PSA import key / sign hash not working after SDK update

RE: PSA import key / sign hash not working after SDK update

dejans — Mon, 10 Jun 2024 13:20:56 GMT

Hi Bernhard,

Your issue might be related to the support of different key formats in PSA Crypto and legacy ("builtin") mbedtls crypto API. Supported key formats for PSA are documented in the PSA Crypto specification.

Best regards,
Dejan

RE: PSA import key / sign hash not working after SDK update

Bernhard — Sun, 09 Jun 2024 13:16:15 GMT

Hello dejans,

just as a short note for anybody else with the same problem...

I finally found out that the newer drivers = oberon & cc3xx (in difference to older 'builtin') are not able to handle the "PrivateKeyInfo" header anymore, so as a bugfix I just removed the first 26 bytes of the key and than its working fine again.

Thanks for not supporting the topic at all.

Best regards,
Bernhard

RE: PSA import key / sign hash not working after SDK update

dejans — Tue, 19 Mar 2024 15:50:55 GMT

Hi Bernhard,

It seems that you tried to build the sample with TF-M support. Documentation specifies what happens when you build for _ns target. Could you try to run RSA sample using the same build target as me (nrf9160dk_nrf9160)?

Best regards,
Dejan

RE: PSA import key / sign hash not working after SDK update

Bernhard — Tue, 19 Mar 2024 14:10:25 GMT

Hello Dejan,

I tested different versions but it's always the same output for me, e.g. SDK v2.5.2

*** Booting nRF Connect SDK v2.5.2 ***
[00:00:00.389,129] <inf> rsa: Starting the RSA example...
[00:00:00.389,160] <inf> rsa: Generating random RSA keypair...
[00:00:00.389,312] <inf> rsa: psa_generate_key failed! (Error: -134)
[00:00:00.389,343] <inf> rsa: Example exited with error!

What I noticed is this message:

Is it possible that you are working with a different TF-M version?

I don't really feel like the problem is on my side since other users were reporting the same problems in the forum without real solutions (just using different libraries at all). For example a year ago (with older TF-M version?) you just answered that the project is able to compile but not that it is working:

Error -134 running Crypto samples on Thingy91

RE: PSA import key / sign hash not working after SDK update

dejans — Tue, 19 Mar 2024 13:19:43 GMT

Hi Bernhard,

[quote user="Bernhard"]I was trying to make you a minimal example (since my application is already big and complex), thereby I noticed that even the RSA samples (e.g. C:\ncs\v2.x.x\nrf\samples\crypto) are not working on the nRF9160DK:[/quote]

I have tested unmodified RSA sample using NCS v2.5.0 and building for nrf9160dk_nrf9160. Here is my log:

As you can see, RSA sample runs fine on my nrf9160-dk.

Here is prj.conf from the same working RSA sample:

CONFIG_MAIN_STACK_SIZE=16384
CONFIG_HEAP_MEM_POOL_SIZE=16384

# Enable logging
CONFIG_CONSOLE=y
CONFIG_LOG=y

# Enable nordic security backend and PSA APIs
CONFIG_NRF_SECURITY=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=16384

CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR=y
CONFIG_PSA_WANT_ALG_SHA_256=y

Here is nrf9160dk_nrf9160.conf from the same RSA sample:

CONFIG_SRAM_SIZE=256

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

Best regards,
Dejan

RE: PSA import key / sign hash not working after SDK update

Bernhard — Tue, 19 Mar 2024 10:31:57 GMT

Hello Dejan,

[quote userid="111786" url="~/f/nordic-q-a/109270/psa-import-key-sign-hash-not-working-after-sdk-update/474310"]What was the most recent NCS version which you used and did not get any issues?[/quote]

The main difference (at least what I can see) seems to be between SDK versions v2.4.3 and v2.5.0, but I was actually working with v2.3.0

I was trying to make you a minimal example (since my application is already big and complex), thereby I noticed that even the RSA samples (e.g. C:\ncs\v2.x.x\nrf\samples\crypto) are not working on the nRF9160DK:

*** Booting Zephyr OS build v3.2.99-ncs2 ***
[00:00:00.633,911] <inf> rsa: Starting the RSA example...
[00:00:00.633,941] <inf> rsa: Generating random RSA keypair...
[00:00:00.634,094] <inf> rsa: psa_generate_key failed! (Error: -134)
[00:00:00.634,094] <inf> rsa: Example exited with error!

It seems that some additional configuration is needed, especially CONFIG_TFM_PROFILE_TYPE_NOT_SET=y, but that produces some further errors:

c:/ncs/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: platform/libplatform_s.a(tfm_hal_platform_common.o): in function `tfm_hal_platform_common_init':
C:/ncs/v2.3.0/modules/tee/tf-m/trusted-firmware-m/platform/ext/target/nordic_nrf/common/core/tfm_hal_platform_common.c:36: undefined reference to `stdio_init'
c:/ncs/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: platform/libplatform_s.a(tfm_hal_spm_logdev_peripheral.o): in function `tfm_hal_output_spm_log':
C:/ncs/v2.3.0/modules/tee/tf-m/trusted-firmware-m/platform/ext/common/tfm_hal_spm_logdev_peripheral.c:14: undefined reference to `stdio_output_string'

So for my understanding some addtional undocumented configurations are necessary which changed between the SDK versions.

[quote userid="111786" url="~/f/nordic-q-a/109270/psa-import-key-sign-hash-not-working-after-sdk-update/474310"]Could you provide both configuration files and relevant code (as you did in your initial post) when you had everything working as expected?[/quote]

Attached is an excerpt:

devzone.nordicsemi.com/.../rsa_5F00_working_5F00_2.3.0.zip

Thank you and best regards,
Bernhard

RE: PSA import key / sign hash not working after SDK update

dejans — Mon, 18 Mar 2024 12:15:50 GMT

Hi Bernhard,

Could you provide both configuration files and relevant code (as you did in your initial post) when you had everything working as expected?

What was the most recent NCS version which you used and did not get any issues?

Best regards,
Dejan

RE: PSA import key / sign hash not working after SDK update

Bernhard — Sat, 16 Mar 2024 22:20:29 GMT

Hello Dejan,

I have studied the documentation but it does not give any answers to my problem, the interface has not changed between the two SDK versions and from configuration point of view I have already tested quite a lot.

Also I do not understand why one driver respons with 'not supported' to my key while it's ok for the other one, although should be supported by both. (If both would fail I would search more for a format error or something like that.)

Here are some additional settings I have played with in between:

CONFIG_MBEDTLS_HEAP_SIZE=16384

CONFIG_CRYPTO=y

CONFIG_NRF_SECURITY=y
#CONFIG_NORDIC_SECURITY_BACKEND=y
#CONFIG_CC3XX_BACKEND=y

CONFIG_PSA_CRYPTO_DRIVER_OBERON=y
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=n

CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_MBEDTLS_USE_PSA_CRYPTO=y

CONFIG_MBEDTLS_RSA_C=y
CONFIG_MBEDTLS_SHA256_C=y
CONFIG_MBEDTLS_AES_C=y
CONFIG_MBEDTLS_PKCS1_V15=y

CONFIG_MBEDTLS_PK_PARSE_C=y
CONFIG_MBEDTLS_TLS_LIBRARY=y

CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR=y
CONFIG_PSA_WANT_ALG_SHA_256=y
CONFIG_PSA_WANT_RSA_KEY_SIZE_2048=y

# test only
CONFIG_PSA_WANT_ALG_HKDF=y
CONFIG_PSA_WANT_ALG_PBKDF2_HMAC=y
CONFIG_PSA_WANT_ALG_TLS12_PRF=y
CONFIG_PSA_WANT_ALG_TLS12_PSK_TO_MS=y
CONFIG_PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS=y

and for CC3XX driver additionaly:

CONFIG_PSA_USE_CC3XX_SIGNATURE_DRIVER=y
CONFIG_PSA_USE_CC3XX_HASH_DRIVER=y
CONFIG_PSA_USE_CC3XX_KEY_PAIR_DRIVER=y
CONFIG_PSA_USE_CC3XX_CIPHER_DRIVER=y
CONFIG_PSA_USE_CC3XX_ASYMMETRIC_DRIVER=y

I also tryd now to switch to SDK v2.6.0 but the device was not booting up anymore, it is really annoying that the SDK versions are not an upgrade from one to each other but rather just a change.

Hope you could help me anyway.

Best regards,
Bernhard

RE: PSA import key / sign hash not working after SDK update

dejans — Fri, 15 Mar 2024 09:55:16 GMT

Hi Bernhard,

You can read more about Crypto libraries, nRF Security library, nRF Security drivers, and drivers configurations and supported features in the NCS v2.5.2 documentation.

Best regards,
Dejan

RE: PSA import key / sign hash not working after SDK update

Bernhard — Thu, 14 Mar 2024 17:14:12 GMT

Hello Dejan,

this is my configuration for CC3XX driver:

devzone.nordicsemi.com/.../prj_5F00_sdk_5F00_a.conf

and the console output:

[00:00:26.890,411] <inf> rsa: psa_export_public_key failed! (Error: -147)
[00:00:26.910,247] <inf> rsa: psa_sign_hash failed! (Error: -147)

and this is my configuration for Oberon driver:

devzone.nordicsemi.com/.../prj_5F00_sdk_5F00_b.conf

and the console output:

[00:00:13.139,404] <inf> rsa: psa_import_key failed! (Error: -134)
[00:00:13.159,606] <inf> rsa: psa_sign_hash failed! (Error: -136)

Thanks and best regards,
Bernhard

RE: PSA import key / sign hash not working after SDK update

dejans — Thu, 14 Mar 2024 12:15:25 GMT

Hi,

Could you send a full log with the error messages -134 = PSA_ERROR_NOT_SUPPORTED and -147 = PSA_ERROR_HARDWARE_FAILURE?
Which configurations did you have in both of these failing cases?

Best regards,
Dejan