This post is older than 2 years and might not be relevant anymore
More Info: Consider searching for newer posts

What's the difference between flag NRF_DFU_REQUIRE_SIGNED_APP_UPDATE and NRF_BL_APP_SIGNATURE_CHECK_REQUIRED?

I'm new to nRF52833 and when I am working with my DK of DFU modules, I'm getting really confused with option  NRF_DFU_REQUIRE_SIGNED_APP_UPDATE and NRF_BL_APP_SIGNATURE_CHECK_REQUIRED. What exactly is the difference between these two? 

I read nrf_dfu_validation.c and found NRF_DFU_REQUIRE_SIGNED_APP_UPDATE determined whether signature is required. So is the option responsible for secure firmware update? Then how about NRF_BL_APP_SIGNATURE_CHECK_REQUIRED? Dose it have something to do with DFU(Literally I think so)? How and When? 

  • Yes, you need to set the app boot validation type to VALIDATE_ECDSA_P256_SHA256. From the help text:

    $ nrfutil pkg generate --help
    ...
      --app-boot-validation [NO_VALIDATION|VALIDATE_GENERATED_CRC|VALIDATE_GENERATED_SHA256|VALIDATE_ECDSA_P256_SHA256]
                                      The method of boot validation for
                                      application.
    

  • Pardon me since I am not at all knowledgable on matters related to 'security' and 'encryption'.

    The way I understood it (and please correct me if I am wrong) there are two notions of security in the DFU workflow.

    1. Siging/verifying the DFU zip packet using some form of signature verification techniques.
    2. Boot validation i.e. the boot loader validates the CRC of the application once (or everytime?) before loading and executing the application.

    Does "--app-boot-validation" apply to both options above, or (as I would intuitively imagine) only to option (2) above?

    And what role does the <private,public> key pair have in this workflow when these are used to build (public key) and generate the DFU (private key)  and sign it?

  • RMV said:
    Does "--app-boot-validation" apply to both options above, or (as I would intuitively imagine) only to option (2) above?

    This is to option is to specify which boot validation method to use (see Boot validation), and is not related to the signing of the update itself (Signature verification).

Related