How can the bin file be encrypted and signed?

RE: How can the bin file be encrypted and signed?

AHaug — Wed, 03 Sep 2025 12:33:12 GMT

Hello,

[quote user="hoai nguyen"] Can you explain how to get .signed.encrypted.bin file without using sysbuild?[/quote]

Without sysbuild it is not supported and there won't be any support added for this without sysbuild either.

SunHuang FYI

At the point in time this case was raised it was possible to do, but a bit rough to implement. At least now for the 54L15 which has its own KMU it's relatively straight forward to implement. Note that for multi-image DFU such as OTA over Matter or Zigbee requires, it will not work due to a multi image requirement.

For encrypted BLE OTA on the nRF54L15 you can follow https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf54l/ecies_x25519.html together with

and

https://academy.nordicsemi.com/courses/nrf-connect-sdk-intermediate/lessons/lesson-9-bootloaders-and-dfu-fota/topic/exercise-5-fota-over-bluetooth-low-energy/

This should result in something like this sample that I've made for the 54l15. Steps to use in description.

devzone.nordicsemi.com/.../1_5F00_ble_5F00_fota_5F00_ft_5F00_ext_5F00_flash.zip

Kind regards;
Andreas

RE: How can the bin file be encrypted and signed?

Jason — Wed, 03 Sep 2025 07:18:52 GMT

Hi SunHuang Can you explain how to get .signed.encrypted.bin file without using sysbuild? Thanks.

RE: How can the bin file be encrypted and signed?

Jason — Wed, 03 Sep 2025 07:08:48 GMT

Hi AHaug , do you know how to get .encrypted.bin file without sysbuild? Thanks.

RE: How can the bin file be encrypted and signed?

SunHuang — Thu, 13 Feb 2025 09:16:47 GMT

Hi,

Based on the document you provided, I believe that as long as "encrypted" appears, it means my BIN file has been successfully encrypted. I just need a definite answer. Thank you for your assistance.

RE: How can the bin file be encrypted and signed?

AHaug — Wed, 12 Feb 2025 09:54:23 GMT

Hi,

[quote user="SunHuang"]After the project has been successfully compiled, I noticed that the bin file in the dfu_application directory has the suffix .signed.encrypted. Does this mean that my bin file has been successfully signed and encrypted?[/quote]

From https://docs.nordicsemi.com/bundle/ncs-2.9.0/page/nrf/app_dev/config_and_build/output_build_files.html

"zephyr.signed.encrypted.hex is the HEX file variant of the <file_name>.signed.encrypted.bin file. Can also be used standalone for a single-image DFU. Contains the signed and encrypted version of the application. Compatible with MCUboot. zephyr is the value of CONFIG_KERNEL_BIN_NAME. The file is located in the build/<your_application_name>/zephyr directory."

[quote user="SunHuang"]Will the bootloader verify my key after performing the OTA update? I'm a bit concerned because I still see the following message in the compilation log.[/quote]

https://academy.nordicsemi.com/courses/nrf-connect-sdk-intermediate/lessons/lesson-9-bootloaders-and-dfu-fota/ and exercise 2 regarding DFU with custom keys explains application verification and signing using keys.

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Wed, 12 Feb 2025 08:54:23 GMT

Hi,

After the project has been successfully compiled, I noticed that the bin file in the dfu_application directory has the suffix .signed.encrypted. Does this mean that my bin file has been successfully signed and encrypted?

Will the bootloader verify my key after performing the OTA update? I'm a bit concerned because I still see the following message in the compilation log.

CMake Warning at C:/ncs/v2.9.0/nrf/cmake/sysbuild/debug_keys.cmake:21 (message):


      --------------------------------------------------------------
      --- WARNING: Using generated NSIB public/private key-pair. ---
      --- It should not be used for production.                  ---
      --- See SB_CONFIG_SECURE_BOOT_SIGNING_KEY_FILE             ---
      --------------------------------------------------------------


Call Stack (most recent call first):

RE: How can the bin file be encrypted and signed?

AHaug — Tue, 11 Feb 2025 12:58:30 GMT

Hi,

No problem, here's some relevant resources

https://docs.nordicsemi.com/bundle/ncs-2.9.0/page/mcuboot/encrypted_images.html

https://docs.nordicsemi.com/bundle/ncs-2.9.0/page/nrf/app_dev/bootloaders_dfu/mcuboot_nsib/bootloader_mcuboot_nsib.html

https://docs.nordicsemi.com/bundle/ncs-2.9.0/page/nrf/app_dev/bootloaders_dfu/mcuboot_nsib/bootloader_signature_keys.html

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Tue, 11 Feb 2025 07:35:40 GMT

Hi,

Sorry for the delayed response. To avoid other issues, I have already updated the SDK to version 2.9.0 during this time.

Could you provide the correct encryption and signing method? I would prefer the official approach.

As for the "vendor prefix" issue, please ignore it since I will be using it in the APP code later. Its functionality is working as expected.

RE: How can the bin file be encrypted and signed?

