psa_hash_compute with 8k message got error -141 built with nrf54l15dk_nrf54l15_cpuapp_ns target

[Sophak]

I am implementing sha256 with hash message bigger than or equal to 8KB. I tried with nrf54l15dk_nrf54l15_cpuapp target, and it's working fine but if I try with nrf54l15dk_nrf54l15_cpuapp_ns I got an error -141(PSA_ERROR_INSUFFICIENT_MEMORY). Likewise, I tried on sample code and got the same error: C:\ncs\v2.9.1\nrf\samples\crypto\sha256

Device: nRF54L15-DK

NCS: V2.9.1

int hash_singlepart_sha256(void)
{
    uint32_t olen;
    psa_status_t status;

    uint8_t* ptrs = malloc(1024 * 8);
    if(ptrs == NULL) {
        LOG_INF("Malloc Error %d...", 1024 * 8);
    }

    memset(ptrs, 1, 8 * 1024);


    LOG_INF("Hashing using SHA256...");

    /* Calculate the SHA256 hash */
    status = psa_hash_compute(
        PSA_ALG_SHA_256, ptrs, 1024 * 8, m_hash, sizeof(m_hash), &olen);
    if (status != PSA_SUCCESS) {
        LOG_INF("psa_hash_compute failed! (Error: %d)", status);
        return APP_ERROR;
    }

    LOG_INF("Hashing successful!");
    PRINT_HEX("SHA256 hash", m_hash, sizeof(m_hash));

    return APP_SUCCESS;
}

Could you please help and advise?

Thanks,

Sophak

[Håkon Alseth]

Hi,

 

Looks like the TFM image needs to be adjusted to handle such a large buffer.

Try to adjust CONFIG_TFM_CRYPTO_IOVEC_BUFFER_SIZE to a higher size, and see if this works.

 

Kind regards,

Håkon

[Sophak]

Thank you so much for your help.

I have tested by set CONFIG_TFM_CRYPTO_IOVEC_BUFFER_SIZE to 16KB and able to compute hash with message 8KB.

Best regards,

Sophak

[Sophak]

Hello Håkon,

I have another problem when build project with nrf54l15dk_nrf54l15_cpuapp_ns target.

#1 - I set enable mbedtls, but on the log it always set false.

CONFIG_MBEDTLS_USE_PSA_CRYPTO=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y

#2 - I want to use low level driver on cracen library to handle my custom cryptography logic such as: 

#include <cracen/mem_helpers.h>
#include <cracen/statuscodes.h>
#include <sicrypto/drbghash.h>
#include <sicrypto/ecdsa.h>
#include <sicrypto/ed25519.h>
#include <sicrypto/ik.h>
#include <sicrypto/internal.h>
#include <sicrypto/rsapss.h>
#include <sicrypto/rsassa_pkcs1v15.h>
#include <sicrypto/sicrypto.h>
#include <silexpk/blinding.h>
#include <silexpk/ec_curves.h>
#include <silexpk/ed25519.h>
#include <silexpk/ik.h>
#include <silexpk/sxbuf/sxbufop.h>
#include <silexpk/sxops/eccweierstrass.h>
#include <sxsymcrypt/sha1.h>
#include <sxsymcrypt/sha2.h>
#include <sxsymcrypt/trng.h>

I am able to use all this API from when I build with nrf54l15dk_nrf54l15_cpuapp but when I build with nrf54l15dk_nrf54l15_cpuapp_ns, I got no such file or directory during build time.

Could you please help to check and advise for all this issue?

 

Thanks and Best Regards,

Sophak

[Håkon Alseth]

Hi,

 

It looks like the listing is a visual error? Atleast on my side, the symbols are indeed set.

I checked for both symbols when building sha256 for nrf54l15dk/nrf54l15/cpuapp/ns:

$ grep -r -e CONFIG_MBEDTLS_USE_PSA_CRYPTO -e CONFIG_MBEDTLS_PSA_CRYPTO_C

...
build/sha256/zephyr/.config:CONFIG_MBEDTLS_PSA_CRYPTO_C=y
build/sha256/zephyr/.config:CONFIG_MBEDTLS_USE_PSA_CRYPTO=y
...

 

Sophak said:

I am able to use all this API from when I build with nrf54l15dk_nrf54l15_cpuapp but when I build with nrf54l15dk_nrf54l15_cpuapp_ns, I got no such file or directory during build time.

CRACEN is a secure only peripheral:

https://docs.nordicsemi.com/bundle/ps_nrf54L15/page/cracen.html#ariaid-title21

and cannot directly be accessed from a non-secure application.

 

Any sort of interfacing towards crypto when running secure/non-secure split will have to use a non-secure callable function.

 

Kind regards,

Håkon

[Sophak]

Hello Håkon,

Have implemented it in secure application and implement non-secure callable function for call from non-secure application, but it still the problem.

Thanks and Regards

Sophak

[Håkon Alseth]

Hi Sophak,

 

Can you share your .config file?

 

Kind regards,

Håkon

[Sophak]

Hello Håkon,

Here is the config file

3603.prj.conf

Thanks and regards,

Sophak

[Håkon Alseth]

Hi Sophak,

 

Do you have CONFIG_PSA_CRYPTO_DRIVER_CRACEN selected in your project?

sec_spi.c::9 seems to trigger this error. Do you have a guard against if this is only imported for the secure build (check for CONFIG_TRUSTED_EXECUTION_SECURE) ?

 

Kind regards,

Håkon

[Sophak]

Hello Håkon,

Yes, I have selected CONFIG_PSA_CRYPTO_DRIVER_CRACEN in the project.

nrf54l15dk_nrf54l15_cpuapp_ns.conf

Yes, sec_spi.c is my source implement in secure partition (TFM secure peripheral) and I have included low level CRECAN driver in that file. That is why error triggered on that file.

#include <cracen/mem_helpers.h>
#include <cracen/statuscodes.h>
#include <sicrypto/drbghash.h>
...

Yes, It should import to the secure build only. CONFIG_TRUSTED_EXECUTION_SECURE is enabled

but the problem still occurred.

Thanks,

Sophak

[Håkon Alseth]

Hi,

 

#include cracen/*.h shall only be executed in a secure side firmware, it cannot be included in a non-secure firmware. Given your original statement:

Sophak said:

I am able to use all this API from when I build with nrf54l15dk_nrf54l15_cpuapp but when I build with nrf54l15dk_nrf54l15_cpuapp_ns, I got no such file or directory during build time.

Ie. that you can compile for _cpuapp, but not for _cpuapp_ns, it does indicate that you are including this file for both secure and non-secure firmware.

 

Could you double check this?

 

Kind regards,

Håkon