How to properly add the private key to the bootloader (without warnings)

[J0sh1101]

Hi,

I would like to add the private keys correctly to the bootloader to have a secure application. I've followed the steps described in the Devzone tickets (1,2,3, ...) and online documentation(1, 2, 3, ...), but I don't know if I'm done or still need to do something, because the misleading warnings I get when compiling are quite frustrating. Here are my steps in a nutshell:

1. Create a private key as follows: "python3.exe C:\ncs\v2.4.2\bootloader\mcuboot\scripts\imgtool.py keygen -t ecdsa-p256 -k C:\keys\priv_ecdsa.pem"
2. Create a new application from the nrf_cloud_rest_fota example.
3. Two flags have been added to the child_image/mcuboot.conf file:
   

   1. CONFIG_SPI=n
      CONFIG_SPI_NOR=n
      
      CONFIG_SB_SIGNING_KEY_FILE="C:\\keys\\priv_ecdsa.pem"
      CONFIG_BOOT_SIGNATURE_KEY_FILE="C:\\keys\\priv_ecdsa.pem"

4. Create a build configuration like this:
   1. 
5. Here is also the prj.conf:

   1. # Sample
      CONFIG_REST_FOTA_DO_JITP=n
      CONFIG_NRF_CLOUD_REST_FOTA_SAMPLE_LOG_LEVEL_INF=y
      
      # nRF Cloud REST
      CONFIG_NRF_CLOUD_REST=y
      CONFIG_NRF_CLOUD_CLIENT_ID_SRC_IMEI=y
      CONFIG_MODEM_JWT=y
      CONFIG_NETWORKING=y
      CONFIG_NET_SOCKETS=y
      CONFIG_NET_SOCKETS_POSIX_NAMES=y
      CONFIG_NET_NATIVE=n
      
      # FOTA download
      CONFIG_FOTA_DOWNLOAD=y
      CONFIG_FOTA_DOWNLOAD_PROGRESS_EVT=y
      CONFIG_DFU_TARGET=y
      CONFIG_DOWNLOAD_CLIENT=y
      
      # MCUBOOT
      CONFIG_BOOTLOADER_MCUBOOT=y
      CONFIG_IMG_MANAGER=y
      CONFIG_STREAM_FLASH=y
      CONFIG_MCUBOOT_IMG_MANAGER=y
      CONFIG_IMG_ERASE_PROGRESSIVELY=y
      CONFIG_SECURE_BOOT=y
      CONFIG_BUILD_S1_VARIANT=y
      CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=n
      
      # Settings
      CONFIG_FLASH=y
      CONFIG_FLASH_PAGE_LAYOUT=y
      CONFIG_FLASH_MAP=y
      CONFIG_FCB=y
      CONFIG_SETTINGS=y
      CONFIG_SETTINGS_FCB=y
      CONFIG_MPU_ALLOW_FLASH_WRITE=y
      
      # Button/LED support
      CONFIG_DK_LIBRARY=y
      
      # Modem/LTE Link
      CONFIG_NRF_MODEM_LIB=y
      CONFIG_LTE_LINK_CONTROL=y
      CONFIG_LTE_NETWORK_MODE_LTE_M=y
      
      # AT Host library - Used to send AT commands directy from an UART terminal and to allow
      #		    integration with nRF Connect for Desktop LTE Link monitor application.
      CONFIG_AT_HOST_LIBRARY=y
      
      # Modem info
      CONFIG_MODEM_INFO=y
      CONFIG_MODEM_INFO_ADD_DEVICE=y
      CONFIG_MODEM_INFO_ADD_NETWORK=y
      CONFIG_MODEM_INFO_ADD_SIM=y
      CONFIG_MODEM_INFO_ADD_SIM_ICCID=y
      CONFIG_MODEM_INFO_ADD_SIM_IMSI=y
      
      # System
      CONFIG_HEAP_MEM_POOL_SIZE=8192
      CONFIG_MAIN_STACK_SIZE=8192
      CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=8192
      CONFIG_ASSERT=y
      CONFIG_REBOOT=y
      CONFIG_FPU=y
      CONFIG_NEWLIB_LIBC=y
      CONFIG_NEWLIB_LIBC_FLOAT_PRINTF=y
      CONFIG_NEWLIB_LIBC_FLOAT_SCANF=y
      
      # Logging
      CONFIG_LOG=y
      CONFIG_LOG_MODE_IMMEDIATE=y
      CONFIG_UART_INTERRUPT_DRIVEN=y
      

When I compiled the project, I received these warnings:

1. 
2. 
3. 
4. 

