Crypto: SHA-256
The SHA-256 sample demonstrates how to use the PSA Crypto API to compute and verify hashes using the SHA-256 hash algorithm. The sample demonstrates both single-part and multi-part hash operations.
Requirements
The sample supports the following development kits:
Hardware platforms |
PCA |
Board name |
|
|---|---|---|---|
PCA10153 |
|
||
PCA10090 |
|
||
PCA10171 |
|
||
nRF7120 DK |
nrf7120dk |
|
|
nRF54LV10 DK |
PCA10188 |
|
|
nRF54LS05 DK |
PCA10214 |
nrf54ls05dk |
|
PCA10184 |
|
||
nRF54LC10 DK |
PCA10226 |
nrf54lc10dk |
|
PCA10156 |
|
||
PCA10156 |
|
||
PCA10156 |
|
||
PCA10175 |
|
||
PCA10095 |
|
||
PCA10056 |
|
||
PCA10100 |
|
For more security, it is recommended to use the */ns variant of the board target.
When built for this variant, the sample is configured to compile and run as a non-secure application using security by separation.
Therefore, it automatically includes Trusted Firmware-M that prepares the required peripherals and secure services to be available for the application.
Overview
The sample enables PSA Crypto API and configures the following Kconfig options for the cryptographic features:
CONFIG_PSA_WANT_ALG_SHA_256- Used to enable support for the SHA-256 hash algorithm from among the supported cryptographic operations for Hash algorithms.
The sample also configures the cryptographic drivers for each board target using Kconfig options in the overlay files in the boards directory.
These Kconfig options are then used by the build system to compile the required cryptographic PSA directives and make the configured cryptographic drivers available at runtime. See Driver selection for more information about this process.
Once built and run, the sample performs the following operations:
Initialization:
The PSA Crypto API is initialized using
psa_crypto_init().
Single-part hash computation and verification:
The SHA-256 hash of the plaintext is computed using
psa_hash_compute()in a single operation.The computed hash is verified using
psa_hash_compare().
Multi-part hash computation and verification:
A multi-part hash operation is set up using
psa_hash_setup().The input data is processed in chunks using
psa_hash_update()(three chunks of 42, 58, and 50 bytes).The hash is finalized using
psa_hash_finish().The computed hash is verified using
psa_hash_compare().
Building and running
This sample can be found under samples/crypto/sha256 in the nRF Connect SDK folder structure.
For more security, it is recommended to use the */ns variant of the board target (see the Requirements section above.)
When built for this variant, the sample is configured to compile and run as a non-secure application using security by separation.
Therefore, it automatically includes Trusted Firmware-M that prepares the required peripherals and secure services to be available for the application.
To build the sample, follow the instructions in Building an application for your preferred building environment. See also Programming an application for programming steps and Testing and optimization for general information about testing and debugging in the nRF Connect SDK.
Note
When building repository applications in the SDK repositories, building with sysbuild is enabled by default.
If you work with out-of-tree freestanding applications, you need to manually pass the --sysbuild parameter to every build command or configure west to always use it.
Testing
After programming the sample to your development kit, complete the following steps to test it:
Connect to the kit with a terminal emulator (for example, the Serial Terminal app). See Testing and optimization for the required settings and steps.
Build and program the application.
Observe the logs from the application using the terminal emulator. For example, the log output should look like this:
*** Booting nRF Connect SDK v3.1.0-6c6e5b32496e ***
*** Using Zephyr OS v4.1.99-1612683d4010 ***
[00:00:00.251,159] <inf> sha256: Starting SHA-256 example...
[00:00:00.251,190] <inf> sha256: ---- Plaintext to hash (len: 150): ----
[00:00:00.251,220] <inf> sha256: Content:
Example string to demonstrate basic usage of SHA256.
That uses single and multi-part PSA crypto API's to
perform a SHA-256 hashing operation.
[00:00:00.251,251] <inf> sha256: ---- Plaintext to hash end ----
[00:00:00.251,281] <inf> sha256: Hashing using SHA-256...
[00:00:00.251,312] <inf> sha256: Hash computation successful!
[00:00:00.251,342] <inf> sha256: ---- SHA-256 hash (len: 32): ----
[00:00:00.251,373] <inf> sha256: Content:
12 34 56 78 9a bc de f0 12 34 56 78 9a bc de f0 |.4Vx.... .4Vx....|
12 34 56 78 9a bc de f0 12 34 56 78 9a bc de f0 |.4Vx.... .4Vx....|
[00:00:00.251,404] <inf> sha256: ---- SHA-256 hash end ----
[00:00:00.251,434] <inf> sha256: Verifying the SHA-256 hash...
[00:00:00.251,465] <inf> sha256: SHA-256 verification successful!
[00:00:00.251,495] <inf> sha256: Hashing using multi-part SHA-256...
[00:00:00.251,526] <inf> sha256: Added 42 bytes
[00:00:00.251,556] <inf> sha256: Added 58 bytes
[00:00:00.251,587] <inf> sha256: Added 50 bytes
[00:00:00.251,617] <inf> sha256: Hash computation successful!
[00:00:00.251,648] <inf> sha256: ---- SHA-256 hash (len: 32): ----
[00:00:00.251,678] <inf> sha256: Content:
12 34 56 78 9a bc de f0 12 34 56 78 9a bc de f0 |.4Vx.... .4Vx....|
12 34 56 78 9a bc de f0 12 34 56 78 9a bc de f0 |.4Vx.... .4Vx....|
[00:00:00.251,709] <inf> sha256: Verifying the SHA-256 hash...
[00:00:00.251,739] <inf> sha256: SHA-256 verification successful!
[00:00:00.251,770] <inf> sha256: Example finished successfully!