MCUXpresso Secure Provisioning documentation

This page contains documentation for the MCUXpresso Secure Provisioning Tool (SEC)

Quick Start

• Overview
• Hardware requirements
• Software requirements
• Installing and configuring the SEC tool
• Using the tool
  • Prerequisites
  • New workspace
  • Tool GUI
  • Check connection
  • Build bootable image
  • Test bootable image
  • What is next
  • Processor-specific workflows
• References
  • Release Notes
  • User Guide
  • NXP Secure Provisioning web
  • Community, forum, knowledge base
• Revision history

User Guide

• Introduction
• Features
  • Security Enablement
  • Device Communication & Flashing
  • User Experience
  • Useful Extensions
  • Device & Platform Support
• Terms and definitions
• Installation
  • Minimum system requirements
  • Windows
    • Windows CLI
  • MacOS
    • Enabling USB connection on macOS
  • Linux
  • Uninstalling
    • Windows
    • MacOS
    • Linux
    • Remove configuration files
    • Remove restricted data
• User interface
  • Menu and settings
    • Title of the Main Window
    • Menu bar
    • Preferences
    • Workspaces
      • New workspace creation
      • Sharing and copying workspaces
      • Import workspace from the ZIP
      • Profile creation
    • Toolbar
    • Connection
    • Boot memory configuration
      • SPI NOR
      • OnChip RAM
    • Trust provisioning
      • Device HSM provisioning
      • EdgeLock 2GO trust provisioning
    • Debug Probe Selection dialog
  • Build image
    • Generated files
    • Build script hooks
    • Source image formats
    • Additional images
    • Firmware versions
    • XMCD configuration dialog
    • TrustZone configuration file
    • OTP/PFR/IFR/BCA/FCF configuration
      • Table of all items
      • Tree-filtering toolbar
      • Item editor
      • Buttons
      • Read from connected device
      • Required value
      • Burn fuse/write field
      • Locks
      • Calculated fields
      • Validation and problem resolution
      • Advanced mode
      • Write/Burn
      • PFR/IFR and OTP differences
  • Write image
    • Manufacturing package
  • PKI management
    • Generate keys
    • Add keys
    • Re-generate certificate
    • Import/Export keys
    • Debug authentication
    • Signature provider
      • URL parameters
      • Payload parameters
      • Buttons and Base URL
      • Signature provider server API
      • Server examples
  • Manufacturing Tool
    • USB path
  • Flash Programmer
  • SB editor
    • SB editor contains the following main UI parts:
    • File type
    • Properties view
    • Commands view
    • $ Variables
    • Validation
    • Creating a manufacturing package button
    • To Manufacturing button
  • Merge Tool
• Processor-specific workflows
  • Common steps
    • Downloading MCUXpresso SDK
    • Opening example project
    • Building example project
    • Setting up Secure Provisioning Tool
    • Preparing secure keys
    • Build and write
      • BCA and FCF pages
  • i.MX 9x device workflow
    • Preparing images for build for i.MX 9x devices
    • Connecting the board for i.MX 9x devices
      • Table: Boot mode selection for board for i.MX9x Cortex-M33 core
      • Table: Boot mode selection for board for i.MX9x Cortex-A55 core
      • Step by step process:
    • Booting images for i.MX 9x devices
      • i.MX 93 bootable image examples
      • i.MX 95 bootable image examples
      • Booting/loading unsigned image
      • Booting signed bootloader image from Cortex-A55 core on i.MX 93
      • Write fuses and update life cycle with nxpele over U-Boot
      • Build U-Boot with AHAB secure boot features
      • Get ELE events with nxpele tool
  • KW45xx/K32W1xx/MCXW71xx/KW47xx/MCXW72xx device workflow
    • Preparing source image for KW45xx/K32W1xx/MCXW71xx/KW47xx/MCXW72xx devices
    • Connecting the board for KW45xx/K32W1xx/MCXW71xx/KW47xx/MCXW72xx devices
    • Booting images for KW45xx/K32W1xx/MCXW71xx/KW47xx/MCXW72xx devices
      • Booting plain or CRC image
      • Booting signed image
      • Booting PRINCE encrypted image
      • Life cycle for KW45xx/K32W1xx/MCXW71xx/KW47xx/MCXW72xx devices
      • EdgeLock 2GO
