RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Amanda Hsieh — Tue, 27 Feb 2024 18:55:35 GMT

Thanks for the update.

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Tue, 27 Feb 2024 18:22:49 GMT

Just an FYI and thanks for the support.

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Tue, 27 Feb 2024 18:20:46 GMT

But, instead when i chop the first 24 bytes from the above output and instead pass the remaining 398 bytes to the PSA API, then everything works.
i.e. on other words, the chopped off version of public key(398 bytes) long in the below ASN.1 format is being accepted by PSA:

398 bytes
SEQUENCE {
   INTEGER 0x00bf8b1f325b3063daee3cf3f06a92d4ac1941f6c9d3d6e70094965001d815edca90e8f00c3e646d3a4219c77fcbdeca8be1acbe13d5c2ec78750d938be881d3165321ea7237b921ee0f4da295da3778f39247d076f80790cfd80a72ae3ed3dd06aede4962c50870a499c97dc8b87cf1a76d903f44bdaf6e9f3269bcda351039608f523320014d57c7a22f70f9f6a4856ad5269c9d4c9b0d84fdc59304599c6e08e81d041d347f32190f6273a4fadee498f2422aa1a700f727f1df6838a3ae0b492845d86d477e27a7b4921448afeab01ffdb48bee6e8de75f714b74a2605fda845378de2fd89549158f123472744a991e1cd42e4e4308713caaba7b7fae1fd805e79a6ba1ba3949e9dfad825ea4cc0d7866e9bed8559e66ccb4392ebd52ba19b74befb13135e428ecad2d2b277dfa03df35df8c6b1e2a2b161bb21bd4a215dcee05f4c31f4921f2475ce65c4aa33d79180966f90276f97f2508b338ed515a8b5802016d91bb071f47616ebd00828b0431d533c9d686065f563bb862d7ec6a9b9b
   INTEGER 0x010001 (65537 decimal)
}

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Tue, 27 Feb 2024 18:15:57 GMT

Okay, Just as an update, wanted to share what i found as the difference in the key formats generated by openssl versus what is accepted by PSA.

Basically, when i use openssl commands, the public key in DER format is 422 bytes long, i.e.

openssl rsa -in mathi_pvt_key.der -inform DER -pubout -outform DER -out mathi_public_key.der
openssl pkey -pubin -in mathi_public_key.der -outform DER | xxd -g 1  -i -c 422

The public key output by openssl in DER format is 422 bytes long:
308201a2300d06092a864886f70d01010105000382018f003082018a0282018100bf8b1f325b3063daee3cf3f06a92d4ac1941f6c9d3d6e70094965001d815edca90e8f00c3e646d3a4219c77fcbdeca8be1acbe13d5c2ec78750d938be881d3165321ea7237b921ee0f4da295da3778f39247d076f80790cfd80a72ae3ed3dd06aede4962c50870a499c97dc8b87cf1a76d903f44bdaf6e9f3269bcda351039608f523320014d57c7a22f70f9f6a4856ad5269c9d4c9b0d84fdc59304599c6e08e81d041d347f32190f6273a4fadee498f2422aa1a700f727f1df6838a3ae0b492845d86d477e27a7b4921448afeab01ffdb48bee6e8de75f714b74a2605fda845378de2fd89549158f123472744a991e1cd42e4e4308713caaba7b7fae1fd805e79a6ba1ba3949e9dfad825ea4cc0d7866e9bed8559e66ccb4392ebd52ba19b74befb13135e428ecad2d2b277dfa03df35df8c6b1e2a2b161bb21bd4a215dcee05f4c31f4921f2475ce65c4aa33d79180966f90276f97f2508b338ed515a8b5802016d91bb071f47616ebd00828b0431d533c9d686065f563bb862d7ec6a9b9b0203010001
In other words, when converting the above bytes to ASN.1 format, it looks like this:
SEQUENCE {
   SEQUENCE {
      OBJECTIDENTIFIER 1.2.840.113549.1.1.1 (rsaEncryption)
      NULL 
   }
   BITSTRING 0x3082018a0282018100bf8b1f325b3063daee3cf3f06a92d4ac1941f6c9d3d6e70094965001d815edca90e8f00c3e646d3a4219c77fcbdeca8be1acbe13d5c2ec78750d938be881d3165321ea7237b921ee0f4da295da3778f39247d076f80790cfd80a72ae3ed3dd06aede4962c50870a499c97dc8b87cf1a76d903f44bdaf6e9f3269bcda351039608f523320014d57c7a22f70f9f6a4856ad5269c9d4c9b0d84fdc59304599c6e08e81d041d347f32190f6273a4fadee498f2422aa1a700f727f1df6838a3ae0b492845d86d477e27a7b4921448afeab01ffdb48bee6e8de75f714b74a2605fda845378de2fd89549158f123472744a991e1cd42e4e4308713caaba7b7fae1fd805e79a6ba1ba3949e9dfad825ea4cc0d7866e9bed8559e66ccb4392ebd52ba19b74befb13135e428ecad2d2b277dfa03df35df8c6b1e2a2b161bb21bd4a215dcee05f4c31f4921f2475ce65c4aa33d79180966f90276f97f2508b338ed515a8b5802016d91bb071f47616ebd00828b0431d533c9d686065f563bb862d7ec6a9b9b0203010001 : 0 unused bit(s)
}

