Skip to content

Commit d4e4d8a

Browse files
AntonZmanordicjm
AntonZma
authored and
nordicjm
committed
nrf_security: CRACEN: Changed PSA_WANT_ to PSA_NEED_CRACEN_ for KMU
All CONFIG_PSA_WANT_ALG_ use cases exchanged with PSA_NEED_CRACEN_ configs. Added new config: PSA_NEED_CRACEN_ECDH. Signed-off-by: Anton Zyma <[email protected]>
1 parent b6138a7 commit d4e4d8a

File tree

4 files changed

+72
-60
lines changed

4 files changed

+72
-60
lines changed

‎subsys/nrf_security/cmake/psa_crypto_config.cmake‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_RSA_PSS)
6767
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_ANY_ECC)
6868
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_ANY_RSA)
6969
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_DRIVER)
70+
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ECDH)
7071
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_RSA_OAEP)
7172
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_RSA_PKCS1V15_CRYPT)
7273
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ASYMMETRIC_ENCRYPTION_DRIVER)

‎subsys/nrf_security/configs/psa_crypto_config.h.template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,7 @@
301301
#cmakedefine PSA_NEED_CRACEN_ECDH_SECP_K1_192 @PSA_NEED_CRACEN_ECDH_SECP_K1_192@
302302
#cmakedefine PSA_NEED_CRACEN_ECDH_SECP_K1_256 @PSA_NEED_CRACEN_ECDH_SECP_K1_256@
303303
#cmakedefine PSA_NEED_CRACEN_ECDH_SECP_K1 @PSA_NEED_CRACEN_ECDH_SECP_K1@
304+
#cmakedefine PSA_NEED_CRACEN_ECDH @PSA_NEED_CRACEN_ECDH@
304305
#cmakedefine PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_ANY_RSA @PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_ANY_RSA@
305306
#cmakedefine PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_ANY_ECC @PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_ANY_ECC@
306307
#cmakedefine PSA_NEED_CRACEN_ECDSA_BRAINPOOL_P_R1_192 @PSA_NEED_CRACEN_ECDSA_BRAINPOOL_P_R1_192@

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c‎

Lines changed: 62 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -364,21 +364,23 @@ static psa_status_t get_kmu_slot_id_and_metadata(mbedtls_svc_key_id_t key_id,
364364
return read_primary_slot_metadata(*slot_id, metadata);
365365
}
366366

367-
#if defined(CONFIG_PSA_WANT_ALG_PURE_EDDSA) || defined(CONFIG_PSA_WANT_ALG_ED25519PH) || \
368-
defined CONFIG_PSA_WANT_ALG_ECDSA || defined(CONFIG_PSA_WANT_ALG_HMAC)
367+
#if defined(PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS) || \
368+
defined(PSA_NEED_CRACEN_ED25519PH) || \
369+
defined(PSA_NEED_CRACEN_ECDSA) || \
370+
defined(PSA_NEED_CRACEN_HMAC)
369371
static bool can_sign(const psa_key_attributes_t *key_attr)
370372
{
371373
return (psa_get_key_usage_flags(key_attr) & PSA_KEY_USAGE_SIGN_MESSAGE) ||
372374
(psa_get_key_usage_flags(key_attr) & PSA_KEY_USAGE_SIGN_HASH);
373375
}
374-
#endif /* defined(CONFIG_PSA_WANT_ALG_PURE_EDDSA) || define(CONFIG_PSA_WANT_ALG_ED25519PH) */
376+
#endif
375377

376-
#if defined(CONFIG_PSA_WANT_ALG_ECDH)
378+
#if defined(PSA_NEED_CRACEN_ECDH)
377379
static bool can_derive(const psa_key_attributes_t *key_attr)
378380
{
379381
return psa_get_key_usage_flags(key_attr) & PSA_KEY_USAGE_DERIVE;
380382
}
381-
#endif
383+
#endif /* PSA_NEED_CRACEN_ECDH */
382384

383385
/**
384386
* @brief Check provisioning state, and delete slots that were not completely provisioned.
@@ -598,61 +600,61 @@ static psa_status_t convert_to_psa_attributes(kmu_metadata *metadata,
598600
psa_set_key_usage_flags(key_attr, usage_flags);
599601

600602
switch (metadata->algorithm) {
601-
#ifdef CONFIG_PSA_WANT_ALG_STREAM_CIPHER
603+
#ifdef PSA_NEED_CRACEN_STREAM_CIPHER_CHACHA20
602604
case METADATA_ALG_CHACHA20:
603605
psa_set_key_type(key_attr, PSA_KEY_TYPE_CHACHA20);
604606
psa_set_key_algorithm(key_attr, PSA_ALG_STREAM_CIPHER);
605607
break;
606-
#endif
607-
#ifdef CONFIG_PSA_WANT_ALG_CHACHA20_POLY1305
608+
#endif /* PSA_NEED_CRACEN_STREAM_CIPHER_CHACHA20 */
609+
#ifdef PSA_NEED_CRACEN_CHACHA20_POLY1305
608610
case METADATA_ALG_CHACHA20_POLY1305:
609611
psa_set_key_type(key_attr, PSA_KEY_TYPE_CHACHA20);
610612
psa_set_key_algorithm(key_attr, PSA_ALG_CHACHA20_POLY1305);
611613
break;
612-
#endif
613-
#ifdef CONFIG_PSA_WANT_ALG_GCM
614+
#endif /* PSA_NEED_CRACEN_CHACHA20_POLY1305 */
615+
#ifdef PSA_NEED_CRACEN_GCM_AES
614616
case METADATA_ALG_AES_GCM:
615617
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
616618
psa_set_key_algorithm(key_attr, PSA_ALG_GCM);
617619
break;
618-
#endif
619-
#ifdef CONFIG_PSA_WANT_ALG_CCM
620+
#endif /* PSA_NEED_CRACEN_GCM_AES */
621+
#ifdef PSA_NEED_CRACEN_CCM_AES
620622
case METADATA_ALG_AES_CCM:
621623
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
622624
psa_set_key_algorithm(key_attr, PSA_ALG_CCM);
623625
break;
624-
#endif
625-
#ifdef CONFIG_PSA_WANT_ALG_ECB_NO_PADDING
626+
#endif /* PSA_NEED_CRACEN_CCM_AES */
627+
#ifdef PSA_NEED_CRACEN_ECB_NO_PADDING_AES
626628
case METADATA_ALG_AES_ECB:
627629
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
628630
psa_set_key_algorithm(key_attr, PSA_ALG_ECB_NO_PADDING);
629631
break;
630-
#endif
631-
#ifdef CONFIG_PSA_WANT_ALG_CTR
632+
#endif /* PSA_NEED_CRACEN_ECB_NO_PADDING_AES */
633+
#ifdef PSA_NEED_CRACEN_CTR_AES
632634
case METADATA_ALG_AES_CTR:
633635
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
634636
psa_set_key_algorithm(key_attr, PSA_ALG_CTR);
635637
break;
636-
#endif
637-
#ifdef CONFIG_PSA_WANT_ALG_CBC_NO_PADDING
638+
#endif /* PSA_NEED_CRACEN_CTR_AES */
639+
#ifdef PSA_NEED_CRACEN_CBC_NO_PADDING_AES
638640
case METADATA_ALG_AES_CBC:
639641
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
640642
psa_set_key_algorithm(key_attr, PSA_ALG_CBC_NO_PADDING);
641643
break;
642-
#endif
643-
#ifdef CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_CMAC
644+
#endif /* PSA_NEED_CRACEN_CBC_NO_PADDING_AES */
645+
#ifdef PSA_NEED_CRACEN_SP800_108_COUNTER_CMAC
644646
case METADATA_ALG_SP800_108_COUNTER_CMAC:
