In this exercise, we will learn how to sign DFU images using custom keys. Only individuals with a valid key can perform a DFU on a device.
As covered in the Application verification topic. Signing a Device Firmware Update (DFU) image ensures its authenticity and integrity. A cryptographic signature is generated using a private key and attached to the DFU image. The device uses the corresponding public key to verify the signature, confirming the image is from a trusted source and has not been tampered with. The public key is automatically generated from the private key and stored in the MCUboot image.
The more observant readers might have noticed the following warning from the build logs so far:
--------------------------------------------------------- --- WARNING: Using default MCUBoot key, it should not --- --- be used for production. --- ---------------------------------------------------------
Terminal
When building for MCUboot, a default signing key is used to ease development. For production, it is extremely important to use your own key instead!
MCUboot has a set of default keys, which can be found here. If we do not configure the application to use a custom key, anyone will be able to upload DFU to our device!
Using the Key Management Unit (KMU) on the nRF54L Series to store the public key
On the nRF54L Series, two options are available for storing the public key used to verify the signature on an image in the SoC.
Store it in the MCUboot bootloader image itself. In this approach, the build system embeds the public key within the MCUboot bootloader image automatically
Store it in the KMU (Recommended). Requires manual provisioning of the public key.
In this exercise, we will cover both approaches.
The tab “All other DKs” describes method 1, which, by the way, can also be done on the nRF54L Series SoCs
The tab “nRF54L15 DK” describes the KMU approach, which is only applicable to the nRF54L15 DK and is the recommended approach for the nRF54L Series devices.
Exercise steps
1. Creating the key.
You can create the key however you want; It is nothing but a normal key in .pem format. We will use the imgtool.py bundled with the nRF Connect SDK as an example.
1.1 To set our own key, we first need to generate a key. We will use imgtool for this:
1.2 Back up the key to somewhere safe. It is not uncommon to lose the key and thus be unable to ever do DFU on the devices again.
2. Configure the project to use this key.
Next up, we will configure the project to use this key. The key is used both by MCUboot to generate a custom key, and by Sysbuild to automatically create and sign DFU files. Therefore, this is set in Sysbuild Kconfig.
2.1 To configure our project to use this key, we will follow docs at Bootloader & DFU -> Signature keys. We set the path to the key in sysbuild.conf. We can use the full path of the key if it is stored elsewhere on the PC, but for this example, the key is stored in the project folder, and we will use ${APP_DIR}:
Copy
# STEP 2.1 - Add private key for MCUbootSB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APP_DIR}/private_key.pem"
Kconfig
2.2 Next, we should configure the key type to match the key we generated in step 1.1.
On the nRF54L15 DK, we need to enable the following two parameters:
SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU – This option enables using Key Management Unit (KMU) to store keys for signature verification instead of compiling key data into the MCUboot bootloader image. Using KMU requires manually provisioning the public key, which is done in the next step.
The SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519 is to select the type of key.
No action is needed here. The public key will be stored in the MCUboot bootloader image automatically by the build system
If you are using the KMU to store the public key (Only applicable for the nRF54L15 Series ). You need to upload the public key to the device; the build system does NOT do this automatically at this stage, and it needs to be done manually. The nRF Connect SDK provides a west command,ncs-provision, allowing the upload of keys to the device through the Serial Write Debug (SWD) interface.
4.2 Now, try to do DFU over UART as we learned in Exercise 1 (sections: 5.3 – 5.4) with the new zephyr.signed.bin. Since this one uses a different key than the one we flashed in step 3 , DFU should fail with the error (remember to close AuTerm before connecting serial terminal in VSCode and resetting the board):
It is possible to update the board again by changing the key to the proper one and doing a pristine build (this will cause signing the firmware again with the correct key).
In this exercise, we will learn how to sign DFU images using custom keys. Only individuals with a valid key can perform a DFU on a device.
As covered in the Application verification topic. Signing a Device Firmware Update (DFU) image ensures its authenticity and integrity. A cryptographic signature is generated using a private key and attached to the DFU image. The device uses the corresponding public key to verify the signature, confirming the image is from a trusted source and has not been tampered with. The public key is automatically generated from the private key and stored in the MCUboot image.
The more observant readers might have noticed the following warning from the build logs so far:
--------------------------------------------------------- --- WARNING: Using default MCUBoot key, it should not --- --- be used for production. --- ---------------------------------------------------------
Terminal
When building for MCUboot, a default signing key is used to ease development. For production, it is extremely important to use your own key instead!
