Single-bank DFU bare metal - image verification

[tdfilip]

Hello

I played with the mcuboot_recovery_entry bare metal dfu sample. I noticed that if I sign an application image with an invalid key (invalid on purpose), the firmware loader still downloads the application and overwrites the old one. Then after a reboot, the MCUBoot verifies the image, rejects it and start the firmware loader again. 

Is there a possibility for firmware loader to verify the image signature before overwriting the current image? If no, isn't there a possibility that anyone could start dfu with an invalid image which would remove the current image?

Regards,
Filip

[Hung Bui]

Hi Filip, 

So the hash and signature is located at the image trailer. From what you described, seems that the trailer is not sent before the image is received. So you have a point here that one with an invalid image (and a way to put the device to DFU mode) can brick the device with an invalid image. 

However, even if the signature and hash is sent before the image, one can still spoof a valid signature and hash (copy from a valid DFU package) combine with an invalid image. If you want to have a secure authentication, I guess it has to be implemented before the device enter DFU mode. 

Anyway, I have forwarded your question internally to NCS Bare Metal team, let's see what their take on this. 

[tdfilip]

Hello, is there any update from the NCS Bare Metal team?

Regards,
Filip