From 3321e2adf885b16ce979979da0fc99e2077f13c9 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Tue, 14 Jul 2026 16:26:55 +0800 Subject: [PATCH] feat(mbedtls): add option to choose constant-time prime generation mbedtls 4.1.1 made the small-factor test in prime generation constant-time (a CT GCD against the product of primes up to 997, run for every prime candidate). This makes RSA key generation roughly ten times slower on ESP chips and starves the idle task since the software GCD never yields, tripping the task watchdog. Add MBEDTLS_CONSTANT_TIME_PRIME_GEN under the new "Security hardening" menu, default y so the upstream constant-time behavior ships as the secure default. When disabled, esp_config.h defines MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME and mbedtls uses the pre-3.6.7 variable-time trial division, restoring key generation performance on devices where no untrusted co-resident code could time key generation. --- components/mbedtls/Kconfig | 27 +++++++++++++++++++ .../mbedtls/port/include/mbedtls/esp_config.h | 12 +++++++++ 2 files changed, 39 insertions(+) diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig index f97f2c1bcb4..bc00c91e52c 100644 --- a/components/mbedtls/Kconfig +++ b/components/mbedtls/Kconfig @@ -1416,6 +1416,33 @@ menu "mbedTLS" priority level and any level from 1 to 3 can be selected (based on the availability). Note: Higher value indicates high interrupt priority. + menu "Security hardening" + + config MBEDTLS_CONSTANT_TIME_PRIME_GEN + bool "Constant-time prime generation" + default y + help + Use mbedtls' constant-time small-factor test (a + constant-time GCD against the product of all odd primes up + to 997) when generating prime numbers, e.g. during RSA key + generation. + + The constant-time implementation avoids a timing side + channel in prime generation, but it makes RSA key + generation roughly ten times slower, and its long + non-yielding software computations can starve the idle + task and trigger the task watchdog, so key generation code + may need a larger watchdog timeout or the watchdog + disabled. + + If disabled, the variable-time trial division that mbedtls + used before versions 3.6.7/4.1.1 is used instead, + restoring key generation performance. Only consider + disabling this if no untrusted code running on the device + could observe the timing of key generation operations. + + endmenu # Security hardening + config MBEDTLS_HARDWARE_AES bool "Enable hardware AES acceleration" default y diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h index 596a30faddb..2cb7ee2d622 100644 --- a/components/mbedtls/port/include/mbedtls/esp_config.h +++ b/components/mbedtls/port/include/mbedtls/esp_config.h @@ -257,6 +257,18 @@ #undef MBEDTLS_MPI_MUL_MPI_ALT #endif +/* mbedtls 4.1.1 made the small-factor test used in prime + * generation constant-time, which slows RSA key generation down roughly + * tenfold and starves the idle task (the computation never yields the CPU). + * The constant-time variant is the default; when it is explicitly disabled, + * fall back to the variable-time trial division from earlier releases. See + * MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME in + * tf-psa-crypto/drivers/builtin/src/bignum.c. + */ +#ifndef CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN +#define MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME +#endif + #if defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY) || defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN) || defined(CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN) #define ESP_ECDSA_DRIVER_ENABLED #ifdef CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY