nRF9160: How to make MCUboot more secure by placing keys in OTP area?

[kk2mkk]

Hi,

https://devzone.nordicsemi.com/f/nordic-q-a/67024/nrf9160-questions-related-to-immutable-mcuboot-application

From the above thread i learn that MCUBoot is not that secure as the public key is been stored in general flash area which can be read and altered by attacker, is there a way with which i can store the keys (for validating the chain image) in an area like OTP which cant be altered without erasing the whole chip(like its done b0 immutable bootloader)?

regards

KK

[Marjeris Romero]

Hi,

It's usually not a big problem that the public keys are stored in flash, as long as you remember to enable MCUBoot flash protection. For increased security you can stored the keys directly in OTP (part of the UICR).

[kk2mkk]

Hi,

I dont think the present mcuboot have this feature of protecting the flash, Can you please demonstrate with simple example code for the same?

regards

kk

[Marjeris Romero]

Hi,

We have a library for Hardware flash write protection (fprotect) that can be used for protecting lash areas from writing. Flash protection is already implemented on bootloader/mcuboot/boot/zephyr/main.c

[Marjeris Romero]

If you are unsure that fprotect_area() is being called you can check that the Partition Manager is enabled and that CONFIG_FPROTECT is set in kconfig:

https://github.com/nrfconnect/sdk-mcuboot/blob/master/boot/zephyr/main.c#L422

[Marjeris Romero]

For your information, there is also plans to add the use of fprotect to all nrf samples. In that case every image will be able to protect their flash area. There is a pull request for this on the loop: https://github.com/nrfconnect/sdk-nrf/pull/3264