Adding Encryption to Secure DFU SDK v15

RE: Adding Encryption to Secure DFU SDK v15

user4903 — Wed, 26 Jan 2022 20:54:14 GMT

The ECB key is simply 12 cryptographically random bytes.

You can generate 12 cryptographically random bytes using Python. Open up a Python command line and type the following:

import os

import import binascii

binascii.hexlify(os.urandom(12))The output should look something like this (i.e. 12 hex values):

b'5cf1159902090a33cbbd5c03'

RE: Adding Encryption to Secure DFU SDK v15

user94408 — Wed, 26 Jan 2022 05:30:10 GMT

Hi Mathew,

Thank you for the clarification!

I have one query that how to get ECB key is not mentioned any where. Could you please update on how to get the corresponding ECB key?

Thanks!

RE: Adding Encryption to Secure DFU SDK v15

user4903 — Sat, 20 Nov 2021 01:26:31 GMT

Existing function code in SDK 15:

nrf_dfu_result_t nrf_dfu_validation_post_data_execute(uint32_t src_addr, uint32_t data_len)
{
    nrf_dfu_result_t     ret_val = NRF_DFU_RES_CODE_SUCCESS;
    dfu_init_command_t * p_init  = m_packet.has_signed_command ? &m_packet.signed_command.command.init
                                                               : &m_packet.command.init;

    if (!fw_hash_ok(p_init, src_addr, data_len))
    {
        ret_val = EXT_ERR(NRF_DFU_EXT_ERROR_VERIFICATION_FAILED);
    }
    else
    {
        if (p_init->type == DFU_FW_TYPE_APPLICATION)
        {
            postvalidate_app(p_init);
        }
        else
        {
            bool with_sd = p_init->type & DFU_FW_TYPE_SOFTDEVICE;
            bool with_bl = p_init->type & DFU_FW_TYPE_BOOTLOADER;

            if (!postvalidate_sd_bl(p_init, with_sd, with_bl, src_addr))
            {
                ret_val = NRF_DFU_RES_CODE_INVALID_OBJECT;
                if (with_sd && !DFU_REQUIRES_SOFTDEVICE &&
                    (src_addr == nrf_dfu_softdevice_start_address()))
                {
                    nrf_dfu_softdevice_invalidate();
                }
            }
        }
    }

    if (ret_val == NRF_DFU_RES_CODE_SUCCESS)
    {
        // Store CRC32 for image
        s_dfu_settings.bank_1.image_crc = s_dfu_settings.progress.firmware_image_crc;
        s_dfu_settings.bank_1.image_size = data_len;
    }
    else
    {
        nrf_dfu_bank_invalidate(&s_dfu_settings.bank_1);
    }

    // Set the progress to zero and remove the last command
    memset(&s_dfu_settings.progress, 0, sizeof(dfu_progress_t));
    memset(s_dfu_settings.init_command, 0xFF, DFU_SIGNED_COMMAND_SIZE);

    s_dfu_settings.write_offset                  = 0;
    s_dfu_settings.progress.update_start_address = src_addr;

    return ret_val;
}

Change to:

nrf_dfu_result_t nrf_dfu_validation_post_data_execute(uint32_t src_addr, uint32_t data_len)
{
    nrf_dfu_result_t     ret_val = NRF_DFU_RES_CODE_SUCCESS;
    dfu_init_command_t * p_init  = m_packet.has_signed_command ? &m_packet.signed_command.command.init
                                                               : &m_packet.command.init;

    if (!fw_hash_ok(p_init, src_addr, data_len))
    {
        ret_val = EXT_ERR(NRF_DFU_EXT_ERROR_VERIFICATION_FAILED);
    }
    else
    {
        if (p_init->type == DFU_FW_TYPE_APPLICATION || p_init->type & DFU_FW_TYPE_BOOTLOADER)
        {
            s_dfu_settings.progress.firmware_image_crc = crc32_compute((uint8_t*)src_addr, data_len, NULL);
        }
        
        if (p_init->type == DFU_FW_TYPE_APPLICATION)
        {
            postvalidate_app(p_init);
        }
        else
        {
            bool with_sd = p_init->type & DFU_FW_TYPE_SOFTDEVICE;
            bool with_bl = p_init->type & DFU_FW_TYPE_BOOTLOADER;

            if (!postvalidate_sd_bl(p_init, with_sd, with_bl, src_addr))
            {
                ret_val = NRF_DFU_RES_CODE_INVALID_OBJECT;
                if (with_sd && !DFU_REQUIRES_SOFTDEVICE &&
                    (src_addr == nrf_dfu_softdevice_start_address()))
                {
                    nrf_dfu_softdevice_invalidate();
                }
            }
        }
    }

    if (ret_val == NRF_DFU_RES_CODE_SUCCESS)
    {
        // Store CRC32 for image
        s_dfu_settings.bank_1.image_crc = s_dfu_settings.progress.firmware_image_crc;
        s_dfu_settings.bank_1.image_size = data_len;
    }
    else
    {
        nrf_dfu_bank_invalidate(&s_dfu_settings.bank_1);
    }

    // Set the progress to zero and remove the last command
    memset(&s_dfu_settings.progress, 0, sizeof(dfu_progress_t));
    memset(s_dfu_settings.init_command, 0xFF, DFU_SIGNED_COMMAND_SIZE);

    s_dfu_settings.write_offset                  = 0;
    s_dfu_settings.progress.update_start_address = src_addr;

    return ret_val;
}

RE: Adding Encryption to Secure DFU SDK v15

user94408 — Sat, 20 Nov 2021 01:11:35 GMT

Hi Mathew,

I am confused when adding code to nrf_dfu_validation_post_data_execute. It seems like there's an incomplete code?

