Skip to content

Commit 103b8e5

Browse files
degjorvarlubos
degjorva
authored and
rlubos
committed
nrf_security: cracen: Rom optimization for ECC verify
Add IS_ENABLED for ECC verify calls This stops algoritms that are not needed from being included Signed-off-by: Dag Erik Gjørvad <[email protected]>
1 parent 2258678 commit 103b8e5

File tree

4 files changed

+37
-12
lines changed

4 files changed

+37
-12
lines changed

‎subsys/nrf_security/cmake/psa_crypto_config.cmake‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,8 @@ kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ECDSA_SECP_R1)
5656
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ECDSA_SECP_K1_192)
5757
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ECDSA_SECP_K1_256)
5858
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ECDSA_SECP_K1)
59+
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_DETERMINISTIC_ECDSA)
60+
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ECDSA)
5961
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_255)
6062
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_448)
6163
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS)

‎subsys/nrf_security/configs/psa_crypto_config.h.template‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,8 @@
280280
#cmakedefine PSA_NEED_CRACEN_ECDSA_SECP_K1_192 @PSA_NEED_CRACEN_ECDSA_SECP_K1_192@
281281
#cmakedefine PSA_NEED_CRACEN_ECDSA_SECP_K1_256 @PSA_NEED_CRACEN_ECDSA_SECP_K1_256@
282282
#cmakedefine PSA_NEED_CRACEN_ECDSA_SECP_K1 @PSA_NEED_CRACEN_ECDSA_SECP_K1@
283+
#cmakedefine PSA_NEED_CRACEN_DETERMINISTIC_ECDSA @PSA_NEED_CRACEN_DETERMINISTIC_ECDSA@
284+
#cmakedefine PSA_NEED_CRACEN_ECDSA @PSA_NEED_CRACEN_ECDSA@
283285
#cmakedefine PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_255 @PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_255@
284286
#cmakedefine PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_448 @PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_448@
285287
#cmakedefine PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS @PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS@

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/sign.c‎

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,7 @@ static int cracen_signature_prepare_ec_pubkey(const char *key_buffer, size_t key
179179
status = generate_ikg_pub_key(key_buffer, key_buffer_size, *sicurve, pubkey_buffer);
180180
return status;
181181
}
182-
if (IS_ENABLED(PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS)) {
182+
if (IS_ENABLED(PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_255)) {
183183
if (alg == PSA_ALG_PURE_EDDSA || alg == PSA_ALG_ED25519PH) {
184184
if (PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY(psa_get_key_type(attributes))) {
185185
memcpy(pubkey_buffer, key_buffer, key_buffer_size);
@@ -262,7 +262,7 @@ static psa_status_t handle_eddsa_sign(bool is_message, const psa_key_attributes_
262262
{
263263
int status;
264264

265-
if (alg == PSA_ALG_ED25519PH && IS_ENABLED(CONFIG_PSA_WANT_ALG_ED25519PH)) {
265+
if (alg == PSA_ALG_ED25519PH && IS_ENABLED(PSA_NEED_CRACEN_ED25519PH)) {
266266
status = cracen_ed25519ph_sign(key_buffer, signature, input, input_length,
267267
is_message);
268268
if (status == SX_OK) {
@@ -271,7 +271,7 @@ static psa_status_t handle_eddsa_sign(bool is_message, const psa_key_attributes_
271271
return silex_statuscodes_to_psa(status);
272272
}
273273
if (alg == PSA_ALG_PURE_EDDSA && psa_get_key_bits(attributes) == 255 &&
274-
IS_ENABLED(CONFIG_PSA_WANT_ALG_PURE_EDDSA)) {
274+
IS_ENABLED(PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_255)) {
275275
status = cracen_ed25519_sign(key_buffer, signature, input, input_length);
276276
if (status == SX_OK) {
277277
*signature_length = 2 * ecurve->sz;
@@ -345,15 +345,16 @@ static psa_status_t handle_ecdsa_sign(bool is_message, const uint8_t *key_buffer
345345
status = SX_ERR_INCOMPATIBLE_HW;
346346

347347
if (PSA_ALG_IS_DETERMINISTIC_ECDSA(alg) &&
348-
IS_ENABLED(CONFIG_PSA_WANT_ALG_DETERMINISTIC_ECDSA)) {
348+
IS_ENABLED(PSA_NEED_CRACEN_DETERMINISTIC_ECDSA)) {
349349
if (is_message) {
350350
status = cracen_ecdsa_sign_message_deterministic(
351351
&privkey, hashalgpointer, ecurve, input, input_length, signature);
352352
} else {
353353
status = cracen_ecdsa_sign_digest_deterministic(
354354
&privkey, hashalgpointer, ecurve, input, input_length, signature);
355355
}
356-
} else if (IS_ENABLED(CONFIG_PSA_WANT_ALG_ECDSA)) {
356+
} else if ((PSA_ALG_IS_ECDSA(alg) && IS_ENABLED(PSA_NEED_CRACEN_ECDSA)) &&
357+
!PSA_ALG_IS_DETERMINISTIC_ECDSA(alg)) {
357358
if (is_message) {
358359
status = cracen_ecdsa_sign_message(&privkey, hashalgpointer, ecurve, input,
359360
input_length, signature);
@@ -397,12 +398,13 @@ static psa_status_t cracen_signature_ecc_sign(bool is_message,
397398
return PSA_ERROR_BUFFER_TOO_SMALL;
398399
}
399400

400-
if ((alg == PSA_ALG_PURE_EDDSA && IS_ENABLED(CONFIG_PSA_WANT_ALG_PURE_EDDSA)) ||
401-
(alg == PSA_ALG_ED25519PH && IS_ENABLED(CONFIG_PSA_WANT_ALG_ED25519PH))) {
401+
if ((alg == PSA_ALG_PURE_EDDSA &&
402+
IS_ENABLED(PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_255)) ||
403+
(alg == PSA_ALG_ED25519PH && IS_ENABLED(PSA_NEED_CRACEN_ED25519PH))) {
402404
return handle_eddsa_sign(is_message, attributes, key_buffer, alg, signature, input,
403405
input_length, ecurve, signature_length);
404-
} else if (PSA_ALG_IS_ECDSA(alg) && (IS_ENABLED(CONFIG_PSA_WANT_ALG_ECDSA) ||
405-
IS_ENABLED(CONFIG_PSA_WANT_ALG_DETERMINISTIC_ECDSA))) {
406+
} else if (PSA_ALG_IS_ECDSA(alg) && (IS_ENABLED(PSA_NEED_CRACEN_ECDSA) ||
407+
IS_ENABLED(PSA_NEED_CRACEN_DETERMINISTIC_ECDSA))) {
406408
return handle_ecdsa_sign(is_message, key_buffer, alg, input, input_length, ecurve,
407409
signature, signature_length);
408410
}
@@ -466,15 +468,18 @@ static psa_status_t cracen_signature_ecc_verify(bool is_message,
466468
return PSA_ERROR_INVALID_SIGNATURE;
467469
}
468470

469-
if (alg == PSA_ALG_ED25519PH) {
471+
if (IS_ENABLED(PSA_NEED_CRACEN_ED25519PH) && alg == PSA_ALG_ED25519PH) {
470472
sx_status = cracen_ed25519ph_verify(pubkey_buffer, (char *)input, input_length,
471473
signature, is_message);
472474

473-
} else if (alg == PSA_ALG_PURE_EDDSA) {
475+
} else if (IS_ENABLED(PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_255) &&
476+
alg == PSA_ALG_PURE_EDDSA) {
474477
sx_status = cracen_ed25519_verify(pubkey_buffer, (char *)input, input_length,
475478
signature);
476479

477-
} else if (PSA_ALG_IS_ECDSA(alg) || PSA_ALG_IS_DETERMINISTIC_ECDSA(alg)) {
480+
} else if ((PSA_ALG_IS_ECDSA(alg) && IS_ENABLED(PSA_NEED_CRACEN_ECDSA)) ||
481+
(IS_ENABLED(PSA_NEED_CRACEN_DETERMINISTIC_ECDSA) &&
482+
PSA_ALG_IS_DETERMINISTIC_ECDSA(alg))) {
478483
struct sxhashalg hashalg = {0};
479484
const struct sxhashalg *hash_algorithm_ptr = &hashalg;
480485

‎subsys/nrf_security/src/drivers/cracen/psa_driver.Kconfig‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -348,6 +348,22 @@ config PSA_NEED_CRACEN_ECDSA_SECP_K1
348348
depends on PSA_NEED_CRACEN_ECDSA_SECP_K1_192 || \
349349
PSA_NEED_CRACEN_ECDSA_SECP_K1_256
350350

351+
config PSA_NEED_CRACEN_DETERMINISTIC_ECDSA
352+
bool
353+
default y
354+
depends on PSA_WANT_ALG_DETERMINISTIC_ECDSA
355+
depends on PSA_NEED_CRACEN_ECDSA_SECP_K1 || \
356+
PSA_NEED_CRACEN_ECDSA_SECP_R1 || \
357+
PSA_NEED_CRACEN_ECDSA_BRAINPOOL_P_R1
358+
359+
config PSA_NEED_CRACEN_ECDSA
360+
bool
361+
default y
362+
depends on PSA_WANT_ALG_ECDSA
363+
depends on PSA_NEED_CRACEN_ECDSA_SECP_K1 || \
364+
PSA_NEED_CRACEN_ECDSA_SECP_R1 || \
365+
PSA_NEED_CRACEN_ECDSA_BRAINPOOL_P_R1
366+
351367
config PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS_255
352368
bool
353369
default y

0 commit comments

Comments
 (0)