Skip to content

Commit ad164e2

Browse files
tomi-fontendre-nordic
authored andcommitted
nrf_security: drivers: cracen: fix ECDH/SPAKE2+ key check
Remove a step that is not needed and that was not performed properly. It showed up as an error on CRACEN Lite because the IP returns a different error code. ref: DLT-3834 Signed-off-by: Tomi Fontanilles <[email protected]>
1 parent cf0edf2 commit ad164e2

File tree

1 file changed

+5
-13
lines changed
  • subsys/nrf_security/src/drivers/cracen/cracenpsa/src

1 file changed

+5
-13
lines changed

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/common.c

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -340,7 +340,6 @@ psa_status_t cracen_ecc_check_public_key(const struct sx_pk_ecurve *curve,
340340
const sx_pk_affine_point *in_pnt)
341341
{
342342
int sx_status;
343-
int psa_status;
344343
char char_x[CRACEN_MAC_ECC_PRIVKEY_BYTES];
345344
char char_y[CRACEN_MAC_ECC_PRIVKEY_BYTES];
346345

@@ -352,29 +351,22 @@ psa_status_t cracen_ecc_check_public_key(const struct sx_pk_ecurve *curve,
352351
.y = {.sz = n.sz, .bytes = char_y}};
353352

354353
/* This function checks if the point is on the curve, it also checks
355-
* that both x and y are <= p - 1. So it gives us coverage for 1,2,3.
354+
* that both x and y are <= p - 1. So it gives us coverage for steps 1, 2 and 3.
356355
*/
357356
sx_status = sx_ec_ptoncurve(curve, in_pnt);
358357
if (sx_status != SX_OK) {
359358
return silex_statuscodes_to_psa(sx_status);
360359
}
361360

362-
/* Step 4 of the checks, we do (order * pnt) and we expect to get the
363-
* point of infinity as a result. The Cracen returns
364-
* SX_ERR_NOT_INVERTIBLE and not SX_ERR_POINT_AT_INFINITY as expected
361+
/* Skip step 4.
362+
* Only do partial key validation as we only support NIST curves and X25519.
363+
* See DLT-3834 for more information.
365364
*/
366-
sx_status = sx_ecp_ptmult(curve, &n, in_pnt, &scratch_pnt);
367-
if (sx_status == SX_ERR_NOT_INVERTIBLE) {
368-
psa_status = PSA_SUCCESS;
369-
} else {
370-
psa_status = (sx_status == SX_OK) ? PSA_ERROR_INVALID_ARGUMENT
371-
: silex_statuscodes_to_psa(sx_status);
372-
}
373365

374366
safe_memzero(scratch_pnt.x.bytes, scratch_pnt.x.sz);
375367
safe_memzero(scratch_pnt.x.bytes, scratch_pnt.x.sz);
376368

377-
return psa_status;
369+
return PSA_SUCCESS;
378370
}
379371

380372
psa_status_t rnd_in_range(uint8_t *n, size_t sz, const uint8_t *upperlimit, size_t retry_limit)

0 commit comments

Comments
 (0)