MCUBoot: how to use an individual signature key (instead of default MCUBoot key)?

[SvenSchmidt]

We have successfully created an app with MCUBoot and can easily install updates with the "default MCUBoot key".

However, we have a problem when changing the signature key.
(all CONFIG settings are in an overlay config, which is added as a Kconfig fragment to the build configuration)

When using CONFIG_MCUBOOT_SIGNATURE_KEY_FILE="bitsz_ble_basic.pem" it appears:

MCUBoot bootloader key file: D:/Nordic/v2.4.2/bootloader/mcuboot/root-rsa-2048.pem
 === child image mcuboot - end ===
 WARNING: Using default MCUBoot key, it should not be used for production.
 CONFIG_MCUBOOT_SIGNATURE_KEY_FILE is set to "bitsz_ble_basic.pem".
 You are using the NCS Mcuboot signing, which means this option will be ignored.
 Image signing in NCS is done via the MCUboot image's CONFIG_BOOT_SIGNATURE_KEY_FILE option.
 Consider setting CONFIG_MCUBOOT_SIGNATURE_KEY_FILE in your application image back to its default value, the empty string.


We then tried to use the following setting:

CONFIG_MCUBOOT_SIGNATURE_KEY_FILE=""
CONFIG_BOOT_SIGNATURE_KEY_FILE="bitsz_ble_basic.pem"

The result is:

warning: BOOT_SIGNATURE_KEY_FILE (defined at D:/Nordic/v2.4.2/nrf/modules/mcuboot/Kconfig:3) was assigned the value 'bitsz_ble_basic.pem' but got the value ''. Check these unsatisfied dependencies: (!MCUBOOT_BUILD_STRATEGY_FROM_SOURCE) (=n). See docs.zephyrproject.org/.../kconfig.html and/or look up BOOT_SIGNATURE_KEY_FILE in the menuconfig/guiconfig interface. The Application Development Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be helpful too.
 === child image mcuboot - begin ===
 MCUBoot bootloader key file: D:/Nordic/v2.4.2/bootloader/mcuboot/root-rsa-2048.pem
 === child image mcuboot - end ===
 WARNING: Using default MCUBoot key, it should not be used for production.

Unfortunately the given link does not work.


We changed the setting:

 CONFIG_MCUBOOT_SIGNATURE_KEY_FILE=""
 CONFIG_BOOT_SIGNATURE_KEY_FILE="bitsz_ble_basic.pem"
 CONFIG_MCUBOOT_BUILD_STRATEGY_FROM_SOURCE=n

and got the result:

warning: BOOT_SIGNATURE_KEY_FILE (defined at D:/Nordic/v2.4.2/nrf/modules/mcuboot/Kconfig:3) was assigned the value 'bitsz_ble_basic.pem' but got the value ''. Check these unsatisfied dependencies: (!MCUBOOT_BUILD_STRATEGY_FROM_SOURCE) (=n). See docs.zephyrproject.org/.../kconfig.html and/or look up BOOT_SIGNATURE_KEY_FILE in the menuconfig/guiconfig interface. The Application Development Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be helpful too.
=== child image mcuboot - begin ===
MCUBoot bootloader key file: D:/Nordic/v2.4.2/bootloader/mcuboot/root-rsa-2048.pem
=== child image mcuboot - end ===
WARNING: Using default MCUBoot key, it should not be used for production.


Environment:

- Windows 10 (Windows_NT x64 10.0.19045)
- Visual Studio Code 1.82.0 (system setup)
- Extension nRF Connect for VS Code v2023.9.169
- nRF Connect SDK 2.4.2 (Zephyr 3.3.99)


All the instructions found so far did not solve the problem and most of them no longer apply to MCUBoot because many CONFIG identifiers were changed in Zephyr 3.3.0.
Now the question is, how to change the signing key?
Is there a working guide for "Visual Studio Code" (with nRF Connect for VS Code) and the current SDK 2.4.2?

[Mike Austin (LPI)]

I've got this working on a similar set up to yours (I'm still on v2.2.0 of NCS though).

I put this in my mcuboot.conf file:

CONFIG_BOOT_SIGNATURE_KEY_FILE="C:/Nordic/PUBLIC_PRIVATE_KEYS/"my_pem_file.pem"

C:/Nordic/PUBLIC_PRIVATE_KEYS is obviously where I store the key files and my_pem_file.pem is the actual file

Are you making the changes in the mcuboot.conf file, or the proj.conf file?

Cheers,

Mike

[dejans]

Hi,

Documentation provides information on how to add a custom signature key file. As mentioned in the similar section for immutable bootloader there are 2 options available when specifying path to the pem file - relative and absolute path to the key. Probably the simplest way would be to use absolute path. You should be able to properly reference the key by putting the pem key file inside child_image\mcuboot folder.and referencing it using absolute path in CONFIG_BOOT_SIGNATURE_KEY_FILE config option which should be put in mcuboot's prj.conf file. 

You can get more information from the following discussions - signing firmware with custom key, MCUboot enabled apps and flash methods and MCUboot signing images.

Best regards,
Dejan

[Marko W]

Hallo,
ich arbeite mit Sven am selben Projekt und habe die Dokumentation „ Hinzufügen einer benutzerdefinierten Signaturschlüsseldatei “ getestet.

Ich habe jetzt im Projekt einen Ordner „child_image“ erstellt (parallel zu „src“) und darin eine Datei „mcuboot.conf“ erstellt mit (CONFIG_BOOT_SIGNATURE_KEY_FILE aus prj.conf oder Overlay entfernt):

CONFIG_BOOT_SIGNATURE_KEY_FILE="<absolute Path to Project>/bitsz_ble_basic.pem"

Das Kompilieren funktionierte ohne Vorwarnung zum Signieren von Schlüsseln. Ein Update klappt auch damit. Das Problem ist nun, dass ich einen vollständigen Pfad angeben muss, was bei der Arbeit im Team mit SVN/GIT nicht praktikabel ist.

Allerdings, wenn ich benutze

CONFIG_BOOT_SIGNATURE_KEY_FILE="bitsz_ble_basic.pem"

es kommt zum:

MCUBoot bootloader key file: D:/Nordic/v2.4.2/bootloader/mcuboot/bitsz_ble_basic.pem
Using default MCUBoot key, it should not be used for production.

Es wird der Standardpfad von Zephyr/MCUBoot kombiniert mit Ihrer eigenen Datei verwendet, die Datei sollte sich jedoch im Projektordner befinden (aufgrund der Projektverwaltung über SVN/GIT).

In der Zwischenzeit habe ich den Hinweis im Code von  https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/blob/main/bootloader_samples/keys_and_signatures/mcuboot_smp_custom_key/CMakeLists.txt  gefunden:

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/bitsz_ble_basic.pem\")

Das funktioniert super und vor allem ohne einen absoluten Pfad!

[dejans]

Hi,

It is great to hear that you found the solution which is the most convenient for you.

Best regards,
Dejan