RE: nrf_inbuilt_key_delete returns 2 for public certificate type

Håkon Alseth — Thu, 24 Jan 2019 08:19:35 GMT

Glad to hear that it's working as expected now. I've created an internal bug on the behavior you're seeing, as it should not have been necessary to remove the build folder.

Kind regards,

Håkon

RE: nrf_inbuilt_key_delete returns 2 for public certificate type

kristian_meshtech — Wed, 23 Jan 2019 14:00:33 GMT

I re-created the /build folder for the segger project AND switched to another dev. kit - and now it works.

The current dev kit is version 0.7.0. The one I got the error was a newer version.

RE: nrf_inbuilt_key_delete returns 2 for public certificate type

kristian_meshtech — Wed, 23 Jan 2019 13:08:28 GMT

I agree that on the first run through the code, I get return code 2. After a reset, however, I would expect all delete calls to return 0.

RE: nrf_inbuilt_key_delete returns 2 for public certificate type

Håkon Alseth — Wed, 23 Jan 2019 12:41:32 GMT

As I read your code, you call _delete() without knowing if the certs are present.

Here's the docs for the API call return code 2 (ENOENT):

* @retval NRF_ENOENT If there was no credential associated with the sec_tag and cred_type.

Getting a return code in your scenario would be expected.

Kind regards,

Håkon

RE: nrf_inbuilt_key_delete returns 2 for public certificate type

kristian_meshtech — Wed, 23 Jan 2019 12:04:22 GMT

const char *tcxn_ca_certificate = {
"-----BEGIN CERTIFICATE-----\r\n"
"MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF\r\n"
"ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6\r\n"
"b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTEL\r\n"
"MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv\r\n"
"b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj\r\n"
"ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM\r\n"
"9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw\r\n"
"IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6\r\n"
"VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L\r\n"
"93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm\r\n"
"jgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\r\n"
"AYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3DQEBCwUA\r\n"
"A4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDI\r\n"
"U5PMCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUs\r\n"
"N+gDS63pYaACbvXy8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vv\r\n"
"o/ufQJVtMVT8QtPHRh8jrdkPSHCa2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU\r\n"
"5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpy\r\n"
"rqXRfboQnoZsG4q5WTP468SQvvG5\r\n"
"-----END CERTIFICATE-----\r\n"
};

const char *tcxn_client_certificate = {
"-----BEGIN CERTIFICATE-----\n"
"MIIDWTCCAkGgAwIBAgIUFBSfKgH3sUcwMzyvgY6uYEnqASIwDQYJKoZIhvcNAQEL\n"
"BQAwTTFLMEkGA1UECwxCQW1hem9uIFdlYiBTZXJ2aWNlcyBPPUFtYXpvbi5jb20g\n"
"SW5jLiBMPVNlYXR0bGUgU1Q9V2FzaGluZ3RvbiBDPVVTMB4XDTE5MDEyMzA4NTQz\n"
"MloXDTQ5MTIzMTIzNTk1OVowHjEcMBoGA1UEAwwTQVdTIElvVCBDZXJ0aWZpY2F0\n"
"ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMJWFrqctZUPAuQj+LyP\n"
"S3+nlhmZ0uG2qrQoiVR86Pe1MskXk7yDsyNqYtaWdoofuDZaUdnemvNmjEBO0Ms7\n"
"0aDCPLHS8o+Yk0ItVUnPJru0nMuQXRqxEgTIkpI8AQlBD11bza3QXrd4cCtDjvTL\n"
"vw4MnsnYENiUJIkTEt+D/RAzrzwEbZxdlFqRKnGTJOaYxJ736RxjVRGIp1o/VoPT\n"
"AmuhXeyQZEhqu1gsPhBhtO4NK0+sv84vhGwQcwl8yGaTqTRyTHsrcENaNFYDAkkX\n"
"soJo2T6jIHJUGKIq68XWNvu/tvEXh4Dgvzf/bFd7SIN+0OwmG8by5rBwR0NJIq0O\n"
"ynkCAwEAAaNgMF4wHwYDVR0jBBgwFoAUtgCcRnLp7Lys19niiRGYz23ME68wHQYD\n"
"VR0OBBYEFCJa9tPWc1pzU3/4dOXjYKJVIXLHMAwGA1UdEwEB/wQCMAAwDgYDVR0P\n"
"AQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IBAQBbfTACHn8uw1zDut7o9vL03w27\n"
"1P9yiA3XmKQIRmR3gcisRUy0xci6/o0H8HxrF/3NxkQomXyqkWM2+Dg06iUGz/xD\n"
"Yz1RpIRxxmFxgiIzo4WX30qxpXVQmAO9IO+ZaGWbNl0qqp3kIwFB8R5pzKzCuuf/\n"
"WSGneeBIcjcpP6jNG6MK3uEcViPLeMfPP1KuLYss7Wa/zR1pj1fXDrNjNx/R3IdA\n"
"oTdJ16FXIgO5AKhyv/RAUJJzRqncTJQiTXJ/2TclNfJFdUBBuU8pDajHv8aFIbfK\n"
"YpBvE9Qe07IbdaduPvC4qoj7axRf0jsDI/Ivg3Ix3EeNDmES7wHptDhdxjwG\n"
"-----END CERTIFICATE-----\n"
};

/* Delete certificates */
    nrf_sec_tag_t sec_tag = 2000;

    int err;

    for (nrf_key_mgnt_cred_type_t type = 0; type < 5; type++) 
    {
        err = nrf_inbuilt_key_delete(sec_tag, type);
        log("nrf_inbuilt_key_delete(%lu, %d) => result=%d\n", sec_tag, type, err);
    }
            
    // Provision CA Certificate
    err = nrf_inbuilt_key_write(sec_tag, NRF_KEY_MGMT_CRED_TYPE_CA_CHAIN,
                (uint8_t *)tcxn_ca_certificate, strlen(tcxn_ca_certificate));
    
    log("nrf_inbuilt_key_write (%d): %d\n", NRF_KEY_MGMT_CRED_TYPE_CA_CHAIN, err);
    
    if (err) 
    {
        log("CA_CERTIFICATE error!\n");
        return err;
    }

    // Provision Private Certificate
    err = nrf_inbuilt_key_write(sec_tag, NRF_KEY_MGMT_CRED_TYPE_PRIVATE_CERT,
        (uint8_t *)tcxn_client_private_key, strlen(tcxn_client_private_key));
    
    log("nrf_inbuilt_key_write (%d): %d\n", NRF_KEY_MGMT_CRED_TYPE_PRIVATE_CERT, err);

    if (err)
    {
        log("CLIENT_PRIVATE_KEY error!\n");
        return err;
    }

    // Provision Public Certificate
    err = nrf_inbuilt_key_write(sec_tag, NRF_KEY_MGMT_CRED_TYPE_PUBLIC_CERT,
        (uint8_t *)tcxn_client_certificate, strlen(tcxn_client_certificate));
    
    log("nrf_inbuilt_key_write (%d): %d\n", NRF_KEY_MGMT_CRED_TYPE_PUBLIC_CERT, err);

    if (err) 
    {
        log("CLIENT_PUBLIC_CERTIFICATE error!\n");
        return err;
    }

You need to put in some string for the private key. The deletes will all return 2 for the first run. For the second run, all 3 should return 0.

RE: nrf_inbuilt_key_delete returns 2 for public certificate type

Håkon Alseth — Wed, 23 Jan 2019 11:53:32 GMT

Hi,

I just did a quick test to see if I could recreate the issue:

	printk("Keys write erase test\n");
	u32_t ret = nrf_inbuilt_key_write(1001, NRF_KEY_MGMT_CRED_TYPE_PUBLIC_CERT, "abcd", 4);
	
	printk("Ret: %d\n", ret);

	ret = nrf_inbuilt_key_delete(1001, NRF_KEY_MGMT_CRED_TYPE_PUBLIC_CERT);

	printk("Ret: %d\n", ret);

In both write and delete, the ret is '0'. Could you share your code so I can have a look?

Kind regards,

Håkon