Is it possible to rotate the signing key for secure DFU?

[michaelhobo]

I already have a few devices in the field, and I'm curious if it is possible to occasionally update the signing key (e.g. to upgrade key, or compromised key, etc). If not possible for already-deployed devices, is there a way to support key rotation for things we haven't developed yet? Does anybody have any suggestions for managing the signing keys?

We are currently using nrfutil pkg generate, with the --key-file flag.

[Vidar Berg]

Hi,

Our default implementation doesn't include a key rotation scheme. However, if your key got compromised, I think you should be able to issue a bootloader update with a new hardcoded public key that will be used for subsequent updates. 

[michaelhobo]

So, the bootloader-only package is signed with the old key, and contains the new key? Can you expand on how you would hardcode the key into the bootloader?

[Vidar Berg]

Yes, that's what meant. The public key is always included in the bootloader image. You can re-compile your bootloader with a public key from a new key-pair (key is in dfu_public_key.c) then use the old key to sign the update. 

[michaelhobo]

Thanks for the pointers. I found dfu_public_key.c in the dfu example. I get the gist of it, and I think this should work. I will make a new question if I have more questions!