[SecureBoot v1] Signature verification failed
Posted: Sun Oct 27, 2024 10:06 pm
Hi all.
I have a pack of devices that I flashed with SecureBoot v1 a couple of years ago using ESP-IDF v4.4.4. An error was made in the firmware, which led to the inability of OTA due to the outdated certificate that was flashed in the devices. But I carefully store the keys to all devices and decided to flash them manually, which I have done many times before, but enough time has passed and I may miss something.
So, I assemble the firmware without a signature and transfer it to a laptop with keys. There I sign with the correct key for a specific device, check for the signature, encrypt the firmware and fill it into slot 0.
When I download the application:
In monitor I see the following errors:
The key is exactly correct, if you specify the wrong one or do not sign the application at all, the errors definitely indicate this.
What could I have missed?
P.S. ESP32 rev1
I have a pack of devices that I flashed with SecureBoot v1 a couple of years ago using ESP-IDF v4.4.4. An error was made in the firmware, which led to the inability of OTA due to the outdated certificate that was flashed in the devices. But I carefully store the keys to all devices and decided to flash them manually, which I have done many times before, but enough time has passed and I may miss something.
So, I assemble the firmware without a signature and transfer it to a laptop with keys. There I sign with the correct key for a specific device, check for the signature, encrypt the firmware and fill it into slot 0.
When I download the application:
Code: Select all
espsecure.py sign_data --version 1 --keyfile /path/to/security_signing_key.pem --output xkee-fw.signed.bin xkee-fw.bin
espsecure.py v4.1
Signed 655348 bytes of data from xkee-fw.bin with key /path/to/security_signing_key.pem
espsecure.py verify_signature --version 1 --keyfile /path/to/security_signing_key.pem xkee-fw.signed.bin
espsecure.py v4.1
Verifying 655348 bytes of data
Signature is valid
espsecure.py encrypt_flash_data --keyfile /path/to/security_flash_key.bin --address 0x10000 --output xkee-fw.bin.enc xkee-fw.signed.bin
espsecure.py v4.1
Using 256-bit key
Note: Padding with 8 bytes of random data (encrypted data must be multiple of 16 bytes long)
esptool.py \
--port /dev/ttyUSB0 --baud 460800 \
--before default_reset --after no_reset --chip esp32 \
write_flash \
--flash_mode dio \
--flash_size 4MB --flash_freq 40m \
0x10000 xkee-fw.bin.enc
esptool.py v4.1
Serial port /dev/ttyUSB0
Connecting....
Chip is ESP32-D0WD (revision 1)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz
MAC: a8:03:2a:6c:6f:60
Uploading stub...
Running stub...
Stub running...
Changing baud rate to 460800
Changed.
Configuring flash size...
Flash will be erased from 0x00010000 to 0x000b0fff...
Compressed 655424 bytes to 640939...
Wrote 655424 bytes (640939 compressed) at 0x00010000 in 15.3 seconds (effective 343.6 kbit/s)...
Hash of data verified.
Leaving...
Staying in bootloader.
Code: Select all
ets Jun 8 2016 00:22:57
rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:2
load:0x3fff00b8,len:13224
load:0x40078000,len:27172
load:0x40080400,len:3608
entry 0x40080664
I (40) boot: ESP-IDF v4.4.4-dirty 2nd stage bootloader
I (41) boot: compile time 15:12:42
I (41) boot: chip revision: v1.0
I (44) boot.esp32: SPI Speed : 40MHz
I (49) boot.esp32: SPI Mode : DIO
I (53) boot.esp32: SPI Flash Size : 4MB
I (58) boot: Enabling RNG early entropy source...
I (63) boot: Partition Table:
I (67) boot: ## Label Usage Type ST Offset Length
I (74) boot: 0 otadata OTA data 01 00 0000e000 00002000
I (82) boot: 1 ota_0 OTA app 00 10 00010000 001b0000
I (89) boot: 2 ota_1 OTA app 00 11 001c0000 001b0000
I (97) boot: 3 phy_init RF data 01 01 00370000 00001000
I (104) boot: 4 nvs WiFi data 01 02 00371000 0000e000
I (112) boot: 5 phones WiFi data 01 02 0037f000 00080000
I (119) boot: 6 nvs_key NVS keys 01 04 003ff000 00001000
I (127) boot: End of partition table
I (131) esp_image: segment 0: paddr=00010020 vaddr=3f400020 size=25664h (153188) map
I (197) esp_image: segment 1: paddr=0003568c vaddr=3ffbdb60 size=026d0h ( 9936) load
I (201) esp_image: segment 2: paddr=00037d64 vaddr=40080000 size=082b4h ( 33460) load
I (217) esp_image: segment 3: paddr=00040020 vaddr=400d0020 size=637b4h (407476) map
I (369) esp_image: segment 4: paddr=000a37dc vaddr=400882b4 size=06488h ( 25736) load
I (381) esp_image: segment 5: paddr=000a9c6c vaddr=00000000 size=06314h ( 25364)
I (390) esp_image: Verifying image signature...
E (725) esp_image: Secure boot signature verification failed
I (725) esp_image: Calculating simple hash to check for corruption...
W (914) esp_image: image valid, signature bad
E (914) boot: OTA app partition slot 0 is not bootable
What could I have missed?
P.S. ESP32 rev1