MCUboot has a set of default keys, which can be found here. If we do not configure the application to use a custom key, anyone will be able to upload DFU to our device!
Using the Key Management Unit (KMU) on the nRF54L Series to store the public key
On the nRF54L Series, two options are available for storing the public key used to verify the signature on an image in the SoC.
Store it in the MCUboot bootloader image itself. In this approach, the build system embeds the public key within the MCUboot bootloader image automatically
Store it in the KMU (Recommended). Requires manual provisioning of the public key.
In this exercise, we will cover both approaches.
The tab “All other DKs” describes method 1, which, by the way, can also be done on the nRF54L Series SoCs
The tab “nRF54L15 DK” describes the KMU approach, which is only applicable to the nRF54L15 DK and is the recommended approach for the nRF54L Series devices.
Exercise steps
1. Creating the key.
You can create the key however you want; It is nothing but a normal key in .pem format. We will use the imgtool.py bundled with the nRF Connect SDK as an example.
1.1 To set our own key, we first need to generate a key. We will use imgtool for this:
1.2 Back up the key to somewhere safe. It is not uncommon to lose the key and thus be unable to ever do DFU on the devices again.
2. Configure the project to use this key.
Next up, we will configure the project to use this key. The key is used both by MCUboot to generate a custom key, and by Sysbuild to automatically create and sign DFU files. Therefore, this is set in Sysbuild Kconfig.
2.1 To configure our project to use this key, we will follow docs at Bootloader & DFU -> Signature keys. We set the path to the key in sysbuild.conf. We can use the full path of the key if it is stored elsewhere on the PC, but for this example, the key is stored in the project folder, and we will use ${APP_DIR}:
Copy
# STEP 2.1 - Add private key for MCUbootSB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APP_DIR}/private_key.pem"
Kconfig
2.2 Next, we should configure the key type to match the key we generated in step 1.1.
On the nRF54L15 DK, we need to enable the following two parameters:
SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU – This option enables using Key Management Unit (KMU) to store keys for signature verification instead of compiling key data into the MCUboot bootloader image. Using KMU requires manually provisioning the public key, which is done in the next step.
The SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519 is to select the type of key.
No action is needed here. The public key will be stored in the MCUboot bootloader image automatically by the build system
If you are using the KMU to store the public key (Only applicable for the nRF54L15 Series ). You need to upload the public key to the device; the build system does NOT do this automatically at this stage, and it needs to be done manually. The nRF Connect SDK provides a west command,ncs-provision, allowing the upload of keys to the device through the Serial Write Debug (SWD) interface.
4.2 Now, try to do DFU over UART as we learned in Exercise 1 (sections: 5.3 – 5.4) with the new zephyr.signed.bin. Since this one uses a different key than the one we flashed in step 3 , DFU should fail with the error (remember to close AuTerm before connecting serial terminal in VSCode and resetting the board):
It is possible to update the board again by changing the key to the proper one and pristine build (it will cause signing firmware again with the correct key).
While the newest version of this exercise covers only custom keys, the v2.6.2 – v2.5.2 version of Exercise 2 covers USB, external flash and Custom keys. In other words, Exercise 2 (v2.6.2-v2.5.2) replaces all Exercises 2, 3 and 4 (v2.9.0 – v2.7.0).
In this exercise, we will modify the previous exercise (DFU over UART) to use DFU over USB instead. We will also cover external flash and custom keys.
Note
Since this exercise requires an nRF SoC with a USB peripheral, it is only supported on nRF5340 DK, nRF52840 DK, nRF52833 DK, and nRF7002 DK. For a list of which SoCs contain a USB peripheral, check the Nordic product guide.
We will use the Zephyr CDC ACM drivers to communicate over USB. For more information on this, you can see USB device support.
Exercise steps
1. Open the code base of the exercise by navigating to Create a new application in the nRF Connect for VS Code extension, select Copy a sample, and search for Lesson 9 – Exercise 2. Exercise 2 base code is the Exercise 1 solution with comments renamed.
3. Increase the partition for the MCUboot bootloader.
The partition for the MCUboot bootloader is not large enough for MCUboot with CDC ACM and USB drivers. This size is 0xC000 by default. To increase this, set CONFIG_PM_PARTITION_SIZE_MCUBOOT to 0x10000 in child_image/mcuboot.conf. It is also possible to make MCUboot take less space. See for example this samples child_image/mcuboot/prj_release.conf.
