nRF54L15 - unable to provision key

[Igor]

I get error provisioning key on nRF54L15 and NCS 3.0.1. I tried using "Erase all" in nRF connect SDK Programmer, but it doesn't help. Please check also the attached log.
nrf54l15dk/nrf54l15/cpuapp/ns is used.

PS H:\cup> python H:/ncs/v3.0.1/bootloader/mcuboot/scripts/imgtool.py keygen -t ed25519 -k private_key.pem
PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem                                                                                                                    
nrfutil device x-provision-keys --key-file C:\Users\IgorGorjanc\AppData\Local\Temp\nrfutil_j8mc7y15\keyfile.json --traits jlink
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)


Uploading failed!
PS H:\cup> nrfutil device x-provision-keys --key-file C:\Users\IgorGorjanc\AppData\Local\Temp\nrfutil_j8mc7y15\keyfile.json --traits jlink --log-level trace --log-output stdout --json > log.txt                              
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)

sysbuild.conf:

SB_CONFIG_BOOTLOADER_MCUBOOT=y
SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APP_DIR}/private_key.pem"
SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU=y
SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y

prj.conf:

CONFIG_NCS_SAMPLES_DEFAULTS=y

CONFIG_BT=y
CONFIG_BT_PERIPHERAL=y
CONFIG_BT_DEVICE_NAME="nRF54L15-PDK"

# Enable the LBS service
CONFIG_BT_LBS=y
CONFIG_BT_LBS_POLL_BUTTON=y
CONFIG_DK_LIBRARY=y

CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=2048

# Enable FOTA over Bluetooth LE
CONFIG_NCS_SAMPLE_MCUMGR_BT_OTA_DFU=y

Output on a virtual COM port:

*** Booting MCUboot v2.1.0-dev-ae1ee57f3906 ***
*** Using nRF Connect SDK v3.0.1-9eb5615da66b ***
*** Using Zephyr OS v4.0.99-77f865b8f8d0 ***
I: Starting bootloader
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
E: ED25519 signature verification failed -136
E: Image in the primary slot is not valid!
E: Unable to find bootable image

4628.log.txt

[AHaug]

Hello,

Looks like you're missing a command in https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf54l/kmu_provision.html, i.e the erase command in between generating the key and uploading the key

Let me know if this changes anything.

Kind regards,
Andreas

[Igor]

Erase does not help.

PS H:\cup> python H:\ncs\v3.0.1\bootloader/mcuboot/scripts/imgtool.py keygen -t ed25519 -k private_key.pem
PS H:\cup> nrfutil device erase --all
v Erased 1057746146
PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem
nrfutil device x-provision-keys --key-file C:\Users\IgorGorjanc\AppData\Local\Temp\nrfutil_2twnst4d\keyfile.json --traits jlink
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)


Uploading failed!

[AHaug]

Fair enough, you also mentioned that you used the erase in VS Code as well.

Could you go through the steps you used to generate the JSON-key-file in the last step "nrfutil device x-provision-keys --serial-number <snr> --key-file <JSON-key-file>" just so we have the same foundation for recreating if the docs works or not?

Kind regards,
Andreas

[Igor]

I still get the same error.

PS H:\cup> nrfutil device erase --all                                                                                          
v Erased 1057746146
PS H:\cup> openssl genpkey -algorithm Ed25519 -out private_key.pem                                           
PS H:\cup> openssl pkey -in private_key.pem -pubout -out public_key.pem
PS H:\cup> python H:\ncs\v3.0.1\nrf\scripts\generate_psa_key_attributes.py --usage VERIFY_MESSAGE_EXPORT --id 0x40022100 --type ECC_TWISTED_EDWARDS --size 255 --algorithm EDDSA_PURE --location LOCATION_CRACEN --key-from-file public_key.pem  --file keys.json --cracen_usage RAW --lifetime PERSISTENCE_DEFAULT
PS H:\cup> nrfutil device x-provision-keys --serial-number 1057746146 --key-file keys.json    
x Failed to provision keys on 1057746146, [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)