLE # [Required], MCU family name; Possible options:['k32w1xx', 'kw45xx', 'lpc55s3x']
containerKeyBlobEncryptionKey: my_pck.txt # [Optional], Part Common Key; Path to PCK/NPK key in plain hex string format.
isNxpContainer: false # [Optional], Enable NXP Container format; Internal usage only, used for generating SB files with NXP content e.g. provisioning firmware, sentinel firmware...
kdkAccessRights: 0 # [Optional], KDK access rights; Accepted values are 0, 1, 2 and 3. Value used as key properties for key derivation process, more details can be found in CSSv2 manual; Possible options:[0, 1, 2, 3]
containerConfigurationWord: 0 # [Optional], Container configuration word; Flag value in SB3.1 manifest, not used by silicons with LPC55S3x ROM. Value can be kept 0, or it can be removed from the configuration file.
description: This is description of generated SB file. # [Optional], Description up to 16 characters, longer will be truncated. Stored in SB3.1 manifest.
commands: # [Required], SB3.1 Commands; Secure Binary v3.1 commands block, list of all possible options - Modify it according to your application
# ----------------------------------------------------------------------------------------------------
# == List of possible 10 options. Option types[object,object,object,object,object,object,object,object,object,object] ==
# ----------------------------------------------------------------------------------------------------
- # [Example of possible configuration #0]
erase: # [Required], Erase; Performs a flash erase of the given address range. The erase will be rounded up to the sector size.
address: 0 # [Required], Address of memory block to be erased.
size: 4096 # [Required], Size of memory block to be erased.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be erased.
- # [Example of possible configuration #1]
load: # [Required], Load; If set, then the data to write immediately follows the range header. The length field contains the actual data length
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_binary.bin # [Optional], Binary file to be loaded.
values: 0x1234, 0x5678, 0, 12345678 # [Optional], Binary values delimited by comma to be loaded.
authentication: cmac # [Optional], Authentication; If authentication is not used, just omit this option or set 'none'; Possible options:['none', 'cmac', 'hashlocking']
- # [Example of possible configuration #2]
execute: # [Required], Execute; Address is the jump-to address. No further processing of SB after jump, ROM do not expect to return.
address: 0 # [Required], Address; Jump-to address to start execute code.
- # [Example of possible configuration #3]
programFuses: # [Required], Program Fuses; Address is OTP index of fuses to be programmed (Check the reference manual for more information). Values is a comma separated list of 32bit values.
address: 0 # [Required], Address; OTP Index of fuses to be programmed. Depends on the chip ROM.
values: 0x1234, 0x5678, 0, 12345678 # [Required], Binary values; 32bit binary values delimited by comma to be programmed.
- # [Example of possible configuration #4]
programIFR: # [Required], Program IFR; The startAddress will be the address into the IFR region, length will be in number of bytes to write to IFR region. The data to write to IFR region at the given address will immediately follow the header
address: 0 # [Required], Address of IFR region to be programmed.
file: my_binary.bin # [Required], Binary file to be programmed.
- # [Example of possible configuration #5]
loadCMAC: # [Required], Load CMAC; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating cmac from loaded data and storing on address known by ROM decided based on startAddress.
address: 0 # [Required], Address of memory block to be CMAC loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be CMAC loaded.
file: my_cmac_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #6]
loadHashLocking: # [Required], Load with HASH locking; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating hash of the data and storing the value in the last 64 bytes of the loaded data, which are reserved for it.
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_hashlocking_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #7]
configureMemory: # [Required], Configure memory.
configAddress: 0 # [Required], Address; Configuration address.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be configured.
- # [Example of possible configuration #8]
fillMemory: # [Required], Fill memory; Used for filling of the memory range by same repeated int32 pattern.
address: 0 # [Required], Address of memory block to be filled.
size: 4096 # [Required], Size of memory block to be filled.
pattern: 2779096485 # [Required], Pattern which will be used to fill memory.
