fix(nordic): select correct hash algorithm for fw validation
What the developer wrote
Authored by tychovrahe
fix(nordic): select correct hash algorithm for fw validation
[no changelog]
What changed, and why it matters
This commit fixes the firmware build scripts for Trezor's Nordic Bluetooth chip variant so the correct cryptographic hash algorithm (SHA-256) is used when validating firmware images. Previously, the nRF54L-based boards could end up using SHA-512 for the image hash, which would not match the hash algorithm expected by the rest of the Trezor firmware validation chain. That mismatch could prevent the device from accepting legitimate firmware updates or, in a worst-case scenario, create a security inconsistency in how firmware authenticity is checked. The fix moves a hash-algorithm override into a board-specific configuration file and explicitly enables SHA-256 in the bootloader configuration.
Treat this as a security-hardening fix with potential firmware-update reliability implications. Verify that produced nRF54L bootloader images now use SHA-256 for image hashing and that the hash algorithm matches the one used by the firmware signing pipeline. Re-sign and re-test any firmware artifacts built before this commit on nRF54L hardware. Consider adding a changelog entry and, if appropriate, request a security review of the MCUboot hash/validation configuration for the Nordic platform.
Security signals we found
Firmware image hash algorithm mismatch between bootloader and expected validation chain
Build script incorrectly placed CMake extra arguments before the '--' separator, potentially causing overlays to be ignored or misapplied
Board-specific Kconfig symbol (SB_CONFIG_BOOT_IMG_HASH_ALG_SHA512) only available on newer NCS version, risking build breakage or silent wrong defaults
Explicit enable of CONFIG_BOOT_IMG_HASH_ALG_SHA256=y in shared MCUboot config
No changelog entry provided despite security-relevant bootloader configuration change
Evidence from the diff
The patch addresses a build-time Kconfig mismatch in the MCUboot bootloader setup for the Nordic-based Trezor BLE firmware. On nRF54L series boards (NCS 3.3), the default ed25519 image hash algorithm is SHA-512, but the project expects SHA-256. The shared sysbuild.conf cannot contain SB_CONFIG_BOOT_IMG_HASH_ALG_SHA512=n because the symbol does not exist on nRF52832 / NCS 2.9, causing an undefined-symbol build error. The fix: (1) creates a board-scoped overlay sysbuild_nrf54l.conf containing SB_CONFIG_BOOT_IMG_HASH_ALG_SHA512=n; (2) updates build_sign_flash.sh to append that overlay only for t3t2_dk* boards and to correctly assemble CMake extra-args after the – separator; (3) adds CONFIG_BOOT_IMG_HASH_ALG_SHA256=y to sysbuild/mcuboot.conf; and (4) documents the rationale in sysbuild.conf. This ensures the generated MCUboot image uses SHA-256 for image hashing on nRF54L boards.
Changed components
nordic/trezor/scripts/build_sign_flash.shnordic/trezor/trezor-ble/sysbuild.confnordic/trezor/trezor-ble/sysbuild/mcuboot.confnordic/trezor/trezor-ble/sysbuild_nrf54l.confMCUboot bootloader configuration for nRF54L Trezor BLE buildsInspect captured patch +36 / −3
diff --git a/nordic/trezor/scripts/build_sign_flash.sh b/nordic/trezor/scripts/build_sign_flash.sh
index af7832e7..8a7976c5 100755
--- a/nordic/trezor/scripts/build_sign_flash.sh
+++ b/nordic/trezor/scripts/build_sign_flash.sh
@@ -225,10 +225,10 @@ while getopts ${OPTSTRING} opt; do
PRISTINE="--pristine=always"
;;
d)
- DEBUG="-- -DOVERLAY_CONFIG=debug.conf -Dmcuboot_EXTRA_CONF_FILE=\"$PWD/$APP_DIR/sysbuild/mcuboot.conf;$PWD/$APP_DIR/sysbuild/mcuboot_debug.conf\""
+ DEBUG="-DOVERLAY_CONFIG=debug.conf -Dmcuboot_EXTRA_CONF_FILE=\"$PWD/$APP_DIR/sysbuild/mcuboot.conf;$PWD/$APP_DIR/sysbuild/mcuboot_debug.conf\""
;;
p)
- PRODUCTION="-- -DOVERLAY_CONFIG=prod.conf -Dmcuboot_EXTRA_CONF_FILE=\"$PWD/$APP_DIR/sysbuild/mcuboot.conf;$PWD/$APP_DIR/sysbuild/mcuboot_prod.conf\""
+ PRODUCTION="-DOVERLAY_CONFIG=prod.conf -Dmcuboot_EXTRA_CONF_FILE=\"$PWD/$APP_DIR/sysbuild/mcuboot.conf;$PWD/$APP_DIR/sysbuild/mcuboot_prod.conf\""
;;
s)
SIGN=1
@@ -250,8 +250,23 @@ if [ -n "$BOARD" ]; then
BOARD="$resolved_board"
fi
verify_environment "$BOARD"
+
+ # Board-scoped sysbuild overlays. The ed25519 image-hash override symbol
+ # (SB_CONFIG_BOOT_IMG_HASH_ALG_SHA512) only exists on nRF54L / NCS 3.3, so
+ # it must not live in the shared sysbuild.conf - assigning it on nRF52832 /
+ # NCS 2.9 aborts the build with an "undefined symbol" Kconfig warning.
