feat(docs): Update minimizing binary size

        The ESP32-H2 software countermeasure may not be necessary
        for ESP32-H2 v1.2 and above, this commit updates
        the relevant documentation

Author: AdityaHPatwardhan

components/hal/Kconfig

@@ -111,5 +111,7 @@ menu "Hardware Abstraction Layer (HAL) and Low Level (LL)"
             Enable this option to apply the countermeasure for ECDSA signature operation
             This countermeasure masks the real ECDSA sign operation
             under dummy sign operations to add randomness in the generated power signature.
+            This countermeasure is only necessary for ESP32-H2 < v1.2.
+
 
 endmenu

components/mbedtls/Kconfig

@@ -592,13 +592,14 @@ menu "mbedTLS"
             select HAL_ECDSA_GEN_SIG_CM
             default y
             help
-                The ECDSA peripheral before ECO5 does not offer constant time ECDSA sign operation.
+                The ECDSA peripheral before ESP32-H2 v1.2 does not offer constant time ECDSA sign operation.
                 This time can be observed through power profiling of the device,
                 making the ECDSA private key vulnerable to side-channel timing attacks.
                 This countermeasure masks the real ECDSA sign operation
                 under dummy sign operations to add randomness in the generated power signature.
                 It is highly recommended to also enable Secure Boot for the device in addition to this countermeasure
                 so that only trusted software can execute on the device.
+                This countermeasure can be safely disabled for ESP32-H2 v1.2 and above.
 
         config MBEDTLS_HARDWARE_ECDSA_SIGN_CONSTANT_TIME_CM
             bool "Make ECDSA signature operation pseudo constant time for software"
@@ -611,6 +612,7 @@ menu "mbedTLS"
                 of an arbitrary message.
                 The signature time would appear to be constant to the external entity after enabling
                 this option.
+                This countermeasure can be safely disabled for ESP32-H2 v1.2 and above.
 
     endmenu
 

docs/en/api-guides/performance/size.rst

@@ -202,23 +202,26 @@ Under **Component Config** > **mbedTLS**, there are multiple mbedTLS features en
 
 These include:
 
-- :ref:`CONFIG_MBEDTLS_HAVE_TIME`
-- :ref:`CONFIG_MBEDTLS_ECDSA_DETERMINISTIC`
-- :ref:`CONFIG_MBEDTLS_SHA512_C`
-- :ref:`CONFIG_MBEDTLS_SHA3_C`
-- :ref:`CONFIG_MBEDTLS_CLIENT_SSL_SESSION_TICKETS`
-- :ref:`CONFIG_MBEDTLS_SERVER_SSL_SESSION_TICKETS`
-- :ref:`CONFIG_MBEDTLS_SSL_CONTEXT_SERIALIZATION`
-- :ref:`CONFIG_MBEDTLS_SSL_ALPN`
-- :ref:`CONFIG_MBEDTLS_SSL_RENEGOTIATION`
-- :ref:`CONFIG_MBEDTLS_CCM_C`
-- :ref:`CONFIG_MBEDTLS_GCM_C`
-- :ref:`CONFIG_MBEDTLS_ECP_C` (Alternatively: Leave this option enabled but disable some of the elliptic curves listed in the sub-menu.)
-- :ref:`CONFIG_MBEDTLS_ECP_NIST_OPTIM`
-- :ref:`CONFIG_MBEDTLS_ECP_FIXED_POINT_OPTIM`
-- Change :ref:`CONFIG_MBEDTLS_TLS_MODE` if both server & client functionalities are not needed.
-- Consider disabling some cipher suites listed in the ``TLS Key Exchange Methods`` sub-menu (i.e., :ref:`CONFIG_MBEDTLS_KEY_EXCHANGE_RSA`).
-- Consider disabling :ref:`CONFIG_MBEDTLS_ERROR_STRINGS` if the application is already pulling in mbedTLS error strings through using :cpp:func:`mbedtls_strerror`.
+.. list::
+
+    - :ref:`CONFIG_MBEDTLS_HAVE_TIME`
+    - :ref:`CONFIG_MBEDTLS_ECDSA_DETERMINISTIC`
+    - :ref:`CONFIG_MBEDTLS_SHA512_C`
+    - :ref:`CONFIG_MBEDTLS_SHA3_C`
+    - :ref:`CONFIG_MBEDTLS_CLIENT_SSL_SESSION_TICKETS`
+    - :ref:`CONFIG_MBEDTLS_SERVER_SSL_SESSION_TICKETS`
+    - :ref:`CONFIG_MBEDTLS_SSL_CONTEXT_SERIALIZATION`
+    - :ref:`CONFIG_MBEDTLS_SSL_ALPN`
+    - :ref:`CONFIG_MBEDTLS_SSL_RENEGOTIATION`
+    - :ref:`CONFIG_MBEDTLS_CCM_C`
+    - :ref:`CONFIG_MBEDTLS_GCM_C`
+    - :ref:`CONFIG_MBEDTLS_ECP_C` (Alternatively: Leave this option enabled but disable some of the elliptic curves listed in the sub-menu.)
+    - :ref:`CONFIG_MBEDTLS_ECP_NIST_OPTIM`
+    - :ref:`CONFIG_MBEDTLS_ECP_FIXED_POINT_OPTIM`
+    - Change :ref:`CONFIG_MBEDTLS_TLS_MODE` if both server & client functionalities are not needed.
+    - Consider disabling some cipher suites listed in the ``TLS Key Exchange Methods`` sub-menu (i.e., :ref:`CONFIG_MBEDTLS_KEY_EXCHANGE_RSA`).
+    - Consider disabling :ref:`CONFIG_MBEDTLS_ERROR_STRINGS` if the application is already pulling in mbedTLS error strings through using :cpp:func:`mbedtls_strerror`.
+    :esp32h2: - For {IDF_TARGET_NAME} v1.2 and above, consider disabling :ref:`CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN_MASKING_CM` and :ref:`CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN_CONSTANT_TIME_CM` as the software countermeasures for the ECDSA sign operation are not required.
 
 The help text for each option has some more information for reference.