Important
For the nRF7002 DK set CONFIG_PM_PARTITION_SIZE_MCUBOOT=0x20000. For the nRF5340 DK set CONFIG_PM_PARTITION_SIZE_MCUBOOT=0x15000 . Otherwise, you will get a linker error.
CONFIG_PM_PARTITION_SIZE_MCUBOOT=0x10000
4. Configure the application to use CDC ACM for DFU.
Next , we will change the application to use CDC ACM for DFU. The configuration we use here is inspired by the SMP Server sample.
4.1 As you can see. We have an app.overlay file in the application directory of l9_e2. This is one way to set devicetree overlays, but you can use other ways to do the same. In this app.overlay, we will first configure CDC ACM by adding the following:
4.3 Next, we will have to add Kconfig options to prj.conf:
# Step 4.3 - Enable USB subsystem
CONFIG_USB_DEVICE_STACK=y
CONFIG_UART_LINE_CTRL=y
CONFIG_USB_DEVICE_INITIALIZE_AT_BOOT=n
4.4 Lastly, USB must be enabled in our source files (main.c). First, include the header file for USB
/* STEP 4.4 - Include header for usb */
#include <zephyr/usb/usb_device.h>
4.5 Enable USB
/* Step 4.5 - Enable USB */
if (IS_ENABLED(CONFIG_USB_DEVICE_STACK)) {
ret = usb_enable(NULL);
if (ret) {
return 0;
}
}
Testing
5. Build and flash the application to your board.
6. Connect your computer to the nRF USB port on the DK.
In this step, we will assume that the hardware has no Debugger/Interface MCU (IMCU) and we use the nRF USB port as the transport for the firmware images.
Disconnect your board from the regular Debugger USB port and connect to The nRF USB port. The nRF USB port is only available on the nRF5340 DK, nRF52840 DK, nRF52833 DK, and nRF7002 DK since it requires an nRF SoC with a USB peripheral. For a list of which SoCs contain a USB peripheral, check the Nordic product guide.
7. DFU over USB
7.1 The MCUmgr library will run in the background, letting you connect to the USB and do DFU while the application runs.
7.2 We can use mcumgr-cli to communicate with the DK. First, we will add a configuration to mcumgr-cli:
“testDK” here can be named whatever we want. COM22 should be changed to whatever port the DKs nRF USB is connected to. Please note that the COM port for nRF USB will not be listed in nRF Connect for VS Code. Use Device Manager in Windows or equivalent on Linux/macOS to find the port allocated to nRF USB. A list of supported mcumgr-cli commands can be found here.
7.3 Check the listing of current images on the DK:
mcumgr -c testDK image list
This should return the slots available, as we have seen in the previous exercise.
7.4 Before we try to upload a new firmware image to the DK, we should change something in the code, so we can verify the change. This can, for example, be to change the delay in the blinky code. Then rebuild the code.
7.5 Now we can upload the new image firmware to the DK, using:
7.6 Since we use a dual slot configuration, the uploaded application does not automatically run. To make the application swap into the primary slot, we must tag it with either “test” or “confirm”. Let’s do “test” first. First, we need to get the hash of the image:
If we reset the board again, we can, in the same way, see that the image swaps back to the old firmware. This is because we passed test not confirm to mcumgr.
Adding External Flash
8. To increase the flash available for the application, we can add an external flash.
The MCUboot secondary partition can then be placed in the external flash, increasing the available space for the application.
The QSPI on the nRF7002 DK is used to connect the host MCU (nRF5340 SoC) to the Wi-Fi Companion IC (nRF7002 IC). Therefore, SPI is used to interface with the external memory, and special configurations are needed that are outlined here.
8.1 We can tell the partition manager that we are using an external flash. See External flash memory partitions. Then MCUboot will automatically be partitioned to use external flash for the mcuboot_seconary partition. To do this, set the chosen nordic,pm-ext-flash = &mx25r64; in both app.overlay and child_image/mcuboot.overlay:
8.2 The QSPI drivers needed for external flash on our development kits are not always automatically added to the MCUboot child image. We will add these to child_image/mcuboot.conf:
CONFIG_NORDIC_QSPI_NOR=y
8.3 We also need to increase the number of sectors used by MCUboot now, as the partitions are larger:
# Step 8.3 - Increase number of sectors
CONFIG_BOOT_MAX_IMG_SECTORS=256
8.4 Connect your computer to the DK debug port again (not nRF USB), and build and flash the new firmware.
8.5 To verify that the partitions have moved, use the Memory Report:
9. Disconnect from the debug port and connect to nRF USB port, you can retest the DFU over USB with External Flash by redoing steps 7.2 – 7.5.
nRF5340 update
The application core of the nRF5340 can be updated, as explained above.
