How to use CryptoCell310 with nRF Connect SDK

RE: How to use CryptoCell310 with nRF Connect SDK

Einar Thorsrud — Fri, 22 Apr 2022 13:52:37 GMT

Unfortunately not. This will take some time and I cannot provide a timeline.

RE: How to use CryptoCell310 with nRF Connect SDK

ipener — Fri, 22 Apr 2022 13:43:28 GMT

Another month passed. Any updates on this?

RE: How to use CryptoCell310 with nRF Connect SDK

Einar Thorsrud — Mon, 21 Mar 2022 13:14:35 GMT

I understand. I will let you know if we find a solution. I cannot promise anything short term, though.

RE: How to use CryptoCell310 with nRF Connect SDK

ipener — Thu, 17 Mar 2022 20:13:16 GMT

Thanks, it would be great to make this work somehow. Else, we'd have to resort to using the nRF5 SDK (which is a ton of work). Doing a simple grep search for CC_LibInit I've noticed that there are matches in the static CC310 libraries, e.g. ./nrfxlib/crypto/nrf_cc310_platform/lib/cortex-m4/soft-float/libnrf_cc310_platform_0.9.13.a which leads me to believe that 1) either this function is invoked as part of some platform initialization routine or 2) the implementation exists but the respective header files are missing from the NCS. Either way, it would be great if you could figure out a solution and let me know.

RE: How to use CryptoCell310 with nRF Connect SDK

Einar Thorsrud — Tue, 15 Mar 2022 19:27:43 GMT

Ah, you are right, I did not remember that. I asked the team and there has not been done any work on this recently, so the situation remains the same. I will try to get more info on this and update here.

Update: We will add support for SRP in the PSA driver when it is added to the PSA Crypto APIs. We have not done any work with the non-standards SRP APIs (from mbedtls_extra) at this point. I will let you know if we are able to make it work nontheless, but I cannot promise anything.

RE: How to use CryptoCell310 with nRF Connect SDK

ipener — Mon, 14 Mar 2022 09:30:45 GMT

Thanks again for the pointers, however, I'm still unable to use the SRP functionality (on systems using CC310). In particular, the function mbedtls_srp_init requires a reference to a CCRndContext_t but there doesn't seem to be a way to initialize it. You mentioned about a year ago here that the SW support for this was incomplete. Using the nRF5 SDK, it was possible to initialize the context with a call to SaSi_LibInit. The CC312 runtime provides a similar way by using a call to CC_LibInit. I presume there must be a way to achieve this for CC310 systems. Is there an update on this situation?

RE: How to use CryptoCell310 with nRF Connect SDK

ipener — Wed, 02 Mar 2022 14:26:58 GMT

Awesome! Thanks for the pointers 👍

RE: How to use CryptoCell310 with nRF Connect SDK

Einar Thorsrud — Wed, 02 Mar 2022 11:49:22 GMT

Hi,

HKDF is supported (see cc3xx_mbedcrypto documentation for list of features). SRP is also available, but outside of mbed TLS (see mbedtls_cc_srp.h).

RE: How to use CryptoCell310 with nRF Connect SDK

ipener — Tue, 01 Mar 2022 15:52:13 GMT

Thanks for the reply. I'm aware of the Nordic Security Module and nrf_cc3xx_mbedcrypto library. However, the SRP and HKDF functionality seems doesn't seem to be accessible through those APIs although the nRF58240 data sheet states that the SoC supports it. As I understand it's possible to use the nRF5 SDK instead of nRF Connect but this comes with other tradeoffs. Do you know whether the nRF Connect SDK will eventually support all of the CryptoCell features?

RE: How to use CryptoCell310 with nRF Connect SDK

Einar Thorsrud — Tue, 01 Mar 2022 14:23:17 GMT

Hi,

The nRF5 SDK included the CC310 runtime library with CRYS_ based API functions, but in most cases users were/are intended to use the nrf_crypto based API's (that is of course optional, though).

For the Connect SDK SDK there are also several layers of libraries and APIs available, but not the CRYS_ based APIs. The intention there is to primarily use the PSA APIs demonstrated by the crypto examples you linked to. However, you can also use the Nordic security module, which in turn interface nrf_cc3xx_mbedcrypto library (among other backends), which you can also use directly. This is the lowest level API you get for CryptoCell in the nRF Connect SDK. You can refer to the Cryptography tests to see examples of using the Nordic security module.