ECC DFU in SDK12 - Possible to on flash decrypt application data?

RE: ECC DFU in SDK12 - Possible to on flash decrypt application data?

bjorn-spockeli — Fri, 23 Sep 2016 09:34:50 GMT

@slowrobotahead (SRA): I would appreciate if you could you mark the answer as correct( click the check mark in the circle to the left of the answer) so that this question is marked as solved.

RE: ECC DFU in SDK12 - Possible to on flash decrypt application data?

bjorn-spockeli — Fri, 23 Sep 2016 08:52:19 GMT

Yes, I can confirm that this is something that we're looking into. However, I cannot promise anything :)

RE: ECC DFU in SDK12 - Possible to on flash decrypt application data?

SRA — Thu, 22 Sep 2016 17:57:26 GMT

Yea, I'm not sure who ever cares about BLE specific encryption when you need to distribute the firmware in the clear. Seems like on the tool side and on the firmware side this would be easy for Nordic. Certainly it would save me some time!

RE: ECC DFU in SDK12 - Possible to on flash decrypt application data?

bjorn-spockeli — Thu, 22 Sep 2016 09:05:40 GMT

I'll add it to our wishlist :)

RE: ECC DFU in SDK12 - Possible to on flash decrypt application data?

Adrian Eggenberger — Thu, 22 Sep 2016 08:59:13 GMT

+1 for firmware end-to-end encryption

RE: ECC DFU in SDK12 - Possible to on flash decrypt application data?

bjorn-spockeli — Thu, 22 Sep 2016 08:39:46 GMT

Ah, I then I understand, you want the firmware to be end-to-end encrypted, not just while the firmware is sent over the air.

RE: ECC DFU in SDK12 - Possible to on flash decrypt application data?

SRA — Wed, 21 Sep 2016 16:40:40 GMT

Bjørn, thanks for the reply. The issue wasn't the BLE layer, but rather the app and/or sending the file out to be flashed. Since I don't consider the app to be secure, I don't know why anyone would rely on the BLE link security. Seems odd to me.

But... That's great on the bootloader - it should be easy enough to add in the decrypt the app data at the time of flashing. That's really helpful!

RE: ECC DFU in SDK12 - Possible to on flash decrypt application data?

bjorn-spockeli — Wed, 21 Sep 2016 08:55:48 GMT

If you use LE Secure Connections you already have ECC encryption at the Link layer, but this requires both sides to support LE Secure Connections and this might not always be the case, at least not yet.

So yes, you have to add a ECC decryption step before writing the received firmware image to flash. Modifying the existing bootloader to do this extra step should not be a problem.

You can find the Secure DFU bootloader example in the SDK under examples/dfu/bootloader_secure which you may modify as you see fit.

-Bjørn