Skip to content

Commit db5e8e6

Browse files
bandogorabandogora
committed
Update Swiftly TLS certificate and MBedTLS config
1 parent cbdaad4 commit db5e8e6

File tree

8 files changed

+58
-89
lines changed

8 files changed

+58
-89
lines changed

‎app/CMakeLists.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ zephyr_include_directories(${gen_dir})
1313

1414
foreach(inc_file
1515
r4.crt
16-
AmazonRootCA1.cer
16+
AmazonRootCA3.cer
1717
)
1818
generate_inc_file_for_target(
1919
app

‎app/VERSION

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
VERSION_MAJOR = 0
2-
VERSION_MINOR = 11
3-
PATCHLEVEL = 2
2+
VERSION_MINOR = 12
3+
PATCHLEVEL = 0
44
VERSION_TWEAK = 0
55
EXTRAVERSION = stable

‎app/boards/circuitdojo_feather_nrf9160_ns.conf

Lines changed: 27 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ CONFIG_TFM_CMAKE_BUILD_TYPE_RELEASE=y
5959
# TF-M memory regions - optimize for size
6060
CONFIG_PM_PARTITION_SIZE_TFM_SRAM=0x10000
6161
CONFIG_PM_PARTITION_SIZE_TFM=0x37E00
62-
# CONFIG_PM_PARTITION_SIZE_TFM_PROTECTED_STORAGE=0x2000
62+
CONFIG_PM_PARTITION_SIZE_TFM_PROTECTED_STORAGE=0x2000
6363

6464
# TF-M logging requirements
6565
CONFIG_TFM_SECURE_UART0=y
@@ -69,12 +69,13 @@ CONFIG_TFM_SECURE_UART_SHARE_INSTANCE=y
6969
CONFIG_NRF_SECURITY=y
7070
# CONFIG_NORDIC_SECURITY_BACKEND=y
7171
CONFIG_MBEDTLS_LEGACY_CRYPTO_C=y
72+
# CONFIG_MBEDTLS_USE_PSA_CRYPTO=y
7273
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y
74+
# CONFIG_MBEDTLS_LIBRARY_NRF_SECURITY=y
7375

7476
# Enable MbedTLS
7577
CONFIG_MBEDTLS=y
7678

77-
CONFIG_MBEDTLS_THREADING_C=y
7879
# CONFIG_CC3XX_BACKEND=y
7980
# MbedTLS configurations
8081
CONFIG_MBEDTLS_ENABLE_HEAP=y
@@ -85,8 +86,8 @@ CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=16384
8586

8687
# MbedTLS net configurations
8788
CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=6
88-
# CONFIG_TLS_MAX_CREDENTIALS_NUMBER=8
89-
# CONFIG_NET_SOCKETS_TLS_MAX_CREDENTIALS=8
89+
CONFIG_TLS_MAX_CREDENTIALS_NUMBER=8
90+
CONFIG_NET_SOCKETS_TLS_MAX_CREDENTIALS=8
9091

9192
# Create the mbed SSL/TLS library in addition to the mbed crypto library
9293
CONFIG_MBEDTLS_TLS_LIBRARY=y
@@ -96,21 +97,30 @@ CONFIG_MBEDTLS_X509_LIBRARY=y
9697

9798
# Enable TLS credentials management subsystem
9899
CONFIG_TLS_CREDENTIALS=y
99-
# CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE=y
100+
CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE=y
100101

