steps to sign binary and encode the signed key to mcuboot

[Ubaid_M]

Hi,

I am using vscode and nCS on windows, kindly help me with below 3 queries:

1. How to generate a binary signing key, say "KEY_1"..?

2. How to sign a binary with "KEY_1" or generate a signed binary with "KEY_1" from vscode..?

3. How to inform mcuboot regarding generated "KEY_1" to validate binary..?

I came across some steps like on : https://devzone.nordicsemi.com/f/nordic-q-a/77077/how-to-specify-signing-the-key-with-mcuboot#:~:text=CONFIG_BOOT_SIGNATURE_KEY_FILE%3D%22c%3A%5C%5Ckey.pem%22

But i need the complete picture.

Thanks,

[Sigurd Hellesvik]

Hi,

When you build an image with MCUboot enabled in the nRF Connect SDK, the build system will do the following:

1. Use a private key to generate a public key for the bootloader. It uses a default private key, but you should change this for production. See our docs on Signature Keys, and maybe also my unofficial MCUBoot Custom Key with SMP Server.
2. Automatically generate a signed binary to use for DFU called app_update.bin. See MCUboot output build files.

So what you explain here is most likely done automatically for you.

For more information on this, I have collected of my understandings of this at https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures.
Keep in mind that this git project is my personal one, and not official Nordic documentation.

Regards,
Sigurd Hellesvik

[Ubaid_M]

Hello Sigurd Hellesvik,

I am unable to understand here,

Correct me if I am wrong on the flow of things below, I am using nCS on windows PC.

First I go to the "nCS\bootloader\mcuboot\scripts" and invoke the command:

imgtool.py keygen -k filename.pem -t rsa-2048

I am getting this error:

Can you help me here how to generate the key..?

[Ubaid_M]

Thanks Sigurd Hellesvik,

I shall try this today.

Sigurd Hellesvik said:

My favorite way to do this is to pass it to the CMakeLists.txt.

Please help me with two more queries:

1. After using this key, I am supposed to use the build file "app_signed.hex" for DFU right..?
2. How can I add salt to the key I am using to sign..?

Thanks,

[Sigurd Hellesvik]

Ubaid_M said:

1. After using this key, I am supposed to use the build file "app_signed.hex" for DFU right..?

No. I use app_update.bin.
From Custom Key SMP sample:

"See the Simple SMP sample for a guide on how to use the SMP Server."

Ubaid_M said:

2. How can I add salt to the key I am using to sign..?

I am a bit confused about this question.

Salt is mostly used for hashing, right?
And not with the asymmetric encryption algorithms(RSA/ECDSA) used for MCUboot i think.

Can you elaborate this question a bit?

Regards,
Sigurd Hellesvik

[Ubaid_M]

Hello Sigurd Hellesvik,

Sigurd Hellesvik said:

No. I use app_update.bin.

Thanks. Got it.

Sigurd Hellesvik said:

And not with the asymmetric encryption algorithms(RSA/ECDSA) used for MCUboot i think.

I was under the impression that we use salt here as well. But if not, then fine.

Thanks for your inputs Sigurd Hellesvik.!

[Sigurd Hellesvik]

If you want to know more about how signing works with MCUboot, I recommend David Browns video on Image signatures in MCUboot .

Regards,
Sigurd Hellesvik

[tellg]

Fails in ncs 2.2.0

(Worked in ncs 2.0.0)

C:/ncs_proj/samples_for_nrf_connect_sdk-main/bootloader_samples/keys_and_signatures/mcuboot_smp_custom_key/build/mcuboot/zephyr/misc/generated/extra_kconfig_options.conf:2: warning: malformed string literal in assignment to BOOT_SIGNATURE_KEY_FILE (defined at C:/ncs/v2.2.0/nrf/modules/mcuboot/boot/zephyr/Kconfig:58, C:/ncs/v2.2.0/bootloader/mcuboot/boot/zephyr/Kconfig:131, C:/ncs/v2.2.0/nrf/modules/mcuboot/Kconfig:3). Assignment ignored.

[tellg]

This seems to work:

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/custom_key_dir/custom_priv.pem\")