Trying to set up secure channel with odsp fails because it can't find the crypto device

RE: Trying to set up secure channel with odsp fails because it can't find the crypto device

Einar Thorsrud — Mon, 11 Nov 2024 15:16:32 GMT

Hi,

I see. The CryptoCell driver is not intended to be used direclty, and it not possible from a non-secure application, so this approach will not work. I suspect that the simplest is to modify the OSDP implementation to use the supported crypti API's, and to be futureproof tahat means using the PSA APIs. You can see examples of those under nrf/samples/crypto.

RE: Trying to set up secure channel with odsp fails because it can't find the crypto device

mackz — Fri, 08 Nov 2024 14:02:04 GMT

I am also able to build and run the sample, the problem is that i am trying to use the secure channel capabilites of OSDP but am getting errors during runtime because dev = device_get_binding(CONFIG_OSDP_CRYPTO_DRV_NAME); gives me an error. So what i am wondering is if it is possible to get the binding of the cc3xx crypto driver? This is what i found from zephyrs crypto sample:

#ifdef CONFIG_CRYPTO_TINYCRYPT_SHIM
#define CRYPTO_DRV_NAME CONFIG_CRYPTO_TINYCRYPT_SHIM_DRV_NAME
#elif CONFIG_CRYPTO_MBEDTLS_SHIM
#define CRYPTO_DRV_NAME CONFIG_CRYPTO_MBEDTLS_SHIM_DRV_NAME
#elif DT_HAS_COMPAT_STATUS_OKAY(st_stm32_cryp)
#define CRYPTO_DEV_COMPAT st_stm32_cryp
#elif DT_HAS_COMPAT_STATUS_OKAY(st_stm32_aes)
#define CRYPTO_DEV_COMPAT st_stm32_aes
#elif CONFIG_CRYPTO_NRF_ECB
#define CRYPTO_DEV_COMPAT nordic_nrf_ecb
#else
#error "You need to enable one crypto device"
#endif

but when i try to set CONFIG_CRYPTO_NRF_ECB i get :

CONFIG_CRYPTO_NRF_ECB was assigned the value y, but got the value n. Missing dependencies:
DT_HAS_NORDIC_NRF_ECB_ENABLED

RE: Trying to set up secure channel with odsp fails because it can't find the crypto device

Einar Thorsrud — Fri, 08 Nov 2024 13:54:07 GMT

Hi,

There will be additional issues that need resolution when you mix and match SDK versions, but for reference this mde the OSDP peripheral device sample build and run without issues (though I did not do additional testing):

1. cmoose osdp-uart, I did it in an app.overlay file:

/ {
	chosen {
		zephyr,osdp-uart = &uart0;

	};
};

For crypto, enable the needed crypto features like this in prj.conf:

CONFIG_NRF_SECURITY=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y

CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192

CONFIG_PSA_WANT_GENERATE_RANDOM=y
CONFIG_PSA_WANT_KEY_TYPE_AES=y
CONFIG_PSA_WANT_ALG_CCM=y

And lastly, remove OSDP_SC_ENABLED as explained in this post from the thread you linked to.

PS: OSDP support is part of Zephyr but not something we have worked with or support directly, and honestly does not know how to test it.