nrf_security: Support platform keys with CMAC KDF

Makes it possibly to use MKEK and MEXT as keys for CMAC
KDF.

Signed-off-by: Vidar Lillebø <[email protected]>

subsys/nrf_security/configs/nrf-config.h.template

@@ -31,6 +31,10 @@ extern "C" {
 #define MBEDTLS_ASN1_PARSE_C
 #endif
 
+#if defined(CONFIG_PSA_NEED_CRACEN_KEY_MANAGEMENT_DRIVER)
+#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
+#endif
+
 /****************************************************************/
 /* Require built-in implementations based on PSA requirements
  *

subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa.h

@@ -24,9 +24,9 @@
  * See "PSA Cryptography API" for documentation.
  */
 
-#define CRACEN_BUILTIN_IDENTITY_KEY_ID ((uint32_t)0x7ffff001)
-#define CRACEN_BUILTIN_MKEK_ID	       ((uint32_t)0x7ffff002)
-#define CRACEN_BUILTIN_MEXT_ID	       ((uint32_t)0x7ffff003)
+#define CRACEN_BUILTIN_IDENTITY_KEY_ID ((uint32_t)0x7fffc001)
+#define CRACEN_BUILTIN_MKEK_ID	       ((uint32_t)0x7fffc002)
+#define CRACEN_BUILTIN_MEXT_ID	       ((uint32_t)0x7fffc003)
 
 #define CRACEN_IDENTITY_KEY_SLOT_NUMBER 0
 #define CRACEN_MKEK_SLOT_NUMBER		1

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_derivation.c

@@ -22,7 +22,7 @@
 #include <string.h>
 
 #define uint32_to_be(i)                                                                            \
-	((((i) & 0xFF) << 24) | ((((i) >> 8) & 0xFF) << 16) | ((((i) >> 16) & 0xFF) << 8) |        \
+	((((i)&0xFF) << 24) | ((((i) >> 8) & 0xFF) << 16) | ((((i) >> 16) & 0xFF) << 8) |          \
 	 (((i) >> 24) & 0xFF))
 
 static psa_status_t ecc_key_agreement_check_alg(psa_algorithm_t alg)
@@ -646,7 +646,8 @@ psa_status_t cracen_key_derivation_input_key(cracen_key_derivation_operation_t *
 	psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
 
 	if (operation->alg != PSA_ALG_SP800_108_COUNTER_CMAC) {
-		return PSA_ERROR_NOT_SUPPORTED;
+		return cracen_key_derivation_input_bytes(operation, step, key_buffer,
+							 key_buffer_size);
 	}
 
 	if (psa_get_key_type(attributes) != PSA_KEY_TYPE_AES) {
@@ -1085,7 +1086,8 @@ psa_status_t cracen_key_derivation_output_bytes(cracen_key_derivation_operation_
 
 	if (IS_ENABLED(PSA_NEED_CRACEN_SP800_108_COUNTER_CMAC) &&
 	    (operation->alg == PSA_ALG_SP800_108_COUNTER_CMAC)) {
-		if (operation->state == CRACEN_KD_STATE_CMAC_CTR_INPUT_LABEL ||
+		if (operation->state == CRACEN_KD_STATE_CMAC_CTR_KEY_LOADED ||
+		    operation->state == CRACEN_KD_STATE_CMAC_CTR_INPUT_LABEL ||
 		    operation->state == CRACEN_KD_STATE_CMAC_CTR_INPUT_CONTEXT ||
 		    operation->state == CRACEN_KD_STATE_CMAC_CTR_OUTPUT) {
 			if (operation->state != CRACEN_KD_STATE_CMAC_CTR_OUTPUT) {

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c

@@ -1217,7 +1217,7 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
 							 PSA_KEY_LOCATION_CRACEN));
 		psa_set_key_type(attributes, PSA_KEY_TYPE_AES);
 		psa_set_key_bits(attributes, 256);
-		psa_set_key_algorithm(attributes, PSA_ALG_CMAC);
+		psa_set_key_algorithm(attributes, PSA_ALG_SP800_108_COUNTER_CMAC);
 		psa_set_key_usage_flags(attributes,
 					PSA_KEY_USAGE_DERIVE | PSA_KEY_USAGE_VERIFY_DERIVATION);
 

subsys/nrf_security/src/drivers/cracen/psa_driver.Kconfig

@@ -1688,7 +1688,8 @@ config PSA_NEED_CRACEN_KEY_MANAGEMENT_DRIVER
 		   PSA_NEED_CRACEN_KEY_TYPE_SRP_6_3072              	  || \
 		   PSA_NEED_CRACEN_KEY_TYPE_RSA_PUBLIC_KEY                || \
 		   PSA_NEED_CRACEN_KEY_TYPE_RSA_KEY_PAIR_IMPORT           || \
-		   PSA_NEED_CRACEN_KEY_TYPE_RSA_KEY_PAIR_EXPORT
+		   PSA_NEED_CRACEN_KEY_TYPE_RSA_KEY_PAIR_EXPORT           || \
+		   PSA_NEED_CRACEN_KEY_DERIVATION_DRIVER
 
 # CRACEN MAC Driver
 

subsys/nrf_security/src/psa_crypto_driver_wrappers.c

@@ -2199,6 +2199,31 @@ psa_driver_wrapper_key_derivation_input_bytes(psa_key_derivation_operation_t *op
 	}
 }
 
+psa_status_t psa_driver_wrapper_key_derivation_input_key(psa_key_derivation_operation_t *operation,
+							 psa_key_derivation_step_t step,
+							 psa_key_attributes_t *attributes,
+							 const uint8_t *data, size_t data_length)
+{
+	switch (operation->id) {
+#if defined(PSA_NEED_CRACEN_KEY_DERIVATION_DRIVER)
+	case PSA_CRYPTO_CRACEN_DRIVER_ID:
+		return cracen_key_derivation_input_key(&operation->ctx.cracen_kdf_ctx, step,
+						       attributes, data, data_length);
+#endif /* PSA_NEED_CRACEN_KEY_DERIVATION_DRIVER */
+#if defined(PSA_NEED_OBERON_KEY_DERIVATION_DRIVER)
+	case PSA_CRYPTO_OBERON_DRIVER_ID:
+		return oberon_key_derivation_input_bytes(&operation->ctx.oberon_kdf_ctx, step, data,
+							 data_length);
+#endif /* PSA_NEED_OBERON_KEY_DERIVATION_DRIVER */
+
+	default:
+		(void)step;
+		(void)data;
+		(void)data_length;
+		return PSA_ERROR_BAD_STATE;
+	}
+}
+
 psa_status_t
 psa_driver_wrapper_key_derivation_input_integer(psa_key_derivation_operation_t *operation,
 						psa_key_derivation_step_t step, uint64_t value)

west.yml

@@ -144,7 +144,7 @@ manifest:
     - name: oberon-psa-crypto
       path: modules/crypto/oberon-psa-crypto
       repo-path: sdk-oberon-psa-crypto
-      revision: 5028cb64083e01122e9360f59854fbf3d36e203d
+      revision: c6f564e8e09ac73cc31380e4042bd932013232d0
     - name: nrfxlib
       repo-path: sdk-nrfxlib
       path: nrfxlib