Topic: Cryptocell RSA signing error
I am using wolfcrypt 4.1.0 with the Nordic NRF52840 cryptocell enabled.
Since enabling cryptocell I am no longer able to use wc_RsaSSL_Sign to sign with my RSA private key.
I have traced it to being unable to decode the private key from the RSA generated keypair.
The following code works successfully when cryptocell is not enabled, but with cryptocell enabled , wc_RsaPrivateKeyDecode return with error code -192 (Bad state operation )
//Key generation
RsaKey RSAKey;
long exp = 65537l;
WC_RNG rng;
int keySize = 1024;
uint8_t *derKey = NULL;
uint16_t derSz = 0;
if( wc_InitRsaKey(&RSAKey, NULL) != 0 ) { // not using heap hint. No custom memory
// error initializing rng
printf("wc_InitRng Failed");
goto end;
}
//initialize random number generator
if( wc_InitRng(&rng) != 0 ) {
// error initializing rng
printf("wc_InitRng Failed");
goto end;
}
if(wc_RsaSetRNG(&RSAKey, &rng) != EXIT_SUCCESS) {
printf("wc_RsaSetRNG Failed\r\n");
goto end;
}
// generate keysize bit long private key
if( wc_MakeRsaKey(&RSAKey, keySize, exp, &rng) != 0 ) {
// error generating private key
printf("wc_MakeRsaKey Failed\r\n");
goto end;
}
//free RNG object
if (wc_FreeRng(&rng) != 0) {
printf("wc_FreeRng Failed \r\n");
}
//Check RSA key
int ret = wc_CheckRsaKey(&RSAKey);
if (ret != 0) {
printf("Key Error\r\n");
}
// Allocate memory for der
derKey = pvPortMalloc(keySize);
if (derKey == NULL) {
NRF_LOG_ERROR("Could not allocate memory to create derKey");
goto end;
}
derSz = 0;
//Convert key to der
derSz = wc_RsaKeyToDer(&RSAKey, derKey, keySize);
printf("Der size = %d \r\n",derSz);
if (derSz == 0) {
printf("der Error\r\n");
}
RsaKey privateKey;
word32 idx = 0;
//decode new private key from DER
ret = wc_RsaPrivateKeyDecode(derKey, &idx, &privateKey, derSz);
if( ret != 0 ) {
printf("Cannot decode private key. ret = %d \r\n",ret);
printf("Failed here \r\n");
}
Question: How can I extract the RSA private key to use to sign data using wc_RsaSSL_Sign- using cryptocell.