- # [Example of possible configuration #9]
checkFwVersion: # [Required], Check firmware version; Used to execute check of provided counter value with value stored in specified monotonous counter in device. If values are not same, SB file is rejected.
value: 1 # [Required], Value - Firmware version; Firmware version to be compared.
counterId: secure # [Required], Counter ID; ID of FW counter to be checked; Possible options:['none', 'nonsecure', 'secure', 'radio', 'snt', 'bootloader']
SecureBinary31 for kw45xx
firmwareVersion([‘number’, ‘string’]): Version of application image firmware.rootCertificateEllipticCurve(string): Elliptic curve type used for root key. Must be one of:['secp256r1', 'secp384r1'].iskCertificateEllipticCurve(string): Elliptic curve type used for ISK key. Must be one of:['secp256r1', 'secp384r1'].binaryCertificateBlock(string): Optionally the certificate could be defined as a pre-generated binary block. In case that is defined, all other configuration for certification block is omitted expect the ‘signingCertificatePrivateKeyFile’ or ‘iskSignProvider’.useIsk(boolean): Enable ISK type of signature certification. Unused when ‘binaryCertificateBlock’ is defined.mainRootCertPrivateKeyFile(string): Path to Main root Certification Private Key. Unused when ‘binaryCertificateBlock’ is defined.signingCertificateFile(string): Path to Signing Certificate. Unused when ‘binaryCertificateBlock’ is defined.signingCertificateConstraint([‘number’, ‘string’]): Signing certificate constrain number. Unused when ‘binaryCertificateBlock’ is defined. Default:0.signCertData(string): Path to Signing Certificate data. Unused when ‘binaryCertificateBlock’ is defined.signingCertificatePrivateKeyFile(string): ISK Certificate private key used to sign certificate. It can be replaced by signProvider key.iskSignProvider(string): Signature provider configuration in format ‘type=<sp_type>;= ; = ”. rootCertificate0File(string): Root certificate file index 0.rootCertificate1File(string): Root certificate file index 1.rootCertificate2File(string): Root certificate file index 2.rootCertificate3File(string): Root certificate file index 3.mainRootCertId([‘number’, ‘string’]): Index of certificate that is used as a main. If not defined, the certificate matching private key will be selected.mainCertChainId([‘number’, ‘string’]): Caution! This property is kept here for backwards compatibility with old schemas. Use mainRootCertId instead.family(string): MCU family name. Must be one of:['k32w1xx', 'kw45xx', 'lpc55s3x'].containerKeyBlobEncryptionKey(string): Path to PCK/NPK key in plain hex string format.isNxpContainer(boolean): Internal usage only, used for generating SB files with NXP content e.g. provisioning firmware, sentinel firmware…kdkAccessRights(number): Accepted values are 0, 1, 2 and 3. Value used as key properties for key derivation process, more details can be found in CSSv2 manual. Must be one of:[0, 1, 2, 3].containerConfigurationWord([‘number’, ‘string’]): Flag value in SB3.1 manifest, not used by silicons with LPC55S3x ROM. Value can be kept 0, or it can be removed from the configuration file.description(string): Description up to 16 characters, longer will be truncated. Stored in SB3.1 manifest.commands(array): Secure Binary v3.1 commands block, list of all possible options - Modify it according to your application.Items
# =========== YAML template SecureBinary31 for kw45xx ===========
# ----------------------------------------------------------------------------------------------------
# == SecureBinary31 for kw45xx ==
# ----------------------------------------------------------------------------------------------------
firmwareVersion: 0 # [Optional], Firmware version; Version of application image firmware.
rootCertificateEllipticCurve: secp256r1 # [Conditionally required], Type of elliptic curve of root key; Elliptic curve type used for root key; Possible options:['secp256r1', 'secp384r1']
iskCertificateEllipticCurve: secp256r1 # [Conditionally required], Type of elliptic curve of ISK key; Elliptic curve type used for ISK key; Possible options:['secp256r1', 'secp384r1']
binaryCertificateBlock: my_isk_cert.bin # [Conditionally required], Binary Certificate; Optionally the certificate could be defined as a pre-generated binary block. In case that is defined, all other configuration for certification block is omitted expect the 'signingCertificatePrivateKeyFile' or 'iskSignProvider'
useIsk: false # [Conditionally required], Use ISK for signature certification; Enable ISK type of signature certification. Unused when 'binaryCertificateBlock' is defined
mainRootCertPrivateKeyFile: main_cert_prv_key.pem # [Conditionally required], Main root Certification Private Key; Path to Main root Certification Private Key. Unused when 'binaryCertificateBlock' is defined
signingCertificateFile: sign_cert.pem # [Conditionally required], Signing Certificate; Path to Signing Certificate. Unused when 'binaryCertificateBlock' is defined
signingCertificateConstraint: 0 # [Optional], Signing certificate constrain number. Unused when 'binaryCertificateBlock' is defined
signCertData: sign_cert.bin # [Optional], Signing Certificate data; Path to Signing Certificate data. Unused when 'binaryCertificateBlock' is defined
signingCertificatePrivateKeyFile: isk_prv_key.pem # [Optional], ISK Certificate private key used to sign certificate. It can be replaced by signProvider key.