      • Update NBU firmware
  • LPC55(S)0x/1x/2x/6x device workflow
    • Preparing source image for LPC55(S)0x/1x/2x/6x devices
      • Image running from internal flash
    • Connecting the board for LPC55(S)0x/1x/2x/6x devices
    • Booting images for LPC55(S)0x/1x/2x/6x devices
      • Security levels
      • Booting Plain/Plain with CRC image
      • Booting plain signed or PRINCE encrypted image
      • PFR and PUF KeyStore
  • LPC55(S)3x device workflow
    • Preparing source image for LPC55(S)3x devices
    • Connecting the board for LPC55(S)3x devices
      • Table: Boot mode selection for LPC55S36 EVK board
    • Booting images for LPC55(S)3x devices
      • Booting plain unsigned or CRC image
      • Booting plain signed image
      • Booting encrypted image
      • Test life cycle
      • Life cycle for LPC55(S)3x devices
  • LPC865 workflow
    • Preparing images for build for LPC865
    • Connecting the LPCXpresso860-MAX board for LPC865
    • Booting images for LPC865
      • Booting unsigned plain image
    • Life cycles
  • MC56F818xx/7xx/6xx and MWCT2xD2/12 devices workflow
    • Preparing source image for MC56F818xx/7xx/6xx and MWCT2xD2/12 devices
    • Connecting the board for MC56F818xx/7xx/6xx and MWCT2xD2/12 devices
    • Booting images for MC56F818xx/7xx/6xx and MWCT2xD2/12 devices
      • Booting plain unsigned or CRC image
      • Booting plain signed image
      • Life cycle and device HSM trust provisioning for MC56F818xx/7xx/6xx and MWCT2xD2/12 devices
    • EdgeLock 2GO WPC workflow
      • EdgeLock 2GO WPC flow, step by step
  • MCX A13x/A14x/A15x device workflow
    • Preparing source image for MCX A13x/A14x/A15x devices
    • Connecting the board
    • Booting images MCX A13x/A14x/A15x devices
    • Life cycle for MCX A14x/A15x devices
    • MCUboot for MCX A13x/A14x/A15x devices
  • MCX C041/C242/C444 device workflow
    • Preparing source image for MCX C041/C242/C444 devices
    • Connecting the board for MCX C041/C242/C444 devices
    • Booting images for MCX C041/C242/C444 devices
      • Booting plain unsigned image
      • Life cycle for MCX C041/C242/C444 devices
      • Backdoor key
  • MCX E24 device workflow
    • Preparing source image for MCX E24x devices
    • Connecting the board for MCX E24x devices
      • Flashloader boot behavior on MCX E24x devices
      • Flashloader initialization via debug probe
      • FRDM-MCXE247 UART pin connections
      • FRDM-MCXE247 connection via SPI
      • Connecting the board to host PC
    • Booting images for MCX E24x devices
      • Booting plain unsigned image
      • Life cycle for MCX E24x devices
      • Disable flash security via debug probe
  • MCX Nx4x/N23x device workflow
    • Preparing source image for MCX Nx4x/N23x devices
    • Connecting the board for MCX Nx4x/N23x devices
    • Booting images for MCX Nx4x/N23x devices
      • Booting plain or CRC image for MCX Nx4x/N23x devices
      • Booting plain signed image
      • Booting encrypted image
      • Life cycle for MCX Nx4x/N23x devices
      • Test life cycle
      • EdgeLock 2GO
  • RT10xx/RT116x/RT117x device workflow
    • Preparing source image for RT10xx/RT116x/RT117x devices
      • Image running from external NOR flash
      • Image running in internal RAM
      • Image running from external SDRAM
    • Connecting the board for RT10xx/RT116x/RT117x devices
    • Booting images for RT10xx/RT116x/RT117x devices
      • Booting unsigned image
      • Booting authenticated (HAB) image
      • Booting encrypted (HAB) authenticated image
      • Booting XIP encrypted image (BEE OTPMK) authenticated (RT10xx)
      • Booting XIP encrypted image (BEE user keys) unsigned (RT10xx)
      • Booting XIP encrypted image (BEE user keys) authenticated (RT10xx)
      • Booting XIP encrypted image (OTFAD OTPMK) authenticated (RT10xx)
      • Booting OTFAD encrypted image unsigned with user keys.
      • Booting OTFAD encrypted image authenticated with user keys
      • Booting IEE encrypted image unsigned (RT116x/7x)
      • Booting IEE encrypted image authenticated (RT116x/7x)
    • Creating/Customizing DCD files
  • RT118x device workflow
    • Preparing source image for RT118x devices
