nRF52840 nRF Connect SDK/Zephyr random number generation

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

Marte Myrvold — Fri, 18 Dec 2020 10:54:51 GMT

Hi,

I'm sorry, I misunderstood your question and answered about the RNG in CryptoCell, not the RNG peripheral that all the nRF5 SoCs have.

It's correct that the RNG is also a TRNG (true random number generator), but the TRNG and RNG are implemented differently. The RNG peripheral isn't implemented according to the same NIST standards as the CryptoCell RNG is. The RNG peripheral is used by the BLE stack, and used as the only entropy source in other nRF52 SoCs.

Best regards,

Marte

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

basvkesteren — Mon, 14 Dec 2020 10:11:32 GMT

Hi Marte,

Thanks! This _almost_ answers my last question 🙂

I get the link between the PRNG and TRNG, but how does the RNG (https://infocenter.nordicsemi.com/index.jsp?topic=%2Fps_nrf52840%2Frng.html&cp=4_0_0_5_20) fit into all this. Both the TRNG and RNG are 'true random', according to the datasheet, and 'suitable for cryptographic purposes'.

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

Marte Myrvold — Mon, 14 Dec 2020 10:04:49 GMT

Hi,

Great to hear that you managed to get it to work, and thank you for explaining it here so others can see it!

Regarding your question about TRNG and RNG, TRNG is used to seed RNG, as a form of PRBS (pseudorandom binary sequence). If you take a look at this link you'll find the following:

True random number generator (TRNG) compliant with NIST 800-90B, AIS-31, and FIPS 140-2
Pseudorandom number generator (PRNG) using underlying AES engine compliant with NIST 800-90A

So to conclude, PRNG uses TRNG for seeding, as well as AES as a part of the process to make pseudorandom numbers, and then regularly reseeds from TRNG.

Hope this answers your question!

Best regards,

Marte

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

basvkesteren — Fri, 11 Dec 2020 14:22:47 GMT

To update (and close) this ticket: I now have correctly behaving random numbers.

I was using nrf_cc310_platform_entropy_get(), which works, but is rather slow. Getting 32 random bytes took close to 100ms, way too much thus breaking my protocol... The correct way (as far as i know) is to use the zephyr entropy driver (the one I could not get to work earlier).

Using ncs 1.4.0, in my prj.conf I have the following relevant settings:

CONFIG_ENTROPY_GENERATOR=y
CONFIG_ENTROPY_NRF5_THR_POOL_SIZE=64
CONFIG_ENTROPY_NRF5_THR_THRESHOLD=32

This uses the RNG perhiperal. The pool (with size as defined above) will be filled in the background. When using entropy with entropy_get_entropy(), you read bytes from this pool. When the pool drops below the configured threshold (as defined above) it starts to fill back up.

This avoids the slowness I was experiencing. I need blocks of 32 bytes, therefore I've configured the pool-size to be twice that, and the threshold to be exactly that. Thus, I should always have atleast one block of random bytes available.

What I'm not quite sure about is how the cryptocell's RNG perhiperals fit into this... Both the cryptocell's TRNG and the RNG provide true randomness, according to the datasheet. Duplicated functionality?

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

Marte Myrvold — Thu, 15 Oct 2020 07:12:51 GMT

Hi Hayden,

As of now, there's only one example that generates random numbers, namely the Secure Services example. However, this example is for the nRF9160 DK and uses the Secure Partition Manager to get random numbers.

If you're still experiencing problems with generating random numbers, please open a new support ticket with your problem.

Best regards,

Marte

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

Hayden Ball — Tue, 13 Oct 2020 09:41:41 GMT

Marte Myrvold is there a sample showing how to generate a random number using the CC310 entropy driver, please?

I've set `CONFIG_ENTROPY_GENERATOR` and `CONFIG_CC310_BACKEND`, but calls to `sys_rand_get` fail.

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

Marte Myrvold — Mon, 12 Oct 2020 14:52:36 GMT

Hi Bastiaan,

I can't give you an exact date for when it will be released, but you can contact your regional sales manager for roadmap details. You can also follow the development on our github.

Best regards,

Marte

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

basvkesteren — Mon, 12 Oct 2020 09:13:40 GMT

Hi Marte,

Thanks, I have a working setup now: just performed my first SHA-256 hash 🙂 When is NCS 1.4.0 expected?

Thanks,

-Bastiaan

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

Marte Myrvold — Mon, 12 Oct 2020 08:43:32 GMT

Hi Bastiaan,

Great to hear that you have random numbers now!

The fix for that issue will come in NCS v1.4.0, so unfortunately you will have to use command line for now. There's a guide on how to do this here.

Best regards,

Marte

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

basvkesteren — Fri, 09 Oct 2020 15:42:20 GMT

Hi Marte,

Yay, I have random numbers. Apparently i went into the wrong direction when using the Zephyr entropy stuff, that didn't work. But calling nrf_cc310_platform_init() and then using nrf_cc310_platform_entropy_get() directly gives me random numbers, so that's good enough for me 🙂

Next step: encryption.. When I enable CONFIG_NORDIC_SECURITY_BACKEND I run into a compilation trouble, seems to be an existing problem:

https://devzone.nordicsemi.com/f/nordic-q-a/63781/ncs1-3-0----mbedtls_config_file----include-expects-filename-or

I already replied there, but; is there a fix for this?

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

basvkesteren — Fri, 09 Oct 2020 08:41:18 GMT

Hi Marte,

Thanks! But, one more question, though...

Can you quide me through how to enable/use this? I'm a newbie to both zephyr and it's build-system, so I'm probably missing a lot of stuff that should be obvious here...

The API documentation says "When used on nRF52840, the entropy_cc310 driver gathers entropy by using the CC310 hardware through the nrf_cc310_platform library.". That seems to be the NRF_CC310_PLATFORM config setting, which says 'to use, link with nrfxlib_crypto in CMAKE'. How to i do that?

I did try to implement some entropy-code (with zephyr\samples\drivers\entropy as an example), but sofar I can't get that to work...

device_get_binding("HW_CC310_0");

cannot find the device: The device exists, but the binding fails because dev->driver_api is null in z_impl_device_get_binding

RE: nRF52840 nRF Connect SDK/Zephyr random number generation

Marte Myrvold — Fri, 09 Oct 2020 06:38:21 GMT

Hi Bastiaan,

You can use the CC310 entropy driver (entropy_cc310) to generate random numbers.

Best regards,

Marte