When doing DFU from the application, no extra configurations are needed to update the network core. Another DFU package file must be used for the network core. Instead of app_update.bin, use net_core_app_update.bin.
The more observant readers might have noticed the following warning from the build logs so far:
---------------------------------------------------------
--- WARNING: Using default MCUBoot key, it should not ---
--- be used for production. ---
---------------------------------------------------------
When building for MCUboot, a default key is used to ease development. For production, it is extremely important to use your own key instead. If not, anyone could update your device with their code.
9.1 To set our own key, we first need to generate a key. We will use imgtool for this:
9.2 To configure our project to use this key, follow docs at MCUboot adding custom signature key file. We can do this in two different ways. Either we can set this key in child_image/mcuboot.conf.
As you can see, this uses the full path to the project, which is a limitation. 9.3 It is possible to use CMakeLists.txt to set the path relative to the project folder. This is more powerful but also more complex. To do this, set the following in CMakeLists.txt:
Here, you can use CMake variables and pathing to choose any folder, as seen relative to your project. It is up to you if you want to use 9.2 or 9.3 in your project. I suggest that you try both and find out which you like the best. These steps will not be included in the solution, as they require a generated key.
Nordic Developer Academy Privacy Policy
1. Introduction
In this Privacy Policy you will find information on Nordic Semiconductor ASA (“Nordic Semiconductor”) processes your personal data when you use the Nordic Developer Academy.
References to “we” and “us” in this document refers to Nordic Semiconductor.
2. Our processing of personal data when you use the Nordic Developer Academy
2.1 Nordic Developer Academy
Nordic Semiconductor processes personal data in order to provide you with the features and functionality of the Nordic Developer Academy. Creating a user account is optional, but required if you want to track you progress and view your completed courses and obtained certificates. If you choose to create a user account, we will process the following categories of personal data:
Email
Name
Password (encrypted)
Course progression (e.g. which course you have completely or partly completed)
Certificate information, which consists of name of completed course and the validity of the certificate
Course results
During your use of the Nordic Developer Academy, you may also be asked if you want to provide feedback. If you choose to respond to any such surveys, we will also process the personal data in your responses in that survey.
The legal basis for this processing is GDPR article 6 (1) b. The processing is necessary for Nordic Semiconductor to provide the Nordic Developer Academy under the Terms of Service.
2.2 Analytics
If you consent to analytics, Nordic Semiconductor will use Google Analytics to obtain statistics about how the Nordic Developer Academy is used. This includes collecting information on for example what pages are viewed, the duration of the visit, the way in which the pages are maneuvered, what links are clicked, technical information about your equipment. The information is used to learn how Nordic Developer Academy is used and how the user experience can be further developed.
2.2 Newsletter
You can consent to receive newsletters from Nordic from within the Nordic Developer Academy. How your personal data is processed when you sign up for our newsletters is described in the Nordic Semiconductor Privacy Policy.
3. Retention period
We will store your personal data for as long you use the Nordic Developer Academy. If our systems register that you have not used your account for 36 months, your account will be deleted.
4. Additional information
Additional information on how we process personal data can be found in the Nordic Semiconductor Privacy Policy and Cookie Policy.
Nordic Developer Academy Terms of Service
1. Introduction
These terms and conditions (“Terms of Use”) apply to the use of the Nordic Developer Academy, provided by Nordic Semiconductor ASA, org. nr. 966 011 726, a public limited liability company registered in Norway (“Nordic Semiconductor”).
Nordic Developer Academy allows the user to take technical courses related to Nordic Semiconductor products, software and services, and obtain a certificate certifying completion of these courses. By completing the registration process for the Nordic Developer Academy, you are agreeing to be bound by these Terms of Use.
These Terms of Use are applicable as long as you have a user account giving you access to Nordic Developer Academy.
2. Access to and use of Nordic Developer Academy
Upon acceptance of these Terms of Use you are granted a non-exclusive right of access to, and use of Nordic Developer Academy, as it is provided to you at any time. Nordic Semiconductor provides Nordic Developer Academy to you free of charge, subject to the provisions of these Terms of Use and the Nordic Developer Academy Privacy Policy.
To access select features of Nordic Developer Academy, you need to create a user account. You are solely responsible for the security associated with your user account, including always keeping your login details safe.
You will able to receive an electronic certificate from Nordic Developer Academy upon completion of courses. By issuing you such a certificate, Nordic Semiconductor certifies that you have completed the applicable course, but does not provide any further warrants or endorsements for any particular skills or professional qualifications.
