Details:

ROM supports an image format in which both boot loader and TIFS images are present. This is called a combined image.

On HS-FS devices, when the combined image is signed with an RSA key, ROM is expected to:

• Skip the integrity check on the boot loader components
• Perform integrity check and signature verification on TIFS components.

Due to a bug in ROM, ROM is skipping the integrity check on the TIFS components on an HS-FS device when a non-degenerate RSA key is used.

Workaround(s):

Sign the X509 certificate with the RSA degenerate key for enabling the integrity check of all the components (bootloader and TIFS)