steps to sign binary and encode the signed key to mcuboot

[Ubaid_M]

Hi,

I am using vscode and nCS on windows, kindly help me with below 3 queries:

1. How to generate a binary signing key, say "KEY_1"..?

2. How to sign a binary with "KEY_1" or generate a signed binary with "KEY_1" from vscode..?

3. How to inform mcuboot regarding generated "KEY_1" to validate binary..?

I came across some steps like on : https://devzone.nordicsemi.com/f/nordic-q-a/77077/how-to-specify-signing-the-key-with-mcuboot#:~:text=CONFIG_BOOT_SIGNATURE_KEY_FILE%3D%22c%3A%5C%5Ckey.pem%22

But i need the complete picture.

Thanks,

[Sigurd Hellesvik]

Hi,

When you build an image with MCUboot enabled in the nRF Connect SDK, the build system will do the following:

1. Use a private key to generate a public key for the bootloader. It uses a default private key, but you should change this for production. See our docs on Signature Keys, and maybe also my unofficial MCUBoot Custom Key with SMP Server.
2. Automatically generate a signed binary to use for DFU called app_update.bin. See MCUboot output build files.

So what you explain here is most likely done automatically for you.

For more information on this, I have collected of my understandings of this at https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures.
Keep in mind that this git project is my personal one, and not official Nordic documentation.

Regards,
Sigurd Hellesvik

[Ubaid_M]

Hello Sigurd Hellesvik,

I am unable to understand here,

Correct me if I am wrong on the flow of things below, I am using nCS on windows PC.

First I go to the "nCS\bootloader\mcuboot\scripts" and invoke the command:

imgtool.py keygen -k filename.pem -t rsa-2048

I am getting this error:

Can you help me here how to generate the key..?

[Sigurd Hellesvik]

Hi

Ubaid_M said:

Please correct me if I am wrong

You only need to pass this to the mcuboot child image.

My favorite way to do this is to pass it to the CMakeLists.txt. This will allow you to use relative paths:

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE \\"${CMAKE_CURRENT_SOURCE_DIR}/custom_key_dir/custom_priv.pem\\")

Ref https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/blob/main/bootloader_samples/keys_and_signatures/mcuboot_smp_custom_key/CMakeLists.txt

Regards,
Sigurd Hellesvik

[Ubaid_M]

Thanks Sigurd Hellesvik,

I shall try this today.

Sigurd Hellesvik said:

My favorite way to do this is to pass it to the CMakeLists.txt.

Please help me with two more queries:

1. After using this key, I am supposed to use the build file "app_signed.hex" for DFU right..?
2. How can I add salt to the key I am using to sign..?

Thanks,

[Sigurd Hellesvik]

Ubaid_M said:

1. After using this key, I am supposed to use the build file "app_signed.hex" for DFU right..?

No. I use app_update.bin.
From Custom Key SMP sample:

"See the Simple SMP sample for a guide on how to use the SMP Server."

Ubaid_M said:

2. How can I add salt to the key I am using to sign..?

I am a bit confused about this question.

Salt is mostly used for hashing, right?
And not with the asymmetric encryption algorithms(RSA/ECDSA) used for MCUboot i think.

Can you elaborate this question a bit?

Regards,
Sigurd Hellesvik

[Ubaid_M]

Hello Sigurd Hellesvik,

Sigurd Hellesvik said:

No. I use app_update.bin.

Thanks. Got it.

Sigurd Hellesvik said:

And not with the asymmetric encryption algorithms(RSA/ECDSA) used for MCUboot i think.

I was under the impression that we use salt here as well. But if not, then fine.

Thanks for your inputs Sigurd Hellesvik.!

[Sigurd Hellesvik]

If you want to know more about how signing works with MCUboot, I recommend David Browns video on Image signatures in MCUboot .

Regards,
Sigurd Hellesvik