8000 Merge pull request #29 from arduino/pennam-patch-1 · arduino/mcuboot-arduino-stm32h7@622f750 · GitHub
[go: up one dir, main page]
Skip to content

Commit 622f750

Browse files
pennampennam
authored
Merge pull request #29 from arduino/pennam-patch-1
README: Substitute default keys for sketch generation
2 parents f01befd + 1f3f24b commit 622f750

File tree

1 file changed

+30
-6
lines changed

1 file changed

+30
-6
lines changed

‎README.md

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,8 @@ To write the default keys in flash you can use this [Sketch](https://github.com/
4545
### Customize signing and encryption keys
4646
You can use your preferred tool the generate your `ecdsa-p256` keys. With imgtool:
4747
```
48-
imgtool keygen -k ecdsa-p256-signing-key.pem -t ecdsa-p256
49-
imgtool keygen -k ecdsa-p256-encrypt-key.pem -t ecdsa-p256
48+
imgtool keygen -k ecdsa-p256-signing-priv-key.pem -t ecdsa-p256
49+
imgtool keygen -k ecdsa-p256-encrypt-priv-key.pem -t ecdsa-p256
5050
```
5151
The public signing key and the private encryption key have to be written in flash at this addresses:
5252
```
@@ -55,15 +55,39 @@ encrypt key @ 0x8000400
5555
```
5656
To get this data from the generated pem files with imgtool:
5757
```
58-
imgtool getpub -k ecdsa-p256-signing-key.pem
59-
imgtool getpriv -k ecdsa-p256-encrypt-key.pem
58+
imgtool getpub -k ecdsa-p256-signing-priv-key.pem > ecdsa-p256-signing-pub-key.h
59+
imgtool getpriv -k ecdsa-p256-encrypt-priv-key.pem > ecdsa-p256-encrypt-priv-key.h
6060
```
6161
Copy and paste the key data in this [Sketch](https://github.com/arduino/ArduinoCore-mbed/blob/master/libraries/STM32H747_System/examples/STM32H747_manageBootloader/STM32H747_manageBootloader.ino) and run it to flash the keys alongside the bootloader.
6262

63-
### Create a signed and encrypted update Sketch
63+
### Substitute default keys for sketch generation
64+
By default the IDE uses the keys located in `{runtime.platform.path}/libraries/MCUboot/default_keys`
65+
66+
To use your custom keys follow this steps:
67+
1. Remove default keys
68+
```
69+
cd {runtime.platform.path}/libraries/MCUboot/default_keys
70+
rm -f *.pem
71+
```
72+
2. Generate encryption public key
73+
```
74+
openssl pkey -in ecdsa-p256-encrypt-priv-key.pem -pubout > ecdsa-p256-encrypt-pub-key.pem
75+
```
76+
or
77+
```
78+
ssh-keygen -e -f ecdsa-p256-encrypt-priv-key.pem -y -m "PEM" > ecdsa-p256-encrypt-pub-key.pem
79+
```
80+
3. Move keys in the MCUboot library folder
81+
```
82+
mv ecsdsa-p256-signing-priv-key.pem `{runtime.platform.path}/libraries/MCUboot/default_keys/ecdsa-p256-signing-priv-key.pem`
83+
mv ecdsa-p256-encrypt-pub-key.pem `{runtime.platform.path}/libraries/MCUboot/default_keys/ecdsa-p256-encrypt-pub-key.pem`
84+
```
85+
Alternatively you can customize your board.txt file following this [guide](https://arduino.github.io/arduino-cli/0.31/guides/secure-boot/)
86+
87+
### Manually create a signed and encrypted update Sketch
6488
To create a signed and encrypted Sketch an additional step is needed after the Sketch binary is generated. This additional step is done passing the binary through `imgtool`. The flags used by the board to create a secure Sketch are defined [here](https://github.com/arduino/ArduinoCore-mbed/blob/fa628e35011a92fb7e54fa6bfd9a69be33173bf8/boards.txt#L79-L86). The resulting command resembles as follows:
6589
```
66-
imgtool sign --key ecdsa-p256-signing-key.pem --encrypt ecdsa-p256-encrypt-key.pem input.bin output.bin --align 32 --max-align 32 --version 1.2.3+4 --header-size 0x20000 --pad-header --slot-size 0x1E0000
90+
imgtool sign --key ecdsa-p256-signing-priv-key.pem --encrypt ecdsa-p256-encrypt-pub-key.pem input.bin output.bin --align 32 --max-align 32 --version 1.2.3+4 --header-size 0x20000 --pad-header --slot-size 0x1E0000
6791
```
6892

6993
### Load an update sketch

0 commit comments

Comments
 (0)
0