Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 10:40:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(bt): migrate mbedtls to PSA APIs

Browse Source
This commit is contained in:
Ashish Sharma
2025-12-18 21:18:58 +08:00
parent b4fea9cccc
commit b0da66f7e1
38 changed files with 986 additions and 790 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/nvs_flash/src/nvs_bootloader_aes.c
+53 -19
View File
@@ -70,7 +70,9 @@ int nvs_bootloader_aes_crypt_ecb(enum AES_TYPE mode,
}
#endif /* CONFIG_ESP_ROM_HAS_MBEDTLS_CRYPTO_LIB */
#else /* BOOTLOADER_BUILD && !CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL_BOOTLOADER */
#include "mbedtls/aes.h"
#include "psa/crypto.h"
static const char *TAG = "nvs_bootloader_aes";
int nvs_bootloader_aes_crypt_ecb(enum AES_TYPE mode,
const unsigned char *key,
@@ -78,34 +80,66 @@ int nvs_bootloader_aes_crypt_ecb(enum AES_TYPE mode,
const unsigned char input[16],
unsigned char output[16])
{
int ret = -1;
psa_status_t status;
psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
psa_key_id_t key_id = 0;
psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT);
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECB_NO_PADDING);
psa_set_key_type(&key_attributes, PSA_KEY_TYPE_AES);
uint16_t keybits = key_bits == AES256 ? 256 : key_bits == AES192 ? 192 : 128;
int mbedtls_aes_mode = mode == AES_ENC ? MBEDTLS_AES_ENCRYPT : MBEDTLS_AES_DECRYPT;
mbedtls_aes_context ctx;
mbedtls_aes_init(&ctx);
psa_set_key_bits(&key_attributes, keybits);
status = psa_import_key(&key_attributes, key, keybits / 8, &key_id);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to import key: %d", status);
return -1;
}
psa_reset_key_attributes(&key_attributes);
if (mode == AES_ENC) {
ret = mbedtls_aes_setkey_enc(&ctx, key, keybits);
status = psa_cipher_encrypt_setup(&operation, key_id, PSA_ALG_ECB_NO_PADDING);
} else {
ret = mbedtls_aes_setkey_dec(&ctx, key, keybits);
status = psa_cipher_decrypt_setup(&operation, key_id, PSA_ALG_ECB_NO_PADDING);
}
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to setup cipher operation: %d", status);
psa_destroy_key(key_id);
return -1;
}
if (ret != 0) {
mbedtls_aes_free(&ctx);
return ret;
size_t output_len = 0;
status = psa_cipher_update(&operation, input, 16, output, 16, &output_len);
if (status != PSA_SUCCESS || output_len != 16) {
ESP_LOGE(TAG, "Failed to update cipher operation: %d", status);
psa_cipher_abort(&operation);
psa_destroy_key(key_id);
return -1;
}
ret = mbedtls_aes_crypt_ecb(&ctx, mbedtls_aes_mode, input, output);
if (ret != 0) {
mbedtls_aes_free(&ctx);
return ret;
status = psa_cipher_finish(&operation, output + output_len, 16 - output_len, &output_len);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to finish cipher operation: %d", status);
psa_cipher_abort(&operation);
psa_destroy_key(key_id);
return -1;
}
mbedtls_aes_free(&ctx);
return ret;
if (output_len != 0) {
ESP_LOGE(TAG, "Output length mismatch: expected 0, got %zu", output_len);
psa_cipher_abort(&operation);
psa_destroy_key(key_id);
return -1;
}
status = psa_cipher_finish(&operation, output, 16, &output_len);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to finish cipher operation: %d", status);
psa_destroy_key(key_id);
return -1;
}
psa_destroy_key(key_id);
return 0;
}
#endif /* !(BOOTLOADER_BUILD && !CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL_BOOTLOADER) */
#endif /* !SOC_AES_SUPPORTED */
components/nvs_flash/src/nvs_bootloader_xts_aes.c
+72 -7
View File
@@ -257,20 +257,26 @@ int nvs_bootloader_aes_crypt_xts(nvs_bootloader_xts_aes_context *ctx,
