Problems verifying DFU package signature in custom background DFU

RE: Problems verifying DFU package signature in custom background DFU

Vidar Berg — Tue, 11 Apr 2023 07:04:16 GMT

TOCGRE , please create a new case where you include the details about the issue you are facing. There were several improvements made to the background DFU support between SDK v15.2 that OP was using compared to SDK 17.0.2, so it is more likely that you are experiencing a different problem.

RE: Problems verifying DFU package signature in custom background DFU

TOCGRE — Fri, 07 Apr 2023 10:24:48 GMT

Hi,

I've got the exact same issue verifying DFU package but with SDK17.0.2 and nrf52832.

Is there any update on this thread ?

Regards,

RE: Problems verifying DFU package signature in custom background DFU

Vidar Berg — Mon, 25 Oct 2021 14:36:38 GMT

Hi,

Interesting that it only works with my hex file. It's one I built from the ble_app_hrs example. Does your hex file include data in the UICR section (0x10001000)? In that case, can you try to remove this section before you generate the zip package? Data in UICR will not be included in the DFU image anyway.

Best regards,

Vidar

RE: Problems verifying DFU package signature in custom background DFU

hfj — Wed, 20 Oct 2021 13:42:14 GMT

Hi,

When using nrfutil 4.0.0 and the .hex you provided it works. I tried generating a new application .hex file, which also failed.

Edit: I do not know what causes this.

BR,

hfj

RE: Problems verifying DFU package signature in custom background DFU

Vidar Berg — Wed, 20 Oct 2021 13:31:55 GMT

Hi,

Could you please try with the hex file below and nrfutil v4.0.0 to see if it might have anything to do with the hex file itself?

devzone.nordicsemi.com/.../ble_5F00_app_5F00_hrs_5F00_pca10056_5F00_s140.hex

Thanks,

RE: Problems verifying DFU package signature in custom background DFU

hfj — Wed, 20 Oct 2021 13:13:55 GMT

Hi,

When using the latest nrfutil executable it works the same as the nrfutil 6.X installed through pip

RE: Problems verifying DFU package signature in custom background DFU

Vidar Berg — Wed, 20 Oct 2021 07:54:28 GMT

Hi,

Does the same application hex work with nrfutil 6? I didn't get any errors when I ran the same command as shown in your screenshot.

RE: Problems verifying DFU package signature in custom background DFU

hfj — Wed, 20 Oct 2021 07:31:18 GMT

Hi,

I'm getting these errors when trying to run the nrfutil 4.0.0 executable, both from 64 and 32-bit powershell terminals. Do you know what I am doing wrong here?

BR,

hfj

RE: Problems verifying DFU package signature in custom background DFU

Vidar Berg — Wed, 20 Oct 2021 07:18:04 GMT

Hi,

It's OK to use micro-ecc library instead. As you problably have seen, this is the library we already use for the other nRF52 variants that don't include cc310 peripheral. The obvious drawback is that you won't benefit from the HW accelleration offered by the Cryptocell, so the signature and hash validations will be a bit slower.

Best regards,

Vidar

RE: Problems verifying DFU package signature in custom background DFU

hfj — Wed, 20 Oct 2021 06:37:14 GMT

Hi Vidar,

Thanks for the reply! If there is backwards compatability it seems reasonable that something else is wrong. I'll try using the pre-built 4.0.0 version of nrfutil anyway and see if that leads to any different results.

We're trying to use the micro-ecc crypto backend at the moment. We tried getting different crypto backends to work such as Oberon and CC310, but had difficulties compiling successfully. We also tried CC310_BL which we were able to compile. However, after creating an object and writing the init command to it we experienced some weird behaviour when trying to validate the init command. Execution stopped without any error messages in the function "nrf_crypto_hash_update()" at the function pointer "ret_val = p_int_context->p_info->update_fn(p_context, p_data, data_size);". We think the app scheduler might have crashed in the background, although we're not entirely sure.

Should we rather try getting the CC310 crypto backend to compile or is using micro-ecc a viable option?

Best regards,

hfj

RE: Problems verifying DFU package signature in custom background DFU

Vidar Berg — Tue, 19 Oct 2021 15:39:47 GMT

Hello,

The init file should be backward compatible with older protobuf parsers. I've tested DFU with SDK 15.2.0 and nrfutil v6.1.0 without issues. That said, according to the documentation here: nRF Util, nrfutil version 4.0.0 is the version we recommended for this SDK release

Note that you can download a pre-built executable for version 4.0.0 here: https://github.com/NordicSemiconductor/pc-nrfutil/releases?page=2 so you don't have to install Python 2.

[quote userid="81273" url="~/f/nordic-q-a/80834/problems-verifying-dfu-package-signature-in-custom-background-dfu"]While also taking into account that the dfu_req_handler converts from little-endian to big-endian, we see that the signature has had it's first and last halves switched.[/quote]

Are you using the regular cc310 crypto backend or the bootloader specific variant of this backend? The nRF crypto top-level API should work with big-endian keys anyway. But I wonder if there is something else that may cause the signature validation to fail.

Best regards,

Vidar