mcuboot signature validation

RE: mcuboot signature validation

Amanda Hsieh — Wed, 30 Mar 2022 11:12:27 GMT

Hi,

Sorry. I need to correct my answer after confirming with the team.

There is no pre-validation before the mcuboot gets triggered in NCS. Real validation of the image (integrity check, authentication, decryption) is up to the secure bootloader. We can't do anything about that right now, only the bootloader has full knowledge and access to private keys. It is up to the application to verify whether the allowed remote actor provides the image and requests the update.

-Amanda

RE: mcuboot signature validation

Shikamaru — Wed, 30 Mar 2022 05:32:53 GMT

thanks amanda,

In 1st validation , it will only check whether the dfu is triggered by the image or not . nothing else , all the security related things are done in booting phase by mcuboot. But how it is checking the triggering of the dfu in 1st validation part , that am not understanding can you please update on this.

RE: mcuboot signature validation

Amanda Hsieh — Thu, 24 Mar 2022 12:32:19 GMT

Hi,

It doesn't verify security if the image sings with a key. The key will be verified while booting. See Revoking private keys.

Regards,
Amanda