How can the bin file be encrypted and signed?

[SunHuang]

Hi,

The SDK version I am using is 2.6.1 and the example is "matter lock".

I wrote the following configuration into \child_image\mcuboot\prj.conf.

Fullscreen

1

2

3

CONFIG_BOOT_SIGNATURE_TYPE_RSA=y

CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=n

CONFIG_BOOT_ENCRYPT_IMAGE=y

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=n
CONFIG_BOOT_ENCRYPT_IMAGE=y

 

And add the code to CMakeLists.txt. Are these steps correct?

Is app_update.bin a generated encrypted file?

Fullscreen

1

2

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/priv.pem\")

set(mcuboot_CONFIG_BOOT_ENCRYPTION_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/encryption_key.pem\")

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/priv.pem\")
set(mcuboot_CONFIG_BOOT_ENCRYPTION_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/encryption_key.pem\")

[AHaug]

Hi,

This configuration is not present in NCS v2.6.1, meaning that encrypted DFU is not supported.

 

But this unofficial sample which should work for 2.5.x and 2.6.x should give you a pointer for how to add it. Note that it does not support the nRF5340 https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures/mcuboot_smp_encryption 

But it is present in 2.9.0-rc1 as far as I can see.

Is app_update.bin a generated encrypted file?

In the latest version of https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/config_and_build/output_build_files.html#common_output_build_files it describes that zephyr.signed.encrypted.bin is used to  create dfu_application.zip for encrypted multi-core DFU updates.

Since 2.9.0-rc1 is just a release candidate, I'm not too familiar with this feature, but I will have a look.

Kind regards,
Andreas

[SunHuang]

Hi,

After I configured CONFIG_BOOT_ENCRYPT_IMAGE=y, mcuboot did not have enough memory space.

I modified the "pm_static_dfu.yml" file. There seems to be a problem with my program.

How to solve the problems?

pm_static_dfu.7z

[AHaug]

Hi,

AHaug said:

This configuration is not present in NCS v2.6.1, meaning that encrypted DFU is not supported.

First of, which version of nRF Connect SDK are you using? As mentioned, this feature is not present in v2.6.1?

Kind regards,
Andreas

[SunHuang]

Hi,

I want to try this method：github.com/.../mcuboot_smp_encryption .

Although this version does not support "CONFIG_BOOT_ENCRYPT_IMAGE", I still want to know why I can't change the memory configuration

[AHaug]

Hi,

SunHuang said:

I still want to know why I can't change the memory configuration

How did you modify the pm_static? There is probably some misaligned partitions in the map.

Kind regards,
Andreas

[SunHuang]

Hi,

Please refer to the attachment of the previous reply

[AHaug]

You've just changed the mcuboot app partition size without changing anything else. This means that in the middle of your memory area there are now a gap with nothing between the app and the factory data. This is how the sizes are set up as default

In your static partitioning there is a gap of 0x4200 between the app and factory data. 

Kind regards,
Andreas

[SunHuang]

Hi,

It seems that my configuration is also 0xF7000. What do you mean by  the gap of 0x4200?

If version 2.6.1 does not support "CONFIG_BOOT_ENCRYPT_IMAGE", is bin file encrypted by default?

[AHaug]

My bad, you are right since you had also modified the start.

Could you upload the build errors you're getting when trying to build with this configuration.

Kind regards,
Andreas

[SunHuang]

Hi,

The current problem is the previous reply.

[AHaug]

That is not the log I'm referring to, but I'm sure the issue is where you're pointing. Could you please enable logging and 

1) Upload the build log

2) Upload the device logs from both bootloader and application

Kind regards,
Andreas

[SunHuang]

Hi,

The attachment is BUILD LOG, the device will not send any messagebuild log.7z

Can you confirm it for me first?

SunHuang said:

If version 2.6.1 does not support "CONFIG_BOOT_ENCRYPT_IMAGE", is bin file encrypted by default?