Skip to content

Commit ff5ff4a

Browse files
57300rlubos
57300
authored and
rlubos
committed
nrf_security: cracen: Remove CRACEN_PLATFORM_KEYS
This code has bit rotted and it will be replaced. Ref: NCSDK-33162 Signed-off-by: Grzegorz Swiderski <[email protected]>
1 parent 9385774 commit ff5ff4a

File tree

11 files changed

+1
-894
lines changed

11 files changed

+1
-894
lines changed

‎subsys/nrf_security/Kconfig‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,6 @@ endchoice
6666
config MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
6767
bool
6868
default y if HAS_HW_NRF_CRACEN && PSA_CRYPTO_DRIVER_CRACEN
69-
default y if PSA_WANT_PLATFORM_KEYS
7069
help
7170
Promptless option used to control if the PSA Crypto core should have support for builtin keys or not.
7271

‎subsys/nrf_security/cmake/psa_crypto_config.cmake‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,6 @@ kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_KEY_TYPE_RSA_KEY_PAIR_GENERATE
239239
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_KEY_MANAGEMENT_DRIVER)
240240
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_KMU_ENCRYPTED_KEYS)
241241
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_KMU_DRIVER)
242-
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_PLATFORM_KEYS)
243242

244243
# MAC driver configurations
245244
kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_HMAC)

‎subsys/nrf_security/configs/psa_crypto_config.h.template‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,6 @@
267267
#cmakedefine PSA_NEED_CRACEN_HASH_DRIVER @PSA_NEED_CRACEN_HASH_DRIVER@
268268
#cmakedefine PSA_NEED_CRACEN_KEY_MANAGEMENT_DRIVER @PSA_NEED_CRACEN_KEY_MANAGEMENT_DRIVER@
269269
#cmakedefine PSA_NEED_CRACEN_KMU_DRIVER @PSA_NEED_CRACEN_KMU_DRIVER@
270-
#cmakedefine PSA_NEED_CRACEN_PLATFORM_KEYS @PSA_NEED_CRACEN_PLATFORM_KEYS@
271270
#cmakedefine PSA_NEED_CRACEN_MAC_DRIVER @PSA_NEED_CRACEN_MAC_DRIVER@
272271
#cmakedefine PSA_NEED_CRACEN_PAKE_DRIVER @PSA_NEED_CRACEN_PAKE_DRIVER@
273272
#cmakedefine PSA_NEED_CRACEN_KEY_DERIVATION_DRIVER @PSA_NEED_CRACEN_KEY_DERIVATION_DRIVER@

‎subsys/nrf_security/src/drivers/Kconfig‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,6 @@ config PSA_CRYPTO_DRIVER_CRACEN
3636
help
3737
PSA crypto driver for the CRACEN HW peripheral.
3838

39-
config PSA_WANT_PLATFORM_KEYS
40-
bool
41-
help
42-
Hidden option if platform keys are supported.
43-
4439
menu "Choose DRBG algorithm"
4540
config PSA_WANT_ALG_CTR_DRBG
4641
prompt "CTR_DRBG"

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/cracenpsa.cmake‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -161,9 +161,3 @@ if(CONFIG_PSA_NEED_CRACEN_KEY_AGREEMENT_DRIVER OR CONFIG_PSA_NEED_CRACEN_KEY_DER
161161
${CMAKE_CURRENT_LIST_DIR}/src/key_derivation.c
162162
)
163163
endif()
164-
165-
if(CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS)
166-
list(APPEND cracen_driver_sources
167-
${CMAKE_CURRENT_LIST_DIR}/src/platform_keys/platform_keys.c
168-
)
169-
endif()

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/common.c‎

Lines changed: 0 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@
55
*/
66

77
#include "common.h"
8-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
9-
#include "platform_keys/platform_keys.h"
10-
#endif
118

129
#include <hal/nrf_cracen.h>
1310
#include <cracen/lib_kmu.h>
@@ -30,19 +27,10 @@
3027
#include "rsa_key.h"
3128

3229
LOG_MODULE_DECLARE(cracen, CONFIG_CRACEN_LOG_LEVEL);
33-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
34-
#include "platform_keys/platform_keys.h"
35-
#endif
3630

3731
#define NOT_ENABLED_CURVE (0)
3832
#define NOT_ENABLED_HASH_ALG (0)
3933

40-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
41-
/* Address from the IPS. May come from the MDK in the future. */
42-
#define DEVICE_SECRET_LENGTH 4
43-
#define DEVICE_SECRET_ADDRESS ((uint32_t *)0x0E001620)
44-
#endif
45-
4634
static const uint8_t RSA_ALGORITHM_IDENTIFIER[] = {0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
4735
0x0d, 0x01, 0x01, 0x01, 0x05, 0x00};
4836

@@ -689,51 +677,6 @@ int cracen_prepare_ik_key(const uint8_t *user_data)
689677

690678
__attribute__((unused)) struct sx_pk_config_ik cfg = {};
691679

692-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
693-
cfg.device_secret = DEVICE_SECRET_ADDRESS;
694-
cfg.device_secret_sz = DEVICE_SECRET_LENGTH;
695-
696-
switch (((uint32_t *)user_data)[0]) {
697-
/* Helper macro to set up an array containing the personalization string.
698-
* The array is a multiple of 4, since the IKG takes a number of uint32_t
699-
* as personalization string.
700-
*/
701-
#define SET_STR(x) \
702-
{ \
703-
static const char lstr_##x[((sizeof(#x) + 3) / 4) * 4] = #x; \
704-
cfg.key_bundle = (uint32_t *)lstr_##x; \
705-
cfg.key_bundle_sz = sizeof(lstr_##x) / sizeof(uint32_t); \
706-
}
707-
case DOMAIN_NONE:
708-
SET_STR(NONE0);
709-
break;
710-
case DOMAIN_SECURE:
711-
SET_STR(SECURE0);
712-
break;
713-
case DOMAIN_APPLICATION:
714-
SET_STR(APPLICATION0);
715-
break;
716-
case DOMAIN_RADIO:
717-
SET_STR(RADIOCORE0);
718-
break;
719-
case DOMAIN_CELL:
720-
SET_STR(CELL0);
721-
break;
722-
case DOMAIN_ISIM:
723-
SET_STR(ISIM0);
724-
break;
725-
case DOMAIN_WIFI:
726-
SET_STR(WIFI0);
727-
break;
728-
case DOMAIN_SYSCTRL:
729-
SET_STR(SYSCTRL0);
730-
break;
731-
732-
default:
733-
return SX_ERR_INVALID_KEYREF;
734-
}
735-
#endif
736-
737680
#ifdef CONFIG_CRACEN_IKG_PERSONALIZED_KEYS
738681
cfg.key_bundle = (const uint32_t *)user_data;
739682
cfg.key_bundle_sz = 1; /* size of the owner_id is one 32-bit word */
@@ -753,9 +696,6 @@ static int cracen_clean_ik_key(const uint8_t *user_data)
753696

754697
static bool cracen_is_ikg_key(const psa_key_attributes_t *attributes)
755698
{
756-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
757-
return cracen_platform_keys_is_ikg_key(attributes);
758-
#else
759699
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
760700
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
761701
case CRACEN_BUILTIN_MKEK_ID:
@@ -764,7 +704,6 @@ static bool cracen_is_ikg_key(const psa_key_attributes_t *attributes)
764704
default:
765705
return false;
766706
}
767-
#endif
768707
};
769708

770709
static psa_status_t cracen_load_ikg_keyref(const psa_key_attributes_t *attributes,
@@ -774,14 +713,6