iskSignProvider: type=file;file_path=my_isk_prv_key.pem # [Optional], ISK Signature Provider; Signature provider configuration in format 'type=<sp_type>;<key1>=<value1>;<key2>=<value2>".
rootCertificate0File: my_certificate0.pub # [Conditionally required], Root Certificate File 0; Root certificate file index 0.
rootCertificate1File: my_certificate1.pub # [Optional], Root Certificate File 1; Root certificate file index 1.
rootCertificate2File: my_certificate2.pub # [Optional], Root Certificate File 2; Root certificate file index 2.
rootCertificate3File: my_certificate3.pub # [Optional], Root Certificate File 3; Root certificate file index 3.
mainRootCertId: 0 # [Conditionally required], Main Certificate Index; Index of certificate that is used as a main. If not defined, the certificate matching private key will be selected.
family: CHOOSE_FROM_TABLE # [Required], MCU family name; Possible options:['k32w1xx', 'kw45xx', 'lpc55s3x']
containerKeyBlobEncryptionKey: my_pck.txt # [Optional], Part Common Key; Path to PCK/NPK key in plain hex string format.
isNxpContainer: false # [Optional], Enable NXP Container format; Internal usage only, used for generating SB files with NXP content e.g. provisioning firmware, sentinel firmware...
kdkAccessRights: 0 # [Optional], KDK access rights; Accepted values are 0, 1, 2 and 3. Value used as key properties for key derivation process, more details can be found in CSSv2 manual; Possible options:[0, 1, 2, 3]
containerConfigurationWord: 0 # [Optional], Container configuration word; Flag value in SB3.1 manifest, not used by silicons with LPC55S3x ROM. Value can be kept 0, or it can be removed from the configuration file.
description: This is description of generated SB file. # [Optional], Description up to 16 characters, longer will be truncated. Stored in SB3.1 manifest.
commands: # [Required], SB3.1 Commands; Secure Binary v3.1 commands block, list of all possible options - Modify it according to your application
# ----------------------------------------------------------------------------------------------------
# == List of possible 20 options. Option types[object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object] ==
# ----------------------------------------------------------------------------------------------------
- # [Example of possible configuration #0]
erase: # [Required], Erase; Performs a flash erase of the given address range. The erase will be rounded up to the sector size.
address: 0 # [Required], Address of memory block to be erased.
size: 4096 # [Required], Size of memory block to be erased.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be erased.
- # [Example of possible configuration #1]
load: # [Required], Load; If set, then the data to write immediately follows the range header. The length field contains the actual data length
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_binary.bin # [Optional], Binary file to be loaded.
values: 0x1234, 0x5678, 0, 12345678 # [Optional], Binary values delimited by comma to be loaded.
authentication: cmac # [Optional], Authentication; If authentication is not used, just omit this option or set 'none'; Possible options:['none', 'cmac', 'hashlocking']
- # [Example of possible configuration #2]
execute: # [Required], Execute; Address is the jump-to address. No further processing of SB after jump, ROM do not expect to return.
address: 0 # [Required], Address; Jump-to address to start execute code.
- # [Example of possible configuration #3]
programFuses: # [Required], Program Fuses; Address is OTP index of fuses to be programmed (Check the reference manual for more information). Values is a comma separated list of 32bit values.
address: 0 # [Required], Address; OTP Index of fuses to be programmed. Depends on the chip ROM.
values: 0x1234, 0x5678, 0, 12345678 # [Required], Binary values; 32bit binary values delimited by comma to be programmed.
- # [Example of possible configuration #4]
programIFR: # [Required], Program IFR; The startAddress will be the address into the IFR region, length will be in number of bytes to write to IFR region. The data to write to IFR region at the given address will immediately follow the header
address: 0 # [Required], Address of IFR region to be programmed.
file: my_binary.bin # [Required], Binary file to be programmed.
- # [Example of possible configuration #5]
loadCMAC: # [Required], Load CMAC; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating cmac from loaded data and storing on address known by ROM decided based on startAddress.
address: 0 # [Required], Address of memory block to be CMAC loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be CMAC loaded.
file: my_cmac_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #6]
loadHashLocking: # [Required], Load with HASH locking; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating hash of the data and storing the value in the last 64 bytes of the loaded data, which are reserved for it.
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_hashlocking_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #7]
configureMemory: # [Required], Configure memory.
configAddress: 0 # [Required], Address; Configuration address.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be configured.
- # [Example of possible configuration #8]
fillMemory: # [Required], Fill memory; Used for filling of the memory range by same repeated int32 pattern.
address: 0 # [Required], Address of memory block to be filled.
size: 4096 # [Required], Size of memory block to be filled.
pattern: 2779096485 # [Required], Pattern which will be used to fill memory.
- # [Example of possible configuration #9]
checkFwVersion: # [Required], Check firmware version; Used to execute check of provided counter value with value stored in specified monotonous counter in device. If values are not same, SB file is rejected.
value: 1 # [Required], Value - Firmware version; Firmware version to be compared.
counterId: secure # [Required], Counter ID; ID of FW counter to be checked; Possible options:['none', 'nonsecure', 'secure', 'radio', 'snt', 'bootloader']
- # [Example of possible configuration #10]
erase: # [Required], Erase; Performs a flash erase of the given address range. The erase will be rounded up to the sector size.
address: 0 # [Required], Address of memory block to be erased.
size: 4096 # [Required], Size of memory block to be erased.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be erased.
- # [Example of possible configuration #11]
load: # [Required], Load; If set, then the data to write immediately follows the range header. The length field contains the actual data length
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_binary.bin # [Optional], Binary file to be loaded.
values: 0x1234, 0x5678, 0, 12345678 # [Optional], Binary values delimited by comma to be loaded.
authentication: cmac # [Optional], Authentication; If authentication is not used, just omit this option or set 'none'; Possible options:['none', 'cmac', 'hashlocking']
- # [Example of possible configuration #12]
execute: # [Required], Execute; Address is the jump-to address. No further processing of SB after jump, ROM do not expect to return.
address: 0 # [Required], Address; Jump-to address to start execute code.
- # [Example of possible configuration #13]
programFuses: # [Required], Program Fuses; Address is OTP index of fuses to be programmed (Check the reference manual for more information). Values is a comma separated list of 32bit values.
address: 0 # [Required], Address; OTP Index of fuses to be programmed. Depends on the chip ROM.
values: 0x1234, 0x5678, 0, 12345678 # [Required], Binary values; 32bit binary values delimited by comma to be programmed.
- # [Example of possible configuration #14]
programIFR: # [Required], Program IFR; The startAddress will be the address into the IFR region, length will be in number of bytes to write to IFR region. The data to write to IFR region at the given address will immediately follow the header
address: 0 # [Required], Address of IFR region to be programmed.
file: my_binary.bin # [Required], Binary file to be programmed.
- # [Example of possible configuration #15]
loadCMAC: # [Required], Load CMAC; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating cmac from loaded data and storing on address known by ROM decided based on startAddress.
address: 0 # [Required], Address of memory block to be CMAC loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be CMAC loaded.
file: my_cmac_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #16]
loadHashLocking: # [Required], Load with HASH locking; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating hash of the data and storing the value in the last 64 bytes of the loaded data, which are reserved for it.
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_hashlocking_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #17]
configureMemory: # [Required], Configure memory.
configAddress: 0 # [Required], Address; Configuration address.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be configured.
- # [Example of possible configuration #18]
fillMemory: # [Required], Fill memory; Used for filling of the memory range by same repeated int32 pattern.
address: 0 # [Required], Address of memory block to be filled.
size: 4096 # [Required], Size of memory block to be filled.
pattern: 2779096485 # [Required], Pattern which will be used to fill memory.
- # [Example of possible configuration #19]
checkFwVersion: # [Required], Check firmware version; Used to execute check of provided counter value with value stored in specified monotonous counter in device. If values are not same, SB file is rejected.
value: 1 # [Required], Value - Firmware version; Firmware version to be compared.
counterId: secure # [Required], Counter ID; ID of FW counter to be checked; Possible options:['none', 'nonsecure', 'secure', 'radio', 'snt', 'bootloader']
SecureBinary31 for lpc55s3x
firmwareVersion([‘number’, ‘string’]): Version of application image firmware.rootCertificateEllipticCurve(string): Elliptic curve type used for root key. Must be one of:['secp256r1', 'secp384r1'].iskCertificateEllipticCurve(string): Elliptic curve type used for ISK key. Must be one of:['secp256r1', 'secp384r1'].binaryCertificateBlock(string): Optionally the certificate could be defined as a pre-generated binary block. In case that is defined, all other configuration for certification block is omitted expect the ‘signingCertificatePrivateKeyFile’ or ‘iskSignProvider’.useIsk(boolean): Enable ISK type of signature certification. Unused when ‘binaryCertificateBlock’ is defined.mainRootCertPrivateKeyFile(string): Path to Main root Certification Private Key. Unused when ‘binaryCertificateBlock’ is defined.signingCertificateFile(string): Path to Signing Certificate. Unused when ‘binaryCertificateBlock’ is defined.signingCertificateConstraint([‘number’, ‘string’]): Signing certificate constrain number. Unused when ‘binaryCertificateBlock’ is defined. Default:0.signCertData(string): Path to Signing Certificate data. Unused when ‘binaryCertificateBlock’ is defined.signingCertificatePrivateKeyFile(string): ISK Certificate private key used to sign certificate. It can be replaced by signProvider key.iskSignProvider(string): Signature provider configuration in format ‘type=<sp_type>;= ; = ”. rootCertificate0File(string): Root certificate file index 0.rootCertificate1File(string): Root certificate file index 1.rootCertificate2File(string): Root certificate file index 2.rootCertificate3File(string): Root certificate file index 3.mainRootCertId([‘number’, ‘string’]): Index of certificate that is used as a main. If not defined, the certificate matching private key will be selected.mainCertChainId([‘number’, ‘string’]): Caution! This property is kept here for backwards compatibility with old schemas. Use mainRootCertId instead.family(string): MCU family name. Must be one of:['k32w1xx', 'kw45xx', 'lpc55s3x'].containerKeyBlobEncryptionKey(string): Path to PCK/NPK key in plain hex string format.isNxpContainer(boolean): Internal usage only, used for generating SB files with NXP content e.g. provisioning firmware, sentinel firmware…kdkAccessRights(number): Accepted values are 0, 1, 2 and 3. Value used as key properties for key derivation process, more details can be found in CSSv2 manual. Must be one of:[0, 1, 2, 3].containerConfigurationWord([‘number’, ‘string’]): Flag value in SB3.1 manifest, not used by silicons with LPC55S3x ROM. Value can be kept 0, or it can be removed from the configuration file.description(string): Description up to 16 characters, longer will be truncated. Stored in SB3.1 manifest.commands(array): Secure Binary v3.1 commands block, list of all possible options - Modify it according to your application.Items
# =========== YAML template SecureBinary31 for lpc55s3x ===========
# ----------------------------------------------------------------------------------------------------
# == SecureBinary31 for lpc55s3x ==
# ----------------------------------------------------------------------------------------------------
firmwareVersion: 0 # [Optional], Firmware version; Version of application image firmware.
rootCertificateEllipticCurve: secp256r1 # [Conditionally required], Type of elliptic curve of root key; Elliptic curve type used for root key; Possible options:['secp256r1', 'secp384r1']
iskCertificateEllipticCurve: secp256r1 # [Conditionally required], Type of elliptic curve of ISK key; Elliptic curve type used for ISK key; Possible options:['secp256r1', 'secp384r1']
binaryCertificateBlock: my_isk_cert.bin # [Conditionally required], Binary Certificate; Optionally the certificate could be defined as a pre-generated binary block. In case that is defined, all other configuration for certification block is omitted expect the 'signingCertificatePrivateKeyFile' or 'iskSignProvider'
useIsk: false # [Conditionally required], Use ISK for signature certification; Enable ISK type of signature certification. Unused when 'binaryCertificateBlock' is defined
mainRootCertPrivateKeyFile: main_cert_prv_key.pem # [Conditionally required], Main root Certification Private Key; Path to Main root Certification Private Key. Unused when 'binaryCertificateBlock' is defined
signingCertificateFile: sign_cert.pem # [Conditionally required], Signing Certificate; Path to Signing Certificate. Unused when 'binaryCertificateBlock' is defined
signingCertificateConstraint: 0 # [Optional], Signing certificate constrain number. Unused when 'binaryCertificateBlock' is defined
signCertData: sign_cert.bin # [Optional], Signing Certificate data; Path to Signing Certificate data. Unused when 'binaryCertificateBlock' is defined
signingCertificatePrivateKeyFile: isk_prv_key.pem # [Optional], ISK Certificate private key used to sign certificate. It can be replaced by signProvider key.