AHaug — Wed, 08 Jan 2025 10:01:05 GMT

Hi,

Yes, I believe so. In line 15 you see that you have a "label" property. This is marked as "deprecated", i.e its not required or has changed.

The second item that I believe might be present in the same file and/or elsewhere in your definition is the "vendor prefix" that is unknown. Do you know if building works if you don't have this vendor prefix "sunion"?

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Wed, 08 Jan 2025 07:01:57 GMT

Hi,

Is this what you want?

&spi3
{
    compatible = "nordic,nrf-spim";
    status = "okay";
    cs-gpios = <&gpio0 18 GPIO_ACTIVE_LOW>;
    pinctrl-0 = <&spi3_default>;
    pinctrl-1 = <&spi3_sleep>;
    pinctrl-names = "default", "sleep";
    mx25r64: mx25r6435f@0
    {
        compatible = "jedec,spi-nor";
        status = "okay";
        reg = <0>;
        spi-max-frequency = <8000000>;
        label = "MX25R64";
        jedec-id = [20 00 16];
        sfdp-bfp =
        [
            53 46 44 50  08 01 00 FF  00 08 01 14  10 00 00 FF
            F5 20 C1 FF  FF FF FF 01  00 00 08 6B  08 3B 00 00
            EE FF FF FF  FF FF 00 00  FF FF 00 00  09 DB 0C 20
            10 D8 00 00  04 08 0C 00  90 F3 0E 00  00 00 00 80
        ];
        size = <67108864>;
        has-dpd;                                                                       // deep power
        t-enter-dpd = <10000>;
        t-exit-dpd = <35000>;
        wp-gpios = <&gpio0 15 (GPIO_ACTIVE_HIGH)>;
    };
};

RE: How can the bin file be encrypted and signed?

AHaug — Tue, 07 Jan 2025 11:27:39 GMT

Hi,

The issues seems to be devicetree related, and not strictly related to your static partitioning yaml. The setup of the external flash seems to be having some issues with some of the items in the flash device. Could you share your overlay/board files showing how you've set up the external flash?

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Mon, 30 Dec 2024 07:22:48 GMT

Hi,

I have solved 3 warnings, "GPIO_ENABLE_DISABLE_INTERRUPT" I have to use, otherwise it will affect the interrupt function.

pm_static has not been solved yet. Which example do you recommend for testing?

RE: How can the bin file be encrypted and signed?

AHaug — Wed, 18 Dec 2024 11:48:26 GMT

Thank you,

[quote user="SunHuang"]

Can you confirm it for me first?

SunHuang said:
If version 2.6.1 does not support "CONFIG_BOOT_ENCRYPT_IMAGE", is bin file encrypted by default?

[/quote]

MCUboot supports encrypted DFU, but there's not support for it in the SDK v2.6.1 out of the box.

The sample in the unofficial repository you refer to shows how you can modify the firmware to have encrypted DFU (https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures/mcuboot_smp_encryption) in NCS v2.6.1.

warning: MBEDTLS (defined at soc/arm/nxp_imx\rt5xx\Kconfig.defconfig.series:63,
soc/arm/nxp_imx\rt6xx\Kconfig.defconfig.series:64, soc/arm/nxp_imx\rt\Kconfig.defconfig.series:117,
C:/ncs/v2.6.1/nrf\modules/trusted-firmware-m/Kconfig.mbedtls_minimal.defconfig:7,
C:/ncs/v2.6.1/nrf\modules/trusted-firmware-m/Kconfig.psa.defconfig:1,
C:/ncs/v2.6.1/zephyr/modules/mbedtls/Kconfig:17, modules\mbedtls\Kconfig:17) was assigned the value
'y' but got the value 'n'. See http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS
and/or look up MBEDTLS in the menuconfig/guiconfig interface. The Application Development Primer,
Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be
helpful too.


warning: PM (defined at soc/arm/silabs_exx32\efr32bg22\Kconfig.defconfig.series:18,
soc/arm/silabs_exx32\efr32bg27\Kconfig.defconfig.series:18,
soc/arm/silabs_exx32\efr32mg24\Kconfig.defconfig.series:19,
soc/arm/st_stm32\stm32f4\Kconfig.defconfig.series:20, subsys/pm/Kconfig:13) was assigned the value
'y' but got the value 'n'. Check these unsatisfied dependencies: ((SOC_SERIES_EFR32BG22 &&
SOC_FAMILY_EXX32) || (SOC_SERIES_EFR32BG27 && SOC_FAMILY_EXX32) || (SOC_SERIES_EFR32MG24 &&
SOC_FAMILY_EXX32) || SOC_SERIES_STM32F4X || (SYS_CLOCK_EXISTS && HAS_PM)) (=n). See
http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_PM and/or look up PM in the
menuconfig/guiconfig interface. The Application Development Primer, Setting Configuration Values,
and Kconfig - Tips and Best Practices sections of the manual might be helpful too.


warning: BT_CTLR_SDC_PERIPHERAL_COUNT (defined at
C:/ncs/v2.6.1/nrf\subsys\bluetooth\controller/Kconfig:123) was assigned the value '3' but got the
value ''. Check these unsatisfied dependencies: BT_LL_SOFTDEVICE (=n), BT_CTLR (=n). See
http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_BT_CTLR_SDC_PERIPHERAL_COUNT and/or look up
BT_CTLR_SDC_PERIPHERAL_COUNT in the menuconfig/guiconfig interface. The Application Development
Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual
might be helpful too.


warning: Experimental symbol GPIO_ENABLE_DISABLE_INTERRUPT is enabled.