101102
# MbedTLS module configurations
102103
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
103-
CONFIG_MBEDTLS_RSA_C=y
104-
# CONFIG_MBEDTLS_PEM_PARSE_C=y
105-
CONFIG_MBEDTLS_SSL_SRV_C=y
106-
104+
CONFIG_MBEDTLS_X509_LIBRARY=y
105+
CONFIG_MBEDTLS_PK_C=y
106+
CONFIG_MBEDTLS_PK_PARSE_C=y
107+
CONFIG_MBEDTLS_PK_PARSE_EC_EXTENDED=y
108+
CONFIG_MBEDTLS_AES_C=y
109+
CONFIG_MBEDTLS_ECDH_C=y
110+
CONFIG_MBEDTLS_ECDSA_C=y
111+
CONFIG_MBEDTLS_CIPHER_C=y
112+
CONFIG_MBEDTLS_SHA256_C=y
113+
# CONFIG_MBEDTLS_GCM_C=y
114+
# CONFIG_MBEDTLS_ECP_C=y
115+
# CONFIG_MBEDTLS_CTR_DRBG_USE_128_BIT_KEY=y
116+
# CONFIG_MBEDTLS_ASN1_PARSE_C=y
117+
118+
CONFIG_MBEDTLS_SSL_SRV_C=n
107119
CONFIG_MBEDTLS_TLS_VERSION_1_2=n
108120
CONFIG_MBEDTLS_CIPHER=n
109-
# CONFIG_MBEDTLS_ECP_C=n
110121
CONFIG_MBEDTLS_ECJPAKE_C=n
111122
CONFIG_MBEDTLS_SHA1_C=n
112123
CONFIG_MBEDTLS_SHA224_C=n
113-
# CONFIG_MBEDTLS_SHA256_C=n
114124
CONFIG_MBEDTLS_SHA384_C=n
115125
CONFIG_MBEDTLS_SHA512_C=n
116126
CONFIG_MBEDTLS_CHACHA20_C=n
@@ -128,36 +138,23 @@ CONFIG_MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN=n
128138
CONFIG_MBEDTLS_CIPHER_PADDING_ZEROS=n
129139
CONFIG_MBEDTLS_MAC_SHA256_ENABLED=n
130140
CONFIG_MBEDTLS_CMAC_C=n
141+
CONFIG_MBEDTLS_CIPHER_MODE_CTR=n
142+
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED=n
131143

132144
# Key exchange configurations
133-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
134-
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED=y
135145
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED=y
136-
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y
137146
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=y
138147

139148
CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=n
140-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED=n
141-
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=n
142-
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED=n
143149
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED=n
144-
CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED=n
145150

146151
# Key type configurations
147152
CONFIG_PSA_WANT_KEY_TYPE_AES=y
148-
149153
CONFIG_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY=y
150154
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y
151155
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
152156
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE=y
153-
154-
CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=y
155-
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT=y
156-
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT=y
157-
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE=y
158-
159-
# Select RSA key sizes
160-
CONFIG_PSA_WANT_RSA_KEY_SIZE_2048=y
157+
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y
161158

162159
# Cipher configurations
163160
CONFIG_PSA_WANT_ALG_CTR=y
@@ -169,30 +166,20 @@ CONFIG_PSA_WANT_ALG_CBC_NO_PADDING=n
169166
CONFIG_PSA_WANT_ALG_ECDH=y
170167

171168
# Key derivation function configurations
172-
CONFIG_PSA_WANT_ALG_TLS12_PRF=y
173-
169+
CONFIG_PSA_WANT_ALG_TLS12_PRF=n
174170
CONFIG_PSA_WANT_ALG_TLS12_PSK_TO_MS=n
175171

176172
# MAC configurations
177-
CONFIG_PSA_WANT_ALG_CMAC=n
173+
CONFIG_PSA_WANT_ALG_HMAC=y
178174

179175
# AEAD configurations
180-
CONFIG_PSA_WANT_ALG_ECB_NO_PADDING=n
181176
CONFIG_PSA_WANT_ALG_GCM=y
182177

183178
# Asymmetric signature configurations
184179
CONFIG_PSA_WANT_ALG_ECDSA=y
185-
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=y
186-
CONFIG_PSA_WANT_ALG_RSA_PSS=y
187-
188-
# Asymmetric encryption configurations
189-
CONFIG_PSA_WANT_ALG_RSA_OAEP=y
190-
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT=y
191-
192180
CONFIG_PSA_WANT_ALG_SHA_256=y
193181

194182
# ECC curve configurations
195-
CONFIG_PSA_WANT_ECC_MONTGOMERY_255=y
196183
CONFIG_PSA_WANT_ECC_SECP_R1_256=y
197184

198185
# RNG configurations
@@ -205,16 +192,13 @@ CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y
205192
# Enable SSL renegotiation
206193
CONFIG_MBEDTLS_SSL_RENEGOTIATION=y
207194

208-
# Enable SSL cache
209-
CONFIG_MBEDTLS_SSL_CACHE_C=y
210-
211195
# Enable SSL session tickets
212196
CONFIG_MBEDTLS_SSL_SESSION_TICKETS=y
213197

214198
# Enable Mbed TLS logs
215199
CONFIG_MBEDTLS_DEBUG=y
216200
CONFIG_MBEDTLS_DEBUG_C=y
217-
# CONFIG_MBEDTLS_DEBUG_LEVEL=4
201+
# CONFIG_MBEDTLS_DEBUG_LEVEL=1
218202
CONFIG_MBEDTLS_LOG_LEVEL_DBG=y
219203
CONFIG_MBEDTLS_SSL_DEBUG_ALL=y
220204