iskSignProvider: type=file;file_path=my_isk_prv_key.pem # [Optional], ISK Signature Provider; Signature provider configuration in format 'type=<sp_type>;<key1>=<value1>;<key2>=<value2>".
rootCertificate0File: my_certificate0.pub # [Conditionally required], Root Certificate File 0; Root certificate file index 0.
rootCertificate1File: my_certificate1.pub # [Optional], Root Certificate File 1; Root certificate file index 1.
rootCertificate2File: my_certificate2.pub # [Optional], Root Certificate File 2; Root certificate file index 2.
rootCertificate3File: my_certificate3.pub # [Optional], Root Certificate File 3; Root certificate file index 3.
mainRootCertId: 0 # [Conditionally required], Main Certificate Index; Index of certificate that is used as a main. If not defined, the certificate matching private key will be selected.
family: CHOOSE_FROM_TABLE # [Required], MCU family name; Possible options:['k32w1xx', 'kw45xx', 'lpc55s3x']
containerKeyBlobEncryptionKey: my_pck.txt # [Optional], Part Common Key; Path to PCK/NPK key in plain hex string format.
isNxpContainer: false # [Optional], Enable NXP Container format; Internal usage only, used for generating SB files with NXP content e.g. provisioning firmware, sentinel firmware...
kdkAccessRights: 0 # [Optional], KDK access rights; Accepted values are 0, 1, 2 and 3. Value used as key properties for key derivation process, more details can be found in CSSv2 manual; Possible options:[0, 1, 2, 3]
containerConfigurationWord: 0 # [Optional], Container configuration word; Flag value in SB3.1 manifest, not used by silicons with LPC55S3x ROM. Value can be kept 0, or it can be removed from the configuration file.
description: This is description of generated SB file. # [Optional], Description up to 16 characters, longer will be truncated. Stored in SB3.1 manifest.
commands: # [Required], SB3.1 Commands; Secure Binary v3.1 commands block, list of all possible options - Modify it according to your application
# ----------------------------------------------------------------------------------------------------
# == List of possible 32 options. Option types[object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object,object] ==
# ----------------------------------------------------------------------------------------------------
- # [Example of possible configuration #0]
erase: # [Required], Erase; Performs a flash erase of the given address range. The erase will be rounded up to the sector size.
address: 0 # [Required], Address of memory block to be erased.
size: 4096 # [Required], Size of memory block to be erased.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be erased.
- # [Example of possible configuration #1]
load: # [Required], Load; If set, then the data to write immediately follows the range header. The length field contains the actual data length
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_binary.bin # [Optional], Binary file to be loaded.
values: 0x1234, 0x5678, 0, 12345678 # [Optional], Binary values delimited by comma to be loaded.
authentication: cmac # [Optional], Authentication; If authentication is not used, just omit this option or set 'none'; Possible options:['none', 'cmac', 'hashlocking']
- # [Example of possible configuration #2]
execute: # [Required], Execute; Address is the jump-to address. No further processing of SB after jump, ROM do not expect to return.
address: 0 # [Required], Address; Jump-to address to start execute code.
- # [Example of possible configuration #3]
programFuses: # [Required], Program Fuses; Address is OTP index of fuses to be programmed (Check the reference manual for more information). Values is a comma separated list of 32bit values.
address: 0 # [Required], Address; OTP Index of fuses to be programmed. Depends on the chip ROM.
values: 0x1234, 0x5678, 0, 12345678 # [Required], Binary values; 32bit binary values delimited by comma to be programmed.
- # [Example of possible configuration #4]
programIFR: # [Required], Program IFR; The startAddress will be the address into the IFR region, length will be in number of bytes to write to IFR region. The data to write to IFR region at the given address will immediately follow the header
address: 0 # [Required], Address of IFR region to be programmed.
file: my_binary.bin # [Required], Binary file to be programmed.
