How to encrypt FW for MCUBOOT image update?

[Sergey]

Hello.

In our project we must have FOTA functionality, and we want to encrypt these updates

I'm trying to create an encrypted firmware image update for MCUBOOT with "blinky" and "smp_srv" samples. I'm sucessfully updated a signed image without encryption, but can't find any manual how to do create an encryped update. According to this description I understood, that I must encrypt FW packet only, but how should I do it: which tool, which commands, what is the sequence ..? 

I tried adding CONFIG_MCUBOOT_EXTRA_IMGTOOL_ARGS="-E my_key_file" to prj.cfg, but all generated hex/bin files contain the same FW payload without encryption (checked with hex editor). 

There is some info here  about the encryption process, but sorry, it's still not obvious for me what I should do. Is there any step-by-step manual how to create encrypted FW images? Maybe an example project or something else? 

Thank you in advance for any help

[Einar Thorsrud]

Hi,

The documentation you point to is from the MCUBoot documentation. However, we do not have an examples of encrypted firmware images in the nRF Connect SDK, nor support for it in tools. It should be possible, though. In principle you build MCUBoot with BOOT_ENCRYPT_EC256 (or _RSA etc, depending on algorithm), and use imgtool as specified in the documentation.