There's 4 warnings in the build configuration that is not present when building the default lock sample in the SDK. I recommend you to clear these up to reduce the possibility that this is an XY problem.

And have you managed to get this working on a sample that is less complex than the Matter door lock? I understand that your end goal is to get it up and running for this app, but I would suggest you verify that it works on a minimal sample first to avoid any XY situations

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Wed, 18 Dec 2024 07:28:34 GMT

Hi,

The attachment is BUILD LOG, the device will not send any messagedevzone.nordicsemi.com/.../build-log.7z

Can you confirm it for me first?

[quote userid="130009" url="~/f/nordic-q-a/117165/how-can-the-bin-file-be-encrypted-and-signed/514839"]If version 2.6.1 does not support "CONFIG_BOOT_ENCRYPT_IMAGE", is bin file encrypted by default?[/quote]

RE: How can the bin file be encrypted and signed?

AHaug — Tue, 17 Dec 2024 14:33:22 GMT

That is not the log I'm referring to, but I'm sure the issue is where you're pointing. Could you please enable logging and

1) Upload the build log

2) Upload the device logs from both bootloader and application

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Mon, 16 Dec 2024 00:55:44 GMT

Hi,

The current problem is the previous reply.

RE: How can the bin file be encrypted and signed?

AHaug — Fri, 13 Dec 2024 10:00:14 GMT

My bad, you are right since you had also modified the start.

Could you upload the build errors you're getting when trying to build with this configuration.

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Fri, 13 Dec 2024 07:41:26 GMT

Hi,

It seems that my configuration is also 0xF7000. What do you mean by the gap of 0x4200?

If version 2.6.1 does not support "CONFIG_BOOT_ENCRYPT_IMAGE", is bin file encrypted by default?

RE: How can the bin file be encrypted and signed?

AHaug — Thu, 12 Dec 2024 09:57:24 GMT

You've just changed the mcuboot app partition size without changing anything else. This means that in the middle of your memory area there are now a gap with nothing between the app and the factory data. This is how the sizes are set up as default

In your static partitioning there is a gap of 0x4200 between the app and factory data.

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Thu, 12 Dec 2024 09:14:49 GMT

Hi,

Please refer to the attachment of the previous reply

RE: How can the bin file be encrypted and signed?

AHaug — Thu, 12 Dec 2024 09:08:20 GMT

Hi,

[quote user="SunHuang"] I still want to know why I can't change the memory configuration[/quote]

How did you modify the pm_static? There is probably some misaligned partitions in the map.

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Thu, 12 Dec 2024 00:28:31 GMT

Hi,

I want to try this method：github.com/.../mcuboot_smp_encryption .

Although this version does not support "CONFIG_BOOT_ENCRYPT_IMAGE", I still want to know why I can't change the memory configuration

RE: How can the bin file be encrypted and signed?

AHaug — Wed, 11 Dec 2024 13:43:47 GMT

Hi,

[quote user="AHaug"]This configuration is not present in NCS v2.6.1, meaning that encrypted DFU is not supported.[/quote]

First of, which version of nRF Connect SDK are you using? As mentioned, this feature is not present in v2.6.1?

Kind regards,
Andreas

RE: How can the bin file be encrypted and signed?

SunHuang — Wed, 11 Dec 2024 08:25:12 GMT

Hi,

After I configured CONFIG_BOOT_ENCRYPT_IMAGE=y, mcuboot did not have enough memory space.

I modified the "pm_static_dfu.yml" file. There seems to be a problem with my program.

How to solve the problems?

devzone.nordicsemi.com/.../pm_5F00_static_5F00_dfu.7z

RE: How can the bin file be encrypted and signed?

AHaug — Tue, 10 Dec 2024 15:03:58 GMT

Hi,

This configuration is not present in NCS v2.6.1, meaning that encrypted DFU is not supported.

But this unofficial sample which should work for 2.5.x and 2.6.x should give you a pointer for how to add it. Note that it does not support the nRF5340 https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures/mcuboot_smp_encryption

But it is present in 2.9.0-rc1 as far as I can see.

[quote user=""]Is app_update.bin a generated encrypted file?[/quote]

In the latest version of https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/config_and_build/output_build_files.html#common_output_build_files it describes that zephyr.signed.encrypted.bin is used to create dfu_application.zip for encrypted multi-core DFU updates.

Since 2.9.0-rc1 is just a release candidate, I'm not too familiar with this feature, but I will have a look.

Kind regards,
Andreas