nrf_security: Add Oberon PSA configurations in Kconfig #11676

Vge0rge · 2023-07-03T11:00:35Z

Change the nrf_security configurations to follow the configuration scheme from the Oberon PSA core.

Signed-off-by: Georgios Vasilakis georgios.vasilakis@nordicsemi.no

test-sdk-nrf: geva-11676

NordicBuilder · 2023-07-03T11:04:28Z

Test specification

CI/Jenkins/NRF

Integration Platforms

CI/Jenkins/integration

Test Module	File based changes	Manually selected	West overwrite
test-fw-nrfconnect-chip	X
test-fw-nrfconnect-nrf_crypto	X
test-fw-nrfconnect-tfm	X
test-sdk-homekit	X

Detailed information of selected test modules

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2023-07-03T11:39:54Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publishing GitHub Action.

NordicBuilder · 2023-07-05T08:50:59Z

The following west manifest projects have been modified in this Pull Request:

Name	Old Revision	New Revision	Diff
zephyr	nrfconnect/sdk-zephyr@`582837b` (main)	nrfconnect/sdk-zephyr#1227	nrfconnect/sdk-zephyr#1227/files

Note: This message is automatically posted and updated by the Manifest GitHub Action.

doc/nrf/libraries/nrf_security/doc/driver_config.rst

melwee01 · 2023-08-02T06:59:14Z

doc/nrf/libraries/nrf_security/doc/driver_config.rst

+
+The option :kconfig:option:`CONFIG_PSA_USE_CC3XX_SIGNATURE_DRIVER` enables the driver :ref:`nrf_security_drivers_cc3xx` for the RSA PKCS#1 v1.5 signing algorithm.
+
+The option :kconfig:option:`CONFIG_PSA_USE_CC3XX_ASYMMETRIC_DRIVER` enables the driver :ref:`nrf_security_drivers_cc3xx` for RSA PKCS#1 v1.5 and RSA OAEP encryption.


Suggested change

The option :kconfig:option:`CONFIG_PSA_USE_CC3XX_ASYMMETRIC_DRIVER` enables the driver :ref:`nrf_security_drivers_cc3xx` for RSA PKCS#1 v1.5 and RSA OAEP encryption.

The option :kconfig:option:`CONFIG_PSA_USE_CC3XX_ASYMMETRIC_DRIVER` enables the driver :ref:`nrf_security_drivers_cc3xx` for RSA PKCS#1 v1.5 and RSA OAEP encryption.

melwee01 · 2023-08-02T06:59:34Z

doc/nrf/libraries/nrf_security/doc/driver_config.rst

-+-----------------------+--------------------------------------------------------------------------+--------------------------------------------------------------------------+
-| RSA PSS | Not supported | :kconfig:option:`CONFIG_PSA_CRYPTO_DRIVER_ALG_RSA_PSS_OBERON` |
-+-----------------------+--------------------------------------------------------------------------+--------------------------------------------------------------------------+
+Configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `RSA configurations`_.


Suggested change

Configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `RSA configurations`_.

Configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user-enabled algorithms in `RSA configurations`_.

search replaced user enabled with user-enabled in the file.

melwee01 · 2023-08-02T07:00:43Z

doc/nrf/libraries/nrf_security/doc/driver_config.rst

-| RIPEMD-160 | Not supported | Not supported |
-+-----------------------+---------------------------------------------------------------+---------------------------------------------------------------+
-
+You can use the following table to check the Hash algorithm support of each driver:


Suggested change

You can use the following table to check the Hash algorithm support of each driver:

Use the following table to check the Hash algorithm support of each driver:

Please apply this change to other instances of this, where we changed 'you can use the following configurations' to 'you can check the table'.

Search-replaced "You can use" with "Use" in the file

melwee01 · 2023-08-02T07:00:55Z

doc/nrf/libraries/nrf_security/doc/driver_config.rst

+
+The option :kconfig:option:`CONFIG_PSA_USE_CC3XX_HASH_DRIVER` enables the driver :ref:`nrf_security_drivers_cc3xx` for all the supported algorithms.
+
+The driver configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `HASH configurations`_.


Suggested change

The driver configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `HASH configurations`_.

The configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `HASH configurations`_.

Search-replaced "The driver configuration" with "The configuration" in the file

melwee01 · 2023-08-02T07:01:11Z

doc/nrf/libraries/nrf_security/doc/driver_config.rst

+| SRP | Not supported | Supported |
+-----------------------+--------------------------+---------------------------+
+
+Configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `Password-authenticated key agreement configurations`_.


Suggested change

Configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `Password-authenticated key agreement configurations`_.

Configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user-enabled algorithms in `Password-authenticated key agreement configurations`_.

melwee01 · 2023-08-02T07:06:22Z

Other notes:

Notes are rendering on the page with bullet points:

I couldn't find other instances of this formatting in clicking around other config sections in library docs.

Adding: Bartek's opinion, which I think is reasonable, is that bullet points are fine where there are two or more points per note, but we could take them out for notes where there is only one bullet point.

melwee01 · 2023-08-30T10:55:10Z

doc/nrf/libraries/nrf_security/doc/driver_config.rst

-+-----------------------+---------------------------------------------------------------------+----------------------------------------------------------------------+
-| Stream cipher | :kconfig:option:`CONFIG_PSA_CRYPTO_DRIVER_ALG_STREAM_CIPHER_CC3XX` | :kconfig:option:`CONFIG_PSA_CRYPTO_DRIVER_ALG_STREAM_CIPHER_OBERON` |
-+-----------------------+---------------------------------------------------------------------+----------------------------------------------------------------------+
+Cipher algorithm support for each driver:


Suggested change

Cipher algorithm support for each driver:

The following table shows cipher algorithm support for each driver:

While I personally prefer your more straightforward way of introducing tables, it seems that 'the following table shows' is a standard stylistic choice throughout NCS. Can you apply these throughout, or would you like me to add a suggestion for each?

doc/nrf/libraries/nrf_security/doc/driver_config.rst

melwee01 · 2023-08-30T11:02:41Z

doc/nrf/libraries/nrf_security/doc/driver_config.rst

@@ -272,17 +300,24 @@ The ECC algorithm support is dependent on one or more Kconfig options enabling c
 ECC driver configurations
 =========================

-You can use the following Kconfig options for fine-grained control over which drivers provide ECC support:
+Use the following table to check the ECC algorithm support of each driver:


Think we should follow the same form for these as well. 'The following table shows ECC algorithim support of each driver'...

melwee01 · 2023-08-30T11:04:14Z

doc/nrf/libraries/nrf_security/doc/driver_config.rst

+--------------------+-----------------------------------------------------+
+
+.. note::
+ * All RSA key size configurations are introduced by :ref:`nrf_security` and are not described by the PSA Crypto specification.


I don't remember if it was in reference to this or another PR, but I checked this formatting with Bartek. He said that notes should have bullet points only if there are multiple items in the list.

Please remove bullet points for notes with only one item.

Comments addressed.

The Oberon core uses a configuration scheme where the user chooses the PSA_WANT and the PSA_USE options and the core itself derives the PSA_NEED configurations which are used internally. This change adapts this new configuration scheme in nrf_security. With this change the user still have the option to explicitely enable/disable drivers with the previous options: PSA_CRYPTO_DRIVER_OBERON PSA_CRYPTO_DRIVER_CC3XX Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>

Update the documentation files for the NRF security configurations of the PSA APIs to follow the Oberon PSA configuration scheme. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>

Update the psa_tls sample to follow the new configuration scheme from Oberon PSA core. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>

frkv

LGTM

doublemis1 · 2023-09-07T10:17:09Z

Matter/Chip plans failed on nRF7002 while connecting to the wifi:

I: 18108 [DL]Wi-Fi scan done (0)
E: ***** BUS FAULT *****
E:   Precise data bus error
E:   BFAR Address: 0x26902bb
E: r0/a1:  0x026902bb  r1/a2:  0x000e44a2  r2/a3:  0x000000a0
E: r3/a4:  0x00000077 r12/ip:  0x00000000 r14/lr:  0x00099c2f
E:  xpsr:  0x21100000
E: s[ 0]:  0x00000000  s[ 1]:  0x00000000  s[ 2]:  0x00000000  s[ 3]:  0x00000000
E: s[ 4]:  0x00000000  s[ 5]:  0x00000000  s[ 6]:  0x00000000  s[ 7]:  0x00000000
E: s[ 8]:  0x00000000  s[ 9]:  0x00000000  s[10]:  0x00000000  s[11]:  0x00000000
E: s[12]:  0x00000000  s[13]:  0x00000000  s[14]:  0x00000000  s[15]:  0x00000000
E: fpscr:  0x20018b24
E: Faulting instruction address (r15/pc): 0x0000f648
E: >>> ZEPHYR FATAL ERROR 25: Unknown error on CPU 0
E: Current thread: 0x2000e160 (CHIP)
E: Halting system

Vge0rge · 2023-09-07T10:20:23Z

Matter/Chip plans failed on nRF7002 while connecting to the wifi:

