otCryptoAesCcm() OpenThread crypto API not working after NCS 2.6 update.

[Fränz Ney]

Hi Nordic Team,

The OpenThread API function otCryptoAesCcm() is not working after updating to NCS v2.6.0.

Setting CONFIG_OPENTHREAD_NRF_SECURITY_CHOICE=y seems to be a workaround.

Any guidance how to get it working with the new PSA cryptography backend?

Thanks

Fränz

[dejans]

Hi,

You can find in the Thread section of NCS v2.6.0 release notes that default backend has been changed to PSA Crypto API. It is still possible to run code with Mbed TLS support by setting CONFIG_OPENTHREAD_NRF_SECURITY_CHOICE=y.

Best regards,
Dejan

[Fränz Ney]

The OpenThread API should be independent of the used crypto backend.

Is it possible that the Nordic security HAL layer was not updated to work with the new PSA backend?

The high level OT API should be platform independent.

Regards,

Fränz

[dejans]

Hi,

Do you get any specific error code when you use otCryptoAesCcm()?

Best regards,
Dejan

[Fränz Ney]

An assertion occurs in otPlatCryptoAesEncrypt() => openthread/src/core/crypto/aes_ecb.cpp:52

psa_cipher_encrypt() is returning error code -136 (PSA_ERROR_INVALID_HANDLE)

Seems that PSA requires mKey to be NULL.

[dejans]

Hi,

Can you verify that otPlatCryptoImportKey has been successfully called before the error occurs?

Best regards,
Dejan