• State Verified Answer
  • Replies 12 replies
  • Subscribers 89 subscribers
  • Views 3927 views
  • Users 0 members are here
Attachments (0)
Nordic Case Info
  • Case ID: 292038
Options

nRF9160 modem_key_mgmt_cmp returns -1

Ron Segal

Am currently trying to implement a client UDP socket application with Mbed DTLS using a Pre Shared Key.

PSK and PSK_ID array values are defined as:

static const unsigned char psk[] = {0x01, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};
static const char psk_id[] = "Client_identity";

These are written to the nRF9160 with: 

err = modem_key_mgmt_write(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_PSK, psk, sizeof(psk));

err = modem_key_mgmt_write(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_IDENTITY, psk_id,sizeof(psk_id)-1);

PSK_TAG has been set to 2;

Then checking the validity of what has been written with:

err = modem_key_mgmt_cmp(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_PSK, psk, sizeof(psk));

err = modem_key_mgmt_cmp(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_IDENTITY, psk_id, sizeof(psk_id)-1);

The psk_id comparison returns a match (err == 0) whereas the psk comparison returns -1 (err = -1)

It's unclear what error is -1 (match failure is supposed to be +1) and how it can be resolved.

Ideas appreciated. 

Thanks. Cheers Ron.

Parents
  • 0

    Hello Ron, 

    It's unclear what error is -1 (match failure is supposed to be +1) and how it can be resolved.

    Error -1 means that the credentials do not match. 

    Ideas appreciated. 

    You probably should perform a read here and compare the credentials. 

    Regards, 

    Markus 

  • 0 in reply to Albrecht Markus Schellenberger

    Hi Marcus

    Thanks for your reply.

    Had already tried reading the psk to do a manual compare with:

    char buf[(size_t) sizeof(psk)];
    size_t len = sizeof(psk);
    err = modem_key_mgmt_read(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_PSK, buf, &len);
    However a -1 error is returned, which I'd assumed was related to a permissions problem?
    With a write being followed by a compare using exactly the same parameters, as per my code, what in theory might cause the comparison to fail?
    Cheers, Ron
    PS - On examining the underlying code of the compare function, it seems to be trying to read the PSK from the modem, which is a surprise, as for security surely the operation should be conducted by the modem to enable a comparison to be made without the security issue of returning the key itself. So it appears that the problem is simply because there is no permission to read keys from the modem, whereas PSK ID succeeds as there is no such security restriction. Does that make sense?
Reply
  • 0 in reply to Albrecht Markus Schellenberger

    Hi Marcus

    Thanks for your reply.

    Had already tried reading the psk to do a manual compare with:

    char buf[(size_t) sizeof(psk)];
    size_t len = sizeof(psk);
    err = modem_key_mgmt_read(PSK_TAG, MODEM_KEY_MGMT_CRED_TYPE_PSK, buf, &len);
    However a -1 error is returned, which I'd assumed was related to a permissions problem?
    With a write being followed by a compare using exactly the same parameters, as per my code, what in theory might cause the comparison to fail?
    Cheers, Ron
    PS - On examining the underlying code of the compare function, it seems to be trying to read the PSK from the modem, which is a surprise, as for security surely the operation should be conducted by the modem to enable a comparison to be made without the security issue of returning the key itself. So it appears that the problem is simply because there is no permission to read keys from the modem, whereas PSK ID succeeds as there is no such security restriction. Does that make sense?
Children
No Data
Related