From 20ee0021e957105e4ca107bfb7cf3c9517ceedb3 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Tue, 14 Jul 2026 16:26:55 +0800 Subject: [PATCH] feat(mbedtls): add option to choose constant-time prime generation mbedtls 4.1.1 made the small-factor test in prime generation constant-time (a CT GCD against the product of primes up to 997, run for every prime candidate). This makes RSA key generation roughly ten times slower on ESP chips and starves the idle task since the software GCD never yields, tripping the task watchdog. Add MBEDTLS_CONSTANT_TIME_PRIME_GEN under the new "Security hardening" menu, default y so the upstream constant-time behavior ships as the secure default. When disabled, esp_config.h defines MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME and mbedtls uses the pre-3.6.7 variable-time trial division, restoring key generation performance on devices where no untrusted co-resident code could time key generation. --- components/mbedtls/Kconfig | 27 +++++++++++++++++++ .../mbedtls/port/include/mbedtls/esp_config.h | 12 +++++++++ 2 files changed, 39 insertions(+) diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig index 2fc7f968f1f..f1bcdf83628 100644 --- a/components/mbedtls/Kconfig +++ b/components/mbedtls/Kconfig @@ -1419,6 +1419,33 @@ menu "mbedTLS" priority level and any level from 1 to 3 can be selected (based on the availability). Note: Higher value indicates high interrupt priority. + menu "Security hardening" + + config MBEDTLS_CONSTANT_TIME_PRIME_GEN + bool "Constant-time prime generation" + default y + help + Use mbedtls' constant-time small-factor test (a + constant-time GCD against the product of all odd primes up + to 997) when generating prime numbers, e.g. during RSA key + generation. + + The constant-time implementation avoids a timing side + channel in prime generation, but it makes RSA key + generation roughly ten times slower, and its long + non-yielding software computations can starve the idle + task and trigger the task watchdog, so key generation code + may need a larger watchdog timeout or the watchdog + disabled. + + If disabled, the variable-time trial division that mbedtls + used before versions 3.6.7/4.1.1 is used instead, + restoring key generation performance. Only consider + disabling this if no untrusted code running on the device + could observe the timing of key generation operations. + + endmenu # Security hardening + config MBEDTLS_HARDWARE_AES bool "Enable hardware AES acceleration" default y diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h index a1c64d8697e..3c9856aa0a2 100644 --- a/components/mbedtls/port/include/mbedtls/esp_config.h +++ b/components/mbedtls/port/include/mbedtls/esp_config.h @@ -258,6 +258,18 @@ #undef MBEDTLS_MPI_MUL_MPI_ALT #endif +/* mbedtls 4.1.1 made the small-factor test used in prime + * generation constant-time, which slows RSA key generation down roughly + * tenfold and starves the idle task (the computation never yields the CPU). + * The constant-time variant is the default; when it is explicitly disabled, + * fall back to the variable-time trial division from earlier releases. See + * MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME in + * tf-psa-crypto/drivers/builtin/src/bignum.c. + */ +#ifndef CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN +#define MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME +#endif + #if defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY) || defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN) || defined(CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN) #define ESP_ECDSA_DRIVER_ENABLED #ifdef CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY