Struggling with encryption, nrf52840 using ncs 1.3.1

RE: Struggling with encryption, nrf52840 using ncs 1.3.1

Heidi — Fri, 23 Oct 2020 08:03:33 GMT

Hm, okay. That sounds strange, but as long as it's working for you!

If you want, I can read through your .config file (which yes, is the complete list of configurations in the build) to check.

Let me know if there's anything else I can do for you. :)

RE: Struggling with encryption, nrf52840 using ncs 1.3.1

basvkesteren — Thu, 22 Oct 2020 15:11:28 GMT

Hello Heidi,

I have to admit that the build-system isn't 100% clear to me (still learning...), but the build/zephyr/.config file (which, as far as i understand it, is the actual config file after all the build-system magic has happened) contains CONFIG_CC310_BACKEND=y

In my prj.conf file I have, among others, CONFIG_NORDIC_SECURITY_BACKEND=y

As far as i can tell there are no other lines in my prj.conf file that do anything encryption-related

Thanks,

-Bastiaan

RE: Struggling with encryption, nrf52840 using ncs 1.3.1

Heidi — Thu, 22 Oct 2020 14:20:44 GMT

Hi!

CONFIG_CC3XX_BACKEND will select CONFIG_CC310_BACKEND when SOC_NRF52840 && NORDIC_SECURITY_BACKEND is true, see here. So it's just a more general configuration.

[quote user="basvkesteren"]Enabling CONFIG_NORDIC_SECURITY_BACKEND automagically enables CONFIG_CC310_BACKEND for me, so i think i already have the setting you mean enabled?[/quote]

Are you sure? In the documentation, it doesn't look like this configuration selects the CC310_BACKEND. Perhaps you have something else enabled that does it.

Best regards,

Heidi

RE: Struggling with encryption, nrf52840 using ncs 1.3.1

basvkesteren — Wed, 21 Oct 2020 07:57:13 GMT

Hello Heidi,

Thanks for the response! But, I'm not quite getting it (sorry... ;) )

Is the CONFIG_CC310_BACKEND the same as CONFIG_CC3XX_BACKEND? Because i cant find the latter...?

Enabling CONFIG_NORDIC_SECURITY_BACKEND automagically enables CONFIG_CC310_BACKEND for me, so i think i already have the setting you mean enabled?

Thanks,

-Bastiaan

RE: Struggling with encryption, nrf52840 using ncs 1.3.1

Heidi — Tue, 20 Oct 2020 17:38:24 GMT

Hi!

Right now, you only have nrf_oberon enabled as backend, which only runs in software To use the CC310 module, you need to enable the Arm CryptoCell cc3xx backend, by enabling CONFIG_CC3XX_BACKEND.

The functions you are calling (mbedtls_aes_setkey_enc and mbedtls_aes_crypt_cbc) are part of the mbed TLS glue layer (API reference), which allows you to use both the HW and SW implementations simultaneously, which means you can have both of these backends enabled in your application.

When you have multiple backends available, the mbed TLS glue layer enables a dynamic check to verify whether the cryptographic algorithm is supported in hardware. For instance, the cc3xx backend is limited to key sizes of 128 bits on devices with CC310. In this case, the layer will call into a different enabled backend (nrf_oberon) as a fallback.

Let me know if this clears things up for you!

Best regards,

Heidi

RE: Struggling with encryption, nrf52840 using ncs 1.3.1

basvkesteren — Fri, 16 Oct 2020 15:38:45 GMT

Ah, it seems that enabling the oberon stuff (CONFIG_NRF_OBERON=y, CONFIG_OBERON_BACKEND=y) does wonders;

The mbedtls_aes_setkey_enc/mbedtls_aes_crypt_cbc code now works, have not tested the mbedtls_cipher API bu t I assume that works aswell.

Does this mean my code doesn't work on the CC310 module? As I understand it, I'm doing AES-128 here, and the CC310 should support that, right?