Skip to content

Commit 1e384af

Browse files
degjorvajukkar
degjorva
authored and
jukkar
committed
Tests: Crypto: Added tests for kmu and ikg functionality
Added tests for writing to and using keys from the kmu. Added tests for using the ikg to derive a key and signing. Signed-off-by: Dag Erik Gjørvad <[email protected]>
1 parent bce1276 commit 1e384af

File tree

11 files changed

+771
-0
lines changed

11 files changed

+771
-0
lines changed

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -824,6 +824,7 @@
824824
/tests/modules/mcuboot/direct_xip/ @nrfconnect/ncs-pluto
825825
/tests/modules/mcuboot/external_flash/ @nrfconnect/ncs-pluto
826826
/tests/nrf5340_audio/ @nrfconnect/ncs-audio @nordic-auko
827+
/tests/psa_crypto/ @nrfconnect/ncs-aegir
827828
/tests/subsys/app_event_manager/ @nrfconnect/ncs-si-muffin @nrfconnect/ncs-si-bluebagel
828829
/tests/subsys/audio/audio_module_template/ @nrfconnect/ncs-audio
829830
/tests/subsys/audio_module/ @nrfconnect/ncs-audio

‎tests/psa_crypto/CMakeLists.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#
2+
# Copyright (c) 2024 Nordic Semiconductor ASA
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
7+
cmake_minimum_required(VERSION 3.13.1)
8+
9+
find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
10+
project(NONE)
11+
12+
FILE(GLOB app_sources src/*.c)
13+
target_sources(app PRIVATE ${app_sources})
14+
target_include_directories(app PRIVATE src)
15+
16+
add_subdirectory(tests)

‎tests/psa_crypto/prj.conf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#
2+
# Copyright (c) 2021-2024 Nordic Semiconductor ASA
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
7+
CONFIG_ZTEST=y
8+
CONFIG_ZTEST_STACK_SIZE=15360
9+
10+
CONFIG_SYS_CLOCK_TICKS_PER_SEC=1000
11+
CONFIG_MAIN_STACK_SIZE=8192
12+
CONFIG_HEAP_MEM_POOL_SIZE=8192
13+
14+
# Enable logging
15+
CONFIG_CONSOLE=y
16+
CONFIG_LOG=n
17+
18+
# Enable nordic security backend and PSA APIs
19+
CONFIG_NRF_SECURITY=y
20+
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
21+
CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y
22+
23+
CONFIG_HW_UNIQUE_KEY=y
24+
CONFIG_HW_UNIQUE_KEY_WRITE_ON_CRYPTO_INIT=y
25+
26+
CONFIG_MBEDTLS_ENABLE_HEAP=y
27+
CONFIG_MBEDTLS_HEAP_SIZE=8192
28+
29+
CONFIG_PSA_WANT_ECC_TWISTED_EDWARDS_255=y
30+
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
31+
32+
CONFIG_PSA_WANT_ALG_ECDSA=y
33+
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y
34+
CONFIG_PSA_WANT_ECC_SECP_R1_256=y
35+
CONFIG_PSA_WANT_ALG_SHA_256=y
36+
CONFIG_PSA_WANT_ALG_SHA_512=y
37+
CONFIG_PSA_WANT_KEY_TYPE_AES=y
38+
CONFIG_PSA_WANT_ALG_PURE_EDDSA=y
39+
40+
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y
41+
CONFIG_PSA_WANT_GENERATE_RANDOM=y

‎tests/psa_crypto/src/psa_tests_common.c‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
/*
2+
* Copyright (c) 2024 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
*/
6+
7+
#include <stdarg.h>
8+
#include <string.h>
9+
#include <stdint.h>
10+
#include <stddef.h>
11+
#include <zephyr/sys/printk.h>
12+
13+
#include <psa/crypto.h>
14+
#include <psa/crypto_values.h>
15+
#include <psa/crypto_extra.h>
16+
17+
#include <zephyr/sys/util.h>
18+
#include <zephyr/sys_clock.h>
19+
#include <zephyr/logging/log.h>
20+
#include <zephyr/ztest.h>
21+
#include <pm_config.h>
22+
#include "psa_tests_common.h"
23+
#include <hw_unique_key.h>
24+
25+
#ifdef CONFIG_BUILD_WITH_TFM
26+
#include <tfm_ns_interface.h>
27+
#include <tfm_builtin_key_ids.h>
28+
#include "cracen_psa_kmu.h"
29+
#include <tfm_crypto_defs.h>
30+
#else
31+
#include <cracen_psa.h>
32+
#endif
33+
34+
LOG_MODULE_REGISTER(ikg, LOG_LEVEL_INF);
35+
36+
ZTEST_SUITE(test_suite_ikg, NULL, NULL, NULL, NULL, NULL);
37+
38+
static psa_key_id_t key_id;
39+
40+
int crypto_init(void)
41+
{
42+
psa_status_t status;
43+
44+
#if !defined(CONFIG_BUILD_WITH_TFM)
45+
if (!hw_unique_key_are_any_written()) {
46+
status = hw_unique_key_write_random();
47+
if (status != HW_UNIQUE_KEY_SUCCESS) {
48+
return status;
49+
}
50+
}
51+
#endif
52+
status = psa_crypto_init();
53+
if (status != PSA_SUCCESS) {
54+
return status;
55+
}
56+
return APP_SUCCESS;
57+
}
58+
59+
int crypto_finish(void)
60+
{
61+
psa_status_t status;
62+
63+
status = psa_destroy_key(key_id);
64+
if (status != PSA_SUCCESS) {
65+
return status;
66+
}
67+
68+
return APP_SUCCESS;
69+
}

‎tests/psa_crypto/src/psa_tests_common.h‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/*
2+
* Copyright (c) 2024 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
*/
6+
7+
#include <stdio.h>
8+
#include <stdarg.h>
9+
#include <stdint.h>
10+
#include "common.h"
11+
#include <zephyr/toolchain.h>
12+
#include <zephyr/sys/util.h>
13+
#include <zephyr/drivers/entropy.h>
14+
15+
#if defined(CONFIG_ZTEST)
16+
#include <zephyr/ztest.h>
17+
#endif
18+
19+
#define APP_SUCCESS (0)
20+
#define APP_ERROR (-1)
21+
#define APP_SUCCESS_MESSAGE "Example finished successfully!"
22+
#define APP_ERROR_MESSAGE "Example exited with error!"
23+
24+
#ifndef TEST_MEMCMP
25+
#define TEST_MEMCMP(x, y, size) ((memcmp(x, y, size) == 0) ? 0 : 1)
26+
#endif
27+
28+
/**@brief Macro asserting equality.
29+
*/
30+
#ifndef TEST_VECTOR_ASSERT_EQUAL
31+
#define TEST_VECTOR_ASSERT_EQUAL(expected, actual) \
32+
zassert_equal((expected), (actual), \
33+
"\tAssert values: 0x%04X != -0x%04X", (expected), \
34+
(-actual))
35+
#endif
36+
37+
/**@brief Macro asserting inequality.
38+
*/
39+
#ifndef TEST_VECTOR_ASSERT_NOT_EQUAL
40+
#define TEST_VECTOR_ASSERT_NOT_EQUAL(expected, actual) \
41+
zassert_not_equal((expected), (actual), \
42+
"\tAssert values: 0x%04X == -0x%04X", (expected), \
43+
(-actual))
44+
#endif
45+
46+
int crypto_finish(void);
47+
int crypto_init(void);

‎tests/psa_crypto/testcase.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
tests:
2+
crypto.cracen:
3+
sysbuild: true
4+
platform_allow:
5+
- nrf54l15dk/nrf54l15/cpuapp
6+
- nrf54l15dk/nrf54l15/cpuapp/ns
7+
8+
tags: tfm psa_crypto sysbuild ci_tests_tfm
9+
integration_platforms:
10+
- nrf54l15dk/nrf54l15/cpuapp
11+
- nrf54l15dk/nrf54l15/cpuapp/ns

‎tests/psa_crypto/tests/CMakeLists.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#
2+
# Copyright (c) 2024 Nordic Semiconductor ASA
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
7+
zephyr_include_directories(
8+
${CMAKE_CURRENT_SOURCE_DIR}/../src
9+
)
10+
zephyr_sources(test_ikg_identity_key_sign_verify.c)
11+
zephyr_sources(test_ikg_key_derivation.c)
12+
zephyr_sources(test_kmu_write.c)
13+
zephyr_sources(test_kmu_use.c)

‎tests/psa_crypto/tests/test_ikg_identity_key_sign_verify.c‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
/*
2+
* Copyright (c) 2024 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
*/
6+
7+
#include <zephyr/ztest.h>
8+
#include <pm_config.h>
9+
#include <zephyr/kernel.h>
10+
#include <zephyr/sys/printk.h>
11+
#include <zephyr/logging/log.h>
12+
#include <stdio.h>
13+
#include <stdlib.h>
14+
#include <psa/crypto.h>
15+
#include <psa/crypto_values.h>
16+
#include <psa/crypto_extra.h>
17+
#include <zephyr/sys/printk.h>
18+
#include "psa_tests_common.h"
19+
20+
#ifdef CONFIG_BUILD_WITH_TFM
21+
#include <tfm_ns_interface.h>
22+
#include <tfm_builtin_key_ids.h>
23+
#include "cracen_psa_kmu.h"
24+
static psa_key_id_t identity_key_id = TFM_BUILTIN_KEY_ID_IAK;
25+
#else
26+
#include <cracen_psa.h>
27+
static psa_key_id_t identity_key_id = CRACEN_BUILTIN_IDENTITY_KEY_ID;
28+
#endif
29+
30+
/* ====================================================================== */
31+
/* Global variables/defines for the IKG signing tests */
32+
33+
#define NRF_CRYPTO_TEST_IKG_TEXT_SIZE (68)
34+
#define NRF_CRYPTO_TEST_IKG_SIGNATURE_SIZE (64)
35+
#define NRF_CRYPTO_EXAMPLE_ECDSA_PUBLIC_KEY_SIZE (65)
36+
37+
38+
/* Below text is used as plaintext for signing/verification */
39+
static uint8_t m_plain_text[NRF_CRYPTO_TEST_IKG_TEXT_SIZE] = {
40+
"Example string to demonstrate basic usage of the IKG identity key."
41+
};
42+
43+
static uint8_t m_pub_key[NRF_CRYPTO_EXAMPLE_ECDSA_PUBLIC_KEY_SIZE];
44+
static uint8_t m_signature[NRF_CRYPTO_TEST_IKG_SIGNATURE_SIZE];
45+
static psa_key_handle_t key_handle;
46+
static psa_key_id_t key_id;
47+
/* ====================================================================== */
48+
49+
LOG_MODULE_DECLARE(app, LOG_LEVEL_DBG);
50+
51+
int get_identity_key(void)
52+
{
53+
psa_status_t status;
54+
psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
55+
size_t data_length;
56+
57+
key_handle = mbedtls_svc_key_id_make(0, identity_key_id);
58+
psa_key_attributes_t attr = key_attributes;
59+
60+
status = psa_get_key_attributes(key_handle, &attr);
61+
if (status != APP_SUCCESS) {
62+
return status;
63+
}
64+
65+
status = psa_export_public_key(key_handle,
66+
m_pub_key,
67+
sizeof(m_pub_key),
68+
&data_length);
69+
70+
if (status != PSA_SUCCESS) {
71+
return status;
72+
}
73+
return APP_SUCCESS;
74+
}
75+
76+
int import_ecdsa_pub_key(void)
77+
{
78+
psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
79+
psa_status_t status;
80+
81+
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_VERIFY_MESSAGE);
82+
psa_set_key_lifetime(&key_attributes, PSA_KEY_LIFETIME_VOLATILE);
83+
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDSA(PSA_ALG_SHA_256));
84+
psa_set_key_type(&key_attributes, PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_SECP_R1));
85+
psa_set_key_bits(&key_attributes, 256);
86+
87+
status = psa_import_key(&key_attributes, m_pub_key, sizeof(m_pub_key), &key_id);
88+
if (status != PSA_SUCCESS) {
89+
return status;
90+
}
91+
92+
psa_reset_key_attributes(&key_attributes);
93+
94+
return APP_SUCCESS;
95+
}
96+
97+
int sign_message(void)
98+
{
99+
uint32_t output_len;
100+
psa_status_t status;
101+
102+
status = psa_sign_message(identity_key_id,
103+
PSA_ALG_ECDSA(PSA_ALG_SHA_256),
104+
m_plain_text,
105+
sizeof(m_plain_text),
106+
m_signature,
107+
sizeof(m_signature),
108+
&output_len);
109+
110+
if (status != PSA_SUCCESS) {
111+
return status;
112+
}
113+
114+
return APP_SUCCESS;
115+
}
116+
117+
int verify_message(void)
118+
{
119+
psa_status_t status;
120+
121+
status = psa_verify_message(key_id,
122+
PSA_ALG_ECDSA(PSA_ALG_SHA_256),
123+
m_plain_text,
124+
sizeof(m_plain_text),
125+
m_signature,
126+
NRF_CRYPTO_TEST_IKG_SIGNATURE_SIZE);
127+
128+
if (status != PSA_SUCCESS) {
129+
return status;
130+
}
131+
132+
return APP_SUCCESS;
133+
}
134+
135+
int ikg_identity_key_test(void)
136+
{
137+
int status;
138+
139+
status = crypto_init();
140+
TEST_VECTOR_ASSERT_EQUAL(APP_SUCCESS, status);
141+
142+
status = get_identity_key();
143+
TEST_VECTOR_ASSERT_EQUAL(APP_SUCCESS, status);
144+
145+
status = import_ecdsa_pub_key();
146+
TEST_VECTOR_ASSERT_EQUAL(APP_SUCCESS, status);
147+
148+
status = sign_message();
149+
TEST_VECTOR_ASSERT_EQUAL(APP_SUCCESS, status);
150+
151+
status = verify_message();
152+
TEST_VECTOR_ASSERT_EQUAL(APP_SUCCESS, status);
153+
154+
status = crypto_finish();
155+
TEST_VECTOR_ASSERT_EQUAL(APP_SUCCESS, status);
156+
157+
return status;
158+
}
159+
160+
ZTEST(test_suite_ikg, ikg_identity_key_test)
161+
{
162+
ikg_identity_key_test();
163+
}

0 commit comments

Comments
 (0)