diff --git a/testplan/zephyr/0001-bad-old-rsa-in-boot-not-in-image.patch b/testplan/zephyr/0001-bad-old-rsa-in-boot-not-in-image.patch
new file mode 100644
index 0000000..99d9d51
--- /dev/null
+++ b/testplan/zephyr/0001-bad-old-rsa-in-boot-not-in-image.patch
@@ -0,0 +1,28 @@
+From 8f3c2f2fe9ade9ff6fe2a37b39318b0186d08efb Mon Sep 17 00:00:00 2001
+From: David Brown <david.brown@linaro.org>
+Date: Thu, 27 Jul 2017 09:50:48 -0600
+Subject: [PATCH] bad: old rsa in boot, not in image
+
+This patch makes the bootloader use the old signature style, but does
+not modify the images.  Neither image should boot.
+
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 1e9ec42..db97832 100644
+--- a/Makefile
++++ b/Makefile
+@@ -14,7 +14,7 @@ CFLAGS += -DMCUBOOT_SIGN_RSA -DMCUBOOT_USE_MBED_TLS
+ 
+ # Newer uses should use the RSA-PSS signature algorithm.  This define
+ # enables (and requires) this type of signature.
+-#CFLAGS += -DMCUBOOT_RSA_PKCS1_15
++CFLAGS += -DMCUBOOT_RSA_PKCS1_15
+ 
+ # ECDSA P-256
+ #CONF_FILE = boot/zephyr/prj-p256.conf
+-- 
+2.11.0
+