nRF9151 - NCS 3.4.0 - use of CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y

[Achim Kraus]

nRF9151 - NCS 3.4.0

I like to use a library, which uses  

CONFIG_PSA_CRYPTO=y
CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y

with NCS 3.2.4 successfully.

If I try to migrate to NCS 3.4.0 (removing the obsolete CONFIG_NRF_SECURITY) I get compile and/or link errors.

C:/ncs/v3.4.0/modules/crypto/oberon-psa-crypto/oberon/drivers/oberon_check_unsupported.h:475:10: error: #error "No crypto implementation for brainpoolP256r1 public key"
475 | #error "No crypto implementation for brainpoolP256r1 public key"

Using 

CONFIG_PSA_USE_CC3XX_KEY_MANAGEMENT_DRIVER=y

doesn't help, it results in the same error.

If I enable 

CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

I get:

C:/ncs/v3.4.0/modules/crypto/oberon-psa-crypto/include/tf-psa-crypto/build_info.h:146:10: fatal error: psa/crypto_config.h: No such file or directory
146 | #include "psa/crypto_config.h"

So, is it possible to use ECC_BRAINPOOL_P_R1_256 with NCS 3.4.0 PSA?

What is missing, to compile that successful?

[Amanda Hsieh]

Hi Achim, 

is it possible to use ECC_BRAINPOOL_P_R1_256 with NCS 3.4.0 PSA?

Yes, see ECC curve types

I cannot reproduce with the nrf/samples/crypto/ecdsa by

replacing secp256r1 with CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y in prj.conf;

using PSA_ECC_FAMILY_BRAINPOOL_P_R1 for key generation + import;

Unchanged boards/nrf9151dk_nrf9151_ns.conf (already has CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y).

You can verify the Kconfig symbols in build/app_name/zephyr/.config:

• CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y
• CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y
• CONFIG_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY_BRAINPOOL_P_R1_256=y
• CONFIG_PSA_NEED_CC3XX_ECDSA_BRAINPOOL_P_R1_256=y
• CONFIG_PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS=y

Here is my test project: ecdsa-brainpool-verify.7z

“Beware that this code/configuration is not fully tested or qualified and should be considered provided “as-is”. Please test it with your application and let me know if you find any issues.”

Regards,
Amanda H. 

[Achim Kraus]

Thanks a lot, one step further. The lib I want to use, uses also

CONFIG_TFM_CONNECTION_BASED_SERVICE_API=y

and with that, the nrf/samples/crypto/ecdsa fails as well.

C:/ncs/v3.4.0/build/ecdsa/zephyr/include/generated/zephyr/autoconf.h:335:9: warning: "CONFIG_TFM_CONNECTION_BASED_SERVICE_API" redefined
335 | #define CONFIG_TFM_CONNECTION_BASED_SERVICE_API 1
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from C:/ncs/v3.4.0/modules/tee/tf-m/trusted-firmware-m/secure_fw/spm/include/config_spm.h:11,
from C:/ncs/v3.4.0/modules/tee/tf-m/trusted-firmware-m/secure_fw/spm/core/psa_interface_thread_fn_call.c:7:
C:/ncs/v3.4.0/build/ecdsa/tfm/generated/interface/include/config_impl.h:20:9: note: this is the location of the previous definition
20 | #define CONFIG_TFM_CONNECTION_BASED_SERVICE_API 0
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

(The library uses tfm_secure_partition. Maybe I try to add CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y to that sanple.)