RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

[Mathi]

Hi,

The RSA crypto sample from the 2.5.0 SDK fails at psa_generate_key() returning -134. The sample is by default configured to use 2048-bit keys. 
Note that, It fails with the same error code also when changing the sample code and configuration to use say for example - changing it to CONFIG_PSA_WANT_RSA_KEY_SIZE_1536=y or configuring CONFIG_PSA_WANT_RSA_KEY_SIZE_1024=y.

Please note, the AES samples and the ECDH samples from the 2.5.0 SDK works very well on this board. I don't understand why the RSA sample application fails with the UNSUPPORTED error code.

(1) When can the basic/default RSA sample application in SDK 2.5.0 fail on the nRF5340 Development Kit?
(2) We intend to use PSA API for RSA OAEP with key size CONFIG_PSA_WANT_RSA_KEY_SIZE_3072. Is this supported in SDK 2.5.0?

Thanks,

Mathi.

#PSA #Crypto #RSA #SDK 2.5.0 #SAMPLE#nRF5340 DK #keyformat#keygeneration #openssl-versus-PSA

[Amanda Hsieh]

Hi, 

It fails with the same error code when changing the sample code and configuration to use CONFIG_PSA_WANT_RSA_KEY_SIZE_1536=y or configuring CONFIG_PSA_WANT_RSA_KEY_SIZE_1024=y.

If you check the .config under build/zephyr, you can find CONFIG_PSA_WANT_RSA_KEY_SIZE_1024=y is set by default.

How do you modify the code? Could you elaborate on what you modified?

(1) When can the basic/default RSA sample application in SDK 2.5.0 fail on the nRF5340 Development Kit?

The error would give some clues. 

(2) We intend to use PSA API for RSA OAEP with key size CONFIG_PSA_WANT_RSA_KEY_SIZE_3072. Is this supported in SDK 2.5.0?

The default setting already has CONFIG_PSA_WANT_RSA_KEY_SIZE_3072.  You check the .config under build/zephyr. 

Regards,
Amanda H.

 

[Mathi]

Hi Amanda,

Thanks for the reply.
Meanwhile, I just randomly increased the memory sizes from 16K to 20K and the default sample for key size 2048 bits, worked.
(i.e. basically for experimentation, i just set CONFIG_MAIN_STACK_SIZE, CONFIG_HEAP_MEM_POOL_SIZE, CONFIG_MBEDTLS_HEAP_SIZE, all to 20 K) and it worked.
I did not expect an PSA_ERR_NOT_SUPPORTED error code for memory reasons though.
Also, I also noticed that the key_generation takes a longer time, with different key sizes.
Will update you further.

Mathi.

[Mathi]

Hi Amanda,

I continued further and modifed the default RSA example to try RSA_OAEP encryption for 1024-bit keys
and that fails i.e. psa_asymmetric_encrypt() fails with error code -147(HARDWARE_FAILURE).

This looks very similair to the problem my colleague had experienced about an year ago, see this ==>
 RSA example fails on psa_sign_hash returning -133 - Nordic Q&A - Nordic DevZone - Nordic DevZone (nordicsemi.com)

I don't know if anything has changed in the past 1 year between 2.1.1 and 2.5.0 -
Could you please confirm whether psa_asymmetric_encrypt() for RSA 1024-bit keys is supported or not?

Kind Regards, Mathi.

[Amanda Hsieh]

Hi, 

Did you change the buffer sizes for the key: 

NRF_CRYPTO_EXAMPLE_RSA_PUBLIC_KEY_SIZE
NRF_CRYPTO_EXAMPLE_RSA_SIGNATURE_SIZE 

If these are increased the 2048 bit RSA key should work as expected. 

-Amanda H.

[Mathi]

Hi,

As an update, please note that the psa_asymmetric_encrypt() API worked fine now after passing the keypair_handle (i.e. instead of using the pub_key_handle) to the API.

The encryption works fine for 1024, 2048 and 3072-bit keys when the algorithm is set to 
psa_set_key_algorithm(&key_attributes, (PSA_ALG_RSA_OAEP(PSA_ALG_SHA_256)));

[Mathi]

But then, psa_asymmetric_encrypt() fails with same error code (-147 = HARDWARE_FAILURE)
for all key sizes WHEN setting the algorithm to 
psa_set_key_algorithm(&key_attributes, (PSA_ALG_RSA_OAEP(PSA_ALG_SHA_1)));

[Amanda Hsieh]

Hi, 

Did you enable the config for PSA_ALG_SHA_1?

Disclaimer from PSA Crypto API: 

The SHA-1 hash is weak and deprecated and is only recommended for use in legacy protocols.

-Amanda H.

[Mathi]

That helped. Thanks.

[Mathi]

I ran into another problem.
If i import a RSA public key generated using openssl, then psa_asymmetric_enrypt() fails with (-147 = HARDWARE_FAILURE). Here, i use the pub_key_handle from psa_key_import().
Does this mean, only keys generated on the device, are supported?
Or Is there anything specific about the PSA key-format for RSA-OAEP-3072?

