CoAP Secure CLI Example

[hugzy123]

Hi,

I'm running into some issues testing the CoAP Secure (CoAPS) functionality on the nRF "Thread: CLI" example".  I have attempted to use both pre-shared key (pskc) and the default x509 certificate as authentication types, but both are producing errors, albeit slightly different ones. The "pskc" authentication fails when executing the "ot coaps connect" command and returns Error 7 "Invalid Args". On the other hand, the x509 authentication processes the "connect" command, but disconnects instantly.

I've been following the "OpenThread- CoAPS Example" documentation. I can run the standard "OpenThread CoAP" example without authentication ok.

Example Set up

HW : 2x nrf52840 DK 
nrf connect SDK : Tried v2.2.0 and v2.1.0

Instructions thread set up

1. Flash both Dev kits with Thread: CLI" example
2. Connect both dev kits to the same thread network, using commands ot channel, ot panid, ot networkkey, ot ifconfig up, ot thread start
3. run ot ipaddr on the Server node to get Server the ip address
4. ping Server ip address from the Client node to confirm connection over Thread

Authentication type pskc

1. Set server and client node authentication  psk* using command 

   ot coaps set psk 123 pskid
   

2. run CoAP server on Node 1
   

   ot coaps start
   ot coaps resource test-resource

3. run CoAP client on Node 2
   

   ot coaps start
ot coaps connect <peer-ip6-address>

After running the connect command I get the InvalidArgs error. 

Authentication type x509

1. Tell Server and client to use the default certificate for authentication
   ot coaps x509
2. run CoAp server on Node 1
   ot coaps resource test-resource
3. run CoAP client on Node 2 
   ot coaps start
   ot coaps connect <peer-ip6-address>
   
4. CoAP client fails to connect and returns;
   coaps disconnected

Is there anything I am doing wrong here?

Thank you,

[Sigurd Hellesvik]

Hi,

I will look into this and return with more information tomorrow.

Regards,
Sigurd Hellesvik

[hugzy123]

Thanks for looking into this.

I've managed to get the psk authentication type working by setting CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED in the kconfig. However, i'm still having issues with the x509 certificate based authentication. Is there an equivalent I should set in the kconfig to get the x509 type working?

[Sigurd Hellesvik]

Hi,

hugzy123 said:

I've managed to get the psk authentication type working by setting CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED in the kconfig.

Good job!

hugzy123 said:

However, i'm still having issues with the x509 certificate based authentication. Is there an equivalent I should set in the kconfig to get the x509 type working?

I do not know for sure which configuration it would be now.
But to test, I searched for the following:

To check if it is any key exchange configuration, try with CONFIG_MBEDTLS_KEY_EXCHANGE_ALL_ENABLED.
Does x509 work with this?

Regards,
Sigurd Hellesvik

[hugzy123]

Hi,

Thanks for the quick reply.

I tried your suggestion but no luck unfortunately, it still won't connect. One interesting thing I noticed was the coaps connect command with certificate authentication type only triggers on the v2.1.0 sdk. On the v2.2.0 sdk the command fails with error "InvalidArgs" every time, even with CONFIG_MBEDTLS_KEY_EXCHANGE_ALL_ENABLED. I'm guessing there must some differences in the kconfig of the CLI example between v2.1.0 and v2.2.0.

Is there any other suggestions you recommend?

[Sigurd Hellesvik]

I have unfortunately not been able to figure this out today.

But I will continue to look into it on Monday.

Regards,
Sigurd Hellesvik