RE: NCS 3.3.0 HMAC-SHA512 with image encryption

Vidar Berg — Mon, 22 Jun 2026 12:17:25 GMT

Hello,

It looks like we decided to standardise on SHA512 for encryption as well do avoid having to include support for both sha256 and sha512 in the bootloader crypto library (by default), but removing the option of using SHA 256 seems like a breaking change. I will need to check internally to confirm the details. In the meantime, can you confirm that it works if you temoparly remove the "imgtool_encrypt_extra_args" assignment in the signing script?

Best regards,

Vidar

EDIT: turns out there was already an open PR to address this: https://github.com/nrfconnect/sdk-nrf/pull/28618

EDIT2: PR above was a back port to 3.1 branch and was closed. Fix is merged on main: https://github.com/nrfconnect/sdk-nrf/commit/0caabb0d090de9ae3d4e85744ac26a739b26fc37