Build with MCUBOOT and only provide public key

RE: Build with MCUBOOT and only provide public key

Menon — Mon, 13 Jan 2025 15:08:46 GMT

Hello,

Please take a look at this sample, which showcases manual signing. Kindly use this repository only for reference, as it is outdated and not maintained according to the current NCS version.

I hope this will serve your purpose.

Kind regards,
Abhijith

RE: Build with MCUBOOT and only provide public key

robertp — Mon, 13 Jan 2025 14:46:56 GMT

Hi, thanks for the reply.

Do you know how to embed the public key in the bootloader binary during or after build? I can't find any documentation about that.

RE: Build with MCUBOOT and only provide public key

Menon — Mon, 13 Jan 2025 14:37:10 GMT

Hello,

I believe this is feasible. You can share the public key while keeping the private key secure with you. MCUBoot requires the public key to verify the signed application during the boot process. The public key is embedded into the bootloader binary during its build.

The configuration parameter CONFIG_BOOT_SIGNATURE_KEY_FILE specifies the file containing the private key used for signing the binaries. This private key is not needed during the application build process but is required during the MCUBoot build process.

Ensure the private key remains in your possession and use it to sign the final application binary. Third parties can provide you with unsigned application binaries, which you can then sign before distribution.

See the section signature keys for generating keys using different tools.

Kind Regards,

Abhijith