feat: use nrf52 hardware crypto where we can

[NickDunklee]

First PR, advert-only

While working on some sensor code implementations, I ran into some hard crashes that root-caused to the 4KB loop task stack being exhausted.

Looking for various optimization schemes resulted in this relatively low-lift fix. RAK3401 and RAK4631 both support hardware crypto. Edit: Heltec t096 and Seeed t1000-e support this as well, so I have tested them and added them.

Rather than loading in one of the two software crypto libs, we can just use the onboard hardware. This is faster, should consume less power, and in testing used a scant up to 700 bytes in the run loop vs 2.5-3KB per advert.

This change only affects advert verification processing, which currently consumes a significant chunk of the 4KB run loop.

I figured such a change should likely be implemented in phases.

After soaking, this hardware crypto verification
process could be implemented across the entire MeshCore cryptographic function on RAK nodes. Also possible other nodes have available hardware crypto, however, I have not checked, so future improvements may also exist there.

Tested on:

• RAK3401 RAK 1W
• RAK4631 19001
• Heltec t096
• Seeed t1000-e

Addendum, more crypto added:

feat: add more crypto

After soaking for a bit on the adverts without issue on multiple nodes, I added more hardware crypto.

Supported nodes is unchanged in this PR addition, but if others can verify, they can easily be added.

Some info on the CC310: https://docs.nordicsemi.com/r/bundle/ps_nrf9151/page/cryptocell.html

Added:

• AES-128 packet encryption/decryption now use hardware crypto
• HMAC-SHA-256 authentication now uses hardware crypto
• ACK hash computation and channel ID derivation now use hardware crypto
• RNG (random number generator) now uses hardware crypto rather than radio noise + weak software RNG (which can have issues if there's no surrounding radio noise.) NIST SP 800-90B certified.
  • Runs hardware self-tests on startup
  • Runs continuous health tests during operation
  • Uses thermal noise/shot noise for randomness

Unchanged:

• calcSharedSecret remains software - it would be a split hw/sw solution and added complexity for likely not a lot of gains. This only happens when establishing a new contact, so not too frequent to be worth it.
• ed25519_create_keypair remains software. This is only called when a node is first initialized. It does use the hardware RNG change, however, so better randomization.

Tested on (so far):

• Heltec t096 ble companion
• rak19001 sensor

Build test on:

• Heltec t096 companion ble
• t1000e companion ble
• RAK 4631 repeater
• RAK 3401 companion BLE
• Heltec v3 companion wifi

[lbibass]

Shouldn't this work on every NRF52840?

[NickDunklee]

@lbibass very likely! Although anything's possible to break with different hardware designs. So I added types that I could confirm work thus far. If you or anyone else can confirm this works on other node types, happy to add them.

[entr0p1]

This is really cool. I'll try to remember to give it a test on some other boards and see how it plays out.

[Magalex2x14]

I just wanted to say that I flashed my RAK4631 companion and RAK3401 repeater with this code - I don’t see any problems. Nice PR!