[crypto] PSA API: Enable native ITS File and RAM implementations

LuDuda · LuDuda · commit d78a76f8ccfd · 2025-02-23T11:00:02.000+01:00
Signed-off-by: Łukasz Duda &lt;lukasz.duda@nordicsemi.no&gt;
diff --git a/.github/workflows/toranj.yml b/.github/workflows/toranj.yml
@@ -165,8 +165,6 @@ jobs:
         ./tests/toranj/build.sh posix-15.4+trel
         git clean -dfx
         ./tests/toranj/build.sh posix-trel
-        git clean -dfx
-        ./tests/toranj/build.sh --enable-plat-key-ref all
 
   toranj-macos:
     name: toranj-macos
diff --git a/etc/cmake/options.cmake b/etc/cmake/options.cmake
@@ -288,6 +288,11 @@ if(ot_index EQUAL -1)
     message(FATAL_ERROR "Invalid value for OT_PLATFORM - valid values are:" "${OT_PLATFORM_VALUES}")
 endif()
 
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+set(OT_CRYPTO_LIB_VALUES "MBEDTLS" "PSA" "PLATFORM")
+ot_multi_option(OT_CRYPTO_LIB OT_CRYPTO_LIB_VALUES OPENTHREAD_CONFIG_CRYPTO_LIB OPENTHREAD_CONFIG_CRYPTO_LIB_ "set Crypto backend library")
+
 # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 set(OT_THREAD_VERSION_VALUES "1.1" "1.2" "1.3" "1.3.1" "1.4")
 set(OT_THREAD_VERSION "1.4" CACHE STRING "set Thread version")
@@ -342,7 +347,7 @@ ot_int_option(OT_RCP_TX_WAIT_TIME_SECS OPENTHREAD_SPINEL_CONFIG_RCP_TX_WAIT_TIME
 # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
 if(NOT OT_EXTERNAL_MBEDTLS)
-    set(OT_MBEDTLS mbedtls)
+    set(OT_MBEDTLS mbedtls mbedcrypto)
     target_compile_definitions(ot-config INTERFACE "OPENTHREAD_CONFIG_ENABLE_BUILTIN_MBEDTLS=1")
 else()
     set(OT_MBEDTLS ${OT_EXTERNAL_MBEDTLS})
diff --git a/examples/apps/cli/ftd.cmake b/examples/apps/cli/ftd.cmake
@@ -41,9 +41,9 @@ target_link_libraries(ot-cli-ftd PRIVATE
     openthread-cli-ftd
     ${OT_PLATFORM_LIB_FTD}
     openthread-ftd
-    ${OT_PLATFORM_LIB_FTD}
     openthread-cli-ftd
     ${OT_MBEDTLS}
+    ${OT_PLATFORM_LIB_FTD}
     ot-config-ftd
     ot-config
 )
diff --git a/examples/apps/cli/mtd.cmake b/examples/apps/cli/mtd.cmake
@@ -41,9 +41,9 @@ target_link_libraries(ot-cli-mtd PRIVATE
     openthread-cli-mtd
     ${OT_PLATFORM_LIB_MTD}
     openthread-mtd
-    ${OT_PLATFORM_LIB_MTD}
     openthread-cli-mtd
     ${OT_MBEDTLS}
+    ${OT_PLATFORM_LIB_MTD}
     ot-config-mtd
     ot-config
 )
diff --git a/examples/apps/ncp/ftd.cmake b/examples/apps/ncp/ftd.cmake
@@ -41,9 +41,9 @@ target_link_libraries(ot-ncp-ftd PRIVATE
     openthread-ncp-ftd
     ${OT_PLATFORM_LIB_FTD}
     openthread-ftd
-    ${OT_PLATFORM_LIB_FTD}
     openthread-ncp-ftd
     ${OT_MBEDTLS}
+    ${OT_PLATFORM_LIB_FTD}
     ot-config-ftd
     ot-config
 )
diff --git a/examples/apps/ncp/mtd.cmake b/examples/apps/ncp/mtd.cmake
@@ -41,9 +41,9 @@ target_link_libraries(ot-ncp-mtd PRIVATE
     openthread-ncp-mtd
     ${OT_PLATFORM_LIB_MTD}
     openthread-mtd
-    ${OT_PLATFORM_LIB_MTD}
     openthread-ncp-mtd
     ${OT_MBEDTLS}
+    ${OT_PLATFORM_LIB_MTD}
     ot-config-mtd
     ot-config
 )
diff --git a/examples/platforms/simulation/CMakeLists.txt b/examples/platforms/simulation/CMakeLists.txt
@@ -103,9 +103,10 @@ endif()
 
 target_link_libraries(openthread-simulation PRIVATE
     openthread-platform
+    mbedtls
+    openthread-native-its-file
     ot-simulation-config
     ot-config
-    mbedtls
 )
 
 target_compile_options(openthread-simulation PRIVATE
diff --git a/examples/platforms/simulation/openthread-core-simulation-config.h b/examples/platforms/simulation/openthread-core-simulation-config.h
@@ -39,8 +39,6 @@
 #define OPENTHREAD_RADIO 0
 #endif
 
-#if !OPENTHREAD_RADIO
-
 #ifndef OPENTHREAD_CONFIG_CRYPTO_LIB
 #define OPENTHREAD_CONFIG_CRYPTO_LIB OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
 #endif
@@ -49,6 +47,8 @@
 #define OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE 1
 #endif
 
+#if OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
+#define OPENTHREAD_CONFIG_MULTIPLE_STATIC_INSTANCE_ENABLE 1
 #endif
 
 #ifndef OPENTHREAD_CONFIG_PLATFORM_INFO
diff --git a/examples/platforms/simulation/system.c b/examples/platforms/simulation/system.c
@@ -61,6 +61,11 @@ extern otRadioCaps gRadioCaps;
 
 static volatile bool gTerminate = false;
 
+#if OPENTHREAD_PSA_CRYPTO_NATIVE_ITS_FILE
+static char        sNativeItsFileNamePrefix[256];
+extern const char *gItsFileNamePrefix;
+#endif
+
 static void handleSignal(int aSignal)
 {
     OT_UNUSED_VARIABLE(aSignal);
@@ -193,6 +198,12 @@ void otSysInit(int aArgCount, char *aArgVector[])
     signal(SIGTERM, &handleSignal);
     signal(SIGHUP, &handleSignal);
 
+#if OPENTHREAD_PSA_CRYPTO_NATIVE_ITS_FILE
+    snprintf(sNativeItsFileNamePrefix, sizeof(sNativeItsFileNamePrefix), "%s/%s_%d_",
+             OPENTHREAD_CONFIG_POSIX_SETTINGS_PATH, getenv("PORT_OFFSET") ? getenv("PORT_OFFSET") : "0", gNodeId);
+    gItsFileNamePrefix = sNativeItsFileNamePrefix;
+#endif
+
     platformLoggingInit(basename(aArgVector[0]));
     platformAlarmInit(speedUpFactor);
     platformRadioInit();
diff --git a/examples/platforms/simulation/virtual_time/platform-sim.c b/examples/platforms/simulation/virtual_time/platform-sim.c
@@ -60,6 +60,11 @@ static volatile bool gTerminate = false;
 int    gArgumentsCount = 0;
 char **gArguments      = NULL;
 
+#if OPENTHREAD_PSA_CRYPTO_NATIVE_ITS_FILE
+static char        sNativeItsFileNamePrefix[256];
+extern const char *gItsFileNamePrefix;
+#endif
+
 uint64_t sNow = 0; // microseconds
 int      sSockFd;
 uint16_t sPortBase = 9000;
@@ -222,6 +227,12 @@ void otSysInit(int argc, char *argv[])
         DieNow(OT_EXIT_FAILURE);
     }
 
+#if OPENTHREAD_PSA_CRYPTO_NATIVE_ITS_FILE
+    snprintf(sNativeItsFileNamePrefix, sizeof(sNativeItsFileNamePrefix), "%s/%s_%d_",
+             OPENTHREAD_CONFIG_POSIX_SETTINGS_PATH, getenv("PORT_OFFSET") ? getenv("PORT_OFFSET") : "0", gNodeId);
+    gItsFileNamePrefix = sNativeItsFileNamePrefix;
+#endif
+
     socket_init();
 
     platformAlarmInit(1);
diff --git a/src/core/config/platform.h b/src/core/config/platform.h
@@ -34,7 +34,7 @@
 #ifndef CONFIG_PLATFORM_H_
 #define CONFIG_PLATFORM_H_
 
-#include "config/srp_server.h"
+#include "config/crypto.h"
 
 /**
  * @addtogroup config-platform
@@ -154,9 +154,13 @@
  * @def OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
  *
  * Define to 1 if you want to enable key ref usage support as defined by platform.
+ *
+ * This config is enabled by default for PSA Crypto backend.
+ *
  */
 #ifndef OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
-#define OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE 0
+#define OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE \
+     (OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PSA)
 #endif
 
 /**
diff --git a/src/core/instance/instance.cpp b/src/core/instance/instance.cpp
@@ -280,6 +280,7 @@ Instance::Instance(void)
     , mIsInitialized(false)
     , mId(Random::NonCrypto::GetUint32())
 {
+#if OPENTHREAD_MTD || OPENTHREAD_FTD
 #if OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
 #if OPENTHREAD_CONFIG_MULTIPLE_STATIC_INSTANCE_ENABLE
     mCryptoStorageKeyRefManager.SetKeyRefExtraOffset(Crypto::Storage::KeyRefManager::kKeyRefExtraOffset * GetIdx(this));
@@ -288,6 +289,7 @@ Instance::Instance(void)
        "The `KeyRef` values will be shared across different `Instance` objects"
 #endif
 #endif
+#endif
 }
 
 #if OPENTHREAD_CONFIG_HEAP_INTERNAL_ENABLE
diff --git a/src/core/mac/link_raw.cpp b/src/core/mac/link_raw.cpp
@@ -58,6 +58,8 @@ LinkRaw::LinkRaw(Instance &aInstance)
     , mSubMac(aInstance.Get<SubMac>())
 #endif
 {
+    otPlatCryptoInit();
+
     Init();
 }
 
diff --git a/src/core/net/srp_client.cpp b/src/core/net/srp_client.cpp
@@ -391,11 +391,6 @@ Client::Client(Instance &aInstance)
     };
 
     mHostInfo.Init();
-
-#if OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
-    KeyInfo keyInfo(Get<Crypto::Storage::KeyRefManager>().KeyRefFor(Crypto::Storage::KeyRefManager::kEcdsa));
-    IgnoreError(ReadOrGenerateKey(keyInfo));
-#endif
 }
 
 Error Client::Start(const Ip6::SockAddr &aServerSockAddr, Requester aRequester)
@@ -1116,10 +1111,10 @@ Error Client::PrepareUpdateMessage(MsgInfo &aInfo)
 
 #if OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
     aInfo.mKeyInfo.SetKeyRef(Get<Crypto::Storage::KeyRefManager>().KeyRefFor(Crypto::Storage::KeyRefManager::kEcdsa));
-#else
-    SuccessOrExit(error = ReadOrGenerateKey(aInfo.mKeyInfo));
 #endif
 
+    SuccessOrExit(error = ReadOrGenerateKey(aInfo.mKeyInfo));
+
     header.SetMessageId(mNextMessageId);
 
     // SRP Update (DNS Update) message must have exactly one record in
diff --git a/src/posix/platform/CMakeLists.txt b/src/posix/platform/CMakeLists.txt
@@ -173,6 +173,7 @@ target_link_libraries(openthread-posix
         ot-config
         ot-posix-config
         mbedtls
+        openthread-native-its-file
         $<$<NOT:$<BOOL:${OT_ANDROID_NDK}>>:util>
         $<$<STREQUAL:${CMAKE_SYSTEM_NAME},Linux>:rt>
 )
diff --git a/src/posix/platform/openthread-core-posix-config.h b/src/posix/platform/openthread-core-posix-config.h
@@ -164,6 +164,10 @@
 #define OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE 1
 #endif
 
+#ifndef OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE
+#define OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE 1
+#endif
+
 #ifndef OPENTHREAD_CONFIG_MAX_STATECHANGE_HANDLERS
 /**
  * The `system.cpp` has registered a state-changed callback handler. Another state-changed callback handler
diff --git a/src/posix/platform/system.cpp b/src/posix/platform/system.cpp
@@ -52,6 +52,7 @@
 
 #include "common/code_utils.hpp"
 #include "common/debug.hpp"
+#include "common/encoding.hpp"
 #include "posix/platform/daemon.hpp"
 #include "posix/platform/firewall.hpp"
 #include "posix/platform/infra_if.hpp"
@@ -64,6 +65,11 @@
 otInstance *gInstance = nullptr;
 bool        gDryRun   = false;
 
+#if OPENTHREAD_PSA_CRYPTO_NATIVE_ITS_FILE
+static char        sNativeItsFileNamePrefix[256];
+extern const char *gItsFileNamePrefix;
+#endif
+
 CoprocessorType sCoprocessorType = OT_COPROCESSOR_UNKNOWN;
 
 static void processStateChange(otChangedFlags aFlags, void *aContext)
@@ -207,6 +213,17 @@ void platformInit(otPlatformConfig *aPlatformConfig)
         break;
     }
 
+#if OPENTHREAD_PSA_CRYPTO_NATIVE_ITS_FILE
+    uint64_t nodeId;
+
+    otPlatRadioGetIeeeEui64(gInstance, reinterpret_cast<uint8_t *>(&nodeId));
+    nodeId = ot::BigEndian::HostSwap64(nodeId);
+
+    snprintf(sNativeItsFileNamePrefix, sizeof(sNativeItsFileNamePrefix), "%s/%s_%" PRIx64 "_",
+             OPENTHREAD_CONFIG_POSIX_SETTINGS_PATH, getenv("PORT_OFFSET") ? getenv("PORT_OFFSET") : "0", nodeId);
+    gItsFileNamePrefix = sNativeItsFileNamePrefix;
+#endif
+
     aPlatformConfig->mCoprocessorType = sCoprocessorType;
 }
 
diff --git a/tests/gtest/CMakeLists.txt b/tests/gtest/CMakeLists.txt
@@ -49,6 +49,8 @@ add_library(ot-fake-platform
 )
 target_link_libraries(ot-fake-platform
     ot-config
+    ${OT_MBEDTLS}
+    openthread-native-its-ram
 )
 
 add_library(ot-fake-ftd INTERFACE)
diff --git a/tests/gtest/fake_platform.cpp b/tests/gtest/fake_platform.cpp
@@ -49,6 +49,10 @@
 #include <openthread/platform/trel.h>
 #include <openthread/platform/udp.h>
 
+#if (OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PSA)
+#include <psa/crypto.h>
+#endif
+
 using namespace ot;
 
 namespace ot {
@@ -456,6 +460,38 @@ otError otPlatEntropyGet(uint8_t *aOutput, uint16_t aOutputLength)
     return error;
 }
 
+#if (OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PSA) && defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
+/**
+ * When OpenThread is compiled with the PSA Crypto backend using Mbed TLS 3.x, there is no
+ * API to configure a dedicated non-default entropy source. It is documented that a future version of
+ * Mbed TLS (likely 4.x) will include a PSA interface for configuring entropy sources.
+ *
+ * For now, we need to define the external RNG. Since the implementation of `otPlatEntropyGet` already
+ * uses CSPRNG, we will call it here as well.
+ */
+extern "C" psa_status_t mbedtls_psa_external_get_random(mbedtls_psa_external_random_context_t *context,
+                                                        uint8_t                               *output,
+                                                        size_t                                 output_size,
+                                                        size_t                                *output_length)
+{
+    OT_UNUSED_VARIABLE(context);
+
+    otError      error;
+    psa_status_t status = PSA_ERROR_GENERIC_ERROR;
+
+    error = otPlatEntropyGet(output, (uint16_t)output_size);
+    if (error == OT_ERROR_NONE)
+    {
+        *output_length = output_size;
+        status         = PSA_SUCCESS;
+    }
+
+    return status;
+}
+#endif
+
+// otError otPlatCryptoExportKey(otCryptoKeyRef, uint8_t *, size_t, size_t *) { return OT_ERROR_NONE; }
+
 void otPlatDiagSetOutputCallback(otInstance *, otPlatDiagOutputCallback, void *) {}
 
 void otPlatDiagModeSet(bool) {}
diff --git a/tests/toranj/build.sh b/tests/toranj/build.sh
diff --git a/tests/unit/CMakeLists.txt b/tests/unit/CMakeLists.txt
diff --git a/tests/unit/test_dns_client.cpp b/tests/unit/test_dns_client.cpp
diff --git a/tests/unit/test_srp_server.cpp b/tests/unit/test_srp_server.cpp
diff --git a/third_party/CMakeLists.txt b/third_party/CMakeLists.txt
diff --git a/third_party/mbedtls/CMakeLists.txt b/third_party/mbedtls/CMakeLists.txt
