NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

Charlie — Mon, 08 Aug 2022 14:22:49 GMT

Hi Zack,

Here is the feedback from our development team:

We are planning to do OpenThread PSA Configurations for nRF Connect SDK 2.1, but the configuration will most likely be a prototype (experimental).

Best regards,

Charlie

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

Charlie — Mon, 08 Aug 2022 10:01:56 GMT

Hi Zack,

Sorry for the late reply. I am just back from vacation.

I see no change on the latest NCS2.0.x, I will check with our development team to learn the current state.

Best regards,

Charlie

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

zcornelius — Mon, 25 Jul 2022 20:08:52 GMT

Charlie Has this been addressed in NCS 2.X?

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

zcornelius — Tue, 22 Mar 2022 15:30:03 GMT

We have an application using BLE + OpenThread (as an SED), using ECDH key exchange and CBC encryption on the (unpaired) BLE connection

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

Charlie — Tue, 22 Mar 2022 15:21:46 GMT

Hi Zack,

You cannot avoid this since OpenThread needs legacy APIs.

Can you explain more about your application? What are you going to do with aes_cbc through PSA APIs with an OpenThread device?

Best regards,

Charlie

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

zcornelius — Tue, 22 Mar 2022 14:21:46 GMT

Charlie,

Sadly, our current implementations are already using the PSA APIs in nRF Connect SDK (Even 1.7 and 1.8) - We cannot port our application to use the legacy APIs.

We do not use TLS/DTLS in our application - Is there a workaround where we can have PSA enabled but without the TLS/DTLS support?

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

Charlie — Tue, 22 Mar 2022 12:55:44 GMT

Hi Zack,

After some investigation, we found enabling PSA crypto APIs in OpenThread is limited to some configurations around ECJPAKE (required for OpenThread)

There are a few things missing in TLS/DTLS to handle pure PSA crypto APIs. Unfortunately, we have some conflicts with regards to old and new configurations so we can't enable both in case TLS/DTLS is in use. We hope to solve some of this before nRF Connect SDK 2.0.0 timeline, but it may be fairly heavy work, so we don't have a good estimation of when the alternative solution will be ready by far.

Is that OK you continue your development with the legacy crypto library and switch to the new one later?

Best regards,

Charlie

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

Charlie — Mon, 21 Mar 2022 13:52:12 GMT

Hi Zack,

Sorry for the late reply.

It is true that a lot of legacy configurations will prevent PSA configuraiton added to the OpenThread sample proj.conf from being used.

We will try to figure out an alternative solution with PSA enabled and need a bit more time to do adaption and tests. Thanks for your patience.

Best regards,

Charlie

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

zcornelius — Fri, 18 Mar 2022 14:00:00 GMT

Charlie Any updates here? We're still unable to use NCS 1.9.1 with our application because of this.

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

zcornelius — Fri, 11 Mar 2022 15:16:03 GMT

Our actual application is based off an OpenThread sample, and added PSA crypto. Even when the new PSA crypto methods are enabled, they're not linked (undefined reference to all PSA crypto methods)

A bit more testing and it appears the culprit here is actually the legacy crypto support.

Just adding

CONFIG_NORDIC_SECURITY_BACKEND=y

to that aes_cbc sample causes the same compilation failures. It just happens that OpenThread is using the legacy crypto, rather than the newer CONFIG_NRF_SECURITY.

What can we do to have legacy crypto support and the newer PSA methods enabled at the same time?

RE: NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

Charlie — Fri, 11 Mar 2022 11:53:58 GMT

Hi Zack,

I am not sure if you can enable openthread support in this sample directly. If you work on an openthread related project, it would be better to start with openthread samples and add other features you need.

I will do some investigation and feedback to you later.

Best regards,

Charlie