Error with MCUboot image encryption when using sysbuild

[mmade]

Hello,

I am using nRF9160DK, nRF SDK 2.8.0 with sysbuild and trying to enable image encryption trough sysbuild Kconfig options. I have set SB_CONFIG_BOOT_ENCRYPTION and SB_CONFIG_BOOT_ENCRYPTION_KEY_FILE options.

When I build the project I get an error. From some older forum posts suggest that adding CONFIG_BOOT_ECDSA_TINYCRYPT=y option helps. I still got the same error when adding CONFIG_BOOT_ECDSA_TINYCRYPT=y to sysbuild/mcuboot/prj.conf.

error: #error "One crypto backend must be defined: either MBED_TLS or TINYCRYPT"

[Vidar Berg]

Hello,

Do you also have SB_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256 enabled in your sysbuild configuration (sysbuild.conf)? Enabling CONFIG_BOOT_ECDSA_TINYCRYPT will not help if you are not using ECDSA.

Best regards,

Vidar

[mmade]

Hello,

Thank your for the reply. Yes I have enabled SB_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y in sysbuild configuration.

[Vidar Berg]

Hello,

Thank you for confirming. Could you also check the generated .config file for MCUBoot to confirm that this symbol ends up being selected in your build? I did a quick test here but was unable to reproduce the build error.

Edit: including the project I used to test the build configuration. Note: this does not enable DFU support in the app itself, but it should not be relevant to the encryption part.

3782.hello_world_dfu.zip

[mmade]

Thanks for the project it helped a lot. I had Secure boot enabled (SB_CONFIG_SECURE_BOOT_APPCORE=y) which prevented CONFIG_BOOT_ECDSA_TINYCRYPT=y and CONFIG_BOOT_USE_TINYCRYPT=y.

So is it the case that I cannot use secure boot as first stage bootloader and then use MCUboot as second stage bootloader when I have enabled firmware encryption?

[Vidar Berg]

I did not think of that. The problem is that the mcuboot defaults to using crypto services exposed by b0 to reduce the memory footprint. Please try to comment these lines and see if it enables you to build the project: https://github.com/nrfconnect/sdk-nrf/blob/a2386bfc84016fa571f997ac871b25bd67ca481a/sysbuild/CMakeLists.txt#L454-L457 

[mmade]

Now the project compiles past that problem. Is that problem which is fixed on future releases or should that be commented out every time when new version of nrf sdk is released?

[Vidar Berg]

I'm glad to hear you are able to build the project now. We currently do not have official support for encrypted DFU in our SDK, though it is available through the MCUBoot project, which we include. Therefore, we do not have tests to uncover issues like these. I'm not able to provide a timeline for if or when support will be added. The last time I checked, it did not support secure key storage, which is likely something that would need to be implemented first.