Adding encryption library to application using nRF Connect for VS Code

RE: Adding encryption library to application using nRF Connect for VS Code

underpickled — Fri, 22 Dec 2023 20:53:02 GMT

I am also very interested in this question. I am trying to implement AES-EAX with a 4 byte tag for authentication and running into these same limitations. Have you made any progress on this?

RE: Adding encryption library to application using nRF Connect for VS Code

Tim Chadwick — Thu, 24 Aug 2023 16:11:48 GMT

Yes, if I pass the function the smaller auth tag the decryption works correctly (the decrypted data is what I expected it to be), but the decryption function returns -1 indicating that the auth tag isn't valid. I think that the oberon encrypt/decrypt functions expect a 16-byte buffer for the auth tag. I went back to the "hello world" sample that you sent me and changed the tag buffer to be 2 bytes long instead 16. If I step through the code in the debugger, when the encrypt function gets called (tag is an output parameter) I see the tag buffer being overrun. If I change one of the values in the overrun part of memory before calling the decrypt function, it returns -1 indicating an invalid tag. Based on this it looks like it's expecting 16 bytes. So if I'm not using authentication it still encrypts/decrypts correctly.

Thanks for your help.

Tim

RE: Adding encryption library to application using nRF Connect for VS Code

Vidar Berg — Thu, 24 Aug 2023 11:54:49 GMT

Sorry, but I wasn't able to confirm today whether the Oberon API requires the auth. tag to be 16 bytes or not. Have you had an opportunity to test this with the beacon payload to see if it can decrypt it despite the shorter tag length?

RE: Adding encryption library to application using nRF Connect for VS Code

Tim Chadwick — Wed, 23 Aug 2023 15:21:30 GMT

I am trying to decrypt data in a message sent from a BLE beacon. I have a few questions about the authentication tag. Is this an optional parameter to the API and what is it's length. In the sample you sent me it's length is 16 bytes. The documentation for the BLE beacon I'm working with says the tag is optional and if it uses it the length is 2 bytes.

RE: Adding encryption library to application using nRF Connect for VS Code

Vidar Berg — Wed, 23 Aug 2023 15:10:23 GMT

No problem. Thank you for confirming that it worked.

Regards,

Vidar

RE: Adding encryption library to application using nRF Connect for VS Code

Tim Chadwick — Wed, 23 Aug 2023 14:50:22 GMT

Vidar,

Thank you so much for your prompt response. I have your sample program running in my environment, correctly encrypting and decrypting data. Thanks again for your assistance.

Regards,

Tim

RE: Adding encryption library to application using nRF Connect for VS Code

Vidar Berg — Tue, 22 Aug 2023 15:10:18 GMT

Hello Tim,

Most of our crypto examples utilize mbedTLS or the PSA crypto API, with Oberon being one of the available backends. However, since neither of these support EAX, it appears that the option at the moment is to use the Oberon library directly, as you mentioned.

I put together a small demo based on the Hello World sample which I have included below. To link in the Oberon library with this project I had to add CONFIG_NRF_OBERON=y to the prj.conf file, and 'zephyr_library_link_libraries(nrfxlib_crypto)' to the project CMakelists.txt file.

Test project

devzone.nordicsemi.com/.../5228.hello_5F00_world_5F00_aes_5F00_eax_5F00_test.zip

Disclaimer: this project has not been tested or validated by our R&D team. Please keep this in mind if you use the code implementation as a reference.

Best regards,

Vidar

API doc:

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/2.3.0/nrfxlib/crypto/doc/api.html#aes-eax-apis