AES CBC (or EBC) on nRF52832 & nRF54L05

So I need to decrypt a single 16 byte block of data using AES128 and a pre-shared key on the above SoCs. But PSA doesn't seem to work (I'm currently working using the nRF52DK). Even the AES CBC example application fails with an error when I run it

I notice there is a config option CONFIG_MBEDTLS_LEGACY_CRYPTO_C, but the description suggests it's not a great option

Any advice on the way forward?

  • Hi,

    The sample does not support nRF52832 out of the box, so you need to add a few configuartions for it. If you add these to prj.conf, the sample should run successfully:

  • Still fails unfortunately this time with error -134 which looks like it is PSA_ERROR_NOT_SUPPORTED

    Here is the entire prj.conf, it's the virgin file from the sample with just the lines you suggested added

    This was pretty simple using SDK17 using nrf_crypto_aes_crypt()...

    What about using a PSK? I was trying to use psa_import_key() but getting errors like the above, until I gave up as I think there's something fundamentally wrong (which seems to be the case as the sample doesn't work)

    For reference, here's the main.c. I want to use my custom board, but for the sake of testing I'm using nRF52DK PCA10040

  • Hi,

    That is odd. I tested again on my end now, and it works. The error is what I would expect without an entropy source, so if CONFIG_ENTROPY_GENERATOR is not set for some reason. Have you made any other changes or forgot to make a pristine build? It should not be needed, but you could also add CONFIG_ENTROPY_NRF5_RNG=y. If that does not work, can you upload the build folder here so that I can have a look?

  • That still didn't work. This is a brand new application using "copy a sample" in VCS. Here are the steps:

    1. Create another new application from sample \nrf\samples\crypto\aes_cbc
    2. Create new build for nRF52DK (generate only)
    3. Modify prj.conf add
      1. CONFIG_MBEDTLS_ENABLE_HEAP=y
      2. CONFIG_MBEDTLS_HEAP_SIZE=4096
      3. CONFIG_ENTROPY_GENERATOR=y
    4. Pristine Build
    5. Flash
    6. Fail
    7. Add CONFIG_ENTROPY_NRF5_RNG=y
    8. Pristine Build
    9. Flash
    10. Fail

    I am using ncs 2.9.0, and right now I am using a PCA10040 board although I started this with my own custom board which has been running code written with SDK17.1 just fine.

    Project zip attached...

    Thanks

    aes_cbc_1.zip

  • Hi,

    I see you have commented out parts of the prj.conf that include important configs. Pleaes refer the sample (and any other changes) and build with the only difference being adding the three lines to prj.conf that I suggested.

1 2