nrf_security: kmu: add support for ecdh keys to kmu

add support for ecdh to kmu
update psa_crypto_driver_wrappers to support this

Signed-off-by: Dag Erik Gjørvad <[email protected]>

Author: degjorva

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c

@@ -76,7 +76,7 @@ enum kmu_metadata_algorithm {
 	METADATA_ALG_ECDSA = 11,
 	METADATA_ALG_ED25519PH = 12,
 	METADATA_ALG_HMAC = 13,
-	METADATA_ALG_RESERVED4 = 14,
+	METADATA_ALG_ECDH = 14,
 	METADATA_ALG_RESERVED5 = 15,
 };
 
@@ -372,6 +372,13 @@ static bool can_sign(const psa_key_attributes_t *key_attr)
 }
 #endif /* defined(CONFIG_PSA_WANT_ALG_PURE_EDDSA) || define(CONFIG_PSA_WANT_ALG_ED25519PH) */
 
+#if defined(CONFIG_PSA_WANT_ALG_ECDH)
+static bool can_derive(const psa_key_attributes_t *key_attr)
+{
+	return psa_get_key_usage_flags(key_attr) & PSA_KEY_USAGE_DERIVE;
+}
+#endif
+
 /**
  * @brief Check provisioning state, and delete slots that were not completely provisioned.
  *
@@ -680,6 +687,12 @@ static psa_status_t convert_to_psa_attributes(kmu_metadata *metadata,
 		psa_set_key_type(key_attr, PSA_KEY_TYPE_HMAC);
 		psa_set_key_algorithm(key_attr, PSA_ALG_HMAC(PSA_ALG_SHA_256));
 		break;
+#endif
+#ifdef CONFIG_PSA_WANT_ALG_ECDH
+	case METADATA_ALG_ECDH:
+		psa_set_key_type(key_attr, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1));
+		psa_set_key_algorithm(key_attr, PSA_ALG_ECDH);
+		break;
 #endif
 	default:
 		return PSA_ERROR_HARDWARE_FAILURE;
@@ -880,6 +893,15 @@ static psa_status_t convert_from_psa_attributes(const psa_key_attributes_t *key_
 		}
 		metadata->algorithm = METADATA_ALG_HMAC;
 		break;
+#endif
+#ifdef CONFIG_PSA_WANT_ALG_ECDH
+	case PSA_ALG_ECDH:
+		if (!can_derive(key_attr) || PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(
+						     key_attr)) != PSA_ECC_FAMILY_SECP_R1) {
+			return PSA_ERROR_NOT_SUPPORTED;
+		}
+		metadata->algorithm = METADATA_ALG_ECDH;
+		break;
 #endif
 	default:
 		/* Ignore the algorithm for the protected ram invalidation kmu slot because

subsys/nrf_security/src/psa_crypto_driver_wrappers.c

@@ -2414,6 +2414,9 @@ psa_status_t psa_driver_wrapper_key_agreement(const psa_key_attributes_t *attrib
 		 * cycle through all known transparent accelerators
 		 */
 #if defined(PSA_NEED_CRACEN_KEY_AGREEMENT_DRIVER)
+#if defined(PSA_NEED_CRACEN_KMU_DRIVER)
+	case PSA_KEY_LOCATION_CRACEN_KMU:
+#endif /* defined(PSA_NEED_CRACEN_KMU_DRIVER) */
 		status = cracen_key_agreement(attributes, priv_key, priv_key_size, publ_key,
 					      publ_key_size, output, output_size, output_length,
 					      alg);