645647
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
646648
psa_set_key_algorithm(key_attr, PSA_ALG_SP800_108_COUNTER_CMAC);
647649
break;
648-
#endif
649-
#ifdef CONFIG_PSA_WANT_ALG_CMAC
650+
#endif /* PSA_NEED_CRACEN_SP800_108_COUNTER_CMAC */
651+
#ifdef PSA_NEED_CRACEN_CMAC
650652
case METADATA_ALG_CMAC:
651653
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
652654
psa_set_key_algorithm(key_attr, PSA_ALG_CMAC);
653655
break;
654-
#endif
655-
#ifdef CONFIG_PSA_WANT_ALG_PURE_EDDSA
656+
#endif /* PSA_NEED_CRACEN_CMAC */
657+
#ifdef PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS
656658
case METADATA_ALG_ED25519:
657659
/* If the key can sign it is assumed it is a private key */
658660
psa_set_key_type(
@@ -662,8 +664,8 @@ static psa_status_t convert_to_psa_attributes(kmu_metadata *metadata,
662664
: PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS));
663665
psa_set_key_algorithm(key_attr, PSA_ALG_PURE_EDDSA);
664666
break;
665-
#endif
666-
#ifdef CONFIG_PSA_WANT_ALG_ED25519PH
667+
#endif /* PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS */
668+
#ifdef PSA_NEED_CRACEN_ED25519PH
667669
case METADATA_ALG_ED25519PH:
668670
/* If the key can sign it is assumed it is a private key */
669671
psa_set_key_type(
@@ -673,23 +675,23 @@ static psa_status_t convert_to_psa_attributes(kmu_metadata *metadata,
673675
: PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS));
674676
psa_set_key_algorithm(key_attr, PSA_ALG_ED25519PH);
675677
break;
676-
#endif
677-
#ifdef CONFIG_PSA_WANT_ALG_ECDSA
678+
#endif /* PSA_NEED_CRACEN_ED25519PH */
679+
#ifdef PSA_NEED_CRACEN_ECDSA
678680
case METADATA_ALG_ECDSA:
679681
psa_set_key_type(key_attr,
680682
can_sign(key_attr)
681683
? PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)
682684
: PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_SECP_R1));
683685
psa_set_key_algorithm(key_attr, PSA_ALG_ECDSA(PSA_ALG_ANY_HASH));
684686
break;
685-
#endif
686-
#ifdef CONFIG_PSA_WANT_ALG_HMAC
687+
#endif /* PSA_NEED_CRACEN_ECDSA */
688+
#ifdef PSA_NEED_CRACEN_HMAC
687689
case METADATA_ALG_HMAC:
688690
psa_set_key_type(key_attr, PSA_KEY_TYPE_HMAC);
689691
psa_set_key_algorithm(key_attr, PSA_ALG_HMAC(PSA_ALG_SHA_256));
690692
break;
691-
#endif
692-
#ifdef CONFIG_PSA_WANT_ALG_ECDH
693+
#endif /* PSA_NEED_CRACEN_HMAC */
694+
#ifdef PSA_NEED_CRACEN_ECDH
693695
case METADATA_ALG_ECDH:
694696
psa_set_key_type(key_attr, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1));
695697
psa_set_key_algorithm(key_attr, PSA_ALG_ECDH);
@@ -770,80 +772,80 @@ static psa_status_t convert_from_psa_attributes(const psa_key_attributes_t *key_
770772
}
771773