I: 18108 [DL]Wi-Fi scan done (0)
E: ***** BUS FAULT *****
E:   Precise data bus error
E:   BFAR Address: 0x26902bb
E: r0/a1:  0x026902bb  r1/a2:  0x000e44a2  r2/a3:  0x000000a0
E: r3/a4:  0x00000077 r12/ip:  0x00000000 r14/lr:  0x00099c2f
E:  xpsr:  0x21100000
E: s[ 0]:  0x00000000  s[ 1]:  0x00000000  s[ 2]:  0x00000000  s[ 3]:  0x00000000
E: s[ 4]:  0x00000000  s[ 5]:  0x00000000  s[ 6]:  0x00000000  s[ 7]:  0x00000000
E: s[ 8]:  0x00000000  s[ 9]:  0x00000000  s[10]:  0x00000000  s[11]:  0x00000000
E: s[12]:  0x00000000  s[13]:  0x00000000  s[14]:  0x00000000  s[15]:  0x00000000
E: fpscr:  0x20018b24
E: Faulting instruction address (r15/pc): 0x0000f648
E: >>> ZEPHYR FATAL ERROR 25: Unknown error on CPU 0
E: Current thread: 0x2000e160 (CHIP)
E: Halting system

Two runs ago CHIP was green. (Check run 90). It seems to me like a CI issue CHIP/MATTER.

doublemis1 · 2023-09-07T10:23:41Z

Matter/Chip plans failed on nRF7002 while connecting to the wifi:

I: 18108 [DL]Wi-Fi scan done (0)
E: ***** BUS FAULT *****
E:   Precise data bus error
E:   BFAR Address: 0x26902bb
E: r0/a1:  0x026902bb  r1/a2:  0x000e44a2  r2/a3:  0x000000a0
E: r3/a4:  0x00000077 r12/ip:  0x00000000 r14/lr:  0x00099c2f
E:  xpsr:  0x21100000
E: s[ 0]:  0x00000000  s[ 1]:  0x00000000  s[ 2]:  0x00000000  s[ 3]:  0x00000000
E: s[ 4]:  0x00000000  s[ 5]:  0x00000000  s[ 6]:  0x00000000  s[ 7]:  0x00000000
E: s[ 8]:  0x00000000  s[ 9]:  0x00000000  s[10]:  0x00000000  s[11]:  0x00000000
E: s[12]:  0x00000000  s[13]:  0x00000000  s[14]:  0x00000000  s[15]:  0x00000000
E: fpscr:  0x20018b24
E: Faulting instruction address (r15/pc): 0x0000f648
E: >>> ZEPHYR FATAL ERROR 25: Unknown error on CPU 0
E: Current thread: 0x2000e160 (CHIP)
E: Halting system

Two runs ago CHIP was green. (Check run 90). It seems to me like a CI issue CHIP/MATTER.

Thanks for info

Vge0rge requested review from frkv, vili-nordic, joerchan, SebastianBoe and mswarowsky as code owners July 3, 2023 11:00

Vge0rge removed request for SebastianBoe, joerchan, mswarowsky, frkv and vili-nordic July 3, 2023 11:00

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Jul 3, 2023

Vge0rge force-pushed the oberon_kconfigs branch 3 times, most recently from bdd9e5a to 2f0f829 Compare July 5, 2023 08:50

Vge0rge requested review from carlescufi and tejlmand as code owners July 5, 2023 08:50

github-actions bot added the manifest label Jul 5, 2023

NordicBuilder added manifest-zephyr DNM labels Jul 5, 2023

Vge0rge force-pushed the oberon_kconfigs branch 4 times, most recently from 45eec76 to 9df6d43 Compare July 5, 2023 13:11

NordicBuilder added the manifest-nrfxlib label Jul 5, 2023

Vge0rge force-pushed the oberon_kconfigs branch 2 times, most recently from 2890801 to a954331 Compare July 7, 2023 12:27

Vge0rge requested a review from rlubos as a code owner July 7, 2023 12:27

melwee01 requested changes Aug 2, 2023

View reviewed changes

joerchan force-pushed the oberon_kconfigs branch from 494d658 to 33358e2 Compare August 23, 2023 14:07

joerchan requested a review from stephen-nordic as a code owner August 23, 2023 14:07

joerchan force-pushed the oberon_kconfigs branch 2 times, most recently from e231c8f to e73fb29 Compare August 25, 2023 13:52

github-actions bot removed the manifest label Aug 25, 2023

joerchan force-pushed the oberon_kconfigs branch from e73fb29 to efe3d60 Compare August 25, 2023 14:33

joerchan self-assigned this Aug 29, 2023

melwee01 requested changes Aug 30, 2023

View reviewed changes

joerchan force-pushed the oberon_kconfigs branch from efe3d60 to 10c4b3f Compare September 4, 2023 12:21

joerchan approved these changes Sep 4, 2023

View reviewed changes

melwee01 approved these changes Sep 5, 2023

View reviewed changes

Vge0rge force-pushed the oberon_kconfigs branch 6 times, most recently from c453f78 to 282dfa1 Compare September 6, 2023 18:45

Vge0rge and others added 3 commits September 7, 2023 09:31

nrf_security: Update docs for configurations

9651caa

Update the documentation files for the NRF security configurations of the PSA APIs to follow the Oberon PSA configuration scheme. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>

samples: crypto: psa_tls: Convert Kconfig options

4bf84ea

Update the psa_tls sample to follow the new configuration scheme from Oberon PSA core. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>

Vge0rge force-pushed the oberon_kconfigs branch from 282dfa1 to 4bf84ea Compare September 7, 2023 07:31

frkv approved these changes Sep 7, 2023

View reviewed changes

Vge0rge removed the DNM label Sep 7, 2023

nordicjm merged commit bff4553 into nrfconnect:main Sep 7, 2023
17 of 18 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nrf_security: Add Oberon PSA configurations in Kconfig #11676

nrf_security: Add Oberon PSA configurations in Kconfig #11676

Vge0rge commented Jul 3, 2023 •

edited by stephen-nordic

Loading

NordicBuilder commented Jul 3, 2023 •

edited

Loading

NordicBuilder commented Jul 3, 2023

NordicBuilder commented Jul 5, 2023 •

edited

Loading

melwee01 Aug 2, 2023

melwee01 Aug 2, 2023

joerchan Aug 24, 2023

melwee01 Aug 2, 2023

joerchan Aug 24, 2023

melwee01 Aug 2, 2023

joerchan Aug 24, 2023

melwee01 Aug 2, 2023

melwee01 commented Aug 2, 2023 •

edited

Loading

melwee01 Aug 30, 2023

melwee01 Aug 30, 2023

melwee01 Aug 30, 2023

melwee01 Aug 30, 2023

frkv left a comment

doublemis1 commented Sep 7, 2023

Vge0rge commented Sep 7, 2023

doublemis1 commented Sep 7, 2023


		The option :kconfig:option:`CONFIG_PSA_USE_CC3XX_SIGNATURE_DRIVER` enables the driver :ref:`nrf_security_drivers_cc3xx` for the RSA PKCS#1 v1.5 signing algorithm.

		The option :kconfig:option:`CONFIG_PSA_USE_CC3XX_ASYMMETRIC_DRIVER` enables the driver :ref:`nrf_security_drivers_cc3xx` for RSA PKCS#1 v1.5 and RSA OAEP encryption.

	Configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `RSA configurations`_.
	Configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user-enabled algorithms in `RSA configurations`_.

	You can use the following table to check the Hash algorithm support of each driver:
	Use the following table to check the Hash algorithm support of each driver:


		The option :kconfig:option:`CONFIG_PSA_USE_CC3XX_HASH_DRIVER` enables the driver :ref:`nrf_security_drivers_cc3xx` for all the supported algorithms.

		The driver configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `HASH configurations`_.

	The driver configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `HASH configurations`_.
	The configuration of the :ref:`nrf_security_drivers_oberon` driver is automatically generated based on the user enabled algorithms in `HASH configurations`_.

	Cipher algorithm support for each driver:
	The following table shows cipher algorithm support for each driver:

nrf_security: Add Oberon PSA configurations in Kconfig #11676

nrf_security: Add Oberon PSA configurations in Kconfig #11676

Conversation

Vge0rge commented Jul 3, 2023 • edited by stephen-nordic Loading

NordicBuilder commented Jul 3, 2023 • edited Loading

Test specification

NordicBuilder commented Jul 3, 2023

NordicBuilder commented Jul 5, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

melwee01 commented Aug 2, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

frkv left a comment

Choose a reason for hiding this comment

doublemis1 commented Sep 7, 2023

Vge0rge commented Sep 7, 2023

doublemis1 commented Sep 7, 2023

Vge0rge commented Jul 3, 2023 •

edited by stephen-nordic

Loading

NordicBuilder commented Jul 3, 2023 •

edited

Loading

NordicBuilder commented Jul 5, 2023 •

edited

Loading

melwee01 commented Aug 2, 2023 •

edited

Loading