• State Not Answered
  • Replies 11 replies
  • Subscribers 74 subscribers
  • Views 2413 views
  • Users 0 members are here
Attachments (0)
Nordic Case Info
  • Case ID: 285578
Options

NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

zcornelius

I'm unable to use the PSA crypto methods when OpenThread is enabled on NCS 1.9.1. Linking fails with undefined references to PSA crypto methods.

To reproduce, us the nrf/samples/crypto/aes_cbc example, and add the following to prj.conf:

CONFIG_NETWORKING=y
CONFIG_NET_L2_OPENTHREAD=y

Building for the nrf52840dk_nrf52840  yields errors:

FAILED: zephyr/zephyr_pre0.elf zephyr/zephyr_pre0.map /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr/zephyr_pre0.map 
: && ccache /home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/arm-zephyr-eabi-g++   zephyr/CMakeFiles/zephyr_pre0.dir/misc/empty_file.c.obj -o zephyr/zephyr_pre0.elf  zephyr/CMakeFiles/offsets.dir/./arch/arm/core/offsets/offsets.c.obj  -fuse-ld=bfd  -Wl,-T  zephyr/linker_zephyr_pre0.cmd  -Wl,-Map=/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr/zephyr_pre0.map  -Wl,--whole-archive  app/libapp.a  zephyr/libzephyr.a  zephyr/arch/common/libarch__common.a  zephyr/arch/arch/arm/core/aarch32/libarch__arm__core__aarch32.a  zephyr/arch/arch/arm/core/aarch32/cortex_m/libarch__arm__core__aarch32__cortex_m.a  zephyr/arch/arch/arm/core/aarch32/mpu/libarch__arm__core__aarch32__mpu.a  zephyr/lib/libc/newlib/liblib__libc__newlib.a  zephyr/lib/posix/liblib__posix.a  zephyr/soc/arm/common/cortex_m/libsoc__arm__common__cortex_m.a  zephyr/soc/arm/nordic_nrf/nrf52/libsoc__arm__nordic_nrf__nrf52.a  zephyr/subsys/net/libsubsys__net.a  zephyr/subsys/net/l2/openthread/libsubsys__net__ip__l2__openthread.a  zephyr/subsys/net/ip/libsubsys__net__ip.a  zephyr/subsys/net/lib/openthread/platform/libopenthread_platform.a  zephyr/subsys/random/libsubsys__random.a  zephyr/drivers/clock_control/libdrivers__clock_control.a  zephyr/drivers/console/libdrivers__console.a  zephyr/drivers/gpio/libdrivers__gpio.a  zephyr/drivers/ieee802154/libdrivers__ieee802154.a  zephyr/drivers/flash/libdrivers__flash.a  zephyr/drivers/serial/libdrivers__serial.a  zephyr/drivers/entropy/libdrivers__entropy.a  zephyr/drivers/timer/libdrivers__timer.a  modules/nrf/lib/multithreading_lock/lib..__nrf__lib__multithreading_lock.a  modules/nrf/lib/fatal_error/lib..__nrf__lib__fatal_error.a  modules/nrf/subsys/mpsl/init/lib..__nrf__subsys__mpsl__init.a  modules/nrf/subsys/ieee802154/lib..__nrf__subsys__ieee802154.a  modules/nrf/drivers/mpsl/clock_control/lib..__nrf__drivers__mpsl__clock_control.a  modules/nrf/drivers/mpsl/flash_sync/lib..__nrf__drivers__mpsl__flash_sync.a  modules/nrf/drivers/mpsl/temp_nrf5/lib..__nrf__drivers__mpsl__temp_nrf5.a  modules/nrf/drivers/hw_cc310/lib..__nrf__drivers__hw_cc310.a  modules/hal_nordic/nrf_802154/libnrf-802154-platform.a  modules/nrfxlib/nrf_802154/nrf_802154/driver/libnrf-802154-driver.a  modules/hal_nordic/nrfx/libmodules__hal_nordic__nrfx.a  modules/segger/libmodules__segger.a  modules/nrfxlib/nrfxlib/nrf_security/src/zephyr/libmbedtls_zephyr.a  -Wl,--no-whole-archive  zephyr/kernel/libkernel.a  -L"/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/thumb/v7e-m/nofp"  -L/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr  -lgcc  zephyr/arch/common/libisr_tables.a  modules/hal_nordic/nrf_802154/libnrf-802154-platform.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/nrf_802154/sl/sl/lib/nRF52840/soft-float/libnrf-802154-sl.a  -no-pie  -Wl,--gc-sections  -Wl,--build-id=none  -Wl,--sort-common=descending  -Wl,--sort-section=alignment  -Wl,-u,_OffsetAbsSyms  -Wl,-u,_ConfigAbsSyms  -nostdlib  -static  -Wl,-X  -Wl,-N  -Wl,--orphan-handling=warn  -lm  -Wl,-lc  -L"/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/arm-zephyr-eabi"/lib/thumb/v7e-m/nofp  -Wl,-lgcc  -specs=nano.specs  modules/openthread/build/src/core/libopenthread-ftd.a  modules/openthread/build/third_party/tcplp/libtcplp.a  modules/openthread/build/src/core/libopenthread-mtd.a  modules/openthread/build/src/core/libopenthread-ftd.a  modules/openthread/build/third_party/tcplp/libtcplp.a  modules/openthread/build/src/core/libopenthread-mtd.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/mpsl/lib/cortex-m4/soft-float/libmpsl.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedtls.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedx509.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_psa_crypto_0.9.13.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_mbedcrypto_0.9.13.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_psa_crypto_0.9.13.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_mbedcrypto_0.9.13.a  -lc  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_psa_3.0.10.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_mbedtls_3.0.10.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_3.0.10.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_platform/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_platform_0.9.13.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto_base.a  -mcpu=cortex-m4  -mthumb  -mabi=aapcs  -mfp16-format=ieee  -lc && cd /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr && /usr/bin/cmake -E echo
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `crypto_init':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:56: undefined reference to `psa_crypto_init'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `crypto_finish':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:68: undefined reference to `psa_destroy_key'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `generate_key':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:95: undefined reference to `psa_generate_key'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:102: undefined reference to `psa_reset_key_attributes'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `encrypt_cbc_aes':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:118: undefined reference to `psa_cipher_encrypt_setup'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:125: undefined reference to `psa_cipher_generate_iv'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:132: undefined reference to `psa_cipher_update'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:141: undefined reference to `psa_cipher_finish'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:155: undefined reference to `psa_cipher_abort'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `decrypt_cbc_aes':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:169: undefined reference to `psa_cipher_decrypt_setup'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:176: undefined reference to `psa_cipher_set_iv'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:183: undefined reference to `psa_cipher_update'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:192: undefined reference to `psa_cipher_finish'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:214: undefined reference to `psa_cipher_abort'

