nRF52840 + NCS + MCUBoot, CC310-enabled image encryption?

[FARLY7]

Hi there,

I am working on a new product iteration that uses the nRF52840. Our existing application is already using nRF52832 + NCS + MCUBoot with image signing.

I would like to take this opportunity to enable image encryption in MCUBoot and use the CC310 crypto hardware accelerator to perform image verification and decryption. However, I cannot find a working KConfig configuration that enables image encryption on MCUBoot with CC310.

Normally I can eventually figure these configuration issues out, but this one is difficult. I cannot find a relevant example project, or similar questions on the devzone.

The main compiler errors I am getting are:

 #error "One crypto backend must be defined: either MBED_TLS or TINYCRYPT"

Could someone tell me what KConfig options are required, or point me to an existing sample project?

Thanks,

Sean

[Vidar Berg]

I understand your concern. Unfortunately, once I enable encryption, I can no longer upload images to the secondary slot using serial recovery. I've tried various configurations and patches, but regardless of what I tried, the image was always updated "in-place". And to upload an encrypted image directly to the primary slot, we need to use the single loader to have the image decrypted on-the-fly (single loader is included through the CONFIG_SINGLE_APPLICATION_SLOT=y symbol). 

The problem with activating the single loader is that it disables FW updates via the application, leaving the serial recovery mechanism as the only DFU method.

I'm afraid my only suggestion is to try raising this issue in the MCUBoot project.

[eb12345]

I'll post something asking, although I think the upstream repository is different than what NCS has, so not sure if it is still a valid question. I don't mind that in serial recovery you can only write to the primary slot, just don't want it disable DFU in the application.

[eb12345]

I raised the issue with MCUBoot project.

Encrypting image and using serial recovery · mcu-tools/mcuboot · Discussion #1814 (github.com)

They said that the NCS version is behind and this issue was solved. Do  you know when an upmerge will happen with MCUBoot and/or Zephyr ?

[Vidar Berg]

I'm glad to hear that the issue has been addressed upstream. The upmerge is currently in progress, and you can track its status here: PR: https://github.com/nrfconnect/sdk-nrf/pull/12112. Unfortunately, I'm not able to give you an estimate of when this will be completed.