Skip to content

Commit 882d767

Browse files
57300rlubos
57300
authored and
rlubos
committed
nrf_security: Integrate IronSide PSA crypto driver
Plug the newly defined interface functions into `psa_driver_wrapper_*()` and `mbedtls_psa_platform_get_builtin_key()`. The actual driver implementation will have to reside out of tree. Ref: NCSDK-35399 Signed-off-by: Grzegorz Swiderski <[email protected]>
1 parent 61d5316 commit 882d767

File tree

2 files changed

+150
-3
lines changed

2 files changed

+150
-3
lines changed

‎subsys/nrf_security/src/mbedtls_psa_platform.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,24 @@
99
#include "cracen_psa.h"
1010
#endif
1111

12+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
13+
#include "ironside_psa.h"
14+
#endif
15+
1216
psa_status_t mbedtls_psa_platform_get_builtin_key(mbedtls_svc_key_id_t key_id,
1317
psa_key_lifetime_t *lifetime,
1418
psa_drv_slot_number_t *slot_number)
1519
{
20+
psa_status_t status;
21+
(void)status;
22+
23+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
24+
status = ironside_psa_get_key_slot(key_id, lifetime, slot_number);
25+
if (status != PSA_ERROR_DOES_NOT_EXIST) {
26+
return status;
27+
}
28+
#endif
29+
1630
#if defined(PSA_CRYPTO_DRIVER_CRACEN)
1731
return cracen_get_key_slot(key_id, lifetime, slot_number);
1832
#endif

‎subsys/nrf_security/src/psa_crypto_driver_wrappers.c‎

Lines changed: 136 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,10 @@
121121
#include <psa/nrf_rng_entropy.h>
122122
#endif
123123

124+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
125+
#include "ironside_psa.h"
126+
#endif
127+
124128
/* Repeat above block for each JSON-declared driver during autogeneration */
125129
#endif /* MBEDTLS_PSA_CRYPTO_DRIVERS */
126130

@@ -137,6 +141,8 @@
137141
#define PSA_CRYPTO_TFM_BUILTIN_KEY_LOADER_DRIVER_ID (6)
138142
#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */
139143

144+
#define PSA_CRYPTO_IRONSIDE_DRIVER_ID (7)
145+
140146
#define PSA_CRYPTO_OBERON_DRIVER_ID (28)
141147

142148
#if defined(PSA_CRYPTO_DRIVER_ALG_PRNG_TEST)
@@ -511,6 +517,10 @@ psa_status_t psa_driver_wrapper_get_key_buffer_size(const psa_key_attributes_t *
511517

512518
*key_buffer_size = 0;
513519
switch (location) {
520+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
521+
case PSA_KEY_LOCATION_LOCAL_STORAGE:
522+
return ironside_psa_get_key_buffer_size(attributes, key_buffer_size);
523+
#endif
514524
#if defined(PSA_CRYPTO_DRIVER_CRACEN)
515525
case PSA_KEY_LOCATION_CRACEN:
516526
#if defined(PSA_NEED_CRACEN_KMU_DRIVER)
@@ -542,6 +552,14 @@ psa_status_t psa_driver_wrapper_generate_key(const psa_key_attributes_t *attribu
542552
#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER)
543553
case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION:
544554
#endif /* defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) */
555+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
556+
status = ironside_psa_generate_key(attributes, key_buffer, key_buffer_size,
557+
key_buffer_length);
558+
/* Declared with fallback == true */
559+
if (status != PSA_ERROR_NOT_SUPPORTED) {
560+
return status;
561+
}
562+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
545563
/* Transparent drivers are limited to generating asymmetric keys */
546564
if (PSA_KEY_TYPE_IS_ASYMMETRIC(attributes->type)) {
547565
/* Cycle through all known transparent accelerators */
@@ -609,6 +627,14 @@ psa_status_t psa_driver_wrapper_import_key(const psa_key_attributes_t *attribute
609627
/* Key is stored in the slot in export representation, so
610628
* cycle through all known transparent accelerators
611629
*/
630+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
631+
status = ironside_psa_import_key(attributes, data, data_length, key_buffer,
632+
key_buffer_size, key_buffer_length, bits);
633+
/* Declared with fallback == true */
634+
if (status != PSA_ERROR_NOT_SUPPORTED) {
635+
return status;
636+
}
637+
#endif
612638
#if defined(PSA_NEED_CRACEN_KEY_MANAGEMENT_DRIVER)
613639
status = cracen_import_key(attributes, data, data_length, key_buffer,
614640
key_buffer_size, key_buffer_length, bits);
@@ -752,6 +778,11 @@ psa_status_t psa_driver_wrapper_get_builtin_key(psa_drv_slot_number_t slot_numbe
752778
psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime);
753779

