PSA Peristent Storage not Working

[AntonD]

I am using the PSA library for the nRF340 and trying to use persistent keys.

It all works without persistent keys enabled, but if I add the following two lines to the prj.conf it no longer compiles:

CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C=y
CONFIG_PSA_NATIVE_ITS=y

I have added those as they are part of the persistent_key_usage example. When I add them I get the following compilation error:

c:\Users\anton\ncs\v2.1.0\mbedtls\library\psa_crypto_storage.c:36:10: fatal error: psa/internal_trusted_storage.h: No such file or directory
   36 | #include "psa/internal_trusted_storage.h"
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.

I can find that header in v2.1.0/nrfxlib/nrf_security/include/native_its/psa/internal_trusted_storage.h, which is clearly not getting added to the include path.

How do I add it to the include path?

I have attached my prj.conf file

[Einar Thorsrud]

Hi,

Have you had a look at the Crypto: Persistent key storage sample?

[AntonD]

Yes I have. It is what I based my code on. It doesn't compile either.

[leox]

Hi Anton,

This example Crypto: Persistent key storage sample works with my setup: with the following command:

nrf/samples/crypto/persistent_key_usage$ west build -b nrf5340dk_nrf5340_cpuapp_ns -p

nrf/samples/crypto/persistent_key_usage$ west build -b nrf5340dk_nrf5340_cpuapp -p

could you share the host and toolchain version?

Is the host with Linux, windows?

toolchain version, zephyr 0.14.1?

[AntonD]

I removed the existing version and tried fresh ... and it just worked the second time. Not going to look to far into this I guess.

I do have a follow up question though. What function[s] need to be called to check if a key already exists in persistent storage? I want to store AES keys in persistent storage but there doesn't appear to be any accessible methods to check, and the example destroys keys each cycle.

[Einar Thorsrud]

Hi,

There is currently no API for checking if a key is present. For now, you will have to use something like psa_import_key() or psa_generate_key() and check the return value for PSA_ERROR_ALREADY_EXISTS.