Any help is appreciated!

Thank you in advance,

RE: Adding Encryption to Secure DFU SDK v15

user82236 — Fri, 06 Dec 2019 13:38:48 GMT

I am getting below error for nRF5 SDK 16.0.0

1> C:/Program Files/SEGGER/SEGGER Embedded Studio for ARM 4.18/gcc/arm-none-eabi/bin/ld: ../../../../Output/Release/Obj/nrf_dfu_validation.o: in function `nrf_dfu_validation_crypt':
1> \BootLoaderSource\components\libraries\bootloader\dfu/nrf_dfu_validation.c:188: undefined reference to `sd_ecb_block_encrypt'

RE: Adding Encryption to Secure DFU SDK v15

user82236 — Fri, 06 Dec 2019 10:32:45 GMT

Thank you for sharing such detailed setps.

I have one query that how to get ECB key is not mentioned any where. Please update on ECB key

RE: Adding Encryption to Secure DFU SDK v15

user76851 — Wed, 28 Aug 2019 14:20:11 GMT

anyone had such an error?

Compiling file: nrf_dfu_req_handler.c
../../../../../components/libraries/bootloader/dfu/nrf_dfu_req_handler.c: In function 'on_data_obj_write_request':
../../../../../components/libraries/bootloader/dfu/nrf_dfu_req_handler.c:496:34: error: passing argument 1 of 'nrf_dfu_validation_crypt' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
nrf_dfu_validation_crypt(&p_req->write.p_data[i]);
^
In file included from ../../../../../components/libraries/bootloader/dfu/nrf_dfu_req_handler.c:62:0:
../../../../../components/libraries/bootloader/dfu/nrf_dfu_validation.h:120:10: note: expected 'uint8_t * {aka unsigned char *}' but argument is of type 'const uint8_t * {aka const unsigned char *}'
uint32_t nrf_dfu_validation_crypt( uint8_t * buf);
^~~~~~~~~~~~~~~~~~~~~~~~
cc1.exe: all warnings being treated as errors

please tell me how to fix it

RE: Adding Encryption to Secure DFU SDK v15

user76486 — Mon, 04 Mar 2019 21:18:43 GMT

Matthew,

Thanks for this tutorial. We are trying to implement encryption in a similar manner, however are running into an error when the bootloader checks the p_init->type. I am getting an apparent junk value of 62, when I should be getting 0 per the dfu_fw_type_t enum in dfu-cc.pb.h. I have added a detailed post here, any help with debugging would be greatly appreciated.

RE: Adding Encryption to Secure DFU SDK v15

user4903 — Sat, 26 Jan 2019 02:05:27 GMT

I've updated the post to include the changes made to the files found in the pc-nrfutil/nordicsemi/dfu folder. Don't forget to edit the dfu-cc.proto file and regenerate the dfu_cc_pb2.py file with the protocol buffer compiler.

RE: Adding Encryption to Secure DFU SDK v15

user4903 — Sat, 26 Jan 2019 02:03:57 GMT

RE: Adding Encryption to Secure DFU SDK v15

user41320 — Fri, 25 Jan 2019 23:13:12 GMT

Hi Mathew,

Can you please share the required change to nrfutil to add the nonce? You attached a .exe but I'm modifying the nrfutil source to be able to use this on Linux.

Regards.

RE: Adding Encryption to Secure DFU SDK v15

user4753 — Sat, 17 Nov 2018 08:43:14 GMT

Mathew, thanks for clarifying the description of encryption generation.

Could you please describe the process of changing nrfutil in more detail? For example is need to change init_packet_pb.py and package.py.

I changed the code of nrfutil as you recommend but when I call nrfutil with params "pcg display" is no mention of "nonce".

Thanks.

RE: Adding Encryption to Secure DFU SDK v15

user4753 — Fri, 16 Nov 2018 12:59:57 GMT

Hi, Mathew.
I changed the nrfutil as you recommended, but using it for create zip file, there is no mention of "nonce" when call "pkg display"

Although in folder
C:\Python27\Lib\site-packages\nrfutil-4.0.0-py2.7.egg\nordicsemi\dfu
the file "dfu_cc_pb2.py" is created as You recommend with

optional bytes nonce = 10;
and
dfu.InitCommand.nonce max_size:12.

But when I use Your "1-nrfutil.exe"
the string

|- nonce (little-endian): ca3c807241b2c02b85323556

is present.

Is need to change init_packet_pb.py and package.py ?
What could be? Maybe you missed something?

------------------------------------------------------------

If I use Your "1-nrfutil.exe" to enerate package, bin file in archive stil not encrypted.
What do you mean by encryption? Encrypting the firmware itself or something else?

You wrote: "Next, we need to generate a package using the UNENCRYPTED firmware image" using "nrfutil pkg generate..." and using nRF Connect load this zip-file to device.
But, where in you text encrypting procedure? We load to device UNencrypted firmware.

Best, Vyacheslav.

RE: Adding Encryption to Secure DFU SDK v15

user15146 — Thu, 09 Aug 2018 11:06:04 GMT

Hi,

Thank you for sharing this.