nrf_security: Make the Cracen IKG configurable #22542

Vge0rge · 2025-05-27T13:25:47Z

Add the configuration option CRACEN_IKG
which allows to disable the IKG funcionality
if it is not needed.

This will decrease the flash usage for applications
which don't use the IKG.

Ref: NCSDK-30246

Signed-off-by: Georgios Vasilakis <[email protected]>

NordicBuilder · 2025-05-27T13:31:34Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 6

Inputs:

Sources:

sdk-nrf: PR head: 83fa46f5af1fcd5a1eb83d204409f519651fd389

more details

sdk-nrf:

PR head: 83fa46f5af1fcd5a1eb83d204409f519651fd389
merge base: 3d75f3562e4f8c16491b8c51f250a9cb1b2232b5
target head (main): 3d75f3562e4f8c16491b8c51f250a9cb1b2232b5
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (10)

subsys
│  ├── nrf_security
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── cracen
│  │  │  │  │  ├── Kconfig
│  │  │  │  │  ├── cracenpsa
│  │  │  │  │  │  ├── cracenpsa.cmake
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  ├── common.c
│  │  │  │  │  │  │  ├── key_management.c
│  │  │  │  │  │  │  │ sign.c
│  │  │  │  │  ├── silexpk
│  │  │  │  │  │  ├── include
│  │  │  │  │  │  │  ├── silexpk
│  │  │  │  │  │  │  │  │ ik.h
│  │  │  │  │  │  ├── silexpk.cmake
│  │  │  │  │  │  ├── target
│  │  │  │  │  │  │  ├── baremetal_ba414e_with_ik
│  │  │  │  │  │  │  │  │ pk_baremetal.c
│  │  │  │  │  │  │  ├── hw
│  │  │  │  │  │  │  │  ├── ba414
│  │  │  │  │  │  │  │  │  │ pkhardware_ba414e.c
│  │  │  │  │  │  │  │  ├── ik
│  │  │  │  │  │  │  │  │  │ ikhardware.c

Outputs:

Toolchain

Version: 4aa3467a6d
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:4aa3467a6d_e85602c25f

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
- sdk-nrf test count: 1819
✅ Integration tests
- ✅ test-fw-nrfconnect-boot
- ✅ test_ble_nrf_config
- ✅ test-fw-nrfconnect-chip
- ✅ test-fw-nrfconnect-nrf-iot_cloud
- ✅ test-fw-nrfconnect-nrf_crypto
- ✅ test-fw-nrfconnect-rs
- ✅ test-fw-nrfconnect-tfm
- ✅ test-sdk-find-my
- ✅ test-sdk-mcuboot
- ⚠️ test-sdk-dfu

Disabled integration tests

- desktop52_verification
- doc-internal
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_mosh
- test-fw-nrfconnect-nrf-iot_positioning
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-proprietary_esb
- test-fw-nrfconnect-ps-main
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-thread-main
- test-low-level
- test-sdk-audio
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

github-actions · 2025-05-27T13:51:39Z

You can find the documentation preview for this PR here.

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/sign.c

degjorva

Approved with change to misspelled config. Also NIT: in commit message for "remove unused function" you dropped a word in :"The function exit_ikg instead which is placed in the file
ikg_signature.c". Probably "is used" or something similar.

degjorva · 2025-06-02T07:33:08Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/sign.c

+			return status;
+		} else {
+			return SX_ERR_INCOMPATIBLE_HW;


NIT: you could have this as a single return status; outside the if since the status is set to SX_ERR_INCOMPATIBLE_HW

Makes sense, I did this

degjorva · 2025-06-02T07:35:29Z

subsys/nrf_security/src/drivers/cracen/silexpk/target/baremetal_ba414e_with_ik/pk_baremetal.c

@@ -99,7 +106,7 @@ int read_status(sx_pk_req *req)
 int sx_pk_wait(sx_pk_req *req)
 {
 	do {
-#ifndef CONFIG_CRACEN_HW_VERSION_LITE
+#if !defined(CONFIG_CRACEN_HW_VERSION_LITE) && defined(COFNIG_CRACEN_IKG)


Suggested change

#if !defined(CONFIG_CRACEN_HW_VERSION_LITE) && defined(COFNIG_CRACEN_IKG)

#if !defined(CONFIG_CRACEN_HW_VERSION_LITE) && defined(CONFIG_CRACEN_IKG)

Also as discussed offline this should probably not be here

Updated the logic, have a second look on this please.

Add the configuration option CRACEN_IKG which allows to disable the IKG funcionality if it is not needed. This will decrease the flash usage for applications which don't use the IKG. Ref: NCSDK-30246 Signed-off-by: Georgios Vasilakis <[email protected]>

Remove the function sx_pk_ik_mode_exit which was unused. The function exit_ikg is used instead which is placed in the file ikg_signature.c Signed-off-by: Georgios Vasilakis <[email protected]>

Vge0rge requested review from a team as code owners May 27, 2025 13:25

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label May 27, 2025

Vge0rge force-pushed the configurable_ikg branch from e6c820c to 7d433f8 Compare May 27, 2025 13:54

Vge0rge removed the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label May 27, 2025

degjorva reviewed May 28, 2025

View reviewed changes

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/sign.c Outdated Show resolved Hide resolved

nordicjm approved these changes May 28, 2025

View reviewed changes

Vge0rge force-pushed the configurable_ikg branch from 7d433f8 to 35768a0 Compare June 1, 2025 15:32

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Jun 1, 2025

Vge0rge force-pushed the configurable_ikg branch 2 times, most recently from 6b5e695 to 590d9a5 Compare June 2, 2025 06:35

degjorva approved these changes Jun 2, 2025

View reviewed changes

Vge0rge added 2 commits June 2, 2025 17:04

nrf_security: Remove unused function in Cracen PK

83fa46f

Remove the function sx_pk_ik_mode_exit which was unused. The function exit_ikg is used instead which is placed in the file ikg_signature.c Signed-off-by: Georgios Vasilakis <[email protected]>

Vge0rge force-pushed the configurable_ikg branch from 590d9a5 to 83fa46f Compare June 2, 2025 15:04

carlescufi merged commit 31e578e into nrfconnect:main Jun 3, 2025
14 checks passed

nvlsianpu mentioned this pull request Jun 3, 2025

samples: zephyr: mcuboot_minimal configuration #22532

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

nrf_security: Make the Cracen IKG configurable #22542

nrf_security: Make the Cracen IKG configurable #22542

Vge0rge commented May 27, 2025

Uh oh!

NordicBuilder commented May 27, 2025 •

edited

Loading

Uh oh!

github-actions bot commented May 27, 2025

Uh oh!

Uh oh!

degjorva left a comment

Uh oh!

degjorva Jun 2, 2025

Uh oh!

Vge0rge Jun 2, 2025

Uh oh!

degjorva Jun 2, 2025

Uh oh!

degjorva Jun 2, 2025

Uh oh!

Vge0rge Jun 2, 2025

Uh oh!

Uh oh!

Uh oh!

	#if !defined(CONFIG_CRACEN_HW_VERSION_LITE) && defined(COFNIG_CRACEN_IKG)
	#if !defined(CONFIG_CRACEN_HW_VERSION_LITE) && defined(CONFIG_CRACEN_IKG)

nrf_security: Make the Cracen IKG configurable #22542

nrf_security: Make the Cracen IKG configurable #22542

Conversation

Vge0rge commented May 27, 2025

Uh oh!

NordicBuilder commented May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

github-actions bot commented May 27, 2025

Uh oh!

Uh oh!

degjorva left a comment

Choose a reason for hiding this comment

Uh oh!

degjorva Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

Vge0rge Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

degjorva Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

degjorva Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

Vge0rge Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

NordicBuilder commented May 27, 2025 •

edited

Loading