nRF9160 modem_key_mgmt_cmp returns -1

[Ron Segal]

Am currently trying to implement a client UDP socket application with Mbed DTLS using a Pre Shared Key.

PSK and PSK_ID array values are defined as:

static const unsigned char psk[] = {0x01, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06,

0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};

static const char psk_id[] = "Client_identity";

These are written to the nRF9160 with: 

err = modem_key_mgmt_write(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_PSK, psk, sizeof(psk));

err = modem_key_mgmt_write(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_IDENTITY, psk_id,sizeof(psk_id)-1);

PSK_TAG has been set to 2;

Then checking the validity of what has been written with:

err = modem_key_mgmt_cmp(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_PSK, psk, sizeof(psk));

err = modem_key_mgmt_cmp(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_IDENTITY, psk_id, sizeof(psk_id)-1);

The psk_id comparison returns a match (err == 0) whereas the psk comparison returns -1 (err = -1)

It's unclear what error is -1 (match failure is supposed to be +1) and how it can be resolved.

Ideas appreciated. 

Thanks. Cheers Ron.

[Albrecht Markus Schellenberger]

Hello Ron, 

It's unclear what error is -1 (match failure is supposed to be +1) and how it can be resolved.

Error -1 means that the credentials do not match. 

Ideas appreciated. 

You probably should perform a read here and compare the credentials. 

Regards, 

Markus 

[Ron Segal]

Hi Marcus

Thanks for your reply.

Had already tried reading the psk to do a manual compare with:

char buf[(size_t) sizeof(psk)];

size_t len = sizeof(psk);

err = modem_key_mgmt_read(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_PSK, buf, &len);

However a -1 error is returned, which I'd assumed was related to a permissions problem?

With a write being followed by a compare using exactly the same parameters, as per my code, what in theory might cause the comparison to fail?

Cheers, Ron

PS - On examining the underlying code of the compare function, it seems to be trying to read the PSK from the modem, which is a surprise, as for security surely the operation should be conducted by the modem to enable a comparison to be made without the security issue of returning the key itself. So it appears that the problem is simply because there is no permission to read keys from the modem, whereas PSK ID succeeds as there is no such security restriction. Does that make sense?

[Albrecht Markus Schellenberger]

Hello Ron, 

Ron Segal said:

PS - On examining the underlying code of the compare function, it seems to be trying to read the PSK from the modem, which is a surprise, as for security surely the operation should be conducted by the modem to enable a comparison to be made without the security issue of returning the key itself. So it appears that the problem is simply because there is no permission to read keys from the modem, whereas PSK ID succeeds as there is no such security restriction. Does that make sense?

My bad!  

Reading through the documentation of the %CMNG AT command (which the Modem key management library is based on), it states clearly that: 

“Reading types 1, 2, 3, and 10 are not supported.”

My apologies, I should have taken that into consideration. This probably explains why you are not able to perform a compare neither. 

Cheers, 

Markus 

[Ron Segal]

Thanks Marcus

A couple of follow-up requests to Nordic.

1. Provide additional detail in the nRF9160 "Modem key management" API documentation, which is misleading as it stands.

2. Modify the modem firmware so that a comparison can be made with key material passed into the modem's security context without any key itself being exposed outside of that context, which is what I was expecting as it is the typical method used in similar circumstances.

Cheers Ron.

[Albrecht Markus Schellenberger]

Thanks for your feedback, Ron! Will be forwarded to our development team. 

Cheers, 

Markus