#endif /* CONFIG_ESP_ROM_HAS_MBEDTLS_CRYPTO_LIB */
#else /* BOOTLOADER_BUILD && !CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL_BOOTLOADER */
#include "mbedtls/aes.h"
#include "psa/crypto.h"
static mbedtls_aes_xts_context ctx_xts;
static const char *TAG = "nvs_bootloader_xts_aes";
static psa_cipher_operation_t operation;
static psa_key_id_t nvs_bootloader_xts_aes_key_id = 0;
void nvs_bootloader_xts_aes_init(nvs_bootloader_xts_aes_context *ctx)
{
(void) ctx;
mbedtls_aes_xts_init(&ctx_xts);
// mbedtls_aes_xts_init(&ctx_xts);
// psa_status_t status = PSA_SUCCESS;
}
void nvs_bootloader_xts_aes_free(nvs_bootloader_xts_aes_context *ctx)
{
(void) ctx;
mbedtls_aes_xts_free(&ctx_xts);
psa_cipher_abort(&operation);
psa_destroy_key(nvs_bootloader_xts_aes_key_id);
nvs_bootloader_xts_aes_key_id = 0;
}
int nvs_bootloader_xts_aes_setkey(nvs_bootloader_xts_aes_context *ctx,
@@ -278,7 +284,32 @@ int nvs_bootloader_xts_aes_setkey(nvs_bootloader_xts_aes_context *ctx,
unsigned int key_bytes)
{
(void) ctx;
return mbedtls_aes_xts_setkey_dec(&ctx_xts, key, key_bytes * 8);
// return mbedtls_aes_xts_setkey_dec(&ctx_xts, key, key_bytes * 8);
psa_status_t status;
psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT);
psa_set_key_algorithm(&key_attributes, PSA_ALG_XTS);
psa_set_key_type(&key_attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&key_attributes, key_bytes * 8);
status = psa_import_key(&key_attributes, key, key_bytes, &nvs_bootloader_xts_aes_key_id);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to import key: %d", status);
psa_cipher_abort(&operation);
return -1;
}
psa_reset_key_attributes(&key_attributes);
size_t key_len = key_bytes / 2;
status = psa_cipher_set_iv(&operation, key + key_len, key_len);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to set IV: %d", status);
psa_cipher_abort(&operation);
psa_destroy_key(nvs_bootloader_xts_aes_key_id);
return -1;
}
ESP_LOGI(TAG, "XTS-AES key set successfully");
return 0;
}
/*
* XTS-AES buffer encryption/decryption
@@ -291,9 +322,43 @@ int nvs_bootloader_aes_crypt_xts(nvs_bootloader_xts_aes_context *ctx,
unsigned char *output)
{
(void) ctx;
psa_status_t status;
size_t output_len = 0;
if (nvs_bootloader_xts_aes_key_id == 0) {
ESP_LOGE(TAG, "XTS-AES key not set");
return -1;
}
int mbedtls_aes_mode = mode == AES_ENC ? MBEDTLS_AES_ENCRYPT : MBEDTLS_AES_DECRYPT;
return mbedtls_aes_crypt_xts(&ctx_xts, mbedtls_aes_mode, length, data_unit, input, output);
if (mode == AES_ENC) {
status = psa_cipher_encrypt_setup(&operation, nvs_bootloader_xts_aes_key_id, PSA_ALG_XTS);
} else {
status = psa_cipher_decrypt_setup(&operation, nvs_bootloader_xts_aes_key_id, PSA_ALG_XTS);
}
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to setup cipher operation: %d", status);
return -1;
}
status = psa_cipher_update(&operation, input, length, output, length, &output_len);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to update cipher operation: %d", status);
psa_cipher_abort(&operation);
return -1;
}
if (output_len != length) {
ESP_LOGE(TAG, "Output length mismatch: expected %zu, got %zu", length, output_len);
psa_cipher_abort(&operation);
return -1;
}
status = psa_cipher_finish(&operation, output + output_len, length - output_len, &output_len);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to finish cipher operation: %d", status);
psa_cipher_abort(&operation);
return -1;
}
return 0;
}
#endif /* !(BOOTLOADER_BUILD && !CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL_BOOTLOADER) */
#endif /* !SOC_AES_SUPPORTED */