How to use CryptoCell310 with nRF Connect SDK

[ipener]

Hi there,

the nRF58240 SoC supports a wide range of hardware-accelerated cryptography features using ARM's CryptoCell310. However, I'm unable to use many of the features with the nRF Connect SDK. The samples included in the the official documentation don't use any of the code prefixed with `CRYS_` in contrast to the nRF5 SDK. I need to use the functions previously defined in:

#include <crys_srp.h>
#include <crys_rnd.h>
#include <crys_hkdf.h>
#include <crys_ec_edw_api.h>

They also don't seem to be available in nrfxlib. Any help would be most welcome.

[Einar Thorsrud]

Hi,

The nRF5 SDK included the CC310 runtime library with CRYS_ based API functions, but in most cases users were/are intended to use the nrf_crypto based API's (that is of course optional, though).

For the Connect SDK SDK there are also several layers of libraries and APIs available, but not the CRYS_ based APIs. The intention there is to primarily use the PSA APIs demonstrated by the crypto examples you linked to. However, you can also use the  Nordic security module, which in turn interface nrf_cc3xx_mbedcrypto library (among other backends), which you can also use directly. This is the lowest level API you get for CryptoCell in the nRF Connect SDK. You can refer to the Cryptography tests to see examples of using the Nordic security module.

[ipener]

Thanks for the reply. I'm aware of the Nordic Security Module and nrf_cc3xx_mbedcrypto library. However, the SRP and HKDF functionality seems doesn't seem to be accessible through those APIs although the nRF58240 data sheet states that the SoC supports it. As I understand it's possible to use the nRF5 SDK instead of nRF Connect but this comes with other tradeoffs. Do you know whether the nRF Connect SDK will eventually support all of the CryptoCell features?

[Einar Thorsrud]

Hi,

HKDF is supported (see cc3xx_mbedcrypto documentation for list of features). SRP is also available, but outside of mbed TLS (see mbedtls_cc_srp.h).

[ipener]

Awesome! Thanks for the pointers  

[ipener]

Thanks again for the pointers, however, I'm still unable to use the SRP functionality (on systems using CC310). In particular, the function mbedtls_srp_init requires a reference to a CCRndContext_t but there doesn't seem to be a way to initialize it. You mentioned about a year ago here that the SW support for this was incomplete. Using the nRF5 SDK, it was possible to initialize the context with a call to SaSi_LibInit. The CC312 runtime provides a similar way by using a call to CC_LibInit. I presume there must be a way to achieve this for CC310 systems. Is there an update on this situation?