Bootloader rejects DFU updates with custom key

[Andrés]

Hi all,

We are successfully using the nRF52840 chip in one of our projects except for the DFU functionality. We tried following these tutorials without success:

devzone.nordicsemi.com/.../getting-started-with-nordics-secure-dfu-bootloader
github.com/.../nRF52832-buttonless-dfu-development-tutorial

Our firmware includes the bootloader (with minimal modifications) that Nordic provides, the S140 v6.1.1 SoftDevice, and our application functionality on top of that. The problem appears when trying to update the app with a new version (we don't need to update SD or BL). Testing with nRF Connect, we receive a "Invalid object error" shortly after selecting the zip and starting the DFU procedure. We found that NRF_DFU_REQUIRE_SIGNED_APP_UPDATE set to 0 makes the updates work, so the deduction is that the problem comes from the password checking of the zip.

This post has a project attached where the problem is replicated. It is a copy of the DFU example of nRF5 SDK v15.3.0 for PCA10056 and Segger Studio, and it contains a generated private and public keys for the purpose of this post in addition to the HTS example hex, which is used to test the bootloader and update the app. The folder should be copied to \nRF5_SDK_15.3.0_59ac345\examples\dfu\secure_bootloader\ and the public key to \nRF5_SDK_15.3.0_59ac345\examples\dfu\dfu_public_key.c.
As can be tested in the project, setting NRF_DFU_REQUIRE_SIGNED_APP_UPDATE to 0 in sdk_config.h generates a bootloader that will accept the zip updates. These zips can be generated in the subfolder dfu_gen with the script "generate_files.bat". One aspect that differs from the tutorials is that we did not need to add any uECC library, as the project compiled fine without it. Also, all the testing we have done has been with no bonding.

Thanks in advance,
Best regards.

[Amanda Hsieh]

Hi, 

Not sure I understand your question or not. 

Did you generate your own public and private key? How did you generate the upload application image with your private key? See Working with keys for instructions, and Signature Verification for more information about signatures.

Please refer to the BLE Secure DFU Bootloader section for \nRF5_SDK_15.3.0_59ac345\examples\dfu\secure_bootloader

If you want the application update may come from an unsigned package (NRF_DFU_REQUIRE_SIGNED_APP_UPDATES), please see the Open Bootloader with DFU section.

-Amanda H.

[Andrés]

Hi Amanda,

The question is how to generate the updates in a way that they are accepted by the secure bootloader, as we currently have to set NRF_DFU_REQUIRE_SIGNED_APP_UPDATE to 0 so that the bootloader accepts the zip and updates the application code.

We have tested the functionality with the default public key in the secure bootloader example and it works ok.

We have also tested the bootloader with our own private/public keys and that's when the error comes up.
The test was performed with the HTS example as the application code and our own key as the private key to generate the zip file.

Please, find attached the .zip file that we forgot to include in the previous post:

 pca10056_ble_forumCode.zip

[Amanda Hsieh]

Hi, 

I think your private and public keys are not the same pair. I generated a new pair of keys as 243944_Key.zip to test with your code, and they can work.

Please see BLE Secure DFU Bootloader for testing.

-Amanda H.