Signature verification for RouterOS firmware

Steps to verify signature of Mikrotik firmware files

TL;DR; Ed25519, 302a300506032b6570032100c293ced638a2a33c681fc8de98ee26c54eadc5390c2dfce197d35c83c416cf59.

I happen to have some Mikrotik devices, and last week there were some severe vulnerabilities in the device firmware (CVE-2026-67276).

Due to paranoia, my devices don’t have any internet access, thus firmware updates need to be pushed using other methods.

Firmware files (.npk) are freely available on the Internet, and SHA256 checksums are provided. Images themselves also contain signatures, that device verifies before installation. Due to paranoia, I’d like to verify the files by myself before pushing any code to the devices, that have had their share of vulnerabilities in the past.

Mikrotik does not publish the public key of the signing key (or at least I did not find it), but I WANTED TO HAVE IT, so some research.

As the devices verify the firmware, device should have access to the public key, that might need to be updated, the apparent delivery mechanism is the firmware file itself.

My assumption was also that they use one key to sign different firmware releases, so next task was to implement a tool, which looks for bytes shared between multiple different firmware files.

… and then just downloaded a bunch of NPK files. There are a lot of possible key formats, but I can just look for some shorter key length, as it would be very probable that repeating byte sequences between different architectures and versions are interesting.

$ python3 -c "import sys;sys.stdout.buffer.write(bytes.fromhex('c293ced638a2a33c681fc8de98ee26c54eadc5390c2dfce197d35c83c416cf59'))" > /tmp/pat.bin

and files that contain the key, extracted from v7.24.2 (arm) firmware image:

$ LC_ALL=C grep -rlaF -f /tmp/pat.bin tmp/sqs-7.24.2/
tmp/sqs-7.24.2/bndl/security/nova/bin/ssh
tmp/sqs-7.24.2/nova/bin/sys2
tmp/sqs-7.24.2/nova/bin/installer

Next: how I can know that signing key has been kept secure…