nrfxlib: Nordic Security Backend

[trembel]

Hi,

I'm trying to use the Nordic Security Backend, such that a change to CC-312, if availble soon, would be easy. However I get following error after enabling

CONFIG_NORDIC_SECURITY_BACKEND=y

:

/path/to/nrf_connect_sdk/nrfxlib/nrf_security/src/backend/nrf5x/entropy_nrf5x.c:11:15: error: unknown type name 'defined'
   11 | static_assert(defined(CONFIG_ENTROPY_GENERATOR), "CONFIG_ENTROPY_GENERATOR is not enabled.");
      |               ^~~~~~~

It works on compiling for nRF52840, but fails also on nRF52832.

[Einar Thorsrud]

Hi,

Can you elaborate on this? The nRF52832 does not have CryptoCell, but you can use the Nordic Security Backend without it as well, if you set CONFIG_MBEDTLS_VANILLA_BACKEND to true.

[trembel]

I'm trying to write a generic code for the nRF5340, such that on a later NCS version the (hopefully) supported CryptoCell-312 can be used - without changing the Source Code.

To see if the error does only happen on the nRF5340, I tried it with compiling for nRF52840 and nRF52832. For the nRF52840 this worked well, since CONFIG_NORDIC_SECURITY_BACKEND automatically selects the CryptoCell as backend.

For the nRF5340 and nRF52832 I got the above error. CONFIG_MBEDTLS_VANILLA_BACKEND is automatically selecte, if the CryptoCell is not available.

[Einar Thorsrud]

I see. The idea is that you should use the mbedTLS API regardless of backed and that the Nordic security module will provide this integration with CC312. So if you are developing now and want to have to do to a minimal amount of changes later, then using the Nordic security module with embedTLS SW backend, for now, is probably the most sensible. Then it should be a small matter to change to CC312 when support is made available.

[trembel]

Do you mean mbedTLS API?

My error above resolved itself after an update to the latest master branch.

If using the Nordic Security Backend, how can CCM be used (since there is no config flag)?

[Einar Thorsrud]

trembel said:

Do you mean mbedTLS API?

Yes, I fixed the typo in my previous answer.

trembel said:

If using the Nordic Security Backend, how can CCM be used (since there is no config flag)?

Can you elaborate? Were you looking for CONFIG_MBEDTLS_CCM_C and CONFIG_VANILLA_MBEDTLS_CCM_C?

[trembel]

Dumb me, I was looking in (Top) → Modules → Nordic nrfxlib → Nordic Security → Use Nordic provided security backend → AES - Advanced Encryption Standard and have not seen AEAD. Thanks for your help!