DFU Signature error

[navman]

I have been struggling to get the DFU in our own application to work. When starting a DFU from the desktop nRF Connect 3.4.1 it reports an error:

According to the log from the secure bootloader it fails during Signature check. I have followed all the guides to generate public/private keys - building the secure bootloader and generate the DFU zip package. All theses steps are done without any issues. The secure bootloader in our application is based upon the example from the SDK tailored to our hardware. So in order to rule out any issues with that, I went back to test bootloader_secure_ble example from the SDK "out of the box". It turns out that it produces the same errors when trying to send the ble_app_buttonless_dfu_without_bonds_s132.zip file from nRF Connect.

The log from the secure_bootloader is here running the SDK example:

 

Fullscreen 2475.log.txt Download

00> <debug> app: == We are finished handling conn sec update
00> <debug> app: Set receipt notif
00> <debug> app: Sending Response: [0x2, 0x1]
00> <debug> app: Received select object
00> <info> dfq_req_handling: Valid Command: NRF_DFU_OBJECT_OP_SELECT
00> <debug> app: Sending Object Info: [0x60, 0x06, 0x01 max: 0:x00000100 0:x00000000, CRC:0x00000000]
00> <debug> app: Received create object
00> <info> dfq_req_handling: Before OP create command
00> <info> dfq_req_handling: Valid Command Create
00> <debug> app: Sending Response: [0x1, 0x1]
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <debug> app: Received calculate CRC
00> <info> dfq_req_handling: Valid Command CRC
00> <debug> app: Sending CRC: [0x60, 0x03, 0x01, 0:x0000008A, CRC:0x82F6B34E]
00> <debug> app: Received execute object
00> <info> dfq_req_handling: Before OP execute command
00> <info> dfq_req_handling: Valid command execute
00> <info> dfq_req_handling: PB: Init packet data len: 61
00> <info> dfq_req_handling: Handling signed command
00> <info> dfq_req_handling: Calculating init packet hash
00> <info> dfq_req_handling: Verify signature
00> <error> dfq_req_handling: Signature failed
00> <error> dfq_req_handling: Prevalidate failed!
00> <debug> app: Sending Response: [0x4, 0x5]
00> <debug> app: Received create object
00> <info> dfq_req_handling: Before OP create command
00> <info> dfq_req_handling: Valid Command Create
00> <debug> app: Sending Response: [0x1, 0x1]
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <debug> app: Received calculate CRC
00> <info> dfq_req_handling: Valid Command CRC
00> <debug> app: Sending CRC: [0x60, 0x03, 0x01, 0:x0000008A, CRC:0x82F6B34E]
00> <debug> app: Received execute object
00> <info> dfq_req_handling: Before OP execute command
00> <info> dfq_req_handling: Valid command execute
00> <info> dfq_req_handling: PB: Init packet data len: 61
00> <info> dfq_req_handling: Handling signed command
00> <info> dfq_req_handling: Calculating init packet hash
00> <info> dfq_req_handling: Verify signature
00> <error> dfq_req_handling: Signature failed
00> <error> dfq_req_handling: Prevalidate failed!
00> <debug> app: Sending Response: [0x4, 0x5]
00> <debug> app: Received create object
00> <info> dfq_req_handling: Before OP create command
00> <info> dfq_req_handling: Valid Command Create
00> <debug> app: Sending Response: [0x1, 0x1]
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <info> dfq_req_handling: Before OP write command
00> <debug> app: Received calculate CRC
00> <info> dfq_req_handling: Valid Command CRC
00> <debug> app: Sending CRC: [0x60, 0x03, 0x01, 0:x0000008A, CRC:0x82F6B34E]
00> <debug> app: Received execute object
00> <info> dfq_req_handling: Before OP execute command
00> <info> dfq_req_handling: Valid command execute
00> <info> dfq_req_handling: PB: Init packet data len: 61
00> <info> dfq_req_handling: Handling signed command
00> <info> dfq_req_handling: Calculating init packet hash
00> <info> dfq_req_handling: Verify signature
00> <error> dfq_req_handling: Signature failed
00> <error> dfq_req_handling: Prevalidate failed!
00> <debug> app: Sending Response: [0x4, 0x5]
00> <debug> app: #### Advertising NO BONDING ####
00> <debug> app: DFU reset due to inactivity timeout.
00> <info> app: Inside main

We are using SDK 14.0 and SoftDevice 5.0 with IAR ARM Workbench 7.8. For our application, I have used nrfutil version 5.0 to generate the public/private keys as well as generating the zip package.

Does anyone have clue on what is wrong?

[navman]

Resolved using IAR Toolchain:

I got it working also using the IAR Toolchain. I missed some of the defines, when I ported it from gcc make file. So  I put in these defines in the IAR project:

FLOAT_ABI_SOFT
uECC_ENABLE_VLI_API=0
uECC_OPTIMIZATION_LEVEL=3
uECC_SQUARE_FUNC=0
uECC_SUPPORT_COMPRESSED_POINT=0
uECC_VLI_NATIVE_LITTLE_ENDIAN=1

and it works as expected.

Thanks for your support Vidar Berg.

[RVM]

Hi Vidar

Thanks for the explanations so far.

I have a few quick follow up questions:

1.  Are these extra defines for building the external uECC or do they also have to be included when building the bootloader.

2.  We are developing with the nRF52832 which I believe contains the hardware FP unit.
     Can/Should I use FLOAT_ABI_HARD or is the use of the FLOAT_ABI_SOFT mandatory for the uECC build?

3.  What role does this definition "uECC_SUPPORT_COMPRESSED_POINT=0" play in the build?
     Is it mandatory? If so, and it is not defined, will the validation fail?

Cheers

RMV

[Vidar Berg]

Hi RMV,

I think we can continue this in the other tread thread here: https://devzone.nordicsemi.com/f/nordic-q-a/71120/ecdsa-nrf52832-uecc-secure-bootloader. We generally recommend building the uECC library externally using the existing Makefiles.