The Android build system signes the vbmeta image with the private key above and stores one copy of the public key in the signed
vbmeta image. During AVB verification, U-Boot validates the public key first and then uses the public key to authenticate the
signed vbmeta image.
8.10.2 How to set the vbmeta public key
The public key should be stored in Trusty OS backed RPMB for Android Auto. Perform the following steps to set the public key.
Make your board enter fastboot mode, and enter the following commands on the host side:
fastboot stage ${your-key-directory}/test_rsa4096_public.bin
fastboot oem set-public-key
The public key test_rsa4096_public.bin should be extracted from the specified private key. If no private key is specified, set the
public key as prebuilt testkey_public_rsa4096.bin, which is extracted from the default private key testkey_rsa4096.pem.
8.11 Key attestation
The keystore key attestation aims to provide a way to strongly determine if an asymmetric key pair is hardware-backed, what the
properties of the key are, and what constraints are applied to its usage.
Google provides the attestation "keybox", which contains private keys (RSA and ECDSA) and the corresponding certificate chains
to partners from the Android Partner Front End (APFE). After retrieving the "keybox" from Google, you need to parse the "keybox"
and provision the keys and certificates to secure storage. Both keys and certificates should be Distinguished Encoding Rules
(DER) encoded.
Fastboot commands are provided to provision the attestation keys and certificates. Make sure the secure storage is properly
initialized for Trusty OS:
• Set RSA private key:
fastboot stage <path-to-rsa-private-key>
fastboot oem set-rsa-atte-key
• Set ECDSA private key:
fastboot stage <path-to-ecdsa-private-key>
fastboot oem set-ec-atte-key
• Append RSA certificate chain:
fastboot stage <path-to-rsa-atte-cert>
fastboot oem append-rsa-atte-cert
This command may need to be executed multiple times to append the whole certificate chain.
NOTE
• Append ECDSA certificate chain:
fastboot stage <path-to-ecdsa-cert>
fastboot oem append-ec-atte-cert
This command may need to be executed multiple times to append the whole certificate chain.
NOTE
After provisioning all the keys and certificates, the keystore attestation feature should work properly.
NXP Semiconductors
Customized Configuration
Android
™
User's Guide, Rev. P9.0.0_2.3.2, 6 March 2020
User's Guide
29 / 31