[Mathi]

Another update -
Case 1) I manually saved (in hex) the public key exported from PSA (using psa_generate_key()). And imported it in a different standalone application, encryption(RSA-OAEP-3072) worked.
The length of the public key (with exponent) was 398 bytes 

Case 2) Imported the public key from from openssl, encryption fails with (-147).
The length of the public key (with exponent) was 388 bytes.

Are there any special bytes to be included to the public key format when using PSA APIs
Thanks,

Mathi.

[Mathi]

// Public key exported from PSA

//const uint8_t ext_pub_key[] = {0x30,0x82,0x01,0x8A,0x02,0x82,0x01,0x81,0x00,0x87,0x0D,0xC9,0x5C,0xB8,0x9B,0xD1,0x28,0x09,0x62,0x34,0x27,0xAE,0x76,0x8A,0xAA,0x3A,0x88,0xA6,0xF8,0xE5,0x96,0x28,0x9D,0x7A,0x79,0xE2,0x62,0x98,0xD2,0x56,0x06,0xA0,0x2D,0x53,0xE9,0xB3,0xE8,0x08,0x08,0x13,0x90,0x53,0xA8,0xD4,0xF2,0x68,0x15,0x70,0x4F,0x0F,0x9F,0xF2,0xD5,0x41,0x4B,0x9E,0x07,0x72,0xC7,0xC7,0xD9,0x22,0x6E,0x1E,0xE7,0x9C,0x72,0x6F,0x76,0xBD,0x59,0x84,0x1B,0xBC,0x01,0xCF,0xCC,0x20,0x8D,0xEA,0x4A,0xF5,0x1B,0x20,0x62,0xBB,0xCD,0xA5,0x3D,0xDF,0xD5,0xF4,0xB9,0xF2,0xE3,0x97,0x84,0x94,0x2A,0x8D,0x94,0x83,0x87,0xA1,0x5A,0xB0,0xFD,0x0C,0xC3,0x9A,0xB6,0xA9,0x29,0x1F,0x9F,0x64,0x68,0x85,0x08,0xE0,0x8F,0xCF,0x9B,0x01,0x4B,0xFC,0xCB,0x31,0x17,0xA6,0xE9,0xFE,0x38,0x46,0x20,0x6C,0xB5,0x6A,0x99,0xFC,0x27,0xAF,0xE8,0x9A,0x37,0xF4,0xD1,0xFB,0xD0,0x34,0xEA,0x87,0x5F,0x3A,0xF3,0x2F,0xA0,0x64,0xA1,0x0B,0xA1,0x70,0xCB,0x80,0x3C,0x83,0x6F,0xC2,0xA2,0xCC,0xB1,0xB1,0x14,0xAA,0xA9,0x52,0x96,0x23,0x85,0x2B,0xEA,0x27,0x6B,0xC8,0x4E,0xF5,0x2E,0x67,0x1A,0x92,0x49,0x07,0xED,0x01,0x84,0x78,0x0D,0x87,0x14,0xDF,0x67,0x45,0x86,0x05,0x7B,0x81,0x42,0x20,0xC2,0x1C,0x4B,0x5D,0x8E,0x6A,0xC5,0x73,0x1C,0x30,0x6B,0x57,0xED,0x14,0x16,0xE1,0x5D,0x1F,0x76,0x9C,0x06,0x6F,0xFE,0xA5,0xD2,0xF2,0x61,0x3C,0x1E,0xED,0x52,0xC3,0x19,0x41,0x6C,0xFD,0x5F,0x3A,0x0E,0x50,0x18,0xE9,0x0D,0x27,0x71,0xFE,0x7C,0x52,0xB3,0x1D,0x9F,0xA3,0xB6,0xE2,0x89,0x01,0xC1,0x65,0x10,0xF3,0x26,0x06,0xB3,0x37,0x1C,0x82,0x2D,0xAB,0x53,0xBD,0xFB,0x6E,0x4A,0x15,0x94,0x1C,0xCC,0xB9,0x5C,0x7F,0x5D,0x9E,0x34,0x1C,0x9D,0xFF,0x52,0x59,0x4B,0x5C,0x82,0xB6,0x06,0x87,0xB1,0x92,0xB2,0x80,0x08,0x83,0xB3,0x9B,0xA2,0x5A,0xF4,0xAA,0x13,0x80,0x9F,0xEE,0xA4,0x3D,0xEE,0x85,0xD0,0xA8,0xE6,0x2E,0x45,0x29,0xCC,0x9C,0xEF,0x98,0x33,0xA3,0x62,0xD2,0x59,0x78,0xFB,0x6E,0x6F,0xF1,0x27,0x9B,0x34,0xE6,0x8C,0x33,0xBC,0xDA,0x3A,0x5B,0x66,0xE5,0x76,0x3F,0xB7,0xCD,0x86,0x2B,0x58,0xF8,0x41,0x87,0xFC,0x51,0x40,0x2B,0x1D,0x2F,0x99,0xCF,0x0C,0x51,0xC3,0xAA,0x28,0x89,0x07,0x3A,0x3E,0xE5,0x27,0x02,0x03,0x01,0x00,0x01};

