Making the RSA keypair persist.

RE: Making the RSA keypair persist.

user114473 — Tue, 22 Mar 2022 07:39:48 GMT

Hi Amanda,

Thanks for the detailed answer, it clears out the questions I had.

RE: Making the RSA keypair persist.

user77782 — Tue, 22 Mar 2022 07:35:50 GMT

Hi,

There are two reasons that this fails if you just change the lifetime flag from volatile to persistent. The persistent keys requires to set a key id for the key, with the psa_set_key_id function. The second reason is that you have to enable for the persistent key storage support in Kconfig. In the case of nRF52840 these options need to be added:

CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C=y
CONFIG_PSA_NATIVE_ITS=y

 

# Note that NVS is only one of the options to enable persistent storage of keys
# using the settings subsystem.
CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y

Note that these configurations are documented in our persistent_key_storage sample.

Now to avoid misunderstandings, please be clear that in the case of nRF52840 the keys will anyway be stored in flash and they will not be protected. The comments in the sample which describe that "the key will not be exposed to the application" are relevant only for TF-M enabled devices (namely nRF5340, nRF9160). The nRF52840 has only the ability to store one symmetric key which will be hidden from the application after being flashed. This is the device root key and is documented here:

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/libraries/others/hw_unique_key.html?highlight=kdr#functionality

RE: Making the RSA keypair persist.

user114473 — Mon, 21 Mar 2022 14:43:59 GMT

Okay so if the key pair needs to be exported, changing this line:

psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_SIGN_HASH);

to this

psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_EXPORT);

and then using psa_export_key to export the keypair and using psa_import_key to import does the trick.

But that means i need to save the keypair on flash. Is this a good idea? Ideally PSA_KEY_LIFETIME_PERSISTENT should work so the private key is never exposed. But where would PSA_KEY_LIFETIME_PERSISTENT actually store the key?

RE: Making the RSA keypair persist.

user114473 — Mon, 21 Mar 2022 14:22:39 GMT

RE: Making the RSA keypair persist.

user77782 — Mon, 21 Mar 2022 14:20:05 GMT

Hi,

I am looking into your case and will reply later.

Regards,
Amanda

RE: Making the RSA keypair persist.

user114473 — Mon, 21 Mar 2022 11:49:24 GMT

[deleted]