PSA crypto example does not compile

[franchan]

Hello,

Using v2.6.0 and v2.6.1 for compiling PSA Crypto example (zephyr/samples/tfm_integration/psa_crypto) fails.

Tried building from VSC, tried building from command line (using the steps for nrf5340 in the README.rst; which contains an error on the board parameter value I think).

The error says: <command-line>: fatal error: user-tls-conf.h: No such file or directory

That might be used due to the prj.conf containing:

CONFIG_MBEDTLS_USER_CONFIG_ENABLE=y

CONFIG_MBEDTLS_USER_CONFIG_FILE="user-tls-conf.h"

It seems that the CMakeLists.txt contains this statement (which does not seem to have effect because there's no corresponding -I <include-path> added).

zephyr_include_directories(${APPLICATION_SOURCE_DIR}/src/tls_config)

If commenting out those lines in prj.conf, there's another error
psa_crypto/src/util_app_log.h:10:10: fatal error: psa/initial_attestation.h: No such file or directory
   10 | #include "psa/initial_attestation.h"

Note that a similar sample, PSA Protected Storage (zephyr/samples/tfm_integration/psa_protected_storage), compiles, flashes and runs correctly on the DK board.

How to fix to compile and run the PSA Crypto sample? (I want this sample working to experiment with its CSR part.)

Thank you!

[dejans]

Hi,

Which board do you use?

Can you provide your build command?

Best regards,
Dejan

[franchan]

Hello Dejan,

Thank you for looking into this. I'm using the nrf5340dk_nrf5340_cpuapp_ns. I use Ubuntu 22.04 as platform

... build command
I tried following 3 methods. The 3rd is mentioned in the README.rst (notice the readme uses a wrong target format)

1) I use Nordic's VSC nrf plugin. It has a build button (after create a target)

2) On the command line:

a)
. <(nrfutil toolchain-manager env --as-script --ncs-version v2.6.0)
. <path-to-v2.6.0>/zephyr/zephyr-env.sh
rm -rf build/
west build -b nrf5340dk_nrf5340_cpuapp_ns --pristine=always

b)
rm -rf build
mkdir build && cd build
cmake -GNinja -DBOARD=nrf5340dk_nrf5340_cpuapp_ns ..
ninja

Kind regards, francis

[dejans]

Hi Francis,

Thank you for additional information.

I have replicated your issue. We will further look into the issue internally. I will get back to you hopefully by the end of this week.

Best regards,
Dejan

[dejans]

Hi Francis,

Instead of using Zephyr samples, you could try out our cryptography samples.

Best regards,
Dejan

[franchan]

Hello,
Thank you Dejan for further investigating the issue.
I'm looking forward to better understand the procedure for creating a CSR in that sample once it can compile.
Kind regards, franics

[franchan]

Hello Dejan,

Thank you. I looked in those examples but none of these creates a CSR on a nRF5340.

Meanwhile I have started a separate sample myself using nRF Connect SDK v2.6.1 and trying to duplicate the procedure implemented in this psa_crypto sample. I run into an issue with mbedtls_pk_setup_opaque(). I open a separate ticket for this (as it looks unrelated to this compilation issue).

Kind regards, francis

[dejans]

Hi,

With regard to CSR, we do not have a specific sample. For more information, you can look at this discussion, and this link for list of steps.

Best regards,
Dejan