256-bit AES CBC Encryption on nrf52833 board in Mbedtls functions

[Sakshi_0806]

Hello,

I am trying to generate encrypted data of particular data with IV and Key value by using mbedtls functions but when I try to do that in AES_CBC example code I am getting error of undefined functions of mbedtls.

I am using ncs-2.6.0 version

Board: nrf52833

sample code: AES_CBC

Also If I will use same example code so the Key size id 32-bit but in my case I want to give multiple bytes in key.

For your reference I am attaching the Screenshots.

 

[Sigurd Hellesvik]

Hi,

I am trying to generate encrypted data of particular data with IV and Key value by using mbedtls functions but when I try to do that in AES_CBC example code I am getting error of undefined functions of mbedtls.

We do not recommend using the mbedtls functions in newer versions of the nRF Connect SDK.
We are phasing out the mbedtls crypto backend for the PSA Crypto API.

See  Securing IoT products with PSA Certified APIs for some theory.

See Cryptography samples for samples

Is there any specific reason to why you want to use the mbedtls API for this?

Regards,
Sigurd Hellesvik

[Sakshi_0806]

Hello,

Okay but if we use psa_APIs then for encryption I have to generate Key value but I want to use my hard coded key and IV value in array format.

As given in one of screenshot where key and IV both are array(number of values)

[Sakshi_0806]

Why we can't use mbedtls??
and If PSA_APIs is not supported to give hard coded key and IV value then what will be the other alternative???

[Sigurd Hellesvik]

Sakshi_0806 said:

Okay but if we use psa_APIs then for encryption I have to generate Key value but I want to use my hard coded key and IV value in array format.

As given in one of screenshot where key and IV both are array(number of values)

You can use mbedtls, but since it is legacy we do not recommend it. Also, it will be easier to enable the PSA crypto API, as it is the default.

Sakshi_0806 said:

Okay but if we use psa_APIs then for encryption I have to generate Key value but I want to use my hard coded key and IV value in array format.

As given in one of screenshot where key and IV both are array(number of values)

For example, the psa_tls sample imports keys.

Then it converts the keys to .inc files.
The output will look something like this:

0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0xba,
0x9b, 0x37, 0x95, 0xfb, 0x3e, 0xa9, 0xdc, 0x70,
0x42, 0xb8, 0x46, 0x42, 0xe7, 0xa2, 0x42, 0x55,
0x2d, 0x8a, 0xc8, 0xe4, 0x8f, 0x6a, 0xdf, 0xc3,
0x88, 0x53, 0x91, 0xde, 0xa2, 0x39, 0x86, 0xa0,
0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d,
0x03, 0x01, 0x07, 0xa1, 0x44, 0x03, 0x42, 0x00,
0x04, 0xf9, 0x2a, 0xfb, 0x35, 0xb1, 0xb9, 0x46,
0xba, 0x7f, 0x56, 0x9b, 0xf8, 0xdb, 0x48, 0x9e,
0xd1, 0x0c, 0x56, 0xe9, 0xe9, 0x82, 0x98, 0xb7,
0xf6, 0x98, 0x4f, 0x52, 0xb6, 0xe3, 0xa9, 0x48,
0xf8, 0x3d, 0x72, 0xe6, 0x5f, 0x53, 0x47, 0xb5,
0xe9, 0x7a, 0x32, 0x40, 0x7f, 0x96, 0xb4, 0x37,
0xfa, 0xbe, 0x12, 0x0a, 0xef, 0x77, 0x74, 0x25,
0xa3, 0x0f, 0x1f, 0x15, 0xcf, 0x13, 0x55, 0x2b,
0xb1,

and is used in code as arrays.

So yes, you should be able to include certs as arrays and import them.

[Sakshi_0806]

I was reading nrf52833 data sheet where is mentioned that Is support 128-AES so what it means??
NRF52833 chip is not supporting 256-AES CBC???

[Sakshi_0806]

I have done these configuration in prj.conf file.

I was referring "devzone.nordicsemi.com/.../how-to-use-latest-mbed-tls-2-26-0-with-nrf-connect-sdk-v1-5-0-on-thingy-91" link to add mbedtls functionality in my AES-CBC example code.

But I am getting the run time error :

Please tell me what is the reason of failure, ASAP 

[Sigurd Hellesvik]

The red lines likely are because of Override Kconfig Warnings. I recommend that you look into why your configurations are overidden.

Sakshi_0806 said:

I was reading nrf52833 data sheet where is mentioned that Is support 128-AES so what it means??
NRF52833 chip is not supporting 256-AES CBC???

The hardware peripheral described here is for BLE operation.

Your CPU can still use FW crypto libraries to do other cryptographic operations.