How to Decrypt the encrypted image using MCUBoot

[Sathishkumar-rk]

Hi Team,

I'm started to work with MCUBoot and zephyr application. I'm trying to create the project for basic encryption & decryption.

The project which will have MCUBoot and Zephyr application on slot-0 (which is encrypted using default rsa encryption key "enc-rsa2048-pub.pem"). what are the changes should i do on MCUBoot code to decrypt application image using MCUBoot and run the image?

Regards,
Sathishkumar K

[nvlsianpu]

slot-0 should be decrypted. Decryption happens during the image swap operation (with exception of single-application-slot mode).
If you wan to check whether your image will be properly decrypted - you can flash it manually to the slot-1 and MCUboot will decrypt it during `1st run if CONFIG_BOOT_BOOTSTRAP=y

[Sathishkumar-rk]

Hi,
I have tried with CONFIG_BOOT_BOOTSTARP=y enabled in MCUBoot and manually flashed the encrypted image on slot-1. But while calling "parse_rsa_enckey" API it's returned status as failed (return code is -1).

MCUBoot preparation steps:

1. In proj.conf
   CONFIG_BOOT_ENCRYPTION_KEY_FILE="enc-rsa2048-priv.pem"
   CONFIG_BOOT_BOOTSTRAP=y
   CONFIG_BOOT_ENCRYPT_IMAGE=y
   CONFIG_BOOT_ENCRYPT_RSA=y

with above configuration setting MCUBoot binary prepared.

Application image preparation:

1. Application image prepared and did signing & encryption using imgtool using below command.
   west sign -t imgtool -- --key .\bootloader\mcuboot\root-rsa-2048.pem -v 1.2.3+4 --encrypt .\bootloader\mcuboot\enc-rsa2048-pub.pem --encrypt-keylen 256.
2. Did flashed on slot-1 using flash-loader.
3. while do reset i got error --> E: Image in the secondary slot is not valid!

PS: I can able to run application if image is not encrypted, facing issue only when image is encrypted.

[Sathishkumar-rk]

Hi,

Update on previous thread I can able to do encrypt and decrypt application image if encrypt key length set as "128" but for "256" key length getting error code as "MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE" while program execution.

Following reference thread used for to do encryption with 128 bit key length Encrytion

@danieldegrasse @nvlsianpu
Please give your thought on above error and I want to place encrypted image on primary slot itself to improve the security aspects.

Regards,
Sathishkumar K

[tdjastrzebski]

@Sathishkumar-rk, @nvlsianpu,
Likely I face a similar challenge, a scenario which requires in-place decryption, full story here.
I guess, the question is if in-place decryption is implemented but just not exposed well or or I have to implement it myself, perhaps (re)using MCUboot pieces. Probably calling boot_copy_image() function with MCUBOOT_PRIMARY_ONLY and MCUBOOT_ENC_IMAGES defined would do the trick, but in my scenario I need to execute it just for one (main app) image.
Please comment/advise.