nrf_security: Avoid countermeasures for ChachaPoly in Cracen

There are no countermeasures for ChachaPoly in Cracen so
only call the relevant functions for CCM and GCM.

Signed-off-by: Georgios Vasilakis <[email protected]>

Author: Vge0rge

subsys/nrf_security/src/drivers/cracen/sxsymcrypt/include/sxsymcrypt/internal.h

@@ -93,6 +93,7 @@ struct sxaead {
 	size_t totalaadsz;
 	uint8_t tagsz;
 	bool is_in_ctx;
+	bool has_countermeasures;
 	uint8_t ctxsz;
 	const struct sxkeyref *key;
 	struct sx_dmactl dma;

subsys/nrf_security/src/drivers/cracen/sxsymcrypt/src/aead.c

@@ -108,16 +108,20 @@ int sx_aead_hw_reserve(struct sxaead *c)
 	int err = SX_OK;
 	uint32_t prng_value;
 
-	err = cracen_prng_value_from_pool(&prng_value);
-	if (err != SX_OK) {
-		return err;
+	if (c->has_countermeasures) {
+		err = cracen_prng_value_from_pool(&prng_value);
+		if (err != SX_OK) {
+			return err;
+		}
 	}
 
 	sx_hw_reserve(&c->dma);
 
-	err = sx_cm_load_mask(prng_value);
-	if (err != SX_OK) {
-		goto exit;
+	if (c->has_countermeasures) {
+		err = sx_cm_load_mask(prng_value);
+		if (err != SX_OK) {
+			goto exit;
+		}
 	}
 
 	if (c->key->prepare_key) {
@@ -149,6 +153,8 @@ static int sx_aead_create_aesgcm(struct sxaead *c, const struct sxkeyref *key, c
 		}
 	}
 
+	/* has countermeasures and the key need to be set before callling sx_aead_hw_reserve */
+	c->has_countermeasures = true;
 	c->key = key;
 	err = sx_aead_hw_reserve(c);
 	if (err != SX_OK) {
@@ -235,6 +241,8 @@ static int sx_aead_create_aesccm(struct sxaead *c, const struct sxkeyref *key, c
 		return SX_ERR_TOO_BIG;
 	}
 
+	/* has countermeasures and the key need to be set before callling sx_aead_hw_reserve */
+	c->has_countermeasures = true;
 	c->key = key;
 	err = sx_aead_hw_reserve(c);
 	if (err != SX_OK) {

subsys/nrf_security/src/drivers/cracen/sxsymcrypt/src/chachapoly.c

@@ -110,7 +110,8 @@ static int sx_aead_create_chacha20poly1305(struct sxaead *c, const struct sxkeyr
 		return SX_ERR_INVALID_KEY_SZ;
 	}
 
-	/* The context key need to be set before calling sx_aead_hw_reserve */
+	/* has countermeasures and the key need to be set before callling sx_aead_hw_reserve */
+	c->has_countermeasures = false;
 	c->key = key;
 	sx_aead_hw_reserve(c);