nRF9160 RSA signing data CC310

[aldras]

I am currently working on a project that involves RSA signing data before POSTing it to a PHP web server.

I believe this uses the CC310 cryptography hardware in the nRF9160, but even if the RSA signature takes time to complete it is not an issue.

I have dug around a lot today and have come up with what I think is a good start for this, at this link.

https://devzone.nordicsemi.com/f/nordic-q-a/69657/mbedtls-rsa-trouble-mbedtls_rsa_import-mbedtls_rsa_complete-fails/287781#287781

I am currently using nRF9160 SDK v1.5.0 and have been trying to compile a working sample.  I am uploading the file.

Ultimately the goal is to be able to sign arbitrary data to be POSTed to a PHP server with an RSA private key and using this as a starting point for that development, does this seem possible?

Then the nRF9160 will retrieve the result from the server and write the data to an SD card (the SD card functionality has no issues).

The error that I am encountering is

/opt/nordic/ncs/v1.5.0/toolchain/bin/../lib/gcc/arm-none-eabi/9.2.1/../../../../arm-none-eabi/bin/ld: modules/nrfxlib/nrf_security/src/mbedtls/libmbedtls_base_vanilla.a(entropy.c.obj): in function `mbedtls_entropy_init':
/opt/nordic/ncs/v1.5.0/mbedtls/library/entropy.c:115: undefined reference to `mbedtls_hardware_poll'

The zip project should be extracted here and use the following command to build it.

/opt/nordic/ncs/v1.5.0/nrf/samples/nrf9160/rsa_test

6470.rsa_test_20210328.zip

west build -b nrf9160dk_nrf9160ns -p

I am also copying the proj.conf here as I believe the issue is in this file, but I don't know what to change.

# Logging
CONFIG_LOG=y
CONFIG_LOG_IMMEDIATE=y

# Debugging
CONFIG_ASSERT=y
CONFIG_STACK_SENTINEL=y
CONFIG_DEBUG_OPTIMIZATIONS=y
CONFIG_LOG_PRINTK=y

# Heap
CONFIG_MAIN_STACK_SIZE=8192
CONFIG_HEAP_MEM_POOL_SIZE=8192
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192

# Entropy
CONFIG_ENTROPY_GENERATOR=y
#CONFIG_ENTROPY_NRF5_THR_POOL_SIZE=32
#CONFIG_ENTROPY_NRF5_THR_THRESHOLD=16

# Crypto
CONFIG_NORDIC_SECURITY_BACKEND=y
CONFIG_CC3XX_BACKEND=n
CONFIG_OBERON_BACKEND=y
CONFIG_MBEDTLS_VANILLA_BACKEND=n

# build\modules\nrfxlib\nrf_security\include
CONFIG_MBEDTLS_CFG_FILE="../../../../config-mbedtls.h"

[Carl Richard]

Hi, Aldras!

CC310 is not directly accessible from non-secure applications on the nRF9160. As mentioned in the documentation for the CC310 entropy driver, entropy can be gathered through the Secure Services library. You can also implement your own secure services that can be accessed through this library.

In your case you can get random numbers from SPM using spm_request_random_number. 

Hope this makes sense!

Best regards,
Carl Richard

[aldras]

Hi Carl,

Thank you for the quick response, I will investigate this function!

[Carl Richard]

Hi again!

I just wanted to add that it seems like proper support for entropy on the nRF9160 recently has been added in the master branch. Just apply this commit to your SDK and it should work!

Best regards,
Carl Richard

[aldras]

Hi Carl,

Thank you for the additional information!

I am now working on other parts of the project and have pushed RSA aside for the moment and using a Raspberry Pi to perform the RSA signing in Python to speed up the prototype schedule.

I have the nRF9160 write required information such as the IMEI on an SD card, then insert that SD card (with an adapter) into the Raspberry Pi USB.  The Raspberry Pi performs the RSA signing, communicates with a PHP web server, writes the results to the SD card, then I return it to the nRF9160.  Not the most efficient, but allows faster progression on the prototype.

I was able to get an RSA signature, but it does not match the expected result.  I will look into this soon and open a new ticket at that time when I get back to troubleshooting the RSA signing functions.

At that time I will get back to the RSA signing and update the functions using entropy.

Sincerely,

Allan

[Carl Richard]

Thanks for the update, Allan! Good luck with the prototyping and happy Easter!

Best regards,
Carl Richard

[aldras]

I am closing this ticket as I have opened a new one, but this issue seems to have been resolved with the later 1.9.1 SDK.  Not sure I did something different or not, as I reworked it from the ground up.

Please see the below link for more details, but the signature result does return successfully with the new code.

devzone.nordicsemi.com/.../rsa-crypto-sample-on-nrf9160-does-not-appear-to-function-correctly-sdk-1-9-1