DFU signature error while updating application

[Kristopher]

Hi, I can't manage with error in secure bootloder (from secure_dfu_ble_s132_pca10040_debug example) on custom board with nRF52832xxaa chip. I got a signature validation error trying to update aplication.

I created zip files by command: nrfutil pkg generate --hw-version 52 --sd-req 0x9d --application-version 1 --application app.hex --key-file private.key zip_name.zip

When there is no application (i only flashed softdevice and bootloader) ewerything works, rtt log shows: "get: nrf_dfu_settings: Verify signature" and "nrf_dfu_settings: Image verified"

But when i trying to update secound zip (changig application-version, same private key) i got error: nrf_dfu_settings: Signature failed

Why signature only works for the first time?

On DK board, everything works fine, program is updating successfully many times.

I'm using SDK14, gcc with eclipse, and nRF Connection on android

[bjorn-spockeli]

Are you able to debug the bootloader on the custom board? Can you check the input params to nrf_crypto_ecdsa_verify_hash() in dfu_handle_prevalidate() and then compare them to an update using the nRF52 DK?

[plippo]

I'm having the same issue. Trying to make a DFU with BL+SD+APP => doesn't work. BL+SD updates just fine. When I split to two .zip's (BL+SD --- APP) the first one updates just fine, but second one fails with signature verification.

[bjorn-spockeli]

Does both the old and new bootloader contain the same public key derived from the private key?

Also remember that you need to specify both the version of the SoftDevice present on the device AND the version of the SoftDevice in the zip package with the --sd-req option.

Example updating from S132 v5.0.0 (FWID:0x9D) to S132 v5.1.0 (FWID:0xA5) with a combined BL+APP+SD image

nrfutil pkg generate --hw-version 52 --sd-req 0x9d,0xA5 --application-version 1 --application app.hex --bootloader bootloader.hex --bootloader-version 1 --softdevice softdevice.hex --key-file private.key zip_name.zip

[plippo]

Yep, that was atleast my problem. The location of public key file was different in Makefile => mine wasn't picked.

[bjorn-spockeli]

Great! I would appreciate if you could mark the answer as accepted/correct by clicking the check mark in the grey circle to the left of the answer.