NCS v2.7.0 and sysbuild system.
I'm looking for some clarification about Secure Boot and implementing a custom signing command.
What is the difference between secure boot and the signing that happens when you just set BOOT_SIGNATURE_KEY_FILE="/path/to/key.pem"?
Examining the scripts in `nrf/scripts/bootloaders/` it appears that all of the signing and verification functions are expecting ECDSA keys, which I was unable to find anywhere in the documentation. Is there a way to get this to work with RSA keys? or is ECDSA my only option?
The documentation (https://github.com/nrfconnect/sdk-nrf/blob/a8ea23813b59e40e5999636063b15d629eea373f/sysbuild/Kconfig.secureboot#L73) says that the output of the signing function should be in DER format.
When I ran this signing command that output an actual DER formatted signature, the build system threw an error that it was expecting a 64 byte signature, i.e. just the R and S values of the signature. When I modified the code to write the R and S values it worked as expected.
signature = private_key.sign(data, ec.ECDSA(hashes.SHA256())) # This is the der formatted signature. It would be 70 bytes # sys.stdout.buffer.write(signature) # Instead, extract the R and S values and print them to stdout r, s = decode_dss_signature(signature) r_bytes = r.to_bytes(32, "big") s_bytes = s.to_bytes(32, "big") sig = bytearray(r_bytes) sig.extend(s_bytes) sys.stdout.buffer.write(sig) sys.stdout.flush()