nRF9160 hash MD5 calculation

[ANDRIJ GRABCZAK]

I did not find how to manage MD5 calculation.

The closiest exapmle is `samples/crypto/sha256` and I have started to play with it. Simple replacement of "alg" parameter from "PSA_ALG_SHA_256" to "PSA_ALG_MD5" in functions psa_hash_compute(psa_algorithm_t alg, const uint8_t *input, size_t input_length, uint8_t *hash, size_t hash_size, size_t *hash_length) and psa_hash_compare(psa_algorithm_t alg, const uint8_t *input, size_t input_length, const uint8_t *hash, size_t hash_length) produces errors:

*** Booting Zephyr OS build v3.2.99-ncs1 ***
[00:00:00.613,220] <inf> sha256: Starting SHA256 example...
[00:00:00.613,250] <inf> sha256: Hashing using SHA256...
[00:00:00.613,464] <inf> sha256: psa_hash_compute failed! (Error: -134)
[00:00:00.613,464] <inf> sha256: Example exited with error!

Error means PSA_ERROR_NOT_SUPPORTED. I have tried different configuration options with same negative effect.

I am using:

Windows 10 Home
nrf-connect.sdk:2.2.0
nrf-connect.toolchain:2.2.0
nRF9160-DK version NRF9160_xxAA_REV2

My last configuration is:

CONFIG_MAIN_STACK_SIZE=4096
CONFIG_HEAP_MEM_POOL_SIZE=4096
CONFIG_LOG=y
CONFIG_LOG_BACKEND_UART=y
CONFIG_LOG_BUFFER_SIZE=15360
CONFIG_BUILD_WITH_TFM=y
CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
# Enable nordic security backend and PSA APIs
CONFIG_NRF_SECURITY=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y
CONFIG_MBEDTLS_PSA_BUILTIN_ALG_MD5=y
CONFIG_PSA_WANT_ALG_MD5=y

[ANDRIJ GRABCZAK]

No progress, patiently waiting for an answer...

[Sigurd Hellesvik]

Our implementation of the PSA Crypto API does not support MD5.

A warning, remember that MD5 is generally not recommended:

I suggest using the legacy API if you need to use MD5 with the nRF Connect SDK.
See RSA example fails on psa_sign_hash returning -133 for an example of how to do this.

Regards,
Sigurd Hellesvik

[ANDRIJ GRABCZAK]

I didn't find how to activate calls to the old api in the given post. Actually my problem is that I am using old api in my big project on sdk version 2.0.2. And when trying to switch to a new SDK, linker errors appears of type: "an undefined reference to 'mbedtls_md5_...' .

[Sigurd Hellesvik]

Aha,

Here is a project calling mbedtls_md5_init. This project builds, but I have not tested MD5 operations.

md5_build_example.zip

Regards,
Sigurd Hellesvik

[ANDRIJ GRABCZAK]

Yes, your example is fine. I added the "CONFIG_NORDIC_SECURITY_BACKEND=y" option to the configuration, but my project still does not compile. I compared the resulting configuration files "build/zephyr/.config" and noticed that I did not have the "CONFIG_MBEDTLS_MD5_C=y" option set. However, this option cannot be set manually in the project configuration. Zephyr documentation does not explain how to set this option. How to find out it?

[Sigurd Hellesvik]

Since CONFIG_MBEDTLS_MD5_C has no prompt in its Kconfig, it is not directly user assignable.

To set these, there are two alternatives:

• Find a configuration that selects this, and set the other configuration
• Define it in Kconfig in your project.

I did the second one in my project. See its Kconfig file.

Regards,
Sigurd Hellesvik

[ANDRIJ GRABCZAK]

Defining "MBEDTLS_MD5_C" in Kconfig of my project works, but it is weird and logicless... Thanks.