Verifying - Verifying - 2026.1 English - UG1283

In the device, the BootROM verifies the FSBL, and either the FSBL or U-Boot verifies the subsequent partitions using the Public key.

1. Verify PPK: This step establishes the authenticity of the primary key, which authenticates the secondary key.
   1. The boot image reads PPK from AC
   2. Generate PPK hash
   3. The system compares the hashed PPK with the PPK hash retrieved from eFUSE
   4. If they match, the system trusts the primary key. Otherwise, secure boot fails.
2. Verify secondary keys: This step confirms the authenticity of the secondary key, which authenticates the partitions.
   1. The boot image reads SPK from AC
   2. Generate SPK hashed
   3. Get the SPK hash, by verifying the SPK signature stored in AC, using PPK
   4. Compare hashes from step (b) and step (c)
   5. If they match, we trust the secondary key; otherwise, secure boot fails
3. Verify partitions: This step confirms the authenticity of the partition being booted.
   1. The system reads the partition from the boot image.
   2. Generate hash of the partition.
   3. Get the partition hash, by verifying the Partition signature stored in AC, using SPK.
   4. Compare the hashes from step (b) and step (c)
   5. If they match, the system trusts the partition. Otherwise, secure boot fails.

Bootgen can create a authentication certificate in two ways:

• Supply the PSK and SSK. The SPK signature is calculated on-the-fly using these two inputs.
• Supply the PPK and SSK and the SPK signature as inputs. Use this in situations where the PSK is unknown.