RSA crypto sample in SDK 2.5.0 fails on nRF5340 Development Kit board

[Mathi]

Hi,

The RSA crypto sample from the 2.5.0 SDK fails at psa_generate_key() returning -134. The sample is by default configured to use 2048-bit keys. 
Note that, It fails with the same error code also when changing the sample code and configuration to use say for example - changing it to CONFIG_PSA_WANT_RSA_KEY_SIZE_1536=y or configuring CONFIG_PSA_WANT_RSA_KEY_SIZE_1024=y.

Please note, the AES samples and the ECDH samples from the 2.5.0 SDK works very well on this board. I don't understand why the RSA sample application fails with the UNSUPPORTED error code.

(1) When can the basic/default RSA sample application in SDK 2.5.0 fail on the nRF5340 Development Kit?
(2) We intend to use PSA API for RSA OAEP with key size CONFIG_PSA_WANT_RSA_KEY_SIZE_3072. Is this supported in SDK 2.5.0?

Thanks,

Mathi.

#PSA #Crypto #RSA #SDK 2.5.0 #SAMPLE#nRF5340 DK #keyformat#keygeneration #openssl-versus-PSA

[Mathi]

But then, psa_asymmetric_encrypt() fails with same error code (-147 = HARDWARE_FAILURE)
for all key sizes WHEN setting the algorithm to 
psa_set_key_algorithm(&key_attributes, (PSA_ALG_RSA_OAEP(PSA_ALG_SHA_1)));

[Amanda Hsieh]

Hi, 

Did you enable the config for PSA_ALG_SHA_1?

Disclaimer from PSA Crypto API: 

The SHA-1 hash is weak and deprecated and is only recommended for use in legacy protocols.

-Amanda H.

[Mathi]

That helped. Thanks.

[Mathi]

I ran into another problem.
If i import a RSA public key generated using openssl, then psa_asymmetric_enrypt() fails with (-147 = HARDWARE_FAILURE). Here, i use the pub_key_handle from psa_key_import().
Does this mean, only keys generated on the device, are supported?
Or Is there anything specific about the PSA key-format for RSA-OAEP-3072?

[Mathi]

Another update -
Case 1) I manually saved (in hex) the public key exported from PSA (using psa_generate_key()). And imported it in a different standalone application, encryption(RSA-OAEP-3072) worked.
The length of the public key (with exponent) was 398 bytes 

Case 2) Imported the public key from from openssl, encryption fails with (-147).
The length of the public key (with exponent) was 388 bytes.

Are there any special bytes to be included to the public key format when using PSA APIs
Thanks,

Mathi.