Firmware signature for HW key configured MCUboot

[mateo-ligne]

Hello everyone, 

I am developping on a nRF52840 using sdk-nrf v1.8.0 and Nordic MCUboot fork as bootloader.

For security matter, we want to use the HW keys MCUboot options which enable the user to implement a function to retrieve his signing public key hash. The point is that when this option is activated, MCUboot no longer expect the Hash of the key in Firmware TLV but the key itself. (cf https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/mcuboot/design.html#using-hardware-keys-for-verification) 

As we find convenient all generated binary by Nordic MCUboot relative Cmake (https://github.com/nrfconnect/sdk-nrf/blob/v1.9.0/modules/mcuboot/CMakeLists.txt) and would like to use them for our release build, we wonder if it is conceivable to condition the argument given to imgtool.py call on HW key configuration. It is something done for instance on trusted firmware-m  (https://github.com/ARMmbed/trusted-firmware-m/blob/master/bl2/ext/mcuboot/CMakeLists.txt) on imgtool.py sign call with following line : 

 --public-key-format $<IF:$<BOOL:${MCUBOOT_HW_KEY}>,full,hash> 

Thanks for your time, 

Matéo

[Einar Thorsrud]

Hi Matéo,

This is not currently supported. See this thread for more information.

Einar

[jithurm]

Any update on this issue ?

[mateo-ligne]

Hi jithurm, 

On my side, I do my own call of imgtool.py script on build to generate app_signed.hex and .bin to include the change I mention (between several others). In order to do that, I now bypass signatures in Nordic MCUboot relative Cmake by disabling CONFIG_SIGN_IMAGES and declare target with name mcuboot_sign_target, which contains my call of imgtool. As far as I understood, this target name is mandatory if you want to link with existing build flow.

But I did not check if an HW key support had been made in v1.9.0 of the SDK yet. 

[jithurm]

Hi, thank you for your update I would be very interested to see how you do that. Do you do these steps in the root application CMakeLists ?

Also, the support for HW keys doesn't seem to have been updated unfortunately.