Which elliptic curves are supported by the nrf9160 modem?

[Dan H]

Hi,

We are currently looking into using the nrf9160 for a smart meter gateway like solution. It is of particular interest to us to know if we would be able to achieve compliance with Germany BSI’s TR-03116.

The mandatory cipher suites for our application scenario (TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) are support by the nrf9160 modem according to this.

However, I did not find any information on which elliptic curves the modem uses with this cipher suites. TR-03116 requires BrainpoolP256r1, BrainpoolP384r1 and NIST P-256.

Are they supported by the modem?

[Kazi Afroza Sultana]

Hello Dan,

The nRF9160 has hardware accelerator ARM TrustZone Cryptocell 310 which is a security subsystem provides root of Trust (RoT) and cryptographic services. The supported elliptic curves of this peripheral can be found in the product specification (https://infocenter.nordicsemi.com/pdf/nRF9160_PS_v2.1.pdf) page 84-85. 

This peripheral is mainly used for cryptographic operations when required but the software implementation can be used as well( Cryptography samples — nRF Connect SDK 1.8.99 documentation (nordicsemi.com) ). These examples are not related to Modem. This is basically handled by application core and the CC310 peripheral.

For modem you can find AT command list here in this link https://infocenter.nordicsemi.com/topic/ref_at_commands/REF/at_commands/security/security.html. Security command can be used for device and data security. 

Hope it helps. 

Thanks.

Best Regards,

Kazi Afroza Sultana

[Dan H]

Hi Kazi,

Thanks a lot for taking the time to reply to my question and to compile all the information above.

Just to be clear: At this point, I am confident TR-03116’s requirements could be met by using some combination of the Nordic Security Module’s backends. I have not tried this so far but that is my understanding of the documentation. For clarity, let us call this approach an application core based implementation.

However, what I was wondering about was a modem-based implementation. To put it simple: I want to open a secure TLS/DTLS socket with the nrf9160’s modem, configure the required cipher suites and then use it to send my metering data. I want the modem to take care of protocols and crypto so I do not have to worry about it on the application side.

I have successfully run a small test application on my nrf9160-DK that takes this approach. Now I struggle to verify if this approach will lead to a TR-03116 conform implementation. So it boils down to a couple of questions:

• Which elliptic curve does the modem use by default?
• Does the modem support different elliptic curves for its ECC based cipher suites?
• If yes, which elliptic curves and how do I configure them?
• If no, will there ever be the option to choose the elliptic curve in use?

Or to look at it from another angle:

• Does the modem use the ARM TrustZone Cryptocell 310?
• Or does it itself run some software implementation of the cryptographic algorithms?

Since TR-03116 requires the brainpool curves and the ARM TrustZone Cryptocell 310 does not support them, a modem that solely relies on the ARM TrustZone Cryptocell 310 will not be able to satisfy the requirements in question.

I hope my question got a bit clearer by the above explanation.

 

Kind regards,

Dan


EDIT:

Thinking about this problem, I just realized I could partially answer one of the questions myself. I recorded a DTLS handshake between the modem-based test application (client) I mentioned above and some test server. In it, the nrf9160's modem announces support for the following cipher suites:
secp521r1, brainpoolP512r1, secp384r1, brainpoolP384r1, secp256r1, secp256k1, brainpoolP256r1, secp224r1, secp224k1, secp192r1, secp192k1.

[Dan H]

Hi again,

Taking the time to think about the above questions helped to clear up some misconceptions I had. If anyone else will look at this problem, here is what I realized.

The elliptic curve used by the modem is determined by the key material you decide to use. So first, you create your keys and certificates. In the case of TR-03116, this could be a key on BrainpoolP256r1. Then you follow these instructions to store the credentials in the modem and open a socket referring to the credentials by its sec_tag. One may also want to specify the desired cipher suites using nrf_setsocketopt accordingly. Of corse, the server must also be configured to use the created key and certificates.

In that way, you should be able to use any of the elliptic curves the modem claims to support and which I mentioned in the edit above. However, I have not tried all of them yet and cannot be certain until then.

It would still be interesting to know if the modem at all uses the ARM TrustZone Cryptocell 310 for HW acceleration. And if the modem does use it: for all or only some of the curves in question?

 

Kind regards,

Dan

[Kazi Afroza Sultana]

Hello Dan,

We have been working on it internally. I will provide you the information shortly.

Best Regards,

Kazi Afroza Sultana

[Kazi Afroza Sultana]

Hello Dan,

There is a list of TLS/DTLS supported cipher suites in the modem released zip. 

The modem negotiates automatically with the peer using the necessary cipher suites. Each of the cipher suites is recognized by an official identification number which is registered at Internet Assigned Number Authority (IANA). It is possible to whitelist (opt-in security feature) some ciphersuites to use only the listed ones (Specific for TLS/DTLS connection). This narrowing down of the cipher suite can be done by using the nrf_setsockopt() function. See the following code where it shows the application of the nrf_setsockopt function for Elliptic Curve Diffie Hellman RSA with AES (256) CBC SHA. 

/* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
nrf_sec_cipher_t cipher_list[] = { 0xC014 };

err = nrf_setsockopt(fd, NRF_SOL_SECURE, NRF_SO_CIPHERSUITE_LIST, cipher_list, sizeof(cipher_list));
if (err) {
   /* Failed to set up cipher suite list. */
   return -1;
}

Hope it helps.

Best Regards,

Kazi Afroza Sultana