nrf91 Ciphers

RE: nrf91 Ciphers

Albrecht Markus Schellenberger — Tue, 20 Jul 2021 13:06:47 GMT

Hello again Aziz,

In general, the modem does not prevent any private keys. You can use the Credential storage management %CMNG AT command to write, read and delete private keys.

When opening a TLS connection, the appropriate type/tag pair(s) is used in the TLS attach procedure and TLS negotiation with the server.

Example:

AT%CMNG=0,100,2,"put private key data here"

The client writes a private key to the modem (<type> is 2, private key in ASCII format, <sec_tag> is 100, can be any wanted). This sec tag and private key can then be used for negotiation in TLS attach procedure.

Max length of key/cert data that can be written to memory is about ~8k (contains some header info so actual cert/key data cannot be full 8k).

I hope I could answer your question.

Regards,

Markus

RE: nrf91 Ciphers

Albrecht Markus Schellenberger — Tue, 20 Jul 2021 05:41:24 GMT

Regarding the keys I’m not sure, so I have to ask our modem team. This might take a while though due to vacation period here in Norway, but I will come back to you as soon as possible.

Regards,

Markus

RE: nrf91 Ciphers

Aziz — Fri, 16 Jul 2021 14:07:31 GMT

Thanks this is great. What about supported private keys type/length?

RE: nrf91 Ciphers

Albrecht Markus Schellenberger — Fri, 16 Jul 2021 10:18:24 GMT

Hello Aziz,

you can find our supported cipher suites here (see Feature Brief → TLS Cipher suites).

We support the following ones:

mbed TLS Name / NIST Name               Value
TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 {0xC0,0x24}
TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA    {0xC0,0x0A}
TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 {0xC0,0x23}
TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA    {0xC0,0x09}
TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA      {0xC0,0x14}
TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256   {0xC0,0x27}
TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA      {0xC0,0x13}
TLS-PSK-WITH-AES-256-CBC-SHA            {0x00,0x8D}
TLS-PSK-WITH-AES-128-CBC-SHA256         {0x00,0xAE}
TLS-PSK-WITH-AES-128-CBC-SHA            {0x00,0x8C}
TLS-PSK-WITH-AES-128-CCM-8              {0xC0,0xA8}

For all other suites, we do not have official support.

Regards,

Markus