From 224902efc93cd81da2e49dcddfd71996271f7642 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Fri, 10 Jul 2026 10:33:49 +0800 Subject: [PATCH 1/3] feat(mbedtls): update to version 4.1.1 --- components/mbedtls/mbedtls | 2 +- docs/en/api-reference/protocols/mbedtls.rst | 2 +- docs/zh_CN/api-reference/protocols/mbedtls.rst | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/components/mbedtls/mbedtls b/components/mbedtls/mbedtls index a2b32072ea8..2d4f3710465 160000 --- a/components/mbedtls/mbedtls +++ b/components/mbedtls/mbedtls @@ -1 +1 @@ -Subproject commit a2b32072ea898afc1ed5b6caf6931e36028c91d6 +Subproject commit 2d4f37104654bb8784e42d93d4a28f06a9d7d391 diff --git a/docs/en/api-reference/protocols/mbedtls.rst b/docs/en/api-reference/protocols/mbedtls.rst index 5d576599dc6..aebcb3ad62c 100644 --- a/docs/en/api-reference/protocols/mbedtls.rst +++ b/docs/en/api-reference/protocols/mbedtls.rst @@ -417,5 +417,5 @@ Reducing Binary Size Under ``Component Config`` > ``mbedTLS``, several Mbed TLS features are enabled by default. These can be disabled if not needed to save code size. More information is available in the :ref:`Minimizing Binary Size ` documentation. -.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v3.6.5/ +.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v4.1.1/ .. _`Knowledge Base`: https://mbed-tls.readthedocs.io/en/latest/kb/ diff --git a/docs/zh_CN/api-reference/protocols/mbedtls.rst b/docs/zh_CN/api-reference/protocols/mbedtls.rst index 74c0157cd1a..a134acc8389 100644 --- a/docs/zh_CN/api-reference/protocols/mbedtls.rst +++ b/docs/zh_CN/api-reference/protocols/mbedtls.rst @@ -417,5 +417,5 @@ Mbed TLS 配置系统支持预设配置。``Component Config`` > ``mbedTLS`` 中 在 ``Component Config`` > ``mbedTLS`` 配置中，多个 Mbed TLS 功能已默认启用。如无需使用，可以禁用以减小固件大小。详情请参阅 :ref:`最小化固件大小 `。 -.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v3.6.5/ +.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v4.1.1/ .. _`Knowledge Base`: https://mbed-tls.readthedocs.io/en/latest/kb/ From 20ee0021e957105e4ca107bfb7cf3c9517ceedb3 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Tue, 14 Jul 2026 16:26:55 +0800 Subject: [PATCH 2/3] feat(mbedtls): add option to choose constant-time prime generation mbedtls 4.1.1 made the small-factor test in prime generation constant-time (a CT GCD against the product of primes up to 997, run for every prime candidate). This makes RSA key generation roughly ten times slower on ESP chips and starves the idle task since the software GCD never yields, tripping the task watchdog. Add MBEDTLS_CONSTANT_TIME_PRIME_GEN under the new "Security hardening" menu, default y so the upstream constant-time behavior ships as the secure default. When disabled, esp_config.h defines MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME and mbedtls uses the pre-3.6.7 variable-time trial division, restoring key generation performance on devices where no untrusted co-resident code could time key generation. --- components/mbedtls/Kconfig | 27 +++++++++++++++++++ .../mbedtls/port/include/mbedtls/esp_config.h | 12 +++++++++ 2 files changed, 39 insertions(+) diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig index 2fc7f968f1f..f1bcdf83628 100644 --- a/components/mbedtls/Kconfig +++ b/components/mbedtls/Kconfig @@ -1419,6 +1419,33 @@ menu "mbedTLS" priority level and any level from 1 to 3 can be selected (based on the availability). Note: Higher value indicates high interrupt priority. + menu "Security hardening" + + config MBEDTLS_CONSTANT_TIME_PRIME_GEN + bool "Constant-time prime generation" + default y + help + Use mbedtls' constant-time small-factor test (a + constant-time GCD against the product of all odd primes up + to 997) when generating prime numbers, e.g. during RSA key + generation. + + The constant-time implementation avoids a timing side + channel in prime generation, but it makes RSA key + generation roughly ten times slower, and its long + non-yielding software computations can starve the idle + task and trigger the task watchdog, so key generation code + may need a larger watchdog timeout or the watchdog + disabled. + + If disabled, the variable-time trial division that mbedtls + used before versions 3.6.7/4.1.1 is used instead, + restoring key generation performance. Only consider + disabling this if no untrusted code running on the device + could observe the timing of key generation operations. + + endmenu # Security hardening + config MBEDTLS_HARDWARE_AES bool "Enable hardware AES acceleration" default y diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h index a1c64d8697e..3c9856aa0a2 100644 --- a/components/mbedtls/port/include/mbedtls/esp_config.h +++ b/components/mbedtls/port/include/mbedtls/esp_config.h @@ -258,6 +258,18 @@ #undef MBEDTLS_MPI_MUL_MPI_ALT #endif +/* mbedtls 4.1.1 made the small-factor test used in prime + * generation constant-time, which slows RSA key generation down roughly + * tenfold and starves the idle task (the computation never yields the CPU). + * The constant-time variant is the default; when it is explicitly disabled, + * fall back to the variable-time trial division from earlier releases. See + * MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME in + * tf-psa-crypto/drivers/builtin/src/bignum.c. + */ +#ifndef CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN +#define MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME +#endif + #if defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY) || defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN) || defined(CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN) #define ESP_ECDSA_DRIVER_ENABLED #ifdef CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY From e1e9c65e07401059c6d546a9c2e4186ec5a5c6d2 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Tue, 14 Jul 2026 16:45:38 +0800 Subject: [PATCH 3/3] test(mbedtls): add PSA RSA key generation test The test only runs with MBEDTLS_CONSTANT_TIME_PRIME_GEN disabled: with the constant-time prime generation that is now the default, RSA-2048 key generation takes over a minute on most targets (~86 s on ESP32-S3), exceeding the test timeout and starving the task watchdog. --- components/mbedtls/mbedtls | 2 +- .../test_apps/mbedtls_ut/main/test_psa_rsa.c | 49 ++++++++++++++++++- 2 files changed, 49 insertions(+), 2 deletions(-) diff --git a/components/mbedtls/mbedtls b/components/mbedtls/mbedtls index 2d4f3710465..ce3f3485a12 160000 --- a/components/mbedtls/mbedtls +++ b/components/mbedtls/mbedtls @@ -1 +1 @@ -Subproject commit 2d4f37104654bb8784e42d93d4a28f06a9d7d391 +Subproject commit ce3f3485a121c100f58f36d700cb35b060f6e866 diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_rsa.c b/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_rsa.c index 1330a5a1524..b2977ed0484 100644 --- a/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_rsa.c +++ b/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_rsa.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Unlicense OR CC0-1.0 */ @@ -8,6 +8,7 @@ #include #include "esp_log.h" +#include "sdkconfig.h" #include "psa/crypto.h" #include "mbedtls/pk.h" @@ -18,6 +19,10 @@ #include "test_utils.h" #include "crypto_performance.h" +#if CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT +#include "esp_task_wdt.h" +#endif + typedef enum { PSA_RSA_KEY_SIZE_2048, PSA_RSA_KEY_SIZE_3072, @@ -302,3 +307,45 @@ TEST_CASE("test performance RSA key operations", "[bignum]") keysize++; } } + +/* With constant-time prime generation the RSA-2048 key generation below takes + * over a minute on most targets (~86 s on ESP32-S3), exceeding the test + * timeout and starving the task watchdog, so only run it with the faster + * variable-time implementation. + */ +#if CONFIG_MBEDTLS_HARDWARE_MPI && !CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN + +TEST_CASE("PSA RSA generate key", "[mbedtls][timeout=60]") +{ +#if CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT + /* Check that generating keys doesn't starve the watchdog: long-running + * computations in key generation must not monopolize the CPU. */ + esp_task_wdt_config_t twdt_config = { + .timeout_ms = 1000, + .idle_core_mask = (1 << 0), // Watch core 0 idle + .trigger_panic = true, + }; + TEST_ASSERT_EQUAL(ESP_OK, esp_task_wdt_init(&twdt_config)); +#endif // CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT + + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_key_id_t key_id; + + TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_crypto_init()); + + psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR); + psa_set_key_algorithm(&attributes, PSA_ALG_RSA_PKCS1V15_CRYPT); + psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT); + psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_VOLATILE); + psa_set_key_bits(&attributes, 2048); + + TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_generate_key(&attributes, &key_id)); + + TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_destroy_key(key_id)); + psa_reset_key_attributes(&attributes); + +#if CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT + TEST_ASSERT_EQUAL(ESP_OK, esp_task_wdt_deinit()); +#endif // CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT +} +#endif // CONFIG_MBEDTLS_HARDWARE_MPI && !CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN