Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(mbedtls): Make the driver define macros public to allow application access

Browse Source 
- Also, use the PSA HMAC opaque key interface for HMAC-PBKDF2
This commit is contained in:
harshal.patil
2026-02-02 10:51:31 +05:30
parent 82ff76eb41
commit de7f8c88b2
5 changed files with 96 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/mbedtls/CMakeLists.txt
-14
View File
@@ -352,8 +352,6 @@ endif()
if(CONFIG_SOC_SHA_SUPPORTED)
if(CONFIG_MBEDTLS_HARDWARE_SHA)
target_compile_definitions(tfpsacrypto PRIVATE ESP_SHA_DRIVER_ENABLED)
target_compile_definitions(tfpsacrypto PRIVATE ESP_HMAC_TRANSPARENT_DRIVER_ENABLED)
target_sources(tfpsacrypto PRIVATE
"${COMPONENT_DIR}/port/psa_driver/esp_sha/psa_crypto_driver_esp_sha.c"
"${COMPONENT_DIR}/port/psa_driver/esp_sha/${SHA_PERIPHERAL_TYPE}/psa_crypto_driver_esp_sha256.c"
@@ -369,14 +367,12 @@ if(CONFIG_SOC_SHA_SUPPORTED)
endif()
if(CONFIG_MBEDTLS_ROM_MD5)
target_compile_definitions(tfpsacrypto PRIVATE ESP_MD5_DRIVER_ENABLED)
target_sources(tfpsacrypto PRIVATE
"${COMPONENT_DIR}/port/psa_driver/esp_md/psa_crypto_driver_esp_md5.c"
)
endif()
if(CONFIG_SOC_HMAC_SUPPORTED)
target_compile_definitions(tfpsacrypto PRIVATE ESP_HMAC_OPAQUE_DRIVER_ENABLED)
target_sources(tfpsacrypto PRIVATE
"${COMPONENT_DIR}/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_opaque.c"
)
@@ -411,14 +407,12 @@ if(CONFIG_MBEDTLS_HARDWARE_MPI)
endif()
if(CONFIG_MBEDTLS_HARDWARE_GCM OR CONFIG_MBEDTLS_HARDWARE_AES)
target_compile_definitions(tfpsacrypto PRIVATE ESP_AES_DRIVER_ENABLED)
target_include_directories(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/include/aes")
target_sources(tfpsacrypto PRIVATE
"${COMPONENT_DIR}/port/psa_driver/esp_aes/psa_crypto_driver_esp_aes.c"
"${COMPONENT_DIR}/port/psa_driver/esp_aes/psa_crypto_driver_esp_aes_gcm.c"
)
if(CONFIG_MBEDTLS_CMAC_C)
target_compile_definitions(tfpsacrypto PRIVATE ESP_CMAC_DRIVER_ENABLED)
target_sources(tfpsacrypto PRIVATE
"${COMPONENT_DIR}/port/psa_driver/esp_mac/psa_crypto_driver_esp_cmac.c"
)
@@ -434,14 +428,6 @@ if(CONFIG_SOC_ECC_SUPPORTED)
endif()
if(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN OR CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY OR CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
# ESP_ECDSA_DRIVER_ENABLED needs to be public because users would use OPAQUE key contexts in their applications.
target_compile_definitions(tfpsacrypto PUBLIC ESP_ECDSA_DRIVER_ENABLED)
if(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN OR CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
target_compile_definitions(tfpsacrypto PRIVATE ESP_ECDSA_SIGN_DRIVER_ENABLED)
endif()
if(CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY)
target_compile_definitions(tfpsacrypto PRIVATE ESP_ECDSA_VERIFY_DRIVER_ENABLED)
endif()
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/psa_driver/esp_ecdsa/psa_crypto_driver_esp_ecdsa.c")
target_include_directories(tfpsacrypto PUBLIC "${COMPONENT_DIR}/port/psa_driver/include")
target_link_libraries(tfpsacrypto PRIVATE idf::efuse)
components/mbedtls/esp_tee/esp_tee_mbedtls.cmake
+2 -10
View File
@@ -80,24 +80,15 @@ if(CONFIG_SOC_AES_SUPPORTED)
"${COMPONENT_DIR}/port/aes/esp_aes_xts.c")
target_include_directories(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/include/aes")
if(CONFIG_MBEDTLS_HARDWARE_AES)
target_compile_definitions(tfpsacrypto PRIVATE ESP_AES_DRIVER_ENABLED)
target_sources(tfpsacrypto PRIVATE
"${COMPONENT_DIR}/port/psa_driver/esp_aes/psa_crypto_driver_esp_aes.c"
"${COMPONENT_DIR}/port/psa_driver/esp_aes/psa_crypto_driver_esp_aes_gcm.c"
)
if(CONFIG_MBEDTLS_CMAC_C)
target_compile_definitions(tfpsacrypto PRIVATE ESP_CMAC_DRIVER_ENABLED)
target_sources(tfpsacrypto PRIVATE
"${COMPONENT_DIR}/port/psa_driver/esp_mac/psa_crypto_driver_esp_cmac.c"
)
endif()
endif()
endif()
# SHA implementation
if(CONFIG_SOC_SHA_SUPPORTED)
target_compile_definitions(tfpsacrypto PRIVATE ESP_SHA_DRIVER_ENABLED)
target_compile_definitions(tfpsacrypto PRIVATE ESP_HMAC_TRANSPARENT_DRIVER_ENABLED)
target_sources(tfpsacrypto PRIVATE
"${COMPONENT_DIR}/port/psa_driver/esp_sha/psa_crypto_driver_esp_sha.c"
"${COMPONENT_DIR}/port/psa_driver/esp_sha/core/psa_crypto_driver_esp_sha1.c"
@@ -110,7 +101,6 @@ if(CONFIG_SOC_SHA_SUPPORTED)
endif()
if(CONFIG_MBEDTLS_ROM_MD5)
target_compile_definitions(tfpsacrypto PRIVATE ESP_MD5_DRIVER_ENABLED)
target_sources(tfpsacrypto PRIVATE
"${COMPONENT_DIR}/port/psa_driver/esp_md/psa_crypto_driver_esp_md5.c"
)
@@ -123,7 +113,9 @@ endif()
if(CONFIG_SOC_HMAC_SUPPORTED)
# HMAC-based PBKDF2 implementation
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_opaque.c")
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/esp_hmac_pbkdf2.c")
target_link_libraries(tfpsacrypto PRIVATE idf::efuse)
endif()
# PSA Attestation
components/mbedtls/esp_tee/esp_tee_mbedtls_config.h
+21 -3
View File
@@ -40,7 +40,10 @@
#undef MBEDTLS_TIMING_C
#define MBEDTLS_PLATFORM_C
#if CONFIG_MBEDTLS_HARDWARE_AES
#define ESP_AES_DRIVER_ENABLED
#define MBEDTLS_PSA_ACCEL_KEY_TYPE_AES
#endif
#define MBEDTLS_CIPHER_MODE_XTS
#define MBEDTLS_ASN1_WRITE_C
@@ -71,6 +74,9 @@
#define MBEDTLS_SHA256_C
#if SOC_SHA_SUPPORTED
#define ESP_SHA_DRIVER_ENABLED
#define ESP_HMAC_TRANSPARENT_DRIVER_ENABLED
#undef MBEDTLS_PSA_BUILTIN_ALG_HMAC
#if CONFIG_MBEDTLS_SHA1_C
#define MBEDTLS_PSA_ACCEL_ALG_SHA_1
#undef MBEDTLS_PSA_BUILTIN_ALG_SHA_1
@@ -89,6 +95,21 @@
#define MBEDTLS_ECP_VERIFY_ALT
#endif
#if SOC_HMAC_SUPPORTED
#define ESP_HMAC_OPAQUE_DRIVER_ENABLED
#else
#undef MBEDTLS_PSA_ACCEL_KEY_TYPE_HMAC
#endif
#if CONFIG_MBEDTLS_ROM_MD5
#define ESP_MD5_DRIVER_ENABLED
#define MBEDTLS_PSA_ACCEL_ALG_MD5
#undef MBEDTLS_PSA_BUILTIN_ALG_MD5
#else
#undef PSA_WANT_ALG_MD5
#undef MBEDTLS_MD5_C
#endif
#undef PSA_WANT_ECC_SECP_R1_192
#undef PSA_WANT_ECC_SECP_K1_192
#undef PSA_WANT_ECC_SECP_K1_256
@@ -109,7 +130,6 @@
#undef MBEDTLS_ECP_DP_CURVE25519_ENABLED
#undef MBEDTLS_ECP_DP_CURVE448_ENABLED
#undef PSA_WANT_KEY_TYPE_HMAC
#undef PSA_WANT_KEY_TYPE_ARIA
#undef MBEDTLS_ARIA_C
#undef PSA_WANT_KEY_TYPE_CAMELLIA
@@ -118,8 +138,6 @@
#undef MBEDTLS_DES_C
#undef PSA_WANT_ALG_RIPEMD160
#undef MBEDTLS_RIPEMD160_C
#undef PSA_WANT_ALG_MD5
#undef MBEDTLS_MD5_C
#undef PSA_WANT_ALG_CHACHA20
#undef MBEDTLS_CHACHA20_C
#undef PSA_WANT_ALG_SHA3_224
components/mbedtls/port/esp_hmac_pbkdf2.c
+46 -6
View File
@@ -1,13 +1,17 @@
/*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*
*/
#include <string.h>
#include "esp_hmac.h"
#include <stdlib.h>
#include "sdkconfig.h"
#include "psa/crypto.h"
#include "psa_crypto_driver_esp_hmac_opaque.h"
#include "esp_efuse.h"
#include "esp_efuse_chip.h"
#include "esp_hmac_pbkdf2.h"
@@ -33,22 +37,55 @@ esp_err_t esp_hmac_derive_pbkdf2_key(hmac_key_id_t key_id, const uint8_t *salt,
}
esp_err_t err = ESP_FAIL;
psa_status_t status;
psa_key_id_t psa_key_id = 0;
size_t remaining = key_len;
uint8_t *out_p = out_key;
// Setup key attributes for ESP-HMAC opaque driver
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
psa_set_key_algorithm(&attributes, PSA_ALG_HMAC(PSA_ALG_SHA_256));
psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
psa_set_key_bits(&attributes, 256);
psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_HMAC_VOLATILE);
// Create opaque key reference
esp_hmac_opaque_key_t opaque_key = {
.use_km_key = false,
.efuse_block = (uint8_t)(EFUSE_BLK_KEY0 + key_id),
};
// Import the opaque key
status = psa_import_key(&attributes, (uint8_t *)&opaque_key,
sizeof(opaque_key), &psa_key_id);
psa_reset_key_attributes(&attributes);
if (status != PSA_SUCCESS) {
err = ESP_ERR_INVALID_ARG;
goto cleanup;
}
while (remaining > 0) {
memcpy(hmac_input, salt, salt_len);
memcpy(hmac_input + salt_len, counter, sizeof(counter));
err = esp_hmac_calculate(key_id, hmac_input, salt_len + sizeof(counter), U);
if (err != ESP_OK) {
size_t mac_length = 0;
status = psa_mac_compute(psa_key_id, PSA_ALG_HMAC(PSA_ALG_SHA_256),
hmac_input, salt_len + sizeof(counter),
U, SHA256_DIGEST_SZ, &mac_length);
if (status != PSA_SUCCESS) {
err = ESP_FAIL;
goto cleanup;
}
memcpy(T, U, SHA256_DIGEST_SZ);
for (int i = 1; i < iterations; i++) {
err = esp_hmac_calculate(key_id, U, SHA256_DIGEST_SZ, U);
if (err != ESP_OK) {
status = psa_mac_compute(psa_key_id, PSA_ALG_HMAC(PSA_ALG_SHA_256),
U, SHA256_DIGEST_SZ,
U, SHA256_DIGEST_SZ, &mac_length);
if (status != PSA_SUCCESS) {
err = ESP_FAIL;
goto cleanup;
}
@@ -72,6 +109,9 @@ esp_err_t esp_hmac_derive_pbkdf2_key(hmac_key_id_t key_id, const uint8_t *salt,
err = ESP_OK;
cleanup:
if (psa_key_id != 0) {
psa_destroy_key(psa_key_id);
}
memset(U, 0x00, sizeof(U));
memset(T, 0x00, sizeof(T));
if (hmac_input) {
components/mbedtls/port/include/mbedtls/esp_config.h
+27 -42
View File
@@ -191,21 +191,29 @@
with software fallback.
*/
#ifdef CONFIG_MBEDTLS_HARDWARE_SHA
#define ESP_SHA_DRIVER_ENABLED
#define MBEDTLS_PSA_ACCEL_ALG_SHA_1
#undef MBEDTLS_PSA_BUILTIN_ALG_SHA_1
#define MBEDTLS_PSA_ACCEL_ALG_SHA_224
#undef MBEDTLS_PSA_BUILTIN_ALG_SHA_224
#define MBEDTLS_PSA_ACCEL_ALG_SHA_256
#undef MBEDTLS_PSA_BUILTIN_ALG_SHA_256
#undef MBEDTLS_SHA1_C
#undef MBEDTLS_SHA224_C
#define ESP_HMAC_TRANSPARENT_DRIVER_ENABLED
#define MBEDTLS_PSA_ACCEL_ALG_HMAC
#define MBEDTLS_PSA_BUILTIN_ALG_HMAC
#if SOC_SHA_SUPPORT_SHA512
#define MBEDTLS_PSA_ACCEL_ALG_SHA_384
#undef MBEDTLS_PSA_ACCEL_ALG_SHA_384
#define MBEDTLS_PSA_ACCEL_ALG_SHA_512
#undef MBEDTLS_PSA_ACCEL_ALG_SHA_512
#undef MBEDTLS_SHA512_C
#undef MBEDTLS_SHA384_C
#undef MBEDTLS_PSA_BUILTIN_ALG_HMAC
#endif
#if SOC_SHA_SUPPORT_SHA512
#else
#undef MBEDTLS_SHA512_ALT
#endif
#else
#undef MBEDTLS_SHA1_ALT
#undef MBEDTLS_SHA256_ALT
@@ -216,6 +224,7 @@
with software fallback.
*/
#ifdef CONFIG_MBEDTLS_ROM_MD5
#define ESP_MD5_DRIVER_ENABLED
#define MBEDTLS_PSA_ACCEL_ALG_MD5
#undef MBEDTLS_PSA_BUILTIN_ALG_MD5
#else
@@ -245,18 +254,14 @@
#undef MBEDTLS_MPI_MUL_MPI_ALT
#endif
#ifdef MBEDTLS_HARDWARE_ECDSA_SIGN
#define MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192
#define MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256
#if SOC_ECDSA_SUPPORT_CURVE_P384
#define MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384
#if defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY) || defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN) || defined(CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
#define ESP_ECDSA_DRIVER_ENABLED
#ifdef MBEDTLS_HARDWARE_ECDSA_VERIFY
#define ESP_ECDSA_VERIFY_DRIVER_ENABLED
#endif
#if defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN) || defined(CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
#define ESP_ECDSA_SIGN_DRIVER_ENABLED
#endif
#define MBEDTLS_PSA_ACCEL_ALG_ECDSA
#define MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA
#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY
#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC
#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT
#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT
#endif
#ifdef CONFIG_MBEDTLS_ATCA_HW_ECDSA_SIGN
@@ -287,6 +292,10 @@
#undef MBEDTLS_ECP_VERIFY_ALT_SOFT_FALLBACK
#endif
#ifdef SOC_HMAC_SUPPORTED
#define ESP_HMAC_OPAQUE_DRIVER_ENABLED
#endif
/**
* \def MBEDTLS_AES_ROM_TABLES
*
@@ -499,6 +508,9 @@
*/
#ifdef CONFIG_MBEDTLS_CMAC_C
#define PSA_WANT_ALG_CMAC 1
#ifdef CONFIG_MBEDTLS_HARDWARE_AES
#define ESP_CMAC_DRIVER_ENABLED
#endif
#else
#ifdef CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL
/* The mbedtls present in ROM is built with the MBEDTLS_CMAC_C symbol being enabled,
@@ -1737,6 +1749,7 @@
uncommenting each _ALT macro will use the
hardware-accelerated implementation. */
#ifdef CONFIG_MBEDTLS_HARDWARE_AES
#define ESP_AES_DRIVER_ENABLED
#define MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING
#undef MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING
#define MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7
@@ -2663,34 +2676,6 @@
#undef PSA_WANT_ALG_SHA_224
#endif
/* MBEDTLS_SHAxx_ALT to enable hardware SHA support
with software fallback.
*/
#ifdef CONFIG_MBEDTLS_HARDWARE_SHA
#define MBEDTLS_PSA_ACCEL_ALG_SHA_1
#undef MBEDTLS_PSA_BUILTIN_ALG_SHA_1
#define MBEDTLS_PSA_ACCEL_ALG_SHA_224
#undef MBEDTLS_PSA_BUILTIN_ALG_SHA_224
#define MBEDTLS_PSA_ACCEL_ALG_SHA_256
#undef MBEDTLS_PSA_BUILTIN_ALG_SHA_256
#undef MBEDTLS_SHA1_C
#undef MBEDTLS_SHA224_C
#if SOC_SHA_SUPPORT_SHA512
#define MBEDTLS_PSA_ACCEL_ALG_SHA_512
#undef MBEDTLS_PSA_BUILTIN_ALG_SHA_512
#define MBEDTLS_PSA_ACCEL_ALG_SHA_384
#undef MBEDTLS_PSA_BUILTIN_ALG_SHA_384
#undef MBEDTLS_SHA512_C
#undef MBEDTLS_SHA384_C
#else
#undef MBEDTLS_SHA512_ALT
#endif
#else
#undef MBEDTLS_SHA1_ALT
#undef MBEDTLS_SHA256_ALT
#undef MBEDTLS_SHA512_ALT
#endif
/* MBEDTLS_MD_CAN_SHA* macros indicate whether a hash algorithm is available
* either via legacy implementation (MBEDTLS_SHA*_C) or via PSA (PSA_WANT_ALG_SHA_*).
* These are used for TLS 1.3 signature algorithm configuration.