754780
switch (location) {
781+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
782+
case PSA_KEY_LOCATION_LOCAL_STORAGE:
783+
return ironside_psa_get_builtin_key(slot_number, attributes, key_buffer,
784+
key_buffer_size, key_buffer_length);
785+
#endif
755786
#if defined(PSA_CRYPTO_DRIVER_CRACEN)
756787
case PSA_KEY_LOCATION_CRACEN:
757788
#if defined(PSA_NEED_CRACEN_KMU_DRIVER)
@@ -783,6 +814,12 @@ psa_status_t psa_driver_wrapper_copy_key(psa_key_attributes_t *attributes,
783814
psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime);
784815

785816
switch (location) {
817+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
818+
case PSA_KEY_LOCATION_LOCAL_STORAGE:
819+
return ironside_psa_copy_key(attributes, source_key, source_key_length,
820+
target_key_buffer, target_key_buffer_size,
821+
target_key_buffer_length);
822+
#endif
786823
#if defined(PSA_NEED_CRACEN_KMU_DRIVER)
787824
case PSA_KEY_LOCATION_CRACEN_KMU:
788825
return cracen_copy_key(attributes, source_key, source_key_length, target_key_buffer,
@@ -809,6 +846,15 @@ psa_status_t psa_driver_wrapper_derive_key(const psa_key_attributes_t *attribute
809846
switch (PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime)) {
810847
case PSA_KEY_LOCATION_LOCAL_STORAGE:
811848
/* Add cases for transparent drivers here */
849+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
850+
status = ironside_psa_derive_key(attributes, input, input_length, key_buffer,
851+
key_buffer_size, key_buffer_length);
852+
853+
if (status != PSA_ERROR_NOT_SUPPORTED) {
854+
return status;
855+
}
856+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
857+
812858
#ifdef PSA_NEED_CRACEN_KEY_MANAGEMENT_DRIVER
813859
status = cracen_derive_key(attributes, input, input_length, key_buffer,
814860
key_buffer_size, key_buffer_length);
@@ -2414,10 +2460,18 @@ psa_status_t psa_driver_wrapper_key_agreement(const psa_key_attributes_t *attrib
24142460
/* Key is stored in the slot in export representation, so
24152461
* cycle through all known transparent accelerators
24162462
*/
2417-
#if defined(PSA_NEED_CRACEN_KEY_AGREEMENT_DRIVER)
2418-
#if defined(PSA_NEED_CRACEN_KMU_DRIVER)
2463+
#if defined(PSA_NEED_CRACEN_KEY_AGREEMENT_DRIVER) && defined(PSA_NEED_CRACEN_KMU_DRIVER)
24192464
case PSA_KEY_LOCATION_CRACEN_KMU:
2420-
#endif /* defined(PSA_NEED_CRACEN_KMU_DRIVER) */
2465+
#endif
2466+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
2467+
status = ironside_psa_key_agreement(attributes, priv_key, priv_key_size, alg,
2468+
publ_key, publ_key_size, output, output_size,
2469+
output_length);
2470+
if (status != PSA_ERROR_NOT_SUPPORTED) {
2471+
return status;
2472+
}
2473+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
2474+
#if defined(PSA_NEED_CRACEN_KEY_AGREEMENT_DRIVER)
24212475
status = cracen_key_agreement(attributes, priv_key, priv_key_size, publ_key,
24222476
publ_key_size, output, output_size, output_length,
24232477
alg);
@@ -2470,9 +2524,22 @@ psa_status_t psa_driver_wrapper_key_encapsulate(const psa_key_attributes_t *attr
24702524
size_t *output_key_length, uint8_t *ciphertext,
24712525
size_t ciphertext_size, size_t *ciphertext_length)
24722526
{
2527+
psa_status_t status;
2528+
(void)status;
2529+
24732530
switch (PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime)) {
24742531
case PSA_KEY_LOCATION_LOCAL_STORAGE:
24752532
/* Add cases for transparent drivers here */
2533+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2534+
status = ironside_psa_key_encapsulate(
2535+
attributes, key, key_length, alg, output_attributes, output_key,
2536+
output_key_size, output_key_length, ciphertext, ciphertext_size,
2537+
ciphertext_length);
2538+
/* Declared with fallback == true */
2539+
if (status != PSA_ERROR_NOT_SUPPORTED) {
2540+
return status;
2541+
}
2542+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
24762543
#ifdef PSA_NEED_OBERON_KEY_ENCAPSULATION_DRIVER
24772544
return oberon_key_encapsulate(attributes, key, key_length, alg, output_attributes,
24782545
output_key, output_key_size, output_key_length,
@@ -2504,9 +2571,21 @@ psa_status_t psa_driver_wrapper_key_decapsulate(const psa_key_attributes_t *attr
25042571
uint8_t *output_key, size_t output_key_size,
25052572
size_t *output_key_length)
25062573
{
2574+
psa_status_t status;
2575+
(void)status;
2576+
25072577
switch (PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime)) {
25082578
case PSA_KEY_LOCATION_LOCAL_STORAGE:
25092579
/* Add cases for transparent drivers here */
2580+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2581+
status = ironside_psa_key_decapsulate(
2582+
attributes, key, key_length, alg, ciphertext, ciphertext_length,
2583+
output_attributes, output_key, output_key_size, output_key_length);
2584+
/* Declared with fallback == true */
2585+
if (status != PSA_ERROR_NOT_SUPPORTED) {
2586+
return status;
2587+
}
2588+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
25102589
#ifdef PSA_NEED_OBERON_KEY_ENCAPSULATION_DRIVER
25112590
return oberon_key_decapsulate(attributes, key, key_length, alg, ciphertext,
25122591
ciphertext_length, output_attributes, output_key,
@@ -2543,6 +2622,17 @@ psa_status_t psa_driver_wrapper_pake_setup(psa_pake_operation_t *operation,
25432622
switch (PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime)) {
25442623
case PSA_KEY_LOCATION_LOCAL_STORAGE:
25452624
/* Add cases for transparent drivers here */
2625+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2626+
status = ironside_psa_pake_setup(&operation->ctx.ironside_pake_ctx, attributes,
2627+
password, password_length, cipher_suite);
2628+
if (status == PSA_SUCCESS) {
2629+
operation->id = PSA_CRYPTO_IRONSIDE_DRIVER_ID;
2630+
}
2631+
if (status != PSA_ERROR_NOT_SUPPORTED) {
2632+
return status;
2633+
}
2634+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
2635+
25462636
#ifdef PSA_NEED_CRACEN_PAKE_DRIVER
25472637
status = cracen_pake_setup(&operation->ctx.cracen_pake_ctx, attributes, password,
25482638
password_length, cipher_suite);
@@ -2584,6 +2674,10 @@ psa_status_t psa_driver_wrapper_pake_set_role(psa_pake_operation_t *operation, p
25842674
case PSA_CRYPTO_CRACEN_DRIVER_ID:
25852675
return cracen_pake_set_role(&operation->ctx.cracen_pake_ctx, role);
25862676
#endif /* PSA_NEED_CRACEN_PAKE_DRIVER */
2677+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2678+
case PSA_CRYPTO_IRONSIDE_DRIVER_ID:
2679+
return ironside_psa_pake_set_role(&operation->ctx.ironside_pake_ctx, role);
2680+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
25872681
#ifdef PSA_NEED_OBERON_PAKE_DRIVER
25882682
case PSA_CRYPTO_OBERON_DRIVER_ID:
25892683
return oberon_pake_set_role(&operation->ctx.oberon_pake_ctx, role);
@@ -2604,6 +2698,11 @@ psa_status_t psa_driver_wrapper_pake_set_user(psa_pake_operation_t *operation,
26042698
return cracen_pake_set_user(&operation->ctx.cracen_pake_ctx, user_id,
26052699
user_id_length);
26062700
#endif /* PSA_NEED_CRACEN_PAKE_DRIVER */
2701+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2702+
case PSA_CRYPTO_IRONSIDE_DRIVER_ID:
2703+
return ironside_psa_pake_set_user(&operation->ctx.ironside_pake_ctx, user_id,
2704+
user_id_length);
2705+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
26072706
#ifdef PSA_NEED_OBERON_PAKE_DRIVER
26082707
case PSA_CRYPTO_OBERON_DRIVER_ID:
26092708
return oberon_pake_set_user(&operation->ctx.oberon_pake_ctx, user_id,
@@ -2626,6 +2725,11 @@ psa_status_t psa_driver_wrapper_pake_set_peer(psa_pake_operation_t *operation,
26262725
return cracen_pake_set_peer(&operation->ctx.cracen_pake_ctx, peer_id,
26272726
peer_id_length);
26282727
#endif
2728+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2729+
case PSA_CRYPTO_IRONSIDE_DRIVER_ID:
2730+
return ironside_psa_pake_set_peer(&operation->ctx.ironside_pake_ctx, peer_id,
2731+
peer_id_length);
2732+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
26292733
#ifdef PSA_NEED_OBERON_PAKE_DRIVER
26302734
case PSA_CRYPTO_OBERON_DRIVER_ID:
26312735
return oberon_pake_set_peer(&operation->ctx.oberon_pake_ctx, peer_id,
@@ -2648,6 +2752,11 @@ psa_status_t psa_driver_wrapper_pake_set_context(psa_pake_operation_t *operation
26482752
return cracen_pake_set_context(&operation->ctx.cracen_pake_ctx, context,
26492753
context_length);
26502754
#endif
2755+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2756+
case PSA_CRYPTO_IRONSIDE_DRIVER_ID:
2757+
return ironside_psa_pake_set_context(&operation->ctx.ironside_pake_ctx, context,
2758+
context_length);
2759+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
26512760
#ifdef PSA_NEED_OBERON_PAKE_DRIVER
26522761
case PSA_CRYPTO_OBERON_DRIVER_ID:
26532762
return oberon_pake_set_context(&operation->ctx.oberon_pake_ctx, context,
@@ -2671,6 +2780,11 @@ psa_status_t psa_driver_wrapper_pake_output(psa_pake_operation_t *operation, psa
26712780
return cracen_pake_output(&operation->ctx.cracen_pake_ctx, step, output,
26722781
output_size, output_length);
26732782
#endif
2783+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2784+
case PSA_CRYPTO_IRONSIDE_DRIVER_ID:
2785+
return ironside_psa_pake_output(&operation->ctx.ironside_pake_ctx, step, output,
2786+
output_size, output_length);
2787+
#endif
26742788
#ifdef PSA_NEED_OBERON_PAKE_DRIVER
26752789
case PSA_CRYPTO_OBERON_DRIVER_ID:
26762790
return oberon_pake_output(&operation->ctx.oberon_pake_ctx, step, output,
@@ -2695,6 +2809,11 @@ psa_status_t psa_driver_wrapper_pake_input(psa_pake_operation_t *operation, psa_
26952809
return cracen_pake_input(&operation->ctx.cracen_pake_ctx, step, input,
26962810
input_length);
26972811
#endif
2812+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2813+
case PSA_CRYPTO_IRONSIDE_DRIVER_ID:
2814+
return ironside_psa_pake_input(&operation->ctx.ironside_pake_ctx, step, input,
2815+
input_length);
2816+
#endif
26982817
#ifdef PSA_NEED_OBERON_PAKE_DRIVER
26992818
case PSA_CRYPTO_OBERON_DRIVER_ID:
27002819
return oberon_pake_input(&operation->ctx.oberon_pake_ctx, step, input,
@@ -2720,6 +2839,12 @@ psa_status_t psa_driver_wrapper_pake_get_shared_key(psa_pake_operation_t *operat
27202839
return cracen_pake_get_shared_key(&operation->ctx.cracen_pake_ctx, attributes,
27212840
key_buffer, key_buffer_size, key_buffer_length);
27222841
#endif
2842+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2843+
case PSA_CRYPTO_IRONSIDE_DRIVER_ID:
2844+
return ironside_psa_pake_get_shared_key(&operation->ctx.ironside_pake_ctx,
2845+
attributes, key_buffer, key_buffer_size,
2846+
key_buffer_length);
2847+
#endif
27232848
#ifdef PSA_NEED_OBERON_PAKE_DRIVER
27242849
case PSA_CRYPTO_OBERON_DRIVER_ID:
27252850
return oberon_pake_get_shared_key(&operation->ctx.oberon_pake_ctx, attributes,
@@ -2742,6 +2867,10 @@ psa_status_t psa_driver_wrapper_pake_abort(psa_pake_operation_t *operation)
27422867
case PSA_CRYPTO_CRACEN_DRIVER_ID:
27432868
return cracen_pake_abort(&operation->ctx.cracen_pake_ctx);
27442869
#endif
2870+
#ifdef PSA_CRYPTO_DRIVER_IRONSIDE
2871+
case PSA_CRYPTO_IRONSIDE_DRIVER_ID:
2872+
return ironside_psa_pake_abort(&operation->ctx.ironside_pake_ctx);
2873+
#endif /* PSA_CRYPTO_DRIVER_IRONSIDE */
27452874
#ifdef PSA_NEED_OBERON_PAKE_DRIVER
27462875
case PSA_CRYPTO_OBERON_DRIVER_ID:
27472876
return oberon_pake_abort(&operation->ctx.oberon_pake_ctx);
@@ -3051,6 +3180,10 @@ psa_status_t psa_driver_wrapper_destroy_builtin_key(const psa_key_attributes_t *
30513180
psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime);
30523181

30533182
switch (location) {
3183+
#if defined(PSA_CRYPTO_DRIVER_IRONSIDE)
3184+
case PSA_KEY_LOCATION_LOCAL_STORAGE:
3185+
return ironside_psa_destroy_builtin_key(attributes);
3186+
#endif
30543187
#if defined(PSA_NEED_CRACEN_KMU_DRIVER)
30553188
case PSA_KEY_LOCATION_CRACEN_KMU:
30563189
return cracen_destroy_key(attributes);

0 commit comments

Comments
 (0)