steps to sign binary and encode the signed key to mcuboot

RE: steps to sign binary and encode the signed key to mcuboot

tellg — Thu, 08 Dec 2022 13:51:55 GMT

This seems to work:

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/custom_key_dir/custom_priv.pem\")

RE: steps to sign binary and encode the signed key to mcuboot

tellg — Thu, 08 Dec 2022 13:14:40 GMT

Fails in ncs 2.2.0

(Worked in ncs 2.0.0)

C:/ncs_proj/samples_for_nrf_connect_sdk-main/bootloader_samples/keys_and_signatures/mcuboot_smp_custom_key/build/mcuboot/zephyr/misc/generated/extra_kconfig_options.conf:2: warning: malformed string literal in assignment to BOOT_SIGNATURE_KEY_FILE (defined at C:/ncs/v2.2.0/nrf/modules/mcuboot/boot/zephyr/Kconfig:58, C:/ncs/v2.2.0/bootloader/mcuboot/boot/zephyr/Kconfig:131, C:/ncs/v2.2.0/nrf/modules/mcuboot/Kconfig:3). Assignment ignored.

RE: steps to sign binary and encode the signed key to mcuboot

Sigurd Hellesvik — Wed, 02 Nov 2022 10:13:04 GMT

If you want to know more about how signing works with MCUboot, I recommend David Browns video on Image signatures in MCUboot .

Regards,
Sigurd Hellesvik

RE: steps to sign binary and encode the signed key to mcuboot

Ubaid_M — Wed, 02 Nov 2022 10:10:55 GMT

Hello Sigurd Hellesvik,

[quote userid="106736" url="~/f/nordic-q-a/93315/steps-to-sign-binary-and-encode-the-signed-key-to-mcuboot/393605"]No. I use app_update.bin.[/quote]

Thanks. Got it.

[quote userid="106736" url="~/f/nordic-q-a/93315/steps-to-sign-binary-and-encode-the-signed-key-to-mcuboot/393605"]And not with the asymmetric encryption algorithms(RSA/ECDSA) used for MCUboot i think.[/quote]

I was under the impression that we use salt here as well. But if not, then fine.

Thanks for your inputs Sigurd Hellesvik.!

RE: steps to sign binary and encode the signed key to mcuboot

Sigurd Hellesvik — Wed, 02 Nov 2022 10:06:36 GMT

[quote user="Ubaid_M"]1. After using this key, I am supposed to use the build file "app_signed.hex" for DFU right..?[/quote]

No. I use app_update.bin.
From Custom Key SMP sample:

"See the Simple SMP sample for a guide on how to use the SMP Server."

[quote user="Ubaid_M"]2. How can I add salt to the key I am using to sign..?[/quote]

I am a bit confused about this question.

Salt is mostly used for hashing, right?
And not with the asymmetric encryption algorithms(RSA/ECDSA) used for MCUboot i think.

Can you elaborate this question a bit?

Regards,
Sigurd Hellesvik

RE: steps to sign binary and encode the signed key to mcuboot

Ubaid_M — Wed, 02 Nov 2022 07:47:06 GMT

Thanks Sigurd Hellesvik,

I shall try this today.

[quote userid="106736" url="~/f/nordic-q-a/93315/steps-to-sign-binary-and-encode-the-signed-key-to-mcuboot/393483"]My favorite way to do this is to pass it to the CMakeLists.txt.[/quote]

Please help me with two more queries:

1. After using this key, I am supposed to use the build file "app_signed.hex" for DFU right..?
2. How can I add salt to the key I am using to sign..?

Thanks,

RE: steps to sign binary and encode the signed key to mcuboot

Sigurd Hellesvik — Tue, 01 Nov 2022 13:40:05 GMT

[quote user="Ubaid_M"]Please correct me if I am wrong[/quote]

You only need to pass this to the mcuboot child image.

My favorite way to do this is to pass it to the CMakeLists.txt. This will allow you to use relative paths:

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE \\"${CMAKE_CURRENT_SOURCE_DIR}/custom_key_dir/custom_priv.pem\\")

Ref https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/blob/main/bootloader_samples/keys_and_signatures/mcuboot_smp_custom_key/CMakeLists.txt

Regards,
Sigurd Hellesvik

RE: steps to sign binary and encode the signed key to mcuboot

Ubaid_M — Tue, 01 Nov 2022 13:28:12 GMT

Hello Sigurd Hellesvik,

Thanks I was able to generate a key.

Now All I need to do is to add the key I generated named "custom_key.pem" is to add the config:

CONFIG_BOOT_SIGNATURE_KEY_FILE="{WORKSPACE}\\custom_key.pem"

Into 2 places:
1. prj.conf of mcuboot child project
2. prj.conf of application parent project

Please correct me if I am wrong

Thanks,

[quote userid="106736" url="~/f/nordic-q-a/93315/steps-to-sign-binary-and-encode-the-signed-key-to-mcuboot/392823"]It uses a default private key[/quote]

RE: steps to sign binary and encode the signed key to mcuboot

Ubaid_M — Tue, 01 Nov 2022 12:55:50 GMT

Hello Sigurd Hellesvik,

Now I am getting cryptography module not found error

Also, Please see that PIP and Python are present, as those commands say already installed

RE: steps to sign binary and encode the signed key to mcuboot

Sigurd Hellesvik — Tue, 01 Nov 2022 12:27:43 GMT

Try to do

python3 imgtool.py keygen -k filename.pem -t rsa-2048

And if you still get the same error, it means that you are missing the click pip module. Try:

pip3 install click

Regards,
Sigurd Hellesvik

RE: steps to sign binary and encode the signed key to mcuboot

Ubaid_M — Tue, 01 Nov 2022 12:18:48 GMT

Hello Sigurd Hellesvik,

I am unable to understand here,

Correct me if I am wrong on the flow of things below, I am using nCS on windows PC.

First I go to the "nCS\bootloader\mcuboot\scripts" and invoke the command:

imgtool.py keygen -k filename.pem -t rsa-2048

I am getting this error:

Can you help me here how to generate the key..?

RE: steps to sign binary and encode the signed key to mcuboot

Sigurd Hellesvik — Thu, 27 Oct 2022 12:22:57 GMT

Hi,

When you build an image with MCUboot enabled in the nRF Connect SDK, the build system will do the following:

Use a private key to generate a public key for the bootloader. It uses a default private key, but you should change this for production. See our docs on Signature Keys, and maybe also my unofficial MCUBoot Custom Key with SMP Server.
Automatically generate a signed binary to use for DFU called app_update.bin. See MCUboot output build files.

So what you explain here is most likely done automatically for you.

For more information on this, I have collected of my understandings of this at https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures.
Keep in mind that this git project is my personal one, and not official Nordic documentation.

Regards,
Sigurd Hellesvik