Nordic Semiconductor will continuously develop Nordic Developer Academy with new features and functionality, but reserves the right to remove or alter any existing functions without notice.
3. Acceptable use
You undertake that you will use Nordic Developer Academy in accordance with applicable law and regulations, and in accordance with these Terms of Use. You must not modify, adapt, or hack Nordic Developer Academy or modify another website so as to falsely imply that it is associated with Nordic Developer Academy, Nordic Semiconductor, or any other Nordic Semiconductor product, software or service.
You agree not to reproduce, duplicate, copy, sell, resell or in any other way exploit any portion of Nordic Developer Academy, use of Nordic Developer Academy, or access to Nordic Developer Academy without the express written permission by Nordic Semiconductor. You must not upload, post, host, or transmit unsolicited email, SMS, or \”spam\” messages.
You are responsible for ensuring that the information you post and the content you share does not;
contain false, misleading or otherwise erroneous information
infringe someone else’s copyrights or other intellectual property rights
contain sensitive personal data or
contain information that might be received as offensive or insulting.
Such information may be removed without prior notice.
Nordic Semiconductor reserves the right to at any time determine whether a use of Nordic Developer Academy is in violation of its requirements for acceptable use.
Violation of the at any time applicable requirements for acceptable use may result in termination of your account. We will take reasonable steps to notify you and state the reason for termination in such cases.
4. Routines for planned maintenance
Certain types of maintenance may imply a stop or reduction in availability of Nordic Developer Academy. Nordic Semiconductor does not warrant any level of service availability but will provide its best effort to limit the impact of any planned maintenance on the availability of Nordic Developer Academy.
5. Intellectual property rights
Nordic Semiconductor retains all rights to all elements of Nordic Developer Academy. This includes, but is not limited to, the concept, design, trademarks, know-how, trade secrets, copyrights and all other intellectual property rights.
Nordic Semiconductor receives all rights to all content uploaded or created in Nordic Developer Academy. You do not receive any license or usage rights to Nordic Developer Academy beyond what is explicitly stated in this Agreement.
6. Liability and damages
Nothing within these Terms of Use is intended to limit your statutory data privacy rights as a data subject, as described in the Nordic Developer Academy Privacy Policy. You acknowledge that errors might occur from time to time and waive any right to claim for compensation as a result of errors in Nordic Developer Academy. When an error occurs, you shall notify Nordic Semiconductor of the error and provide a description of the error situation.
You agree to indemnify Nordic Semiconductor for any loss, including indirect loss, arising out of or in connection with your use of Nordic Developer Academy or violations of these Terms of Use. Nordic Semiconductor shall not be held liable for, and does not warrant that (i) Nordic Developer Academy will meet your specific requirements, (ii) Nordic Developer Academy will be uninterrupted, timely, secure, or error-free, (iii) the results that may be obtained from the use of Nordic Developer Academy will be accurate or reliable, (iv) the quality of any products, services, information, or other material purchased or obtained by you through Nordic Developer Academy will meet your expectations, or that (v) any errors in Nordic Developer Academy will be corrected.
You accept that this is a service provided to you without any payment and hence you accept that Nordic Semiconductor will not be held responsible, or liable, for any breaches of these Terms of Use or any loss connected to your use of Nordic Developer Academy. Unless otherwise follows from mandatory law, Nordic Semiconductor will not accept any such responsibility or liability.
7. Change of terms
Nordic Semiconductor may update and change the Terms of Use from time to time. Nordic Semiconductor will seek to notify you about significant changes before such changes come into force and give you a possibility to evaluate the effects of proposed changes. Continued use of Nordic Developer Academy after any such changes shall constitute your acceptance of such changes. You can review the current version of the Terms of Use at any time at https://academy.nordicsemi.com/terms-of-service/
8. Transfer of rights
Nordic Semiconductor is entitled to transfer its rights and obligation pursuant to these Terms of Use to a third party as part of a merger or acquisition process, or as a result of other organizational changes.
9. Third Party Services
To the extent Nordic Developer Academy facilitates access to services provided by a third party, you agree to comply with the terms governing such third party services. Nordic Semiconductor shall not be held liable for any errors, omissions, inaccuracies, etc. related to such third party services.
10. Dispute resolution
The Terms of Use and any other legally binding agreement between yourself and Nordic Semiconductor shall be subject to Norwegian law and Norwegian courts’ exclusive jurisdiction.
