Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new cracen_ctr_drbg driver #272

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

aescolar
Copy link
Member

@aescolar aescolar commented Jan 14, 2025

Introduce a new CRACEN CTR_DRBG pseudo random driver which uses the CRACEN TRNG and Cryptomaster HW.

Note this driver is only intended for nRF54L devices, and meant to be used when nrf security is not in use. That is for builds with plain vanilla Zephyr (no NCS) or other SW builds with nrfx but without Zephyr or NCS.

The first two commits are just bringing those 2 hals ahead of the release. Those files are taken as is.

* @defgroup nrfx_cracen_ctr_drbg CRACEN CTR DRBG
* @{
* @ingroup nrfx_cracen_ctr_drbg
* @brief CRACEN CTR DRBG random generator driver
Copy link

@frkv frkv Jan 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* @brief CRACEN CTR DRBG random generator driver
* @brief CRACEN CTR_DRBG random generator driver

NIST SP800-90A (Recommendation for Random Number Generation Using Deterministic Random Bit Generators) available here defines this PRNG algorithm with the exact nomenclature CTR_DRBG

Please update all references that has CTR DRBG (has space) to be CTR_DRBG (has underscore) in this PR

@frkv
Copy link

frkv commented Jan 15, 2025

Suggestion. Could we add somewhere a build-time (static) assert that ensures these files are not compiled when CONFIG_NRF_SECURITY is defined?

@aescolar
Copy link
Member Author

Suggestion. Could we add somewhere a build-time (static) assert that ensures these files are not compiled when CONFIG_NRF_SECURITY is defined?

I'm ok with that if the hal guys are ok with it :)

@masz-nordic
Copy link
Collaborator

drivers/entropy/entropy_nrf54l_cracen.c would be an appropriate spot for that assert? Unless you want to cover case where only nrfx driver is used, without the SHIM?

@masz-nordic masz-nordic self-requested a review January 15, 2025 10:27
@aescolar aescolar force-pushed the cracen_rng branch 2 times, most recently from 30f8b9a to 6fae33d Compare January 15, 2025 13:29
@aescolar
Copy link
Member Author

drivers/entropy/entropy_nrf54l_cracen.c would be an appropriate spot for that assert? Unless you want to cover case where only nrfx driver is used, without the SHIM?

Unfortunately that is not possible.
Zephyr code cannot reference or mention Kconfig options which are not defined in Zephyr or its modules. It is against its coding guidelines and there is a CI check for that.

@aescolar
Copy link
Member Author

@frkv @masz-nordic ^^

@hermabe
Copy link
Member

hermabe commented Jan 15, 2025

drivers/entropy/entropy_nrf54l_cracen.c would be an appropriate spot for that assert? Unless you want to cover case where only nrfx driver is used, without the SHIM?

Unfortunately that is not possible. Zephyr code cannot reference or mention Kconfig options which are not defined in Zephyr or its modules. It is against its coding guidelines and there is a CI check for that.

When this eventually gets to sdk-nrf we can add a depends on in the NRF_SECURITY config instead.

Bring ahead of the next release the new CRACEN RNG HAL

Signed-off-by: Alberto Escolar Piedras <[email protected]>
@aescolar aescolar force-pushed the cracen_rng branch 5 times, most recently from cbc788d to 052e7c2 Compare January 16, 2025 17:00
Bring ahead of the next release the new CRACEN RNG HAL

Signed-off-by: Alberto Escolar Piedras <[email protected]>
Add a new random CTR DRBG driver using the CRACEN HW TRNG and AES-ECB
acceleration.

Signed-off-by: Alberto Escolar Piedras <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants