Hi,
We're trying to implement HMAC signing on a Thingy91X but getting stuck each time on -134 errors. Having read the resource on your docs AI I'm aware of the limitations on TF-M on the Thingy91X, but am not quite clear why it is possible to run the crypto/hmac sample on the nrf9151dk but not on the Thingy91X.
Our final attempt was to load the key from NVS and although the key seems to load, the call to psa_import_key fails again with -134. The docs AI couldn't find anything obviously wrong with the code, so I'm turning to a human for help:-).
Here is my code snippet and prj.conf. Any help would be appreciated.
Thanks in advance,
[00:00:00.847,595] <inf> mqtt: PSA Crypto initialised.
[00:00:00.940,521] <inf> fs_nvs: 2 Sectors of 4096 bytes
[00:00:00.940,521] <inf> fs_[00:00:10.943,206] <inf> mqtt: Loaded HMAC key from NVS (32 bytes)
[00:00:10.943,237] <inf> mqtt: key len: 32 bytes
[00:00:10.943,359] <err> mqtt: Failed to import HMAC key to PSA: -134
[00:00:10.943,389] <err> application: MQTT init failed!
[00:00:10.943,389] <err> main: Application init failed!// Import key from NVS as volatile PSA key
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_usage_flags(&attributes, (PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_VERIFY_HASH));
psa_set_key_algorithm(&attributes, PSA_ALG_HMAC(PSA_ALG_SHA_256));
psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_VOLATILE);
psa_set_key_bits(&attributes, key_len * 8);
LOG_INF("key len: %d bytes", (key_len));
psa_key_id_t key_id;
status = psa_import_key(&attributes, reinterpret_cast<const uint8_t*>(device_secret), key_len, &key_id);
psa_reset_key_attributes(&attributes);
// Clear secret from RAM
memset(device_secret, 0, sizeof(device_secret));
if (status != PSA_SUCCESS) {
LOG_ERR("Failed to import HMAC key to PSA: %d", status);
return false;
}
# Application
CONFIG_MAIN_STACK_SIZE=8192
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=3072
CONFIG_HEAP_MEM_POOL_SIZE=40960
CONFIG_AT_MONITOR_HEAP_SIZE=1024
CONFIG_EVENTS=y
# C++
CONFIG_CPP=y
CONFIG_STD_CPP20=y
CONFIG_REQUIRES_FULL_LIBCPP=n
CONFIG_MINIMAL_LIBCPP=n
# Modem library
CONFIG_MODEM_KEY_MGMT=y
CONFIG_MODEM_INFO=y
CONFIG_MODEM_INFO_ADD_NETWORK=y
CONFIG_NRF_MODEM_LIB=y
CONFIG_NRF_MODEM_LIB_ON_FAULT_RESET_MODEM=y
CONFIG_NRF_MODEM_LIB_TRACE=n
CONFIG_NRF_MODEM_LIB_HEAP_SIZE=4096
# Networking - Mixed offloaded (modem) and native (WiFi)
CONFIG_NETWORKING=y
CONFIG_NET_NATIVE=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_OFFLOAD=y
CONFIG_NET_TCP=y
CONFIG_NET_IPV4=y
CONFIG_NET_IPV6=n
CONFIG_POSIX_API=y
# LTE link control
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_NETWORK_MODE_LTE_M_GPS=y