772774
switch (psa_get_key_algorithm(key_attr)) {
773-
#ifdef CONFIG_PSA_WANT_ALG_STREAM_CIPHER
775+
#ifdef PSA_NEED_CRACEN_STREAM_CIPHER_CHACHA20
774776
case PSA_ALG_STREAM_CIPHER:
775777
metadata->algorithm = METADATA_ALG_CHACHA20;
776778
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_CHACHA20) {
777779
return PSA_ERROR_NOT_SUPPORTED;
778780
}
779781
break;
780-
#endif
781-
#ifdef CONFIG_PSA_WANT_ALG_CHACHA20_POLY1305
782+
#endif /* PSA_NEED_CRACEN_STREAM_CIPHER_CHACHA20 */
783+
#ifdef PSA_NEED_CRACEN_CHACHA20_POLY1305
782784
case PSA_ALG_CHACHA20_POLY1305:
783785
metadata->algorithm = METADATA_ALG_CHACHA20_POLY1305;
784786
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_CHACHA20) {
785787
return PSA_ERROR_NOT_SUPPORTED;
786788
}
787789
break;
788-
#endif
789-
#ifdef CONFIG_PSA_WANT_ALG_GCM
790+
#endif /* PSA_NEED_CRACEN_CHACHA20_POLY1305 */
791+
#ifdef PSA_NEED_CRACEN_GCM_AES
790792
case PSA_ALG_GCM:
791793
metadata->algorithm = METADATA_ALG_AES_GCM;
792794
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
793795
return PSA_ERROR_NOT_SUPPORTED;
794796
}
795797
break;
796-
#endif
797-
#ifdef CONFIG_PSA_WANT_ALG_CCM
798+
#endif /* PSA_NEED_CRACEN_GCM_AES */
799+
#ifdef PSA_NEED_CRACEN_CCM_AES
798800
case PSA_ALG_CCM:
799801
metadata->algorithm = METADATA_ALG_AES_CCM;
800802
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
801803
return PSA_ERROR_NOT_SUPPORTED;
802804
}
803805
break;
804-
#endif
805-
#ifdef CONFIG_PSA_WANT_ALG_ECB_NO_PADDING
806+
#endif /* PSA_NEED_CRACEN_CCM_AES */
807+
#ifdef PSA_NEED_CRACEN_ECB_NO_PADDING_AES
806808
case PSA_ALG_ECB_NO_PADDING:
807809
metadata->algorithm = METADATA_ALG_AES_ECB;
808810
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
809811
return PSA_ERROR_NOT_SUPPORTED;
810812
}
811813
break;
812-
#endif
813-
#ifdef CONFIG_PSA_WANT_ALG_CTR
814+
#endif /* PSA_NEED_CRACEN_ECB_NO_PADDING_AES */
815+
#ifdef PSA_NEED_CRACEN_CTR_AES
814816
case PSA_ALG_CTR:
815817
metadata->algorithm = METADATA_ALG_AES_CTR;
816818
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
817819
return PSA_ERROR_NOT_SUPPORTED;
818820
}
819821
break;
820-
#endif
821-
#ifdef CONFIG_PSA_WANT_ALG_CBC_NO_PADDING
822+
#endif /* PSA_NEED_CRACEN_CTR_AES */
823+
#ifdef PSA_NEED_CRACEN_CBC_NO_PADDING_AES
822824
case PSA_ALG_CBC_NO_PADDING:
823825
metadata->algorithm = METADATA_ALG_AES_CBC;
824826
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
825827
return PSA_ERROR_NOT_SUPPORTED;
826828
}
827829
break;
828-
#endif
829-
#ifdef CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_CMAC
830+
#endif /* PSA_NEED_CRACEN_CBC_NO_PADDING_AES */
831+
#ifdef PSA_NEED_CRACEN_SP800_108_COUNTER_CMAC
830832
case PSA_ALG_SP800_108_COUNTER_CMAC:
831833
metadata->algorithm = METADATA_ALG_SP800_108_COUNTER_CMAC;
832834
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
833835
return PSA_ERROR_NOT_SUPPORTED;
834836
}
835837
break;
836-
#endif
837-
#ifdef CONFIG_PSA_WANT_ALG_CMAC
838+
#endif /* PSA_NEED_CRACEN_SP800_108_COUNTER_CMAC */
839+
#ifdef PSA_NEED_CRACEN_CMAC
838840
case PSA_ALG_CMAC:
839841
metadata->algorithm = METADATA_ALG_CMAC;
840842
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
841843
return PSA_ERROR_NOT_SUPPORTED;
842844
}
843845
break;
844846

