#Overview

Secure boot is a foundational security mechanism in embedded systems. It establishes a hardware-rooted chain of trust that ensures only authenticated software is allowed to execute during system startup. In the NXP i.MX ecosystem, this functionality is implemented through High Assurance Boot (HAB).

Over multiple i.MX generations, NXP introduced several iterations of HAB:

• HABv3 — used on earlier i.MX processors
• HABv4 — a redesigned and more capable secure boot architecture
• later evolution toward AHAB (Advanced HAB) on high-end i.MX8 platforms

This article introduces HABv3 and HABv4, explains their architecture, and highlights the practical differences relevant to embedded Linux and secure product development.

What Is HAB?

High Assurance Boot (HAB) is NXP’s secure boot implementation integrated into the SoC Boot ROM.

Its purpose is to:

• authenticate boot images
• establish a hardware root of trust
• prevent execution of unauthorized firmware
• protect against tampering and malicious modification

The Boot ROM verifies digital signatures before handing execution to:

• bootloaders
• firmware
• operating systems
• trusted execution environments

If authentication fails, the boot process is halted or enters a failure state depending on device configuration.

Core HAB Concepts

Before comparing HABv3 and HABv4, it is useful to understand several common components.

#Root of Trust

The root of trust is anchored in:

• immutable Boot ROM code
• one-time programmable eFuses

Public key hashes are programmed into eFuses during manufacturing. These become the trust anchor for all future boot image verification.

#SRK — Super Root Key

The SRK (Super Root Key) is the top-level signing authority.

Typically:

1. A vendor creates one or more SRK key pairs.
2. The public key hashes are fused into the SoC.
3. Boot images are signed using subordinate keys chained to the SRK.

This enables:

• controlled firmware signing
• key revocation
• secure field updates

#CSF — Command Sequence File

The CSF defines the authentication procedure executed by HAB.

It specifies:

• certificates
• authentication commands
• memory regions to verify
• cryptographic parameters

The CSF is appended to boot images and interpreted by the Boot ROM during startup.

HABv3

#Introduction

HABv3 is the earlier generation of NXP secure boot technology.

It was primarily used on:

• i.MX25
• i.MX35
• i.MX51

These devices represent an earlier generation of embedded Linux processors where secure boot capabilities were functional but comparatively limited.

#HABv3 Architecture

HABv3 implements:

• RSA-based authentication
• signed boot images
• Boot ROM verification
• eFuse-based root of trust

The architecture is relatively straightforward:

1. Boot ROM loads the image.
2. HAB parses authentication metadata.
3. RSA signatures are verified.
4. Execution proceeds only if validation succeeds.

#Characteristics of HABv3

#Simpler Secure Boot Flow

Compared to later generations, HABv3 uses:

• less modular certificate handling
• simpler authentication structures
• more rigid image formatting

#Legacy Tooling

HABv3 relies on older versions of:

• CST (Code Signing Tool)
• U-Boot integration
• Freescale/NXP BSP infrastructure

As a result:

• documentation can be fragmented
• community support is smaller
• automation is less mature

#Limited Extensibility

HABv3 predates many modern embedded security requirements, including:

• flexible key revocation
• richer authentication policies
• advanced crypto agility

While secure for its intended era, it lacks many improvements introduced in HABv4.

HABv4

#Introduction

HABv4 is the successor to HABv3 and became the standard secure boot architecture for newer i.MX families.

It is used on:

• i.MX6
• i.MX7
• i.MX8M

HABv4 significantly modernized NXP’s secure boot infrastructure.

HABv4 Architecture

HABv4 retains the same core goals:

• authenticated boot
• hardware root of trust
• image signature verification

However, it introduces:

• improved certificate handling
• more flexible authentication flows
• better tooling integration
• stronger chain-of-trust management

Major Improvements in HABv4

#Enhanced CSF Structure

HABv4 introduced a more powerful and extensible CSF model.

This allows:

• cleaner image authentication
• multiple certificate chains
• improved signing workflows
• better integration with manufacturing pipelines

#Improved SRK Handling

HABv4 formalized the SRK table structure.

Benefits include:

• easier key management
• better revocation support
• cleaner manufacturing provisioning

This became important for long-lived embedded products requiring secure OTA update capability.

#Better Toolchain Support

HABv4 is significantly better supported in:

• modern U-Boot
• Yocto Project
• NXP BSPs
• manufacturing automation

As a result, HABv4 is commonly used in:

• industrial gateways
• medical devices
• automotive systems
• secure IoT products

#Broader Cryptographic Support

Depending on the SoC family, HABv4 supports:

• RSA authentication
• SHA-256 hashing
• ECDSA support on some devices

This provides stronger cryptographic flexibility than HABv3.

HABv3 vs HABv4

#Architectural Comparison

Typical HAB Boot Flow

The secure boot process is conceptually similar for both versions.

#Step 1 — Boot ROM Starts

The immutable Boot ROM executes immediately after reset.

#Step 2 — Boot Image Loading

The ROM loads:

• SPL
• U-Boot
• firmware
• or another first-stage image

from:

• eMMC
• NAND
• SD card
• SPI flash

#Step 3 — Authentication

HAB:

• parses the CSF
• validates certificates
• verifies digital signatures
• checks SRK trust anchors

#Step 4 — Execution

If verification succeeds:

• execution transfers to the authenticated image

If verification fails:

• boot is aborted
• HAB events are generated
• secure state may be entered

HAB States

Most HAB-enabled devices support two important modes:

#Open Configuration

Development mode:

• HAB events are reported
• unsigned images may still boot
• useful during bring-up

#Closed Configuration

Production secure mode:

• only authenticated images boot
• secure boot becomes enforced
• irreversible once fuses are programmed

Closing a device is a major manufacturing milestone and must be carefully validated.

Debugging HAB

A major aspect of HAB development is analyzing authentication failures.

Typical debugging involves:

• reading HAB status events
• checking CSF offsets
• validating image alignment
• verifying SRK fuse programming
• inspecting boot image layout

Common tools include:

• U-Boot hab_status
• CST utilities
• NXP manufacturing scripts

Transition Toward AHAB

On high-end i.MX8 families, NXP introduced:

• AHAB (Advanced High Assurance Boot)

AHAB differs substantially from HABv4:

• uses dedicated security controllers
• supports more complex boot topologies
• enables stronger isolation mechanisms

The progression is roughly:

 1HABv3 → HABv4 → AHAB

Choosing Between HABv3 and HABv4

In practice, the HAB version is determined by the SoC family.

However, from a product-development perspective:

#HABv3

Best viewed as:

• legacy secure boot infrastructure
• suitable for maintaining existing products
• less attractive for new designs

#HABv4

Preferred for:

• modern embedded Linux systems
• secure OTA update workflows
• long-term maintainability
• industrial and commercial deployments

Conclusion

HABv3 and HABv4 represent two generations of NXP’s secure boot technology for i.MX processors.

HABv3 introduced the essential secure boot framework:

• authenticated boot
• hardware-rooted trust
• signed firmware verification

HABv4 expanded and modernized the architecture with:

• stronger tooling support
• better certificate handling
• improved key management
• more flexible authentication flows

For embedded developers working with i.MX platforms, understanding the differences between HAB generations is critical when:

• designing secure products
• implementing manufacturing flows
• enabling OTA updates
• debugging secure boot issues
• planning long-term platform support

As embedded systems continue to demand stronger security guarantees, HAB remains one of the core technologies underpinning trusted boot on NXP i.MX processors.