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Amanda Hsieh — Wed, 21 Feb 2024 20:16:44 GMT

(updated)

From the team:

The key-length of 1536 is not recommended for anything than legacy implementations according to NIST recommendations (and others):

RSA key size of 2048 and larger is recommended as usable until 2030, with SHA-2 (224 or larger). The reasoning is that the security strength of the operation is so low that it is difficult to give guarantees that it won't be broken. https://www.keylength.com/en/4/

Hi,

Not know how you exported it, but the key looks wrong. The key must be in DER-form (the first byte of the array should be 0x30). This is documented in the psa spec https://arm-software.github.io/psa-api/crypto/1.1/api/keys/management.html#key-formats (hardware error is the wrong return code, don't know where that comes from)

Command to export DER-formatted keys:

openssl rsa -in private_key.der -inform DER -pubout -outform DER -out public_key.der

-Amanda H.

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Wed, 21 Feb 2024 15:11:22 GMT

// Public key exported from PSA

//const uint8_t ext_pub_key[] = {0x30,0x82,0x01,0x8A,0x02,0x82,0x01,0x81,0x00,0x87,0x0D,0xC9,0x5C,0xB8,0x9B,0xD1,0x28,0x09,0x62,0x34,0x27,0xAE,0x76,0x8A,0xAA,0x3A,0x88,0xA6,0xF8,0xE5,0x96,0x28,0x9D,0x7A,0x79,0xE2,0x62,0x98,0xD2,0x56,0x06,0xA0,0x2D,0x53,0xE9,0xB3,0xE8,0x08,0x08,0x13,0x90,0x53,0xA8,0xD4,0xF2,0x68,0x15,0x70,0x4F,0x0F,0x9F,0xF2,0xD5,0x41,0x4B,0x9E,0x07,0x72,0xC7,0xC7,0xD9,0x22,0x6E,0x1E,0xE7,0x9C,0x72,0x6F,0x76,0xBD,0x59,0x84,0x1B,0xBC,0x01