How can I verify that the bootloader has successfully incorporated the private key into the bootloader image?

What steps can I take to eliminate these warnings?

Why does the bootloader always create 3 images (child-image b0, child-image mcuboot, child-image s1-image)?

Thanks for the help!

[AHaug]

Hi,

What steps can I take to eliminate these warnings?

In the two first warnings it looks like the location has not been parsed correctly by the build system. Are you certain that the path is "C:\\keys\\priv_ecdsa.pem"? Could you cross examine with the samples in https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures (which stores the keys within the project folder)

The two lasts warnings are not related to the key issue

How can I verify that the bootloader has successfully incorporated the private key into the bootloader image?

I will have to check this item and come back to you

Why does the bootloader always create 3 images (child-image b0, child-image mcuboot, child-image s1-image)?

You've configured the device to build all three images in your prj.conf. You can check the configurations here https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/kconfig/index.html 

The parent page https://developer.nordicsemi.com/nRF_Connect_SDK/doc/2.3.0/nrf/app_dev/bootloaders_and_dfu/index.html takes you through steps such as enabling secure boot, i.e to enable b0 by adding CONFIG_SECURE_BOOT=y and you have CONFIG_BOOTLOADER_MCUBOOT=y i.e mcuboot enabled.

Kind regards,
Andreas

[J0sh1101]

Hi,

AHaug said:

In the two first warnings it looks like the location has not been parsed correctly by the build system. Are you certain that the path is "C:\\keys\\priv_ecdsa.pem"? Could you cross examine with the samples in https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures (which stores the keys within the project folder)

Yes, the file exists. Below is the prof:

After looking at the example, I proceeded in exactly the same way. I added the keys to the project folder. Below you can see the resulting folder structure:

Add the flags in the CMakeLists.txt as follows:

#
# Copyright (c) 2021 Nordic Semiconductor
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

cmake_minimum_required(VERSION 3.20.0)

find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
project(nRF_Cloud_REST_FOTA_Sample)
zephyr_compile_definitions(PROJECT_NAME=${PROJECT_NAME})

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/keys/priv_ecdsa.pem\")
set(mcuboot_CONFIG_SB_SIGNING_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/keys/priv_ecdsa.pem\")

# NORDIC SDK APP START
target_sources(app PRIVATE src/main.c)
# NORDIC SDK APP END

add_subdirectory(src/fota)

I am still getting the same errors in the compilation process and a bit more:

I updated the SDK to 2.5.0 and update the modem, maybe this is the reason I got this extra error message. 

I tried to compile the sample project wich you gave me above (https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures ). I cloned, compiled it and got errors:

Are there additional examples that compile without warnings and are compatible with the latest SDK?

Thanks for the help.

[AHaug]

Hi

J0sh1101 said:

I updated the SDK to 2.5.0 and update the modem, maybe this is the reason I got this extra error message. 

Ah, I didn't catch that you were using a 9160. I will check in with the author of the samples to see if there are anything different in this case.

Are you using a Thingy:91 or a nRF9160dk?

I will get back to you early next week

Kind regards,
Andreas

[J0sh1101]

Hi, 

I am using the nrf9160dk. 

Thanks for the update.

[AHaug]

Hi,

J0sh1101 said:

I tried to compile the sample project wich you gave me above (https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures ). I cloned, compiled it and got errors:

Regarding the error in the build output it looks like the path is too long. Try to copy the application and move it to somewhere with a shorter path. I know that if you clone the repo and add it to something like C/nordic/ncs/my_projects/the_git_repo/bootloader_samples/keys_and_signatures/the_app_you're_testing, the path will be too long.and you will see such errors.

Other than this the PM warnings are not something you need to worry about before you're ready to test for DFU so lets resolve the other issue first.

Kind regards,
Andreas