feat(mbedtls): add option to choose constant-time prime generation

mbedtls 4.1.1 made the small-factor test in prime generation
constant-time (a CT GCD against the product of primes up to 997, run
for every prime candidate). This makes RSA key generation roughly ten
times slower on ESP chips and starves the idle task since the software
GCD never yields, tripping the task watchdog.

Add MBEDTLS_CONSTANT_TIME_PRIME_GEN under the new "Security hardening"
menu, default y so the upstream constant-time behavior ships as the
secure default. When disabled, esp_config.h defines
MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME and mbedtls uses the pre-3.6.7
variable-time trial division, restoring key generation performance on
devices where no untrusted co-resident code could time key generation.

components/mbedtls/Kconfig

@@ -1419,6 +1419,33 @@ menu "mbedTLS"
                 priority level and any level from 1 to 3 can be selected (based on the availability).
                 Note: Higher value indicates high interrupt priority.
 
+        menu "Security hardening"
+
+            config MBEDTLS_CONSTANT_TIME_PRIME_GEN
+                bool "Constant-time prime generation"
+                default y
+                help
+                    Use mbedtls' constant-time small-factor test (a
+                    constant-time GCD against the product of all odd primes up
+                    to 997) when generating prime numbers, e.g. during RSA key
+                    generation.
+
+                    The constant-time implementation avoids a timing side
+                    channel in prime generation, but it makes RSA key
+                    generation roughly ten times slower, and its long
+                    non-yielding software computations can starve the idle
+                    task and trigger the task watchdog, so key generation code
+                    may need a larger watchdog timeout or the watchdog
+                    disabled.
+
+                    If disabled, the variable-time trial division that mbedtls
+                    used before versions 3.6.7/4.1.1 is used instead,
+                    restoring key generation performance. Only consider
+                    disabling this if no untrusted code running on the device
+                    could observe the timing of key generation operations.
+
+        endmenu # Security hardening
+
         config MBEDTLS_HARDWARE_AES
             bool "Enable hardware AES acceleration"
             default y

components/mbedtls/port/include/mbedtls/esp_config.h

@@ -258,6 +258,18 @@
 #undef MBEDTLS_MPI_MUL_MPI_ALT
 #endif
 
+/* mbedtls 4.1.1 made the small-factor test used in prime
+ * generation constant-time, which slows RSA key generation down roughly
+ * tenfold and starves the idle task (the computation never yields the CPU).
+ * The constant-time variant is the default; when it is explicitly disabled,
+ * fall back to the variable-time trial division from earlier releases. See
+ * MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME in
+ * tf-psa-crypto/drivers/builtin/src/bignum.c.
+ */
+#ifndef CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN
+#define MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME
+#endif
+
 #if defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY) || defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN) || defined(CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
 #define ESP_ECDSA_DRIVER_ENABLED
 #ifdef CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY