What's the difference between flag NRF_DFU_REQUIRE_SIGNED_APP_UPDATE and NRF_BL_APP_SIGNATURE_CHECK_REQUIRED?

[ayewilling]

I'm new to nRF52833 and when I am working with my DK of DFU modules, I'm getting really confused with option  NRF_DFU_REQUIRE_SIGNED_APP_UPDATE and NRF_BL_APP_SIGNATURE_CHECK_REQUIRED. What exactly is the difference between these two? 

I read nrf_dfu_validation.c and found NRF_DFU_REQUIRE_SIGNED_APP_UPDATE determined whether signature is required. So is the option responsible for secure firmware update? Then how about NRF_BL_APP_SIGNATURE_CHECK_REQUIRED? Dose it have something to do with DFU(Literally I think so)? How and When? 

[Vidar Berg]

Hello,

The NRF_DFU_REQUIRE_SIGNED_APP_UPDATE option says whether the bootloader should require signed app updates or not (Signature verification), while the NRF_BL_APP_SIGNATURE_CHECK_REQUIRED option relates to Boot validation (can optionally be performed on every startup). The default boot validation is a simple CRC validation of the app image.

Best regards,

Vidar

[ayewilling]

Thanks for your explanation, quite clear.

[RMV]

Hi Vidar,

// <q> NRF_BL_APP_SIGNATURE_CHECK_REQUIRED  - Perform signature check on the app. 
// Requires the signature to be sent in the init packet.
#ifndef NRF_BL_APP_SIGNATURE_CHECK_REQUIRED
#define NRF_BL_APP_SIGNATURE_CHECK_REQUIRED 0
#endif

The above is a snippet from the file 'sdk_config.h' available with the secure DFU example code from SDK version 16.0.0.
It says that the signature must be sent in the 'init' packet. I imagine the init packet is a one time transfer that is sent during the DFU process.

Does the boot loader save this signature somewhere in the flash and look it up every time the device (re-)boots?

RMV

[Vidar Berg]

Hi,

Yes, that is correct. The bootloader will copy the signature from the init packet and store it to the bootloader settings page in flash.

[RMV]

Hi

How does one ADD the signature to the init packet? Is that an extra option to the nrfutil package generation workflow?

[Vidar Berg]

Yes, you need to set the app boot validation type to VALIDATE_ECDSA_P256_SHA256. From the help text:

$ nrfutil pkg generate --help
...
  --app-boot-validation [NO_VALIDATION|VALIDATE_GENERATED_CRC|VALIDATE_GENERATED_SHA256|VALIDATE_ECDSA_P256_SHA256]
                                  The method of boot validation for
                                  application.