sysbuild: Allow selecting SHA512 for HMAC/HKDF in MCUboot

When encryption is used and ECIES-X25519 is used for AES-128 key
exchange it is possible now to use SB_CONFIG_NRF_MCUBOOT_HMAC_SHA512
sysbuild option to use SHA512 for HMAC/HKDF. This should allow
to reduce size of MCUboot by removing need for SHA256 being compiled
in just for the key exchange.

Signed-off-by: Dominik Ermel <[email protected]>

Author: de-nordic

sysbuild/CMakeLists.txt

@@ -238,11 +238,18 @@ function(${SYSBUILD_CURRENT_MODULE_NAME}_pre_cmake)
           set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_MAC_DRIVER y)
           set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_KEY_AGREEMENT_DRIVER y)
           set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_KEY_DERIVATION_DRIVER y)
+
+          if(SB_CONFIG_NRF_MCUBOOT_HMAC_SHA512)
+            set_config_bool(mcuboot CONFIG_BOOT_HMAC_SHA512 y)
+	  else()
+            set_config_bool(mcuboot CONFIG_BOOT_HMAC_SHA512 n)
+          endif()
         else()
           set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_CIPHER_DRIVER n)
           set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_MAC_DRIVER n)
           set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_KEY_AGREEMENT_DRIVER n)
           set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_KEY_DERIVATION_DRIVER n)
+          set_config_bool(mcuboot CONFIG_BOOT_HMAC_SHA512 n)
         endif()
 
         if(SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU)

sysbuild/Kconfig.mcuboot

@@ -184,6 +184,15 @@ config MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE
 	help
 	  If enabled, the build system will generate keyfile.json file in the build directory.
 
+config NRF_MCUBOOT_HMAC_SHA512
+	bool "Use SHA256 for HMAC"
+	depends on BOOT_ENCRYPTION && SOC_SERIES_NRF54LX && BOOT_SIGNATURE_TYPE_ED25519
+	help
+	  Default is to use SHA256 for HMAC/HKDF ECIES-X25519 key exchange is used.
+	  This means that both SHA256 and SHA512 support has to be compiled in.
+	  Enabling this option switches to SHA512 for HMAC/HKDF slightly reducing
+	  MCUboot code size.
+
 endif
 
 config MCUBOOT_USE_ALL_AVAILABLE_RAM