DFU Image Encryption

[Emre Bayraktar]

Hello,

I’m trying to enable image encryption on nRF54L. When I enable the encryption, MCUBoot firmware size gets bigger and does not fit into 60kb region. When I set the region to much bigger size, MCUBoot fails to start running the firmware. I’ve also read this ticket (https://devzone.nordicsemi.com/f/nordic-q-a/120819/nrf54-with-mcuboot) that if the app start address higher than 0x10000, the MCUBoot will fail to boot because of Fprotect.

1 - Is there an official support for image encryption with DFU on the nrf Connect SDK ? If yes, are there any reference documents about it ?

2 - If there is a support, how to adjust the partitions of the flash to solve Fprotect problem ?

Thanks & Best Regards,

Emre Bayraktar.

[Vidar Berg]

Hello Emre,

There is currently no official support for image encryption in the SDK. Have you checked if you are able to make it work if you disable CONFIG_FPROTECT? If so, we could try to look at optimizing your bootloader project to get it below 62kB.

Best regards,

Vidar

EDIT: Sorry, I was not aware that support had been added: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf54l/ecies_x25519.html 

[Emre Bayraktar]

Hi Viar, 

With CONFIG_FPROTECT disabled and image encryption enabled, bootloader project exceeded 60kb region by 900 bytes. I've disabled log feature and resulting image fitted into 60kb region and encrypted.hex file is created. But when I flash it to the DK, nothing happens. Are there any extra steps for uploading encrypted image to the nRF54L ? 

When I disable these config commands, blink app works fine. 

SB_CONFIG_BOOT_ENCRYPTION=y

SB_CONFIG_BOOT_ENCRYPTION_KEY_FILE="/opt/nordic/ncs/V3.1.0/bootloader/mcuboot/enc-x25519-priv.pem"

Thanks & Best Regards,

Emre.

[Vidar Berg]

Hi Emre,

Please see my edit in my initial response. I had not noticed that we had introduced support for encryption. Regarding the app not booting, could it be that you have not provisioned the signature key to the KMU? 

https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf54l/kmu_basics.html#provisioning_keys_for_the_bootloader 

Vidar

[lCannon]

What versions of the SDK currently have support for encrypted DFU images.  I see some documentation for encrypted images in 3.0.2

https://docs.nordicsemi.com/bundle/ncs-3.0.2/page/mcuboot/encrypted_images.html

but no examples.  This page discusses a DFU sample with MCUboot with encryption enabled

https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/samples/dfu/mcuboot_with_encryption/README.html

but the version selection for the SDK does not allow any selection other then latest version.  Is this page the best place to start for wokrign with Enrypted DFU packages; if not what would be the place that explains it.  What version of SDK should we use to do this?  Is there a version out of preview that has support?
Thank you