Solution for generating new private keys when modem firmware 1.3.1 cannot be used.

[JVantol]

Does Nordic have a suggested solution for what to do with B0A level devices which cannot run modem firmware 1.3.1 in production? We've got a nice solution using AT%KEYGEN for version 2 hardware, but we've got deployed version 1 devices out in the wild that will soon need a certificate replacement.

Does Nordic have an application side recommended replacement for the AT%KEYGEN functionality that the newer devices with modem firmware 1.3.1 and newer support? Is there an example showing how to to do this? I assume that it can be done by using MBEDTLS, but the setup and use of it is quite intimidating.

Any suggestions you could provide would be very helpful.

[Hakon]

Hello,

I will check this with the modem team.

[JVantol]

It looks like there is a crypto example for generating an RSA private/public key pair:

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/2.2.0/nrf/samples/crypto/rsa/README.html

I think that you could use this to generate the private key, and they generate a CSR from the public key, but I'm not enough of an expert to know exactly how this might be done. Is this correct that you could use the PSA crypto library to make the required key pair? If so, can you suggest a library that can generate a CSR from the public key?

[Hakon]

Modem team;

Once the new certificate is in the application domain it can be written to modem file system. AT%CMNG allows clients to list, read, write and delete certificates in modem file system with some limitations.

Some information about credential management in following links:
https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/libraries/modem/modem_key_mgmt.html#modem-key-mgmt
https://infocenter.nordicsemi.com/index.jsp?topic=%2Fref_at_commands%2FREF%2Fat_commands%2Fsecurity%2Fcmng.html

[JVantol]

Yeah, I know all that, we use that capability to install the initial private key. What I'm needing is capability to generate a new private key, public key and CSR on the device to be able to replace the key and cert at 3 year intervals as required by the strict security posture of the Azure private IOT hub these devices are connected to.

So, step by step, I need:

1.) To generate a new 2048 bit RSA private/public key pair on the device.

2.) To generate a CSR from this.

Then some stuff that we've already implemented happens to call a re-provisioning API on the client's private IOT hub, with the CSR as a parameter. The hub generates a new cert, which we download.

3.) We take the new cert and private key and plug it in using the CMNG commands.

4.) Device reboots and re-connects to the cloud using the new private key and cert.

We have implemented all this using AT%KEYGEN for devices that have modem firmware 1.3.x, but we have a large population of older devices which have Gen1 modems, which are not allowed to be upgraded to 1.3.1 modem firmware, hence the need to generate key pairs in the app processor.

[Hakon]

What mfw are you using in the B0A devices?