RE: Downgrading via Secure Buttonless DFU OTA

Roiger — Wed, 29 Jul 2020 09:17:38 GMT

Thanks for the great explanation Vidar!

RE: Downgrading via Secure Buttonless DFU OTA

Vidar Berg — Tue, 28 Jul 2020 09:53:27 GMT

Hi,

Downgrade prevention is recommended for security reasons. Let's say you issued have issued an update to your end-users with a security fix, then you would not want an attacker to be able to revert this by downgrading the FW.

Without FW signing, you would not have a way to really prevent a downgrade anyway. The attacker could just create take an old update package and bump the version number (does not require access to a private key). So this makes the NRF_DFU_APP_DOWNGRADE_PREVENTION setting less relevant for non-signed updates.

Best regards,

Vidar