‎app/boards/circuitdojo_feather_nrf9160_ns_release.conf

Lines changed: 20 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ CONFIG_NRF_MODEM_LIB=y
2424
CONFIG_NRF_MODEM_LIB_FAULT_STRERROR=y
2525
CONFIG_NRF_MODEM_LIB_ON_FAULT_APPLICATION_SPECIFIC=y
2626
CONFIG_MODEM_KEY_MGMT=n
27-
CONFIG_PDN=y
2827

2928
# Align the max FD entry to NRF_MODEM_MAX_SOCKET_COUNT(8)
3029
CONFIG_ZVFS_OPEN_MAX=8
@@ -60,6 +59,7 @@ CONFIG_TFM_CMAKE_BUILD_TYPE_RELEASE=y
6059
# TF-M memory regions - optimize for size
6160
CONFIG_PM_PARTITION_SIZE_TFM_SRAM=0x10000
6261
CONFIG_PM_PARTITION_SIZE_TFM=0x37E00
62+
CONFIG_PM_PARTITION_SIZE_TFM_PROTECTED_STORAGE=0x2000
6363

6464
# TF-M logging requirements
6565
CONFIG_TFM_LOG_LEVEL_SILENCE=y
@@ -80,10 +80,11 @@ CONFIG_MBEDTLS_ENABLE_HEAP=y
8080
CONFIG_MBEDTLS_HEAP_SIZE=65536
8181
CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
8282
CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=16384
83-
CONFIG_MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH=y
8483

8584
# MbedTLS net configurations
8685
CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=6
86+
CONFIG_TLS_MAX_CREDENTIALS_NUMBER=8
87+
CONFIG_NET_SOCKETS_TLS_MAX_CREDENTIALS=8
8788

8889
# Create the mbed SSL/TLS library in addition to the mbed crypto library
8990
CONFIG_MBEDTLS_TLS_LIBRARY=y
@@ -93,12 +94,21 @@ CONFIG_MBEDTLS_X509_LIBRARY=y
9394

9495
# Enable TLS credentials management subsystem
9596
CONFIG_TLS_CREDENTIALS=y
97+
CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE=y
9698

9799
# MbedTLS module configurations
98100
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
99-
CONFIG_MBEDTLS_RSA_C=y
100-
CONFIG_MBEDTLS_SSL_SRV_C=y
101-
101+
CONFIG_MBEDTLS_X509_LIBRARY=y
102+
CONFIG_MBEDTLS_PK_C=y
103+
CONFIG_MBEDTLS_PK_PARSE_C=y
104+
CONFIG_MBEDTLS_PK_PARSE_EC_EXTENDED=y
105+
CONFIG_MBEDTLS_AES_C=y
106+
CONFIG_MBEDTLS_ECDH_C=y
107+
CONFIG_MBEDTLS_ECDSA_C=y
108+
CONFIG_MBEDTLS_CIPHER_C=y
109+
CONFIG_MBEDTLS_SHA256_C=y
110+
111+
CONFIG_MBEDTLS_SSL_SRV_C=n
102112
CONFIG_MBEDTLS_TLS_VERSION_1_2=n
103113
CONFIG_MBEDTLS_CIPHER=n
104114
CONFIG_MBEDTLS_ECJPAKE_C=n
@@ -121,36 +131,23 @@ CONFIG_MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN=n
121131
CONFIG_MBEDTLS_CIPHER_PADDING_ZEROS=n
122132
CONFIG_MBEDTLS_MAC_SHA256_ENABLED=n
123133
CONFIG_MBEDTLS_CMAC_C=n
134+
CONFIG_MBEDTLS_CIPHER_MODE_CTR=n
135+
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED=n
124136

125137
# Key exchange configurations
126-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
127-
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED=y
128138
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED=y
129-
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y
130139
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=y
131140

132141
CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=n
133-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED=n
134-
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=n
135-
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED=n
136142
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED=n
137-
CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED=n
138143

139144
# Key type configurations
140145
CONFIG_PSA_WANT_KEY_TYPE_AES=y
141-
142146
CONFIG_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY=y
143147
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y
144148
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
145149
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE=y
146-
147-
CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=y
148-
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT=y
149-
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT=y
150-
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE=y
151-
152-
# Select RSA key sizes
153-
CONFIG_PSA_WANT_RSA_KEY_SIZE_2048=y
150+
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y
154151

