picotool encryption example

Open
#282 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
30/100
Issue type
Documentation
Clarity
Needs clarification
Activity status
Stale
Tech stack
cpp, raspberry-pi
Domain
documentation, embedded-iot, security

Research direction

Start with the secure-boot documentation and the picotool commands shown in the issue, including the generated sketch.elf, sketch.enc.elf, out.json, private.pem, privateaes.bin, and ivsalt.bin files. Reproduce the Arduino IDE flow on a Raspberry Pi 5 and document the complete working sequence, including whether an address or the secure-boot enable step is required.

Written by the indexing model from the issue text.

Description

Hi everyone,

I think it would be useful for many of us to have a complete example showing how to enable secure boot and program encryption with picotool, starting from a UF2 file generated by the Arduino IDE.

For example I have this Arduino sketch:

---------------------------------
sketch.ino
---------------------------------
void setup() {
  pinMode(LED_BUILTIN, OUTPUT); // Initialize onboard LED as output
}

void loop() {
  digitalWrite(LED_BUILTIN, HIGH); // Turn LED on
  delay(500);          
  digitalWrite(LED_BUILTIN, LOW);  // Turn LED off
  delay(500);     
}

After compiling in the folder C:\Users$user\AppData\Local\arduino\sketches<sketch_id>I can find sketch.uf2, skecth.bin, sketch.elf.

I moved this 3 files under my Raspberry Pi 5 with picotool compiled from source.

I followed your docs to create my private.pem, privateaes.bin and ivsalt.bin and I moved them under key folder.

The next step I made was try to encrypt with picotool:

picotool encrypt --embed --sign --hash sketch.elf sketch.enc.elf key/privateaes.bin key/ivsalt.bin key/private.pem out.json

I added embed options because I haven't my custom bootloader.

After the execution I have in the folder sketch.enc.elf and out.json.

So I loaded them with:

picotool load sketch.enc.elf 
picotool otp load out.json

I get positive result from picotool, but on Pico2 the led is not blinking, so I not sent the cmd to enable secure boot.

picotool otp set OTP_DATA_CRIT1.SECURE_BOOT_ENABLE 1

Maybe when I load the sketch.enc.elf I have to specify the address?

Thank you!

Dominant language
C++
Stars
999
Forks
189
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from raspberrypi/picotool

All issues in raspberrypi/picotool

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.