Adding MCUBoot with encrypted images

[allard.p]

I got MCUBoot running using signed images. Now I want to enable encrypted images using the build tools, but how? I've found this pull request:https://github.com/zephyrproject-rtos/zephyr/pull/37568 which was merged into Zephyr 2.7.0 in this commit: https://github.com/zephyrproject-rtos/zephyr/commit/8749cd4d768127359c1ead4a940ab85a9f13e8b3. I'm using Zephyr 2.7.99, but setting MCUBOOT_ENCRYPTION_KEY_FILE results in an error:

warning: MCUBOOT_ENCRYPTION_KEY_FILE (defined at Kconfig.zephyr:639) was assigned the value
'G:\key.pem' but got the value ''. Check these unsatisfied dependencies:
(MCUBOOT_SIGNATURE_KEY_FILE != "") (=n), BOOTLOADER_MCUBOOT (=n). See
docs.zephyrproject.org/.../CONFIG_MCUBOOT_ENCRYPTION_KEY_FILE.html
and/or look up MCUBOOT_ENCRYPTION_KEY_FILE in the menuconfig/guiconfig interface. The Application
Development Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of
the manual might be helpful too.

I noticed the rest of the configuration options use a CONFIG_BOOT prefix instead of CONFIG_MCUBOOT, which got me confused.

[poipoicarlos]

I was able to make this one work however maybe this is slightly different to what you want to implement. In my mcuboot.conf I added the following

CONFIG_SINGLE_APPLICATION_SLOT=y

CONFIG_BOOT_SERIAL_ENCRYPT_EC256=y

CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y

 

then I signed and encrypted the app_to_sign.bin using the imgtool. During the DFU, the entire image gets written to the flash first then gets decrypted after. Finally, the decrypted image gets written back to flash.