# MQTT
CONFIG_MQTT_LIB=y
CONFIG_MQTT_LIB_TLS=y
CONFIG_MQTT_CLEAN_SESSION=y
# GPIO and PWM
CONFIG_GPIO=y
CONFIG_PWM=y
CONFIG_GPIO_NRFX=y
# Logging
CONFIG_LOG=y
CONFIG_LOG_DEFAULT_LEVEL=3
CONFIG_USE_SEGGER_RTT=y
CONFIG_LOG_BACKEND_RTT=y
CONFIG_LOG_BACKEND_UART=n
CONFIG_LOG_TIMESTAMP_64BIT=y
CONFIG_LOG_BUFFER_SIZE=4096
# Random number generator
CONFIG_ENTROPY_GENERATOR=y
# Debugging
CONFIG_DEBUG=n
CONFIG_DEBUG_OPTIMIZATIONS=n
CONFIG_DEBUG_THREAD_INFO=n
# Lightweight AT command visibility
CONFIG_AT_MONITOR=y
CONFIG_AT_MONITOR_LOG_LEVEL_INF=n
# Stack monitoring and debugging
CONFIG_INIT_STACKS=n
CONFIG_THREAD_STACK_INFO=n
CONFIG_THREAD_MONITOR=n
CONFIG_THREAD_NAME=y
CONFIG_THREAD_ANALYZER=n
CONFIG_THREAD_ANALYZER_USE_PRINTK=n
CONFIG_THREAD_ANALYZER_AUTO=n
# ===== GNSS Configuration =====
CONFIG_GNSS=y
# nRF Cloud for A-GNSS and WiFi positioning
CONFIG_NRF_CLOUD=y
CONFIG_NRF_CLOUD_MQTT=y
CONFIG_NRF_CLOUD_REST=n
CONFIG_NRF_CLOUD_COAP=n
CONFIG_NRF_CLOUD_AGNSS=y
CONFIG_NRF_CLOUD_LOCATION=y
CONFIG_NRF_CLOUD_CLIENT_ID_SRC_RUNTIME=y
CONFIG_NRF_CLOUD_PROVISION_CERTIFICATES=n
CONFIG_NRF_CLOUD_LOG_LEVEL_DBG=n
# Date/time (required for A-GNSS)
CONFIG_DATE_TIME=y
# JSON parsing for cloud responses
CONFIG_CJSON_LIB=y
# Enable TF-M Crypto module
CONFIG_TFM_CRYPTO_RNG_MODULE_ENABLED=y
# Settings subsystem for nRF Cloud with TF-M
CONFIG_SETTINGS=y
CONFIG_FCB=y
CONFIG_SETTINGS_FCB=y
CONFIG_SETTINGS_RUNTIME=y
# Flash support (TF-M aware)
CONFIG_FLASH=y
CONFIG_FLASH_MAP=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_NVS=y
CONFIG_MPU_ALLOW_FLASH_WRITE=y
# Settings subsystem (NVS backend)
CONFIG_SETTINGS=y
CONFIG_SETTINGS_NVS=y
# NVS configuration
CONFIG_NVS_LOG_LEVEL_DBG=n
# TF-M specific
CONFIG_BUILD_WITH_TFM=y
# ===== Location library =====
CONFIG_LOCATION=y
CONFIG_LOCATION_METHOD_GNSS=y
CONFIG_LOCATION_METHOD_WIFI=y
CONFIG_LOCATION_METHOD_CELLULAR=y
# ===== WiFi Configuration =====
CONFIG_WIFI=y
CONFIG_WIFI_NRF70=y
# Network management for WiFi
CONFIG_NET_L2_ETHERNET=y
CONFIG_NET_MGMT=y
CONFIG_NET_MGMT_EVENT=y
CONFIG_NET_MGMT_EVENT_STACK_SIZE=4096
# Network buffers (required for native WiFi stack)
CONFIG_NET_BUF=y
CONFIG_NET_PKT_RX_COUNT=4
CONFIG_NET_PKT_TX_COUNT=4
CONFIG_NET_BUF_RX_COUNT=8
CONFIG_NET_BUF_TX_COUNT=8
CONFIG_NET_BUF_DATA_SIZE=128
# WiFi credentials
CONFIG_WIFI_CREDENTIALS=n
# Nordic Security Backend (provides actual crypto implementation)
CONFIG_NRF_SECURITY=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y
CONFIG_PSA_WANT_KEY_TYPE_HMAC=y
CONFIG_PSA_WANT_ALG_HMAC=y
CONFIG_PSA_WANT_ALG_SHA_256=y
# Heap monitoring
CONFIG_SYS_HEAP_RUNTIME_STATS=y
CONFIG_SYS_HEAP_LISTENER=y
