How to add support for MCUBoot Image Signature signed with ECC curve secp256k1 created by openSSL ?

[Siddharth Kachhia]

Hi, I'm working on nRF52840-DK board and NCS SDK-v1.7.0 on Windows with Visual Studio Code.

We want to add support for Image validation for imaged signed with ECC curve secp256k1 based ECC key. By default, it consider only secp256r1 based EC curve key but not secp256k1.We want to sign the image with sec256k1 EC curve based key.

First we have created private key using below command:
openssl ecparam -genkey -out priv-sec256k1.pem -name secp256k1

Then we have enabled below configuration options in MCUBoot.conf:

CONFIG_MBEDTLS_ECP_ALL_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_SECP256K1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_BP256R1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_BP384R1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_BP512R1_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED=y
CONFIG_MBEDTLS_ECP_DP_CURVE448_ENABLED=y
CONFIG_MBEDTLS_ECP_NIST_OPTIM=y

Then we have given this private key from custom MCUBoot conf file.

During compile time, it takes generated private key but it throws error of "Unsupported EC curve : secp256k1".Therefore Build fails.

How can I add support for OpenSSL generated ECC curve secp256k1 based signature key ?

[Marjeris Romero]

Hi,

It seems that only the curves secp256r1 and ed25519 are supported (RSA signing is also supported). See mcuboot changelog here:

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/mcuboot/release-notes.html

OpenSSL is supported to create keys, we have some instructions on how to use both OpenSSL and imgtool here:

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/ug_fw_update.html

Best regards,

Marjeris

[Siddharth Kachhia]

Hi,

Yes. There is only support for secp256r1 but no support for secp256k1. So Can we add support for secp256k1 curve based signature key.

Is there any link that provide information about secp256k1 support on zephyr rtos for nRF boards ?

[Marjeris Romero]

I am not sure if it's possible, but I have asked our developers to see if they have more information available.

[Marjeris Romero]

Hello again,

There is no support for secp256k1 in either nrf_cc310_bl or nrf_oberon backend. If you would want to use this curve you will need to link using the nrf_cc310_platform and nrf_c310_mbedcrypto library, but this is not trivial task.

Butr the mbed tls library does has support for the secp356k1 curve type: 
https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrfxlib/crypto/doc/nrf_cc310_mbedcrypto.html#ecdsa-and-ecdh