nRF9160 RSA signing data CC310

RE: nRF9160 RSA signing data CC310

aldras — Fri, 25 Mar 2022 08:15:10 GMT

I am closing this ticket as I have opened a new one, but this issue seems to have been resolved with the later 1.9.1 SDK. Not sure I did something different or not, as I reworked it from the ground up.

Please see the below link for more details, but the signature result does return successfully with the new code.

devzone.nordicsemi.com/.../rsa-crypto-sample-on-nrf9160-does-not-appear-to-function-correctly-sdk-1-9-1

RE: nRF9160 RSA signing data CC310

Carl Richard — Wed, 31 Mar 2021 15:02:40 GMT

Thanks for the update, Allan! Good luck with the prototyping and happy Easter!

Best regards,
Carl Richard

RE: nRF9160 RSA signing data CC310

aldras — Wed, 31 Mar 2021 13:59:21 GMT

Hi Carl,

Thank you for the additional information!

I am now working on other parts of the project and have pushed RSA aside for the moment and using a Raspberry Pi to perform the RSA signing in Python to speed up the prototype schedule.

I have the nRF9160 write required information such as the IMEI on an SD card, then insert that SD card (with an adapter) into the Raspberry Pi USB. The Raspberry Pi performs the RSA signing, communicates with a PHP web server, writes the results to the SD card, then I return it to the nRF9160. Not the most efficient, but allows faster progression on the prototype.

I was able to get an RSA signature, but it does not match the expected result. I will look into this soon and open a new ticket at that time when I get back to troubleshooting the RSA signing functions.

At that time I will get back to the RSA signing and update the functions using entropy.

Sincerely,

Allan

RE: nRF9160 RSA signing data CC310

Carl Richard — Wed, 31 Mar 2021 12:58:12 GMT

Hi again!

I just wanted to add that it seems like proper support for entropy on the nRF9160 recently has been added in the master branch. Just apply this commit to your SDK and it should work!

Best regards,
Carl Richard

RE: nRF9160 RSA signing data CC310

aldras — Mon, 29 Mar 2021 14:30:03 GMT

Hi Carl,

Thank you for the quick response, I will investigate this function!

RE: nRF9160 RSA signing data CC310

Carl Richard — Mon, 29 Mar 2021 14:22:04 GMT

Hi, Aldras!

CC310 is not directly accessible from non-secure applications on the nRF9160. As mentioned in the documentation for the CC310 entropy driver, entropy can be gathered through the Secure Services library. You can also implement your own secure services that can be accessed through this library.

In your case you can get random numbers from SPM using spm_request_random_number.

Hope this makes sense!

Best regards,
Carl Richard

RE: nRF9160 RSA singing data CC310

aldras — Sun, 28 Mar 2021 13:55:15 GMT

I have come up with a solution but I don't like it, I think it completely bypasses the hardware random number generator.

According to what I understand the configuration option CONFIG_MBEDTLS_ENTROPY_HARDWARE_ALT=y has made it into the build meaning that I need to provide the function for the following prototype:

int mbedtls_hardware_poll( void *data, unsigned char *output, size_t len, size_t *olen )

I added this into the main.c file.

I have done so with the below function but I am not sure I am confident with this solution, but it does resolve the build errors and allows me to progress on the project. I can come back and fix this later. Please do offer some suggestion though, if there is any recommendation.

int mbedtls_hardware_poll( void *data,
                           unsigned char *output, size_t len, size_t *olen ) {
    int e;
    //e = mbedtls_hardware_poll(NULL, output, len, NULL);
    e = sys_csrand_get(output, len);
    return e;
}