155152
# Cipher configurations
156153
CONFIG_PSA_WANT_ALG_CTR=y
@@ -162,30 +159,20 @@ CONFIG_PSA_WANT_ALG_CBC_NO_PADDING=n
162159
CONFIG_PSA_WANT_ALG_ECDH=y
163160

164161
# Key derivation function configurations
165-
CONFIG_PSA_WANT_ALG_TLS12_PRF=y
166-
162+
CONFIG_PSA_WANT_ALG_TLS12_PRF=n
167163
CONFIG_PSA_WANT_ALG_TLS12_PSK_TO_MS=n
168164

169165
# MAC configurations
170-
CONFIG_PSA_WANT_ALG_CMAC=n
166+
CONFIG_PSA_WANT_ALG_HMAC=y
171167

172168
# AEAD configurations
173-
CONFIG_PSA_WANT_ALG_ECB_NO_PADDING=n
174169
CONFIG_PSA_WANT_ALG_GCM=y
175170

176171
# Asymmetric signature configurations
177172
CONFIG_PSA_WANT_ALG_ECDSA=y
178-
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=y
179-
CONFIG_PSA_WANT_ALG_RSA_PSS=y
180-
181-
# Asymmetric encryption configurations
182-
CONFIG_PSA_WANT_ALG_RSA_OAEP=y
183-
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT=y
184-
185173
CONFIG_PSA_WANT_ALG_SHA_256=y
186174

187175
# ECC curve configurations
188-
CONFIG_PSA_WANT_ECC_MONTGOMERY_255=y
189176
CONFIG_PSA_WANT_ECC_SECP_R1_256=y
190177

191178
# RNG configurations
@@ -198,8 +185,5 @@ CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y
198185
# Enable SSL renegotiation
199186
CONFIG_MBEDTLS_SSL_RENEGOTIATION=y
200187

201-
# Enable SSL cache
202-
CONFIG_MBEDTLS_SSL_CACHE_C=y
203-
204188
# Enable SSL session tickets
205189
CONFIG_MBEDTLS_SSL_SESSION_TICKETS=y

‎app/keys/public/AmazonRootCA3.cer

442 Bytes
Binary file not shown.

‎app/pm_static.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
EMPTY_0:
2-
address: 0xfc000
2+
address: 0xfa000
33
end_address: 0x100000
44
placement:
55
after:
66
- tfm_ps
77
region: flash_primary
8-
size: 0x4000
8+
size: 0x6000
99
EMPTY_1:
1010
address: 0xf2000
1111
end_address: 0xf8000
@@ -237,7 +237,7 @@ tfm_otp_nv_counters:
237237
size: 0x2000
238238
tfm_ps:
239239
address: 0xf8000
240-
end_address: 0xfc000
240+
end_address: 0xfa000
241241
inside:
242242
- tfm_storage
243243
placement:
@@ -246,7 +246,7 @@ tfm_ps:
246246
before:
247247
- end
248248
region: flash_primary
249-
size: 0x4000
249+
size: 0x2000
250250
tfm_secure:
251251
address: 0x10000
252252
end_address: 0x48000
@@ -268,11 +268,11 @@ tfm_sram:
268268
size: 0x10000
269269
tfm_storage:
270270
address: 0xe8000
271-
end_address: 0xfc000
271+
end_address: 0xfa000
272272
orig_span: &id010
273273
- tfm_ps
274274
- tfm_its
275275
- tfm_otp_nv_counters
276276
region: flash_primary
277-
size: 0x14000
277+
size: 0x12000
278278
span: *id010

‎app/src/main.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,7 @@ int main(void) {
260260
k_msleep(29000);
261261
}
262262
#else
263+
k_msleep(3000);
263264
LOG_ERR("Reached end of main; rebooting.");
264265
/* The ARM implementation sys_reboot ignores the parameter */
265266
sys_reboot(SYS_REBOOT_WARM);

‎app/src/net/lte_manager.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ static const char jes_cert[] = {
2525
#endif // CONFIG_JES_FOTA
2626

2727
static const char swiftly_cert[] = {
28-
#include "AmazonRootCA1.cer.hex"
28+
#include "AmazonRootCA3.cer.hex"
2929
// Null terminate certificate if running Mbed TLS
3030
IF_ENABLED(CONFIG_TLS_CREDENTIALS, (0x00))
3131
};

0 commit comments

Comments
 (0)