DFU Image Encryption

RE: DFU Image Encryption

lCannon — Fri, 05 Dec 2025 16:29:01 GMT

What versions of the SDK currently have support for encrypted DFU images. I see some documentation for encrypted images in 3.0.2

https://docs.nordicsemi.com/bundle/ncs-3.0.2/page/mcuboot/encrypted_images.html

but no examples. This page discusses a DFU sample with MCUboot with encryption enabled

https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/samples/dfu/mcuboot_with_encryption/README.html

but the version selection for the SDK does not allow any selection other then latest version. Is this page the best place to start for wokrign with Enrypted DFU packages; if not what would be the place that explains it. What version of SDK should we use to do this? Is there a version out of preview that has support?
Thank you

RE: DFU Image Encryption

Vidar Berg — Thu, 16 Oct 2025 13:22:31 GMT

Hi Emre,

Please see my edit in my initial response. I had not noticed that we had introduced support for encryption. Regarding the app not booting, could it be that you have not provisioned the signature key to the KMU?

https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf54l/kmu_basics.html#provisioning_keys_for_the_bootloader

Vidar

RE: DFU Image Encryption

Emre Bayraktar — Thu, 16 Oct 2025 12:55:23 GMT

Hi Viar,

With CONFIG_FPROTECT disabled and image encryption enabled, bootloader project exceeded 60kb region by 900 bytes. I've disabled log feature and resulting image fitted into 60kb region and encrypted.hex file is created. But when I flash it to the DK, nothing happens. Are there any extra steps for uploading encrypted image to the nRF54L ?

When I disable these config commands, blink app works fine.

SB_CONFIG_BOOT_ENCRYPTION=y

SB_CONFIG_BOOT_ENCRYPTION_KEY_FILE="/opt/nordic/ncs/V3.1.0/bootloader/mcuboot/enc-x25519-priv.pem"

Thanks & Best Regards,

Emre.

RE: DFU Image Encryption

Vidar Berg — Tue, 14 Oct 2025 13:48:36 GMT

Hello Emre,

There is currently no official support for image encryption in the SDK. Have you checked if you are able to make it work if you disable CONFIG_FPROTECT? If so, we could try to look at optimizing your bootloader project to get it below 62kB.

Best regards,

Vidar

EDIT: Sorry, I was not aware that support had been added: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf54l/ecies_x25519.html