Hardware Acceleration tracking issue

[AnthonyGrondin]

This issue keeps track of the current status of Hardware Acceleration support for ESP32.

Legend: If a cell contains an em dash (—) this means that the particular peripheral is not present for a chip. A check mark (✓) means that some hardware acceleration implementation exists. An Aegean check mark (𐄂) means that the chip has the crypto peripheral but implementation is currently impossible for esp-mbedtls.

Peripheral	ESP32	ESP32-C2	ESP32-C3	ESP32-C6	ESP32-H2	ESP32-S2	ESP32-S3
AES		—
ECC	—		—			—	—
ECDSA	—	—	—	—		—	—
MD5*
RSA (Modular multiplication)		—
RSA (Modular exponentiation)	✓ (512 bits..)	—	✓ (3072 bits)	✓ (3072 bits)	✓ (3072 bits)	✓ (4096 bits)	✓ (4096 bits)
SHA1	𐄂	✓	✓	✓	✓	✓	✓
SHA224	—	✓	✓	✓	✓	✓	✓
SHA256	𐄂	✓	✓	✓	✓	✓	✓
SHA384	𐄂	—	—	—	—	✓	✓
SHA512	𐄂	—	—	—	—	✓	✓

Note*: MD5 is a ROM-based software implementation. Verify whether it provides meaningful performance benefits and code-size savings compared to alternatives.

Implementation PRs:

• feat(bignum): Add initial bignum hardware acceleration #20
• feat(bignum): Add initial hardware acceleration for modular exponentiation #24
• Feat/hw accelerated sha updated #46

[ivmarkov]

Nit: I don't think we need to bother with MD5. Is this still in use? I somehow doubt that.

[ivmarkov]

The ECDSA peripheral (corresponding to your "ECC" line) is NOT supported on the following chips:

• c2
• c6

On the other hand, besides c5 and h2, also the following support it (but they are not supported yet by esp-hal):

• c61
• p4

[AnthonyGrondin]

Documentation specifies the following:

/**                                                                             
 * \def MBEDTLS_MD5_C                                                           
 *                                                                              
 * Enable the MD5 hash algorithm.                                               
 *                                                                              
 * Module:  library/md5.c                                                       
 * Caller:  library/md.c                                                        
 *          library/pem.c                                                       
 *          library/ssl_tls.c                                                   
 *                                                                              
 * This module is required for TLS 1.2 depending on the handshake parameters.   
 * Further, it is used for checking MD5-signed certificates, and for PBKDF1     
 * when decrypting PEM-encoded encrypted keys.                                  
 *                                                                              
 * \warning   MD5 is considered a weak message digest and its use constitutes a 
 *            security risk. If possible, we recommend avoiding dependencies on 
 *            it, and considering stronger message digests instead.             
 *                                                                              
 */                                                                             
#define MBEDTLS_MD5_C                                                           

I personally tried to replace the MD5 module with the ROM implementation, and I tested using a panic in the callback to see if it would even be called during a normal request and it did not. It seems to be only used for a few cases. I also wanted to see how much binary size we save by disabling it, which I don't remember the result, hence the note.

IF using the ROM implementation from esp32 is both faster AND / OR results in a smaller binary size, I don't know why we wouldn't take advantage of it.

[AnthonyGrondin]

The ECDSA peripheral (corresponding to your "ECC" line) is NOT supported on the following chips:

* c2

* c6

On the other hand, besides c5 and h2, also the following support it (but they are not supported yet by esp-hal):

* c61

* p4

Looking at the mbedtls port in esp-idf this list should be made more exhaustive. Feel free to edit it whenever there's a need.

C61 and P4 will be added once they get supported in esp-hal, I mostly copied the table from there.

[ivmarkov]

I'm now really confused.

What do you mean by "ECC"? I thought you meant the ECDSA peripheral? Is there more to elliptic curves w.r.t. hardware acceleration?

What I said is:

The ECDSA peripheral (corresponding to your "ECC" line)

[ivmarkov]

Maybe this can shed some light: https://esp32.com/viewtopic.php?t=19023
Weird stuff...

[ivmarkov]

Small update on ECC vs ECDSA (also here):

These are two different peripherals indeed:

• ECC being the more general one (generic EC cryptoengine, supporting point * scalar mul, point + point add etc.)
• ECDSA specifically only supporting EC sign and verify and operating off from an EC secret which should be in the eFuse
• ECC is older, available on more chips, ECDSA is relatively new
• ECDSA has limited use (basically device attestation):
  • Might be used to store the EC secret key for client mTLS (benefit: secret key cannot leak as it is in efuse)
  • Might be used for rs-matter Device Attestation (benefit: same)