Signing and verifying with OpenSSL vs. nrfutil

RE: Signing and verifying with OpenSSL vs. nrfutil

Vidar Berg — Fri, 25 Apr 2025 15:46:00 GMT

Hi, please let me know if you have made any progress on this. I have not had enough time to investigate this further. Regarding endianess, at least the public key is split into R and S in the code. This is relevant if you need to swap the byte order of that key: RE: ECDSA with nrfutil generated key

RE: Signing and verifying with OpenSSL vs. nrfutil

fwd159 — Thu, 24 Apr 2025 13:11:16 GMT

Hi Vidar,

Thanks for your reply!

I have a feeling the issue is a matter of byte order.

I did use the nrfutil repo (signing.py) as a reference while looking into nrfutil and OpenSSL. I ended up writing a short script to test the Python library that nrfutil uses (ecdsa) and the Python library our server uses (cryptography). I wanted to make sure without a doubt that it's possible to sign an Init packet with one library and verify the signature with the other. After a first attempt to sign something with nrfutil, I noticed it was failing its own verification! This is when I realized that the ecdsa Python library likely expects big-endian data, but for Nordic, the signature needs to be stored in the Init packet as little-endian. As long as the signature is in the right format, both libraries are able to verify the signatures.

I'm not sure if it matters, but I know when we make the API call to the server, the server response is base 64 encoded.

I've tried the byte order both ways for the signature and both ways still fail signature verification. Do you have any recommendations? Also, is the nrfutil verify function an accurate representation of the verification process that happens in the Bootloader during a DFU?

Thanks

RE: Signing and verifying with OpenSSL vs. nrfutil

Vidar Berg — Thu, 24 Apr 2025 08:07:58 GMT

Hello,

Unfortunately, we do not have any samples demonstrating how you can sign the DFU init packet with openssl. The SDK documentation only explains how you can create the keypair with openssl. Did you use the https://github.com/NordicSemiconductor/pc-nrfutil/blob/master/nordicsemi/dfu/signing.py implementation from nrfutil as a reference?

This thread may also be relevant: AWS Key Management System - DFU Package Signing

Best regards,

Vidar