845-
#endif
846-
#ifdef CONFIG_PSA_WANT_ALG_ED25519PH
847+
#endif /* PSA_NEED_CRACEN_CMAC */
848+
#ifdef PSA_NEED_CRACEN_ED25519PH
847849
case PSA_ALG_ED25519PH:
848850
if (PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(key_attr)) !=
849851
PSA_ECC_FAMILY_TWISTED_EDWARDS) {
@@ -856,8 +858,8 @@ static psa_status_t convert_from_psa_attributes(const psa_key_attributes_t *key_
856858
}
857859
metadata->algorithm = METADATA_ALG_ED25519PH;
858860
break;
859-
#endif
860-
#ifdef CONFIG_PSA_WANT_ALG_PURE_EDDSA
861+
#endif /* PSA_NEED_CRACEN_ED25519PH */
862+
#ifdef PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS
861863
case PSA_ALG_PURE_EDDSA:
862864
if (PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(key_attr)) !=
863865
PSA_ECC_FAMILY_TWISTED_EDWARDS) {
@@ -870,8 +872,8 @@ static psa_status_t convert_from_psa_attributes(const psa_key_attributes_t *key_
870872
}
871873
metadata->algorithm = METADATA_ALG_ED25519;
872874
break;
873-
#endif
874-
#ifdef CONFIG_PSA_WANT_ALG_ECDSA
875+
#endif /* PSA_NEED_CRACEN_PURE_EDDSA_TWISTED_EDWARDS */
876+
#ifdef PSA_NEED_CRACEN_ECDSA
875877
case PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):
876878
case PSA_ALG_ECDSA(PSA_ALG_SHA_256):
877879
if (PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(key_attr)) !=
@@ -886,24 +888,24 @@ static psa_status_t convert_from_psa_attributes(const psa_key_attributes_t *key_
886888
}
887889
metadata->algorithm = METADATA_ALG_ECDSA;
888890
break;
889-
#endif
890-
#ifdef CONFIG_PSA_WANT_ALG_HMAC
891+
#endif /* PSA_NEED_CRACEN_ECDSA */
892+
#ifdef PSA_NEED_CRACEN_HMAC
891893
case PSA_ALG_HMAC(PSA_ALG_SHA_256):
892894
if (!can_sign(key_attr) && PSA_ALG_IS_HMAC(psa_get_key_type(key_attr))) {
893895
return PSA_ERROR_NOT_SUPPORTED;
894896
}
895897
metadata->algorithm = METADATA_ALG_HMAC;
896898
break;
897-
#endif
898-
#ifdef CONFIG_PSA_WANT_ALG_ECDH
899+
#endif /* PSA_NEED_CRACEN_HMAC */
900+
#ifdef PSA_NEED_CRACEN_ECDH
899901
case PSA_ALG_ECDH:
900902
if (!can_derive(key_attr) || PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(
901903
key_attr)) != PSA_ECC_FAMILY_SECP_R1) {
902904
return PSA_ERROR_NOT_SUPPORTED;
903905
}
904906
metadata->algorithm = METADATA_ALG_ECDH;
905907
break;
906-
#endif
908+
#endif /* PSA_NEED_CRACEN_ECDH */
907909
default:
908910
/* Ignore the algorithm for the protected ram invalidation kmu slot because
909911
* it will never be used for crypto operations.

‎subsys/nrf_security/src/drivers/cracen/psa_driver.Kconfig‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,14 @@ config PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_DRIVER
460460
depends on PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_ANY_ECC || \
461461
PSA_NEED_CRACEN_ASYMMETRIC_SIGNATURE_ANY_RSA
462462

463+
config PSA_NEED_CRACEN_ECDH
464+
bool
465+
default y
466+
depends on PSA_NEED_CRACEN_ECDH_BRAINPOOL_P_R1 || \
467+
PSA_NEED_CRACEN_ECDH_SECP_R1 || \
468+
PSA_NEED_CRACEN_ECDH_MONTGOMERY || \
469+
PSA_NEED_CRACEN_ECDH_SECP_K1
470+
463471
# CRACEN Asymmetric Encryption Driver
464472

465473
config PSA_NEED_CRACEN_RSA_OAEP

0 commit comments

Comments
 (0)