,0xCF,0xCC,0x20,0x8D,0xEA,0x4A,0xF5,0x1B,0x20,0x62,0xBB,0xCD,0xA5,0x3D,0xDF,0xD5,0xF4,0xB9,0xF2,0xE3,0x97,0x84,0x94,0x2A,0x8D,0x94,0x83,0x87,0xA1,0x5A,0xB0,0xFD,0x0C,0xC3,0x9A,0xB6,0xA9,0x29,0x1F,0x9F,0x64,0x68,0x85,0x08,0xE0,0x8F,0xCF,0x9B,0x01,0x4B,0xFC,0xCB,0x31,0x17,0xA6,0xE9,0xFE,0x38,0x46,0x20,0x6C,0xB5,0x6A,0x99,0xFC,0x27,0xAF,0xE8,0x9A,0x37,0xF4,0xD1,0xFB,0xD0,0x34,0xEA,0x87,0x5F,0x3A,0xF3,0x2F,0xA0,0x64,0xA1,0x0B,0xA1,0x70,0xCB,0x80,0x3C,0x83,0x6F,0xC2,0xA2,0xCC,0xB1,0xB1,0x14,0xAA,0xA9,0x52,0x96,0x23,0x85,0x2B,0xEA,0x27,0x6B,0xC8,0x4E,0xF5,0x2E,0x67,0x1A,0x92,0x49,0x07,0xED,0x01,0x84,0x78,0x0D,0x87,0x14,0xDF,0x67,0x45,0x86,0x05,0x7B,0x81,0x42,0x20,0xC2,0x1C,0x4B,0x5D,0x8E,0x6A,0xC5,0x73,0x1C,0x30,0x6B,0x57,0xED,0x14,0x16,0xE1,0x5D,0x1F,0x76,0x9C,0x06,0x6F,0xFE,0xA5,0xD2,0xF2,0x61,0x3C,0x1E,0xED,0x52,0xC3,0x19,0x41,0x6C,0xFD,0x5F,0x3A,0x0E,0x50,0x18,0xE9,0x0D,0x27,0x71,0xFE,0x7C,0x52,0xB3,0x1D,0x9F,0xA3,0xB6,0xE2,0x89,0x01,0xC1,0x65,0x10,0xF3,0x26,0x06,0xB3,0x37,0x1C,0x82,0x2D,0xAB,0x53,0xBD,0xFB,0x6E,0x4A,0x15,0x94,0x1C,0xCC,0xB9,0x5C,0x7F,0x5D,0x9E,0x34,0x1C,0x9D,0xFF,0x52,0x59,0x4B,0x5C,0x82,0xB6,0x06,0x87,0xB1,0x92,0xB2,0x80,0x08,0x83,0xB3,0x9B,0xA2,0x5A,0xF4,0xAA,0x13,0x80,0x9F,0xEE,0xA4,0x3D,0xEE,0x85,0xD0,0xA8,0xE6,0x2E,0x45,0x29,0xCC,0x9C,0xEF,0x98,0x33,0xA3,0x62,0xD2,0x59,0x78,0xFB,0x6E,0x6F,0xF1,0x27,0x9B,0x34,0xE6,0x8C,0x33,0xBC,0xDA,0x3A,0x5B,0x66,0xE5,0x76,0x3F,0xB7,0xCD,0x86,0x2B,0x58,0xF8,0x41,0x87,0xFC,0x51,0x40,0x2B,0x1D,0x2F,0x99,0xCF,0x0C,0x51,0xC3,0xAA,0x28,0x89,0x07,0x3A,0x3E,0xE5,0x27,0x02,0x03,0x01,0x00,0x01};

// Public key exported from openssl

const uint8_t ext_pub_key[] = {0x00,0xb5,0x97,0x11,0x7a,0x3f,0x80,0xdb,0x2f,0x24,0x7c,0x74,0x1e,0x7b,0xc7,0x50,0x9c,0xf1,0xfb,0x80,0x8d,0x80,0x52,0x97,0xf3,0xd7,0xb6,0x3f,0x02,0x30,0x77,0xa9,0xd1,0x8f,0x93,0xf9,0xa3,0x74,0x97,0xb9,0xd2,0x2c,0x3a,0x75,0x51,0x0d,0xfc,0x94,0x8b,0x29,0x33,0xea,0x84,0xc8,0xc6,0x49,0x99,0x91,0x73,0x2f,0x17,0x52,0x92,0x58,0xeb,0x99,0xdd,0x9c,0x89,0x6a,0x6a,0xb1,0x6c,0x85,0xc0,0xec,0x07,0xfa,0xcf,0x4f,0xe1,0xc7,0xbf,0x0c,0x61,0x87,0xb6,0xbc,0xc6,0x5f,0x64,0xd7,0x34,0x8c,0x0b,0x71,0xfc,0x4f,0xf9,0x3a,0x93,0xf1,0xa2,0x36,0x5f,0xcd,0x03,0xd9,0xaf,0xcd,0x45,0x56,0x4f,0xe4,0x8d,0x8d,0x9b,0xa9,0xb2,0x48,0xa1,0x09,0x84,0xd8,0xb4,0x6b,0x20,0xab,0x13,0x6c,0x82,0x35,0x49,0x8f,0xa7,0x81,0xb9,0xea,0xbb,0x2d,0xb9,0x5b,0x7a,0x51,0x44,0x02,0xf7,0x60,0x9d,0xf1,0xa5,0xa7,0xe5,0x1c,0x49,0x9d,0xb9,0x49,0x32,0xc8,0x39,0x71,0xed,0xe6,0x6a,0xce,0xc3,0x95,0x9c,0x85,0xa7,0x63,0x44,0x3f,0xb5,0xdf,0x12,0x73,0x4b,0x53,0x54,0x3d,0x76,0xc3,0x74,0xf9,0x0c,0x1c,0x4f,0xbf,0x9d,0x21,0x8d,0x91,0xd2,0x46,0x73,0x89,0x58,0x00,0x46,0xcf,0xbe,0xe5,0x21,0x1d,0x00,0xd7,0x0b,0x90,0xe4,0x9c,0xfd,0x1b,0x99,0x7f,0xaa,0xc9,0xd9,0xd6,0x65,0xf7,0xf3,0xd5,0x38,0xb2,0xe3,0x73,0x54,0xab,0xeb,0x03,0x96,0x10,0xc1,0x8d,0xa3,0x22,0xe1,0xf8,0xb7,0xe7,0xc3,0xa8,0xb5,0x2e,0xe3,0x36,0x13,0x92,0x4c,0xa0,0x16,0xa6,0xa6,0xa0,0xb7,0xa8,0xa7,0x08,0xd1,0xa2,0x51,0xd8,0x7a,0xd9,0x7b,0xbf,0x50,0x45,0xd6,0xbf,0xa8,0xfd,0xd5,0x59,0xba,0x46,0x9f,0x80,0x21,0xfd,0xb1,0x70,0x86,0x41,0xed,0xd2,0xfb,0x72,0x58,0x62,0xf0,0xe3,0x07,0x76,0x5d,0xf4,0x19,0x9f,0x9b,0x60,0x6a,0xbd,0x6e,0x7d,0x53,0xfb,0x16,0x8e,0xfc,0xcc,0x50,0xfa,0xc2,0xe9,0xfa,0xd9,0x82,0x29,0x2f,0xd0,0x88,0xc0,0xa6,0x43,0xe0,0x6c,0x7a,0xca,0x76,0xe3,0x39,0x2a,0x47,0x95,0x78,0x10,0x4d,0x4f,0xdf,0x38,0xc8,0x10,0xdb,0xfe,0x1f,0x19,0xc8,0xa9,0xcd,0x7a,0x15,0x2d,0x61,0x87,0x66,0xcf,0x03,0x18,0x7e,0x0a,0xb7,0x16,0xb3,0x39,0xb0,0xb5,0xc1,0x06,0x77,0xb1,0xb1,0xc0,0x4c,0x21,0x5d,0xa8,0x6d,0x34,0x27,0x28,0x92,0x9d,0x19,0x01,0x00,0x01};

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Wed, 21 Feb 2024 15:10:37 GMT

Another update -
Case 1) I manually saved (in hex) the public key exported from PSA (using psa_generate_key()). And imported it in a different standalone application, encryption(RSA-OAEP-3072) worked.
The length of the public key (with exponent) was 398 bytes

Case 2) Imported the public key from from openssl, encryption fails with (-147).
The length of the public key (with exponent) was 388 bytes.

Are there any special bytes to be included to the public key format when using PSA APIs
Thanks,

Mathi.

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Wed, 21 Feb 2024 10:23:27 GMT

I ran into another problem.
If i import a RSA public key generated using openssl, then psa_asymmetric_enrypt() fails with (-147 = HARDWARE_FAILURE). Here, i use the pub_key_handle from psa_key_import().
Does this mean, only keys generated on the device, are supported?
Or Is there anything specific about the PSA key-format for RSA-OAEP-3072?