  • 0

    Hi Zack,

    I am not sure if you can enable openthread support in this sample directly. If you work on an openthread related project, it would be better to start with openthread samples and add other features you need.

    I will do some investigation and feedback to you later.

    Best regards,

    Charlie

  • 0 in reply to Charlie

    Our actual application is based off an OpenThread sample, and added PSA crypto. Even when the new PSA crypto methods are enabled, they're not linked (undefined reference to all PSA crypto methods)

    A bit more testing and it appears the culprit here is actually the legacy crypto support. 

    Just adding 

    CONFIG_NORDIC_SECURITY_BACKEND=y

    to that aes_cbc sample causes the same compilation failures. It just happens that OpenThread is using the legacy crypto, rather than the newer CONFIG_NRF_SECURITY.

    What can we do to have legacy crypto support and the newer PSA methods enabled at the same time?

  • 0 in reply to Charlie

    Any updates here? We're still unable to use NCS 1.9.1 with our application because of this.

  • 0

    Hi  Zack,

    Sorry for the late reply.

    It is true that a lot of legacy configurations will prevent PSA configuraiton added to the OpenThread sample proj.conf from being used.

    We will try to figure out an alternative solution with PSA enabled and need a bit more time to do adaption and tests. Thanks for your patience.

    Best regards,

    Charlie

  • 0

    Hi Zack,


    After some investigation, we found enabling PSA crypto APIs in OpenThread is limited to some configurations around ECJPAKE (required for OpenThread)

    There are a few things missing in TLS/DTLS to handle pure PSA crypto APIs. Unfortunately, we have some conflicts with regards to old and new configurations so we can't enable both in case TLS/DTLS is in use. We hope to solve some of this before nRF Connect SDK 2.0.0 timeline, but it may be fairly heavy work, so we don't have a good estimation of when the alternative solution will be ready by far.

    Is that OK you continue your development with the legacy crypto library and switch to the new one later?

    Best regards,

    Charlie

Related
Terms of service