DFU keys update

RE: DFU keys update

PBeS — Fri, 09 Jul 2021 05:54:20 GMT

Hi Terje,

Little update:

I try to update like this (SDK4):

Prepare keys pair 1 (let's call them pub1 and priv1) and pair 2 (pub2 and priv2)
On SoC: Bootloader 1, Application 1, compiled with public key 1 (pub1), signed with private key 1 (priv1).
Prepare bootlader dfu package (compiled with pub2, signed with priv1)
DFU is performed
Prepare application dfu package (compiled with pub2, signed with priv1)
DFU is performed
1. application is downloaded correctly
2. reboot after DFU
3. bootloader - signature error

In case 9.c I got bootloader error debug:

<error> nrf_dfu_validation: Signature failed (err_code: 0x8542)

I know that it should not update bootloader and keys but is there any other way to change the keys via dfu?

Regards

Piotr

RE: DFU keys update

PBeS — Thu, 08 Jul 2021 09:11:12 GMT

Hi Terje,

Thanks for quick reaction.

I'm using Thread Secure DFU. You are right, I missed step when I update keys for bootloader (Is not required for SDK2, because there is no signature validation by bootloder).

I try to update like this (SDK4):

Prepare keys pair 1 (let's call them pub1 and priv1) and pair 2 (pub2 and priv2)
On SoC: Bootloader 1, Application 1, compiled with public key 1 (pub1), signed with private key 1 (priv1).
Prepare bootlader dfu package (compiled with pub2, signed with priv1)
DFU is performed
Prepare application dfu package (compiled with pub2, signed with priv1)
DFU is performed
Now I have bootloader 2 and application 2
Prepare application dfu package (compiled with pub2, signed with priv2)
DFU is performed
1. application is downloaded correctly
2. reboot after DFU
3. bootloader - signature error

In case 9.c I got bootloader error debug:

<error> nrf_dfu_validation: Signature failed (err_code: 0x8542)

Please let me know if my steps are ok.

Regards

Piotr

RE: DFU keys update

tesc — Wed, 07 Jul 2021 13:00:24 GMT

Hi,

Which DFU solution are you using? There is both the standard DFU bootloader solution from nRF5 SDK, and the particular solution for Thread Secure DFU. The latter can only be used for application updates, and so I assume that you are talking about the (serial) DFU bootloader from nRF5 SDK.

For the one from nRF5 SDK, the DFU bootloader contains a public key, which is used for checking the signing. It will therefore accept any update signed with the corresponding private key.

With key pairs 1 and 2, and bootloaders 1 and 2, the update will go like this:

On SoC: Bootloader 1, compiled with public key 1.
Bootloader 2 (compiled with public key 2) is put into an update package signed with private key 1.
DFU is performed.
Now on SoC: Bootloader 2, compiled with public key 2.
New updates can be prepared and signed with private key 2.
The SoC, now with bootloader 2, can accept those new updates.

In your case, in 6, the bootloader claims the signing is wrong. This may be either because the old bootloader (with old key) is still on the SoC (i.e. the first update failed), or because there is something wrong with the update.

Have you confirmed that the first bootloader update succeeded?
Have you confirmed that the upgrade zip packet is working as expected if programming bootloader 2 directly first?

Regards,
Terje