    • Connecting the board for RT118x devices
      • Booting from SD card
      • Booting from eMMC:
      • Table: Boot mode selection for RT118x EVK boards
    • Booting images for RT118x devices
      • Booting unsigned image
      • Booting signed image
      • Booting encrypted (AHAB) image
      • Booting OTFAD encrypted image
      • Booting IEE encrypted
      • Booting multicore images
      • Life cycle for RT118x device workflow
      • Firmware version
  • RT5xx/6xx device workflow
    • Preparing source image RT5xx/6xx devices
      • Image running in external flash
      • Image running in internal RAM
    • Connecting the board for RT5xx/6xx devices
    • Booting images for RT5xx/6xx devices
      • Booting a plain/plain with CRC image
      • Booting plain signed image using shadow registers
      • Booting OTFAD encrypted image using shadow registers
      • Booting signed/encrypted image - burn fuses
      • Securing the processor
      • Device HSM provisioning
  • RT7xx device workflow
    • Preparing source image for RT7xx devices
    • Connecting the board for RT7xx devices
    • Booting images for RT7xx devices
      • Life cycle for RT7xx devices
      • Booting a plain unsigned/CRC image
      • Booting encrypted unsigned or CRC image
      • Using RT7xx shadow registers
      • Booting signed image using shadow registers
      • Device HSM
      • Pre-erase in write script
  • RW61x device workflow
    • Preparing source image for RW61x devices
    • Connecting the board for RW61x devices
      • Table: Boot configuration of RW61x boards
    • Shadow registers for fuses via debug probe
    • Booting images for RW61x devices
      • Booting plain or CRC image
      • Booting plain signed image
      • Booting encrypted image
      • Device HSM and provisioning
      • Boot type and life cycle for RW61x
      • Life cycle and trust provisioning
      • EdgeLock 2GO
• Generic workflows
  • Debug authentication workflow
    • Example of access rights to debug domains
  • Signature provider workflow
    • Run the server
      • Signature provider and debug authentication
  • Script hooks
    • Build script hooks
    • Write script hooks
    • Manufacturing hooks
    • Typical usage
  • Manufacturing workflow
    • Create manufacturing package
    • Performance optimization
    • Manufacturing operations
    • Steps in the manufacturing production
    • Manufacturing logs
  • MCUboot workflow
  • EdgeLock 2GO Trust Provisioning workflow
    • EdgeLock 2GO flow, high-level description
    • EdgeLock 2GO flow, step by step
    • API key to access EdgeLock 2GO server
      • EdgeLock 2GO Configuration via web portal
  • Merge Images Tool workflow
• Command-line operations
  • Build
  • Write
  • Generate keys
  • Manufacture
  • Devices info
  • Environment variables in filepath-based arguments
  • Command-line examples
    • Example: How to build and write an image for configuration stored in the workspace folder
    • Example how to use args-file argument
  • Command-line tools
• Troubleshooting
  • General
  • Windows
  • Linux
  • macOS
    • macOS i.MX 9x nxpuuu
  • i.MX RT5xx/6xx
  • i.MX RT1024
  • MC56F818xx and MWCT2xD2
  • KW47 and MCXW72xx
  • Debug probes
  • Debug authentication
  • Zephyr projects
  • Custom USB HID devices
• Revision history
• Note about the source code in the document

Release Notes

• Release Notes for MCUXpresso Secure Provisioning Tool
• Overview
• Supported processors
• Features
• System requirements
• Known issues and limitations
• What is new
  • Version 25.06, June-2025
  • Version 25.03.01, April-2025
  • Version 25.03, March-2025
  • Version 10.0, November 2024
  • Version 9.0.1, August 2024
  • Version 9.0, July 2024
  • Version 8.0, January 2024
  • Version 7.0, July 2023
  • Version 6.0, March 2023
  • Version 5.0, November 2022
  • Version 4.1.1, July 2022
  • Version 4.1, June 2022
  • Version 4.0.1, May 2022
  • Version 4.0, May 2022
  • Version 3.1, August 2021
  • Version 3.0, April 2021
  • Version 2.1, December 2020
  • Version 2.0, August 2020
  • Version 1.0.1, January 2020
  • Version 1.0, December 2019
• Revision history