- # [Example of possible configuration #5]
loadCMAC: # [Required], Load CMAC; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating cmac from loaded data and storing on address known by ROM decided based on startAddress.
address: 0 # [Required], Address of memory block to be CMAC loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be CMAC loaded.
file: my_cmac_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #6]
loadHashLocking: # [Required], Load with HASH locking; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating hash of the data and storing the value in the last 64 bytes of the loaded data, which are reserved for it.
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_hashlocking_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #7]
configureMemory: # [Required], Configure memory.
configAddress: 0 # [Required], Address; Configuration address.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be configured.
- # [Example of possible configuration #8]
fillMemory: # [Required], Fill memory; Used for filling of the memory range by same repeated int32 pattern.
address: 0 # [Required], Address of memory block to be filled.
size: 4096 # [Required], Size of memory block to be filled.
pattern: 2779096485 # [Required], Pattern which will be used to fill memory.
- # [Example of possible configuration #9]
checkFwVersion: # [Required], Check firmware version; Used to execute check of provided counter value with value stored in specified monotonous counter in device. If values are not same, SB file is rejected.
value: 1 # [Required], Value - Firmware version; Firmware version to be compared.
counterId: secure # [Required], Counter ID; ID of FW counter to be checked; Possible options:['none', 'nonsecure', 'secure', 'radio', 'snt', 'bootloader']
- # [Example of possible configuration #10]
erase: # [Required], Erase; Performs a flash erase of the given address range. The erase will be rounded up to the sector size.
address: 0 # [Required], Address of memory block to be erased.
size: 4096 # [Required], Size of memory block to be erased.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be erased.
- # [Example of possible configuration #11]
load: # [Required], Load; If set, then the data to write immediately follows the range header. The length field contains the actual data length
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_binary.bin # [Optional], Binary file to be loaded.
values: 0x1234, 0x5678, 0, 12345678 # [Optional], Binary values delimited by comma to be loaded.
authentication: cmac # [Optional], Authentication; If authentication is not used, just omit this option or set 'none'; Possible options:['none', 'cmac', 'hashlocking']
- # [Example of possible configuration #12]
execute: # [Required], Execute; Address is the jump-to address. No further processing of SB after jump, ROM do not expect to return.
address: 0 # [Required], Address; Jump-to address to start execute code.
- # [Example of possible configuration #13]
programFuses: # [Required], Program Fuses; Address is OTP index of fuses to be programmed (Check the reference manual for more information). Values is a comma separated list of 32bit values.
address: 0 # [Required], Address; OTP Index of fuses to be programmed. Depends on the chip ROM.
values: 0x1234, 0x5678, 0, 12345678 # [Required], Binary values; 32bit binary values delimited by comma to be programmed.
- # [Example of possible configuration #14]
programIFR: # [Required], Program IFR; The startAddress will be the address into the IFR region, length will be in number of bytes to write to IFR region. The data to write to IFR region at the given address will immediately follow the header
address: 0 # [Required], Address of IFR region to be programmed.
file: my_binary.bin # [Required], Binary file to be programmed.
- # [Example of possible configuration #15]
loadCMAC: # [Required], Load CMAC; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating cmac from loaded data and storing on address known by ROM decided based on startAddress.
address: 0 # [Required], Address of memory block to be CMAC loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be CMAC loaded.
file: my_cmac_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #16]
loadHashLocking: # [Required], Load with HASH locking; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating hash of the data and storing the value in the last 64 bytes of the loaded data, which are reserved for it.
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_hashlocking_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #17]
configureMemory: # [Required], Configure memory.
configAddress: 0 # [Required], Address; Configuration address.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be configured.
- # [Example of possible configuration #18]
fillMemory: # [Required], Fill memory; Used for filling of the memory range by same repeated int32 pattern.
address: 0 # [Required], Address of memory block to be filled.
size: 4096 # [Required], Size of memory block to be filled.
pattern: 2779096485 # [Required], Pattern which will be used to fill memory.
- # [Example of possible configuration #19]
checkFwVersion: # [Required], Check firmware version; Used to execute check of provided counter value with value stored in specified monotonous counter in device. If values are not same, SB file is rejected.
value: 1 # [Required], Value - Firmware version; Firmware version to be compared.
counterId: secure # [Required], Counter ID; ID of FW counter to be checked; Possible options:['none', 'nonsecure', 'secure', 'radio', 'snt', 'bootloader']
- # [Example of possible configuration #20]
erase: # [Required], Erase; Performs a flash erase of the given address range. The erase will be rounded up to the sector size.
address: 0 # [Required], Address of memory block to be erased.
size: 4096 # [Required], Size of memory block to be erased.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be erased.
