Thread PSKc calculation fails in SDK 2.6.0

[Max Peter]

When compiling Thread CLI sample with default configuration the CLI command:

>> ot dataset pskc -p 123456

returns:
Error 27: NotCapable

Debugging discovers that  "otPlatCryptoPbkdf2GenerateKey(...)" is not properly implemented when OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PSA, which is the new default setting in SDK 2.6.0.

I believe this may also affect creating new datasets and commissioner/Joiner operation because  otPlatCryptoPbkdf2GenerateKey(...) is uses in the Thread stack (meshcop.cpp).

[Sigurd Hellesvik]

Hi,

which is the new default setting in SDK 2.6.0.

Does this mean that what you do worked before?

>> ot dataset pskc -p 123456

What is your end goal?

Regards,
Sigurd Hellesvik

[Max Peter]

The new default setting is:

>> The default cryptography backend for Thread is now Arm PSA Crypto API instead of Mbed TLS, which was used in earlier versions.

See: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/releases_and_maturity/releases/release-notes-2.6.0.htm

otPlatCryptoPbkdf2GenerateKey(..) did work in SDK 2.5.x and earlier.

My use case is using otPlatCryptoPbkdf2GenerateKey(..) for key deviation on applikation level.

Now that otPlatCryptoPbkdf2GenerateKey(..) is also used inside the Thread stack it may also impact the integrity of the Thread stack.

[Sigurd Hellesvik]

Yes, you are correct, that is the change here.

Max Peter said:

>> The default cryptography backend for Thread is now Arm PSA Crypto API instead of Mbed TLS, which was used in earlier versions.

For the PSA Crypto API, see developer.nordicsemi.com/.../driver_config.htmlFeature configurations and driver support for how to configure features.

I am guessing you need something from Key derivation function configurations, for example CONFIG_PSA_WANT_ALG_PBKDF2_HMAC.

Max Peter said:

Now that otPlatCryptoPbkdf2GenerateKey(..) is also used inside the Thread stack it may also impact the integrity of the Thread stack.

I will mention this to our Thread developers, so they know about this, thanks!

[Sigurd Hellesvik]

Thread developers asked me to make an internal ticket so they could look into this as a potential issue. So you know there are some work being done on this

[Max Peter]

Thank you. Looking forward to receiving further input.

[Sigurd Hellesvik]

https://github.com/nrfconnect/sdk-nrf/pull/14869

https://github.com/nrfconnect/sdk-zephyr/pull/1631