bootutil: avoid save of enc keys in secondary slot
When using swap withouth scratch, if a revert operation is detected there
is a fixup that needs to be done to avoid losing metadata. This fixup
copied metadata from the primary slot to the secondary slot temporarily.
Previously it was also copying the encrypted image keys but this is not
required since a fixup is only run when starting a new swap where the
keys were loaded directly from the images. This also avoids that a
secondary slot in external flash would leak keys (according to our
threat model).
Signed-off-by: Fabio Utzig <utzig@apache.org>
diff --git a/boot/bootutil/src/swap_move.c b/boot/bootutil/src/swap_move.c
index ed21774..b18c206 100644
--- a/boot/bootutil/src/swap_move.c
+++ b/boot/bootutil/src/swap_move.c
@@ -408,14 +408,6 @@
rc = boot_write_swap_size(fap_sec, bs->swap_size);
assert(rc == 0);
-#ifdef MCUBOOT_ENC_IMAGES
- rc = boot_write_enc_key(fap_sec, 0, bs->enckey[0]);
- assert(rc == 0);
-
- rc = boot_write_enc_key(fap_sec, 1, bs->enckey[1]);
- assert(rc == 0);
-#endif
-
rc = boot_write_magic(fap_sec);
assert(rc == 0);
}