- # [Example of possible configuration #21]
load: # [Required], Load; If set, then the data to write immediately follows the range header. The length field contains the actual data length
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_binary.bin # [Optional], Binary file to be loaded.
values: 0x1234, 0x5678, 0, 12345678 # [Optional], Binary values delimited by comma to be loaded.
authentication: cmac # [Optional], Authentication; If authentication is not used, just omit this option or set 'none'; Possible options:['none', 'cmac', 'hashlocking']
- # [Example of possible configuration #22]
execute: # [Required], Execute; Address is the jump-to address. No further processing of SB after jump, ROM do not expect to return.
address: 0 # [Required], Address; Jump-to address to start execute code.
- # [Example of possible configuration #23]
programFuses: # [Required], Program Fuses; Address is OTP index of fuses to be programmed (Check the reference manual for more information). Values is a comma separated list of 32bit values.
address: 0 # [Required], Address; OTP Index of fuses to be programmed. Depends on the chip ROM.
values: 0x1234, 0x5678, 0, 12345678 # [Required], Binary values; 32bit binary values delimited by comma to be programmed.
- # [Example of possible configuration #24]
programIFR: # [Required], Program IFR; The startAddress will be the address into the IFR region, length will be in number of bytes to write to IFR region. The data to write to IFR region at the given address will immediately follow the header
address: 0 # [Required], Address of IFR region to be programmed.
file: my_binary.bin # [Required], Binary file to be programmed.
- # [Example of possible configuration #25]
loadCMAC: # [Required], Load CMAC; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating cmac from loaded data and storing on address known by ROM decided based on startAddress.
address: 0 # [Required], Address of memory block to be CMAC loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be CMAC loaded.
file: my_cmac_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #26]
copy: # [Required], Copy; Used for copying data from one place to another. 32 bytes fixed size.
addressFrom: 0 # [Required], Address From; Address of memory block to be copied.
memoryIdFrom: 0 # [Optional], Memory ID From; ID of memory block to be copied.
size: 4096 # [Required], Size of memory block to be copied.
addressTo: 536870912 # [Required], Address To; Address of memory where block to be copied.
memoryIdTo: 0 # [Optional], Memory ID To; ID of memory block where to be copied.
- # [Example of possible configuration #27]
loadHashLocking: # [Required], Load with HASH locking; If set, then the data to write immediately follows the range header. The length field contains the actual data length. ROM is calculating hash of the data and storing the value in the last 64 bytes of the loaded data, which are reserved for it.
address: 0 # [Required], Address of memory block to be loaded.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be loaded.
file: my_hashlocking_binary.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #28]
loadKeyBlob: # [Required], Load Key Blob; Wrapped key blob immediately follows the range key blob header. The length field contains the actual data length.
offset: 0 # [Required], Offset of the key blob.
wrappingKeyId: 0 # [Required], Wrapping key ID; Wrapping ID of key blob; Possible options:['NXP_CUST_KEK_INT_SK', 'NXP_CUST_KEK_EXT_SK']
file: my_keyblob.bin # [Required], Binary file to be loaded.
- # [Example of possible configuration #29]
configureMemory: # [Required], Configure memory.
configAddress: 0 # [Required], Address; Configuration address.
memoryId: 0 # [Optional], Memory ID; ID of memory block to be configured.
- # [Example of possible configuration #30]
fillMemory: # [Required], Fill memory; Used for filling of the memory range by same repeated int32 pattern.
address: 0 # [Required], Address of memory block to be filled.
size: 4096 # [Required], Size of memory block to be filled.
pattern: 2779096485 # [Required], Pattern which will be used to fill memory.
- # [Example of possible configuration #31]
checkFwVersion: # [Required], Check firmware version; Used to execute check of provided counter value with value stored in specified monotonous counter in device. If values are not same, SB file is rejected.
value: 1 # [Required], Value - Firmware version; Firmware version to be compared.
counterId: secure # [Required], Counter ID; ID of FW counter to be checked; Possible options:['none', 'nonsecure', 'secure', 'radio', 'snt', 'bootloader']