nrf_security: drivers: cracen: adding support for ed25519 without sicrypto #19812

degjorva · 2025-01-09T09:02:23Z

Removing the sicrypto implementation of ed25519 and ed25519ph.
Added implementation in cracenpsa of ed25519 and ed25519ph
Updated cracenpsa to support new implementation and
remove references to old

…rypto Adding support directly using silexpk/sxsymcrypt files for ed25519 This bypasses sicrypto, which saves on flash usage Primarily intended for bootloader usecase Signed-off-by: Dag Erik Gjørvad <[email protected]>

NordicBuilder · 2025-01-09T09:05:00Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 13

Inputs:

Sources:

sdk-nrf: PR head: 26c4896cb0337a6bffdd0274d36c192cc24840c4

more details

sdk-nrf:

PR head: 26c4896cb0337a6bffdd0274d36c192cc24840c4
merge base: 6e0cb3a5efefa5417863050198c99afacfcd9686
target head (main): f38d3119502c014935538628b3305009dd0697ff
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (6)

subsys
│  ├── nrf_security
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── cracen
│  │  │  │  │  ├── cracenpsa
│  │  │  │  │  │  ├── cracenpsa.cmake
│  │  │  │  │  │  ├── include
│  │  │  │  │  │  │  │ cracen_psa.h
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  ├── ed25519.c
│  │  │  │  │  │  │  ├── key_management.c
│  │  │  │  │  │  │  │ sign.c
│  │  │  │  │  │ psa_driver.Kconfig

Outputs:

Toolchain

Version:
Build docker image:

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

🟠 Toolchain
🟠 Build twister
🟠 Integration tests
- 🟠 test-fw-nrfconnect-chip
- 🟠 test-fw-nrfconnect-nrf_crypto
- 🟠 test-fw-nrfconnect-tfm
- 🟠 test-sdk-find-my
- 🟠 test-sdk-sidewalk
- 🟠 test-sdk-dfu
- ⚠️ test-fw-nrfconnect-nrf-iot_cloud

Disabled integration tests

- desktop52_verification
- doc-internal
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-boot
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_mosh
- test-fw-nrfconnect-nrf-iot_nrf_provisioning
- test-fw-nrfconnect-nrf-iot_positioning
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-ps
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-thread
- test-fw-nrfconnect-zigbee
- test-low-level
- test-sdk-audio
- test-sdk-mcuboot
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2025-01-09T09:19:25Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

nordicjm · 2025-01-13T14:28:21Z

subsys/nrf_security/Kconfig.psa.nordic

@@ -400,3 +400,10 @@ config PSA_WANT_KEY_TYPE_SRP_PUBLIC_KEY
 	bool "SRP public key support" if !MBEDTLS_PROMPTLESS
 	help
 	  SRP public key support.
+
+comment "Nordic added alternative cracen driver"


why does this need a comment and why is it using comment?

It does not, which is why it has been removed? That is an old commit that will be squashed before pull, but lives there since it the old commit might have a bootloader usecase

nordicjm · 2025-01-13T14:29:33Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa.h

+					const uint8_t *message);
+
+int ed25519_verify(const uint8_t *pubkey, const char *message,
+					size_t message_length, const char *signature);
+
+int create_ed25519_pubkey(const uint8_t *ed25519,
+					uint8_t *pubkey);


the secondary lines of these seem indented to odd lengths, plus the line length is 100 so why are these being chopped into 2 lines even when combined they don't reach 100 characters?

nordicjm · 2025-01-13T14:29:51Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/ed25519.c

+	char workmem[160];
+	struct sxhash hashopctx;
+	char pointr_buffer[64];


use defines for lengths

nordicjm · 2025-01-13T14:30:06Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/ed25519.c

+	r = sx_hash_feed(&hashopctx, workmem+32, 32);
+	if (r != 0) {
+		return r;
+	}
+	r = sx_hash_feed(&hashopctx, message, 100);
+	if (r != 0) {
+		return r;
+	}
+	r = sx_hash_digest(&hashopctx, workmem+96);
+	if (r != 0) {
+		return r;
+	}
+
+	/* Perform point multiplication R = [r]B. This is the encoded point R,
+	 * which is the first part of the signature.
+	 */
+	r = sx_ed25519_ptmult((const struct sx_ed25519_dgst *)(workmem + 96),


magic numbers everywhere, get rid of them

nordicjm · 2025-01-13T14:30:17Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/ed25519.c

+	if (r != 0) {
+		return r;
+	}
+	r = sx_hash_feed(&hashopctx, workmem+32, 32);


x + x with spaces like below

nordicjm · 2025-01-13T14:30:49Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c

+#if CONFIG_PSA_NEED_NO_SI_CRYPTO_ED25519
+#else


first this is a define, secondly, if !defined(x) ?

nordicjm · 2025-01-13T14:30:56Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c

@@ -605,8 +608,10 @@ static psa_status_t export_ecc_public_key_from_keypair(const psa_key_attributes_
 	int si_status = 0;
 	psa_algorithm_t key_alg = psa_get_key_algorithm(attributes);
 	const struct sx_pk_ecurve *sx_curve;
+#if CONFIG_PSA_NEED_NO_SI_CRYPTO_ED25519


nordicjm · 2025-01-13T14:31:05Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c

-
+#if CONFIG_PSA_NEED_NO_SI_CRYPTO_ED25519
+	si_status = create_ed25519_pubkey(key_buffer, data);
+	*data_length = 32;


nordicjm · 2025-01-13T14:32:09Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c

 	const struct sx_pk_ecurve *sx_curve;
-#if CONFIG_PSA_NEED_NO_SI_CRYPTO_ED25519
-#else
+


you just added these in the previous commit... squash changes

Update the removes the sicrypto drivers when using ed25519 with cracen. Adds the functionality to cracenpsa Also does the same for ed25519ph, as their dependencies were interwoven Signed-off-by: Dag Erik Gjørvad <[email protected]>

degjorva added the DNM label Jan 9, 2025

degjorva requested review from a team as code owners January 9, 2025 09:02

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Jan 9, 2025

degjorva removed the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Jan 9, 2025

degjorva force-pushed the no-sicrypto-ED25519 branch from 0c0a5d5 to 933f5a8 Compare January 9, 2025 13:36

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Jan 9, 2025

degjorva force-pushed the no-sicrypto-ED25519 branch 3 times, most recently from 21feb07 to e54e7e5 Compare January 13, 2025 14:12

nordicjm reviewed Jan 13, 2025

View reviewed changes

nordicjm requested changes Jan 13, 2025

View reviewed changes

degjorva force-pushed the no-sicrypto-ED25519 branch 5 times, most recently from 1b7981b to 719961c Compare January 14, 2025 09:46

degjorva force-pushed the no-sicrypto-ED25519 branch from 719961c to 26c4896 Compare January 14, 2025 09:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nrf_security: drivers: cracen: adding support for ed25519 without sicrypto #19812

nrf_security: drivers: cracen: adding support for ed25519 without sicrypto #19812

degjorva commented Jan 9, 2025

NordicBuilder commented Jan 9, 2025 •

edited

Loading

NordicBuilder commented Jan 9, 2025

nordicjm Jan 13, 2025

degjorva Jan 13, 2025

nordicjm Jan 13, 2025

nordicjm Jan 13, 2025

nordicjm Jan 13, 2025

nordicjm Jan 13, 2025

nordicjm Jan 13, 2025

nordicjm Jan 13, 2025

nordicjm Jan 13, 2025

nordicjm Jan 13, 2025

		#if CONFIG_PSA_NEED_NO_SI_CRYPTO_ED25519
		#else

nrf_security: drivers: cracen: adding support for ed25519 without sicrypto #19812

Are you sure you want to change the base?

nrf_security: drivers: cracen: adding support for ed25519 without sicrypto #19812

Conversation

degjorva commented Jan 9, 2025

NordicBuilder commented Jan 9, 2025 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

NordicBuilder commented Jan 9, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

NordicBuilder commented Jan 9, 2025 •

edited

Loading