SECP256K1 curve encryption not working

[Hugo.Dev]

Hi, 

We are using ncs 2.4.0, working with a custom project based in matter lock sample.

We were using SECP256R1 curves for encryption, without issues, but we need to move to SECP256K1, and we are getting MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE error when trying to sign a message. 

Going deeper I´ve found the function returning error is mbedtls_ecdsa_sign, but AFAIU the implementation is within nrfxlib/nrf_security/src/libmbedcrypto.a

Then I cannot check why it is returning this error

I have already enabled MBEDTLS_ECP_DP_SECP256K1_ENABLED in config file.

Any help will be appreciated.

Hugo

[dejans]

Hi,

Do you build your application as non-secure?

Do you use nrf_oberon crypto library?

Best regards,
Dejan

[Hugo.Dev]

Just for adding some more info.

I´ve taken lock matter sample, enabled k1 curve by adding 

config MBEDTLS_ECP_DP_SECP256K1_ENABLED
	default y

in kconfig file

Then I´ve added test code for signing a messge, it fails with -0x4E80 code

[dejans]

Hi,

Could you provide full error log?

Best regards,
Dejan

[Hugo.Dev]

There is no error log

mbedtls_ecdsa_write_signature calls mbedtls_ecdsa_write_signature_restartable which calls ecdsa_sign_det_restartable which calls mbedtls_ecdsa_sign which returns -0x4E80 error

And, as far as I understand the source code from mbedtls_ecdsa_sign is within modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a, so I cannot see why it returns error.

[dejans]

Hi,

SECP256K1 is not listed as supported in nrf_oberon crypto library.

Best regards,
Dejan

[Hugo.Dev]

Ok Dejan, thanks for your reply.

In this case, what would be the best option to get SECP256K1 working with matter?

I mean, for example, do you have some matter sample using c3xx? or a different security driver that supports k1?

Thanks

Hugo

[Hugo.Dev]

Adding some info.
I am currently trying the Matter Lock sample, to enable CC3XX instead of oberon.

I just added this:

CONFIG_OBERON_BACKEND=n
CONFIG_NRF_OBERON=n
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y
CONFIG_CC3XX_BACKEND=y

in prj.conf

It compile but right after boot I get a bus fault:

E: ***** BUS FAULT *****
E:   Precise data bus error
E:   BFAR Address: 0xfe3af010
E: r0/a1:  0xfe3af002  r1/a2:  0x00000000  r2/a3:  0x20018e9c
E: r3/a4:  0xffffffff r12/ip:  0x200016f0 r14/lr:  0x00045cbd
E:  xpsr:  0xa1000000
E: s[ 0]:  0x00000000  s[ 1]:  0x00000000  s[ 2]:  0x00000000  s[ 3]:  0x00000000
E: s[ 4]:  0x00000000  s[ 5]:  0x00000000  s[ 6]:  0x00000000  s[ 7]:  0x00000000
E: s[ 8]:  0x00000000  s[ 9]:  0x00000000  s[10]:  0x00000000  s[11]:  0x00000000
E: s[12]:  0x00000000  s[13]:  0x00000000  s[14]:  0x00000000  s[15]:  0x00000000
E: fpscr:  0xaaaaaaaa
E: Faulting instruction address (r15/pc): 0x00045d24
E: >>> ZEPHYR FATAL ERROR 25: Unknown error on CPU 0
E: Current thread: 0x20008350 (main)
E: Halting system

Do you have any suggerence?

Thanks in advance

[dejans]

Hi,

Could you provide the result of running the command shown below?

arm-none-eabi-addr2line -e build/zephyr/zephyr.elf 0x00045d24

Best regards,
Dejan

[Hugo.Dev]

This is the output:

nrf/samples/matter/lock/build/modules/connectedhomeip/../../../../../../../modules/lib/matter/src/include/platform/PlatformManager.h:400

[dejans]

Hi,

Could you please provide nrf-config* files from your build folder?

You could try disabling/removing CONFIG_MBEDTLS_PSA_CRYPTO_C=y from your project configuration.

Best regards,
Dejan