Provisioning a X25519 key pair in KMU

[Ramakrishnan]

ncs\v3.4.0\nrf\scripts\generate_psa_key_attributes.py doesn't seem to support X25519 PsaKeyType and allowing it to be used with ECDH algorithm. Is this just functionality that is not just added or is there any specific reason for not allowing it ? I tried modifying the script to allow it and it gets provisioned as the cracen driver is supporting it.  I would like to know if there are any issues in doing this .

D:\ncs\v3.4.0\nrf\subsys\nrf_security\src\drivers\cracen\cracenpsa\src\cracen_psa_kmu.c.  

#ifdef PSA_NEED_CRACEN_ECDH

    case PSA_ALG_ECDH:

        if (!can_derive(key_attr) ||

            (PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(key_attr)) !=

                 PSA_ECC_FAMILY_SECP_R1 &&

             PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(key_attr)) !=

                 PSA_ECC_FAMILY_MONTGOMERY)) {

            return PSA_ERROR_NOT_SUPPORTED;

        }

        metadata->algorithm = METADATA_ALG_ECDH;

        break;

[Amanda Hsieh]

Hi, 

The developer added test vectors for x25519 and successfully ran a few ECDH KMU tests on nRF54L15. This confirms that nrfutil-provisioned x25519 KMU keys are working as expected. Note that it's only tested RAW keys with PERSISTENCE_DEFAULT.

In generate_psa_key_attributes.py, add:

and

To generate the key, call the script like this:

python3 generate_psa_key_attributes.py --id 5 --type ECC_KEY_PAIR_MONTGOMERY --key-bits 255 --algorithm ECDH --location LOCATION_CRACEN_KMU --persistence PERSISTENCE_DEFAULT --cracen-usage RAW --key 0xa546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4 --file out.txt --usage DERIVE

The used key_pair is taken from RFC-7748

We will create a PR that updates the generate_psa_key_attributes.py to include x25519 for ECDH sometime this sprint (next 2 weeks).

-Amanda H.

[Ramakrishnan]

Okay.  That's helpful. Thank you for trying it out and confirming.