problem with multiple https request concurrently using ATECC608

[oedzee]

We've impelmented the ATECC608 successfully.

We've added these compile definitions

Code: Select all

add_compile_definitions(MBEDTLS_ECDH_GEN_PUBLIC_ALT)
add_compile_definitions(MBEDTLS_ECDH_COMPUTE_SHARED_ALT)

This moves the responsibility for the ECDH operations from mbedtls to the ATECC608. We've implemented the function mbedtls_ecdh_gen_public to accomplish this.

We always had 2 connections, one to our iot cloud and one to a file upload server.

We've recently added a third connection to a local device. But when we open https requests to that server during a file upload. It's common to see that the function calib_genkey_base is called with a invalid ATCADevice pointer.

After some digging we found out that every time a request is opened to a server ,the function atcab_init_device and atcab_release are called. The atcap_release function releases the only _gDevice instance that is used for all the communication to the server. So if one thread calls this function and the other thread is still talking to the secure element. the second thread fails.

Is there a reason the secure element is initialized/deinitialized on every https call?
How can we work arround this issue?

[ahsrabrifat]

Instead of calling atcab_init_device() and atcab_release() on every request, initialize the secure element once and maintain the instance globally. Modify your code to:

Call atcab_init_device() once during system initialization.
Keep _gDevice persistent throughout the application lifecycle.
Avoid calling atcab_release() unless absolutely necessary (e.g., during shutdown).

[oedzee]

Thanks for the answer.

That is what we want to do yes.
but current implementation of esp_tls_mbedtls.c set_client_config calls
esp_set_atecc608a_pki_context when use_secure_element is set to true.

This set_client_config is called during esp_transport_connect

this results in the call stack
esp_set_atecc608a_pki_context
esp_init_atecc608a
atcab_init
atcab_init_ext

It re initializes the ATECC608, and if it's already initialized, it deinitilizes it first, which results in weird behaviour on other threads using the single device instance

It's only initialed when use_secure_element is set to true. but it is always deinitialized when a connection is closed (and it doesn''t look at the use_secure_element flag) https://github.com/espressif/esp-idf/bl ... tls.c#L376