// Public key exported from openssl

const uint8_t ext_pub_key[] = {0x00,0xb5,0x97,0x11,0x7a,0x3f,0x80,0xdb,0x2f,0x24,0x7c,0x74,0x1e,0x7b,0xc7,0x50,0x9c,0xf1,0xfb,0x80,0x8d,0x80,0x52,0x97,0xf3,0xd7,0xb6,0x3f,0x02,0x30,0x77,0xa9,0xd1,0x8f,0x93,0xf9,0xa3,0x74,0x97,0xb9,0xd2,0x2c,0x3a,0x75,0x51,0x0d,0xfc,0x94,0x8b,0x29,0x33,0xea,0x84,0xc8,0xc6,0x49,0x99,0x91,0x73,0x2f,0x17,0x52,0x92,0x58,0xeb,0x99,0xdd,0x9c,0x89,0x6a,0x6a,0xb1,0x6c,0x85,0xc0,0xec,0x07,0xfa,0xcf,0x4f,0xe1,0xc7,0xbf,0x0c,0x61,0x87,0xb6,0xbc,0xc6,0x5f,0x64,0xd7,0x34,0x8c,0x0b,0x71,0xfc,0x4f,0xf9,0x3a,0x93,0xf1,0xa2,0x36,0x5f,0xcd,0x03,0xd9,0xaf,0xcd,0x45,0x56,0x4f,0xe4,0x8d,0x8d,0x9b,0xa9,0xb2,0x48,0xa1,0x09,0x84,0xd8,0xb4,0x6b,0x20,0xab,0x13,0x6c,0x82,0x35,0x49,0x8f,0xa7,0x81,0xb9,0xea,0xbb,0x2d,0xb9,0x5b,0x7a,0x51,0x44,0x02,0xf7,0x60,0x9d,0xf1,0xa5,0xa7,0xe5,0x1c,0x49,0x9d,0xb9,0x49,0x32,0xc8,0x39,0x71,0xed,0xe6,0x6a,0xce,0xc3,0x95,0x9c,0x85,0xa7,0x63,0x44,0x3f,0xb5,0xdf,0x12,0x73,0x4b,0x53,0x54,0x3d,0x76,0xc3,0x74,0xf9,0x0c,0x1c,0x4f,0xbf,0x9d,0x21,0x8d,0x91,0xd2,0x46,0x73,0x89,0x58,0x00,0x46,0xcf,0xbe,0xe5,0x21,0x1d,0x00,0xd7,0x0b,0x90,0xe4,0x9c,0xfd,0x1b,0x99,0x7f,0xaa,0xc9,0xd9,0xd6,0x65,0xf7,0xf3,0xd5,0x38,0xb2,0xe3,0x73,0x54,0xab,0xeb,0x03,0x96,0x10,0xc1,0x8d,0xa3,0x22,0xe1,0xf8,0xb7,0xe7,0xc3,0xa8,0xb5,0x2e,0xe3,0x36,0x13,0x92,0x4c,0xa0,0x16,0xa6,0xa6,0xa0,0xb7,0xa8,0xa7,0x08,0xd1,0xa2,0x51,0xd8,0x7a,0xd9,0x7b,0xbf,0x50,0x45,0xd6,0xbf,0xa8,0xfd,0xd5,0x59,0xba,0x46,0x9f,0x80,0x21,0xfd,0xb1,0x70,0x86,0x41,0xed,0xd2,0xfb,0x72,0x58,0x62,0xf0,0xe3,0x07,0x76,0x5d,0xf4,0x19,0x9f,0x9b,0x60,0x6a,0xbd,0x6e,0x7d,0x53,0xfb,0x16,0x8e,0xfc,0xcc,0x50,0xfa,0xc2,0xe9,0xfa,0xd9,0x82,0x29,0x2f,0xd0,0x88,0xc0,0xa6,0x43,0xe0,0x6c,0x7a,0xca,0x76,0xe3,0x39,0x2a,0x47,0x95,0x78,0x10,0x4d,0x4f,0xdf,0x38,0xc8,0x10,0xdb,0xfe,0x1f,0x19,0xc8,0xa9,0xcd,0x7a,0x15,0x2d,0x61,0x87,0x66,0xcf,0x03,0x18,0x7e,0x0a,0xb7,0x16,0xb3,0x39,0xb0,0xb5,0xc1,0x06,0x77,0xb1,0xb1,0xc0,0x4c,0x21,0x5d,0xa8,0x6d,0x34,0x27,0x28,0x92,0x9d,0x19,0x01,0x00,0x01};