• State Verified Answer
  • Replies 3 replies
  • Subscribers 71 subscribers
  • Views 2516 views
  • Users 0 members are here
Attachments (0)
Nordic Case Info
  • Case ID: 101444
Options
This post is older than 2 years and might not be relevant anymore
More Info: Consider searching for newer posts

DFU security

KPE

Is there anything preventing anyone from uploading the tinyest image that simply dumps the entire ROM content on the UART?

This would sort of circumvent the HW locking.

Parents
  • 0

    As you can see in table 8 in the MPU chapter of the Reference Manual, code running in code region 1 will always be able to read other code in region 1, so what you state would most likely be technically possible.

    If you are concerned about this, I'd therefore strongly recommend you to include some kind of signing in your DFU process, so that only binaries that have been cryptographically signed with a secret key will be accepted and actually written to the chip. We don't yet have any example code for anything like this, but It should be fairly easy to extend the bootloader from the SDK with such functionality.

Reply
  • 0

    As you can see in table 8 in the MPU chapter of the Reference Manual, code running in code region 1 will always be able to read other code in region 1, so what you state would most likely be technically possible.

    If you are concerned about this, I'd therefore strongly recommend you to include some kind of signing in your DFU process, so that only binaries that have been cryptographically signed with a secret key will be accepted and actually written to the chip. We don't yet have any example code for anything like this, but It should be fairly easy to extend the bootloader from the SDK with such functionality.

Children
No Data
Related
Terms of service