nRF9160 LwM2M with mbedtls

RE: nRF9160 LwM2M with mbedtls

Didrik Rokhaug — Fri, 13 Mar 2020 12:13:58 GMT

I got an answer from one of our developers to my questions. Note that this is mostly speculation as we have not done much (if any) testing of this:

None of our current chips has tamper-proof physical memory AFIK meaning our chips can be decapped and read with the right amount of motivation. TLS keys stored in the modem can theoretically be read out this way.

While we (again, as far as me and the SDK developer that answered knows) do not have tamper-proof physical memory, the keys are stored in the modem, and the application is not allowed to read them back. So unless you are afraid of people physically accessing the flash, it is not possible to access the keys. The relevant AT commands for this are %XPMNG, %CMNG, and %XPRODDONE. In the future, %XSUDO will also be relevant.

To me, it sounds like what they want is just to use is the RAW socket type which you can build your own TLS instance ontop of with libraries like mbedTLS or your own implementation. Be warned that I have no experience in actually doing this but it's at least what I got from reading the documentation and heard from sprint reviews is that you should be able to put your own TLS ontop of RAW sockets.

RE: nRF9160 LwM2M with mbedtls

Fabian Frei — Tue, 10 Mar 2020 13:02:53 GMT

Hello Didrik

Thank you for your response. I'm currently having a look at the bsdlib implementation according to your input.

In the end, we want to outsource security features such as key storage to a secure element (which offers physically tamper-proof memory).

We have already done that in other projects by using mbedtls and setting up a bunch of corresponding software hooks. So, make the nRF9160 use the zephyr sockets with mbedtls instead of offloading the sockets seems like the most "straight forward" approach. Of course I'm open for any other reasonable approach.

RE: nRF9160 LwM2M with mbedtls

Didrik Rokhaug — Tue, 10 Mar 2020 09:28:50 GMT

I am still working on getting you a proper answer.

However, I am wondering why you do not want to use socket offloading?

RE: nRF9160 LwM2M with mbedtls

Didrik Rokhaug — Mon, 09 Mar 2020 13:27:57 GMT

Hi.

While I have to do some more investigation before I can answer your questions, I can comment on the error you are seeing.

In bsdlib (the socket interface to the modem), we define a couple of extra socket types for GPS and AT commands. When you disable socket offloading, these new socket types no longer "exist".

You can change this by modifying the at_cmd library to use nrf_sockets instead of "normal" socket. It should not be more than changing all the socket related calls the corresponding nrf_socket call (which should be as simple as adding "nrf_" in front of the call), and including nrf_socket.h instead of net/socket.h.

I'll come back to you when I know more about how to not offload the sockets.

Best regards,

Didrik