8000 Add instruction on how to customize keys · arduino/mcuboot-arduino-stm32h7@1438866 · GitHub
[go: up one dir, main page]
Skip to content

Commit 1438866

Browse files
pennampennam
committed
Add instruction on how to customize keys
1 parent f01befd commit 1438866

File tree

1 file changed

+29
-6
lines changed

1 file changed

+29
-6
lines changed

‎README.md

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,8 @@ To write the default keys in flash you can use this [Sketch](https://github.com/
4545
### Customize signing and encryption keys
4646
You can use your preferred tool the generate your `ecdsa-p256` keys. With imgtool:
4747
```
48-
imgtool keygen -k ecdsa-p256-signing-key.pem -t ecdsa-p256
49-
imgtool keygen -k ecdsa-p256-encrypt-key.pem -t ecdsa-p256
48+
imgtool keygen -k ecdsa-p256-signing-priv-key.pem -t ecdsa-p256
49+
imgtool keygen -k ecdsa-p256-encrypt-priv-key.pem -t ecdsa-p256
5050
```
5151
The public signing key and the private encryption key have to be written in flash at this addresses:
5252
```
@@ -55,15 +55,38 @@ encrypt key @ 0x8000400
5555
```
5656
To get this data from the generated pem files with imgtool:
5757
```
58-
imgtool getpub -k ecdsa-p256-signing-key.pem
59-
imgtool getpriv -k ecdsa-p256-encrypt-key.pem
58+
imgtool getpub -k ecdsa-p256-signing-priv-key.pem > ecdsa-p256-signing-pub-key.h
59+
imgtool getpriv -k ecdsa-p256-encrypt-priv-key.pem > ecdsa-p256-encrypt-priv-key.h
6060
```
6161
Copy and paste the key data in this [Sketch](https://github.com/arduino/ArduinoCore-mbed/blob/master/libraries/STM32H747_System/examples/STM32H747_manageBootloader/STM32H747_manageBootloader.ino) and run it to flash the keys alongside the bootloader.
6262

63-
### Create a signed and encrypted update Sketch
63+
### Substitute default keys for sketch generation
64+
By default the IDE uses the keys located in `{runtime.platform.path}/libraries/MCUboot/default_keys`
65+
66+
To use your custom keys follow this steps:
67+
1. Remove default keys
68+
```
69+
rm -f *.pem
70+
```
71+
2. Generate encryption public key
72+
```
73+
openssl pkey -in ecdsa-p256-encrypt-priv-key.pem -pubout > ecdsa-p256-encrypt-pub-key.pem
74+
```
75+
or
76+
```
77+
ssh-keygen -e -f ecdsa-p256-encrypt-priv-key.pem -y -m "PEM" > ecdsa-p256-encrypt-pub-key.pem
78+
```
79+
3. Move keys in the MCUboot library folder
80+
```
81+
mv ecsdsa-p256-signing-priv-key.pem `{runtime.platform.path}/libraries/MCUboot/default_keys/ecdsa-p256-signing-priv-key.pem`
82+
mv ecdsa-p256-encrypt-pub-key.pem `{runtime.platform.path}/libraries/MCUboot/default_keys/ecdsa-p256-encrypt-pub-key.pem`
83+
```
84+
Alternatively you can customize your board.txt file following this [guide](https://arduino.github.io/arduino-cli/0.31/guides/secure-boot/)
85+
86+
### Manually create a signed and encrypted update Sketch
6487
To create a signed and encrypted Sketch an additional step is needed after the Sketch binary is generated. This additional step is done passing the binary through `imgtool`. The flags used by the board to create a secure Sketch are defined [here](https://github.com/arduino/ArduinoCore-mbed/blob/fa628e35011a92fb7e54fa6bfd9a69be33173bf8/boards.txt#L79-L86). The resulting command resembles as follows:
6588
```
66-
imgtool sign --key ecdsa-p256-signing-key.pem --encrypt ecdsa-p256-encrypt-key.pem input.bin output.bin --align 32 --max-align 32 --version 1.2.3+4 --header-size 0x20000 --pad-header --slot-size 0x1E0000
89+
imgtool sign --key ecdsa-p256-signing-priv-key.pem --encrypt ecdsa-p256-encrypt-pub-key.pem input.bin output.bin --align 32 --max-align 32 --version 1.2.3+4 --header-size 0x20000 --pad-header --slot-size 0x1E0000
6790
```
6891

6992
### Load an update sketch

0 commit comments

Comments
 (0)
0