+ SB_OVERLAY=
+ case "$BOARD" in
+ t3t2_dk*) SB_OVERLAY="-DSB_EXTRA_CONF_FILE=$PWD/$APP_DIR/sysbuild_nrf54l.conf" ;;
+ esac
+
+ # Assemble all post-'--' cmake args; emit the '--' separator only if any exist.
+ EXTRA_CMAKE_ARGS="$DEBUG $PRODUCTION $SB_OVERLAY"
+ CMAKE_SEP=
+ [ -n "${EXTRA_CMAKE_ARGS// /}" ] && CMAKE_SEP="--"
+
run_under_ncs_subshell \
- "west build ./$APP_DIR -b $BOARD --sysbuild $PRISTINE $DEBUG $PRODUCTION"
+ "west build ./$APP_DIR -b $BOARD --sysbuild $PRISTINE $CMAKE_SEP $EXTRA_CMAKE_ARGS"
fi
get_version_from_file() {
diff --git a/nordic/trezor/trezor-ble/sysbuild.conf b/nordic/trezor/trezor-ble/sysbuild.conf
index 6350c43a..12fa08e1 100644
--- a/nordic/trezor/trezor-ble/sysbuild.conf
+++ b/nordic/trezor/trezor-ble/sysbuild.conf
@@ -8,3 +8,8 @@ SB_CONFIG_MCUBOOT_APP_SYNC_UPDATEABLE_IMAGES=n
# Use DTS fixed-partitions instead of pm_static.yml
SB_CONFIG_PARTITION_MANAGER=n
+
+# Note: the ed25519 image-hash override (SB_CONFIG_BOOT_IMG_HASH_ALG_SHA512=n)
+# lives in the board-scoped overlay sysbuild_nrf54l.conf, because that symbol
+# only exists on the nRF54L series (NCS 3.3) and assigning it on nRF52832 /
+# NCS 2.9 aborts the build with an "undefined symbol" Kconfig warning.
diff --git a/nordic/trezor/trezor-ble/sysbuild/mcuboot.conf b/nordic/trezor/trezor-ble/sysbuild/mcuboot.conf
index ba0818fa..225b62c3 100644
--- a/nordic/trezor/trezor-ble/sysbuild/mcuboot.conf
+++ b/nordic/trezor/trezor-ble/sysbuild/mcuboot.conf
@@ -25,6 +25,7 @@ CONFIG_BOOT_SERIAL_UART=y
#CONFIG_BOOT_SERIAL_DETECT_PIN=11
#CONFIG_MCUMGR_SMP_UART=y
CONFIG_BOOT_VALIDATE_SLOT0=y
+CONFIG_BOOT_IMG_HASH_ALG_SHA256=y
CONFIG_RTT_CONSOLE=n
CONFIG_USE_SEGGER_RTT=n
diff --git a/nordic/trezor/trezor-ble/sysbuild_nrf54l.conf b/nordic/trezor/trezor-ble/sysbuild_nrf54l.conf
new file mode 100644
index 00000000..abfb3e67
--- /dev/null
+++ b/nordic/trezor/trezor-ble/sysbuild_nrf54l.conf
@@ -0,0 +1,12 @@
+# Board-scoped sysbuild overlay for the nRF54L series (NCS 3.3).
+#
+# The nRF54L series defaults the ed25519 image hash to SHA512; override it to
+# SHA256. sysbuild's CMakeLists reads SB_CONFIG_BOOT_IMG_HASH_ALG_SHA512 and
+# injects CONFIG_BOOT_IMG_HASH_ALG_SHA512=y into MCUboot, overriding
+# sysbuild/mcuboot.conf. Setting it to n here lets CONFIG_BOOT_IMG_HASH_ALG_SHA256=y
+# in mcuboot.conf win.
+#
+# This lives in a board-scoped overlay (not sysbuild.conf) because the symbol
+# does not exist on nRF52832 / NCS 2.9 - assigning it there aborts the build
+# with an "undefined symbol" Kconfig warning.
+SB_CONFIG_BOOT_IMG_HASH_ALG_SHA512=n
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.