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Tue, 20 Feb 2024 16:29:25 GMT

That helped. Thanks.

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Amanda Hsieh — Tue, 20 Feb 2024 16:07:41 GMT

Hi,

Did you enable the config for PSA_ALG_SHA_1?

Disclaimer from PSA Crypto API:

The SHA-1 hash is weak and deprecated and is only recommended for use in legacy protocols.

-Amanda H.

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Tue, 20 Feb 2024 15:45:12 GMT

But then, psa_asymmetric_encrypt() fails with same error code (-147 = HARDWARE_FAILURE)
for all key sizes WHEN setting the algorithm to
psa_set_key_algorithm(&key_attributes, (PSA_ALG_RSA_OAEP(PSA_ALG_SHA_1)));

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Tue, 20 Feb 2024 15:07:02 GMT

Hi,

As an update, please note that the psa_asymmetric_encrypt() API worked fine now after passing the keypair_handle (i.e. instead of using the pub_key_handle) to the API.

The encryption works fine for 1024, 2048 and 3072-bit keys when the algorithm is set to
psa_set_key_algorithm(&key_attributes, (PSA_ALG_RSA_OAEP(PSA_ALG_SHA_256)));

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Amanda Hsieh — Mon, 19 Feb 2024 20:40:09 GMT

Hi,

Did you change the buffer sizes for the key:

NRF_CRYPTO_EXAMPLE_RSA_PUBLIC_KEY_SIZE NRF_CRYPTO_EXAMPLE_RSA_SIGNATURE_SIZE

If these are increased the 2048 bit RSA key should work as expected.

-Amanda H.

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Mon, 19 Feb 2024 17:51:28 GMT

Hi Amanda,

I continued further and modifed the default RSA example to try RSA_OAEP encryption for 1024-bit keys
and that fails i.e. psa_asymmetric_encrypt() fails with error code -147(HARDWARE_FAILURE).

This looks very similair to the problem my colleague had experienced about an year ago, see this ==>
RSA example fails on psa_sign_hash returning -133 - Nordic Q&A - Nordic DevZone - Nordic DevZone (nordicsemi.com)

I don't know if anything has changed in the past 1 year between 2.1.1 and 2.5.0 -
Could you please confirm whether psa_asymmetric_encrypt() for RSA 1024-bit keys is supported or not?

Kind Regards, Mathi.

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Mathi — Fri, 16 Feb 2024 14:51:45 GMT

Hi Amanda,

Thanks for the reply.
Meanwhile, I just randomly increased the memory sizes from 16K to 20K and the default sample for key size 2048 bits, worked.
(i.e. basically for experimentation, i just set CONFIG_MAIN_STACK_SIZE, CONFIG_HEAP_MEM_POOL_SIZE, CONFIG_MBEDTLS_HEAP_SIZE, all to 20 K) and it worked.
I did not expect an PSA_ERR_NOT_SUPPORTED error code for memory reasons though.
Also, I also noticed that the key_generation takes a longer time, with different key sizes.
Will update you further.

Mathi.

RE: RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

Amanda Hsieh — Thu, 15 Feb 2024 19:29:53 GMT

Hi,

[quote user=""]It fails with the same error code when changing the sample code and configuration to use CONFIG_PSA_WANT_RSA_KEY_SIZE_1536=y or configuring CONFIG_PSA_WANT_RSA_KEY_SIZE_1024=y.[/quote]

If you check the .config under build/zephyr, you can find CONFIG_PSA_WANT_RSA_KEY_SIZE_1024=y is set by default.

How do you modify the code? Could you elaborate on what you modified?

[quote user=""](1) When can the basic/default RSA sample application in SDK 2.5.0 fail on the nRF5340 Development Kit?[/quote]

The error would give some clues.

[quote user=""](2) We intend to use PSA API for RSA OAEP with key size CONFIG_PSA_WANT_RSA_KEY_SIZE_3072. Is this supported in SDK 2.5.0?[/quote]

The default setting already has CONFIG_PSA_WANT_RSA_KEY_SIZE_3072. You check the .config under build/zephyr.

Regards,
Amanda H.