This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AES CTR: IV size

Hello,

I have a question concerning the decryption of a 90 byte AES CTR ciphertext with a given 16 byte key and 12 byte IV (=8 byte nonce, 4 byte counter).

I've tried to set my variables (ct, key, iv) in the aes_ctr example. The problem is now that my 12 byte IV cannot be set using the function psa_cipher_set_iv.
Next, I've tried to generate a 12 byte IV and found out that the length is not accepted. However, according to the psa api specification, 12 byte is a valid length for an IV.

In more detail I get the following errors:

#define NRF_CRYPTO_EXAMPLE_AES_BLOCK_SIZE (12)
#define NRF_CRYPTO_EXAMPLE_AES_MAX_TEXT_SIZE (90)

/* AES IV buffer */
static uint8_t m_iv[NRF_CRYPTO_EXAMPLE_AES_BLOCK_SIZE];

status = psa_cipher_generate_iv(&operation, m_iv, sizeof(m_iv), &olen);  // status is (Error: -138) => PSA_ERROR_BUFFER_TOO_SMALL

and

status = psa_cipher_set_iv(&operation, m_iv, /sizeof(m_iv)); // status is (Error: -135) => PSA_ERROR_INVALID_ARGUMENT


Could you please tell me how I can solve this problem and decrypt my ciphertext?

Thanks in advance.

Best regards

PS I'm working on the nrf9160 with SDK version 1.6.1.

Parents
  • Hi e-va,

    Right now the mbedtls version used by NCS sdk does not support 12 bytes IVs for the AES cipher. It only supports IVs which are equal to the block_size for this.
     
    Best regards,
    Charlie
  • Hi,

    thanks for clearing that up.

    Will it be supported in the future?

    Best regards

  • Yes, we do plan to move to mbedlts 3.0 which will introduce more features especially using the PSA APIs. It is going to be released with NCS 1.9 (Q1 2022).

    Best regards,

    Charlie

  • Oh, thats good news. Thanks!

Reply Children
No Data