feat: use nrf52 hardware crypto where we can

[NickDunklee]

First PR, advert-only

While working on some sensor code implementations, I ran into some hard crashes that root-caused to the 4KB loop task stack being exhausted.

Looking for various optimization schemes resulted in this relatively low-lift fix. RAK3401 and RAK4631 both support hardware crypto. Edit: Heltec t096 and Seeed t1000-e support this as well, so I have tested them and added them.

Rather than loading in one of the two software crypto libs, we can just use the onboard hardware. This is faster, should consume less power, and in testing used a scant up to 700 bytes in the run loop vs 2.5-3KB per advert.

This change only affects advert verification processing, which currently consumes a significant chunk of the 4KB run loop.

I figured such a change should likely be implemented in phases.

After soaking, this hardware crypto verification
process could be implemented across the entire MeshCore cryptographic function on RAK nodes. Also possible other nodes have available hardware crypto, however, I have not checked, so future improvements may also exist there.

Tested on:

• RAK3401 RAK 1W
• RAK4631 19001
• Heltec t096
• Seeed t1000-e

Addendum, more crypto added:

feat: add more crypto

After soaking for a bit on the adverts without issue on multiple nodes, I added more hardware crypto. While I haven't a chance to do a debug comparison of the run loop like I did with the advert code, moving more crypto out of software and into hardware should further reduce the memory footprint in the run loop by a couple to three hundred bytes which should contribute to overall stability, especially in devices with sensors/GPS consuming more run loop memory. (Possibly some minor performance and/or power improvements.)

Supported nodes is unchanged in this PR addition, but if others can verify, they can easily be added.

Some info on the CC310: https://docs.nordicsemi.com/r/bundle/ps_nrf9151/page/cryptocell.html

Added:

• AES-128 packet encryption/decryption now use hardware crypto
• HMAC-SHA-256 authentication now uses hardware crypto
• ACK hash computation and channel ID derivation now use hardware crypto
• RNG (random number generator) now uses hardware crypto rather than radio noise + weak software RNG (which can have issues if there's no surrounding radio noise.) NIST SP 800-90B certified.
  • Runs hardware self-tests on startup
  • Runs continuous health tests during operation
  • Uses thermal noise/shot noise for randomness

Unchanged:

• calcSharedSecret remains software - it would be a split hw/sw solution and added complexity for likely not a lot of gains. This only happens when establishing a new contact, so not too frequent to be worth it.
• ed25519_create_keypair remains software. This is only called when a node is first initialized. It does use the hardware RNG change, however, so better randomization.

Tested on (so far):

• Heltec t096 ble companion
• rak19001 sensor
• seeed t1000-e companion
• rak19007 repeater

@Magalex2x14 tested on:

• RAK4631 companion
• RAK3401 repeater
• WisMesh Tag
• Build test with Lilligo T-Beam Supreme SX1262

@entr0p1 tested on:

• Xiao nRF52840

Build test on:

• Heltec t096 companion ble
• t1000e companion ble
• RAK 4631 repeater
• RAK 3401 companion BLE
• Heltec v3 companion wifi

[lbibass]

Shouldn't this work on every NRF52840?

[NickDunklee]

@lbibass very likely! Although anything's possible to break with different hardware designs. So I added types that I could confirm work thus far. If you or anyone else can confirm this works on other node types, happy to add them.

[entr0p1]

This is really cool. I'll try to remember to give it a test on some other boards and see how it plays out.

[Magalex2x14]

I just wanted to say that I flashed my RAK4631 companion and RAK3401 repeater with this code - I don’t see any problems. Nice PR!

[Magalex2x14]

Also tested with WisMesh Tag - I don’t see any problems.
Build test with Lilligo T-Beam Supreme SX1262.

[entr0p1]

Tested on Xiao nRF52840 (Repeater) - adverts sent, parse successfully on the receiving side. I'll test some more boards tomorrow if I can get time.

Great work :)

[entr0p1]

Worth noting - given the CC310 is in the nRF52840 MCU itself (and much much more), with enough board tests I think we shouldn't gate it by board and have it globally enabled. The maintainers might have a different view, but to keep things consistent that'd be my $0.02.

Further tested boards - all OK:

• GAT562 30s Mesh Kit (Companion BLE)
• Heltec T114 (Repeater)
• Lilygo T-Echo (Companion BLE)
• Lilygo T-Echo Lite (Repeater)
• Thinknode M1 (Companion BLE)

Tests performed:
Repeater:

• Advert send and receive successfully decoded

Companion BLE:

• Advert send and receive successfully decoded
• Direct message (both directions) sent and received