nRF9151 - NCS 3.4.0 - use of CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y

[Achim Kraus]

nRF9151 - NCS 3.4.0

I like to use a library, which uses  

CONFIG_PSA_CRYPTO=y
CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y

with NCS 3.2.4 successfully.

If I try to migrate to NCS 3.4.0 (removing the obsolete CONFIG_NRF_SECURITY) I get compile and/or link errors.

C:/ncs/v3.4.0/modules/crypto/oberon-psa-crypto/oberon/drivers/oberon_check_unsupported.h:475:10: error: #error "No crypto implementation for brainpoolP256r1 public key"
475 | #error "No crypto implementation for brainpoolP256r1 public key"

Using 

CONFIG_PSA_USE_CC3XX_KEY_MANAGEMENT_DRIVER=y

doesn't help, it results in the same error.

If I enable 

CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

I get:

C:/ncs/v3.4.0/modules/crypto/oberon-psa-crypto/include/tf-psa-crypto/build_info.h:146:10: fatal error: psa/crypto_config.h: No such file or directory
146 | #include "psa/crypto_config.h"

So, is it possible to use ECC_BRAINPOOL_P_R1_256 with NCS 3.4.0 PSA?

What is missing, to compile that successful?

[Amanda Hsieh]

Hi Achim, 

is it possible to use ECC_BRAINPOOL_P_R1_256 with NCS 3.4.0 PSA?

Yes, see ECC curve types

I cannot reproduce with the nrf/samples/crypto/ecdsa by

replacing secp256r1 with CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y in prj.conf;

using PSA_ECC_FAMILY_BRAINPOOL_P_R1 for key generation + import;

Unchanged boards/nrf9151dk_nrf9151_ns.conf (already has CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y).

You can verify the Kconfig symbols in build/app_name/zephyr/.config:

• CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y
• CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y
• CONFIG_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY_BRAINPOOL_P_R1_256=y
• CONFIG_PSA_NEED_CC3XX_ECDSA_BRAINPOOL_P_R1_256=y
• CONFIG_PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS=y

Here is my test project: ecdsa-brainpool-verify.7z

“Beware that this code/configuration is not fully tested or qualified and should be considered provided “as-is”. Please test it with your application and let me know if you find any issues.”

Regards,
Amanda H. 

[Achim Kraus]

Thanks a lot, one step further. The lib I want to use, uses also

CONFIG_TFM_CONNECTION_BASED_SERVICE_API=y

and with that, the nrf/samples/crypto/ecdsa fails as well.

C:/ncs/v3.4.0/build/ecdsa/zephyr/include/generated/zephyr/autoconf.h:335:9: warning: "CONFIG_TFM_CONNECTION_BASED_SERVICE_API" redefined
335 | #define CONFIG_TFM_CONNECTION_BASED_SERVICE_API 1
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from C:/ncs/v3.4.0/modules/tee/tf-m/trusted-firmware-m/secure_fw/spm/include/config_spm.h:11,
from C:/ncs/v3.4.0/modules/tee/tf-m/trusted-firmware-m/secure_fw/spm/core/psa_interface_thread_fn_call.c:7:
C:/ncs/v3.4.0/build/ecdsa/tfm/generated/interface/include/config_impl.h:20:9: note: this is the location of the previous definition
20 | #define CONFIG_TFM_CONNECTION_BASED_SERVICE_API 0
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

(The library uses tfm_secure_partition. Maybe I try to add CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y to that sanple.)

[Achim Kraus]

I got the information, that the 3party library will be migrated to v3.4.0 within a couple of weeks. So it's not that important for me to do that on my own ahead. 

Therefore just for curiosity, using "v3.4.0/nrf/samples/zephyr/tfm_integration/tfm_secure_partition" and adding the configs from the ecdsa sample, it compiles without the CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256. But when you add that as well, it fails with:

C:/ncs/v3.4.0/modules/crypto/oberon-psa-crypto/oberon/drivers/oberon_check_unsupported.h:475:10: error: #error "No crypto implementation for brainpoolP256r1 public key"
475 | #error "No crypto implementation for brainpoolP256r1 public key"
| ^~~~~
C:/ncs/v3.4.0/modules/crypto/oberon-psa-crypto/oberon/drivers/oberon_check_unsupported.h:479:10: error: #error "No crypto implementation for brainpoolP256r1 key pair import"
479 | #error "No crypto implementation for brainpoolP256r1 key pair import"
| ^~~~~
C:/ncs/v3.4.0/modules/crypto/oberon-psa-crypto/oberon/drivers/oberon_check_unsupported.h:483:10: error: #error "No crypto implementation for brainpoolP256r1 key pair export"
483 | #error "No crypto implementation for brainpoolP256r1 key pair export"
| ^~~~~
C:/ncs/v3.4.0/modules/crypto/oberon-psa-crypto/oberon/drivers/oberon_check_unsupported.h:487:10: error: #error "No crypto implementation for brainpoolP256r1 key pair generate"
487 | #error "No crypto implementation for brainpoolP256r1 key pair generate"
| ^~~~~

###### modified prj.conf of v3.4.0/nrf/samples/zephyr/tfm_integration/tfm_secure_partition ############

#
# Copyright (c) 2026 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: Apache-2.0
#

CONFIG_BUILD_WITH_TFM=y
CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
CONFIG_TFM_CONNECTION_BASED_SERVICE_API=y

# Enable cryptographic features
CONFIG_PSA_CRYPTO=y
CONFIG_PSA_WANT_ALG_ECDSA=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
CONFIG_PSA_WANT_ECC_SECP_R1_256=y
CONFIG_PSA_WANT_ALG_SHA_256=y
CONFIG_PSA_WANT_GENERATE_RANDOM=y
CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y

[Amanda Hsieh]

Achim Kraus said:

The lib I want to use, uses also

CONFIG_TFM_CONNECTION_BASED_SERVICE_API=y

and with that, the nrf/samples/crypto/ecdsa fails as well.

The ecdsa sample is not suitable for testing TFM configs due to the lack of the partition setting, so this time I use nrf/samples/zephyr/tfm_integration/tfm_secure_partition sample, which already has the right TF-M wiring, and extend prj.conf like this:

# Existing tfm_secure_partition settings
CONFIG_BUILD_WITH_TFM=y
CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
CONFIG_TFM_CONNECTION_BASED_SERVICE_API=y

# Brainpool + CC3XX (same as verified ecdsa-brainpool setup)
CONFIG_PSA_CRYPTO=y
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y
CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256=y
CONFIG_PSA_WANT_ALG_ECDSA=y
CONFIG_PSA_WANT_ALG_SHA_256=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
CONFIG_PSA_WANT_GENERATE_RANDOM=y

boards/nrf9151dk_nrf9151_ns.conf:
 

CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

and add the code regarding PSA_ECC_FAMILY_BRAINPOOL_P_R1 for key generation + import;

After building the project, verify 

• build/app_name/tfm/generated/interface/include/config_impl.h → #define CONFIG_TFM_CONNECTION_BASED_SERVICE_API 1
• build/app_name/zephyr/.config → CONFIG_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY_BRAINPOOL_P_R1_256=y

Got the expected log:

<inf> ecdsa: Starting ECDSA example...
<inf> ecdsa: Generating random ECDSA key pair...
...
<inf> ecdsa: Example finished successfully!
<inf> main: --- Dummy secure partition (connection-based) ---
<inf> main: Digest
                                be 45 cb 26 ...
...
<inf> main: No valid secret for key, received expected error code
<inf> main: All tests PASSED

Here is my test project: tfm-brainpool-verify.7z

“Beware that this code/configuration is not fully tested or qualified and should be considered provided “as-is”. Please test it with your application and let me know if you find any issues.”

[Achim Kraus]

I was not able to make it working on my own, but the supplier of that 3rd party library has now migrated it successful. Unfortunately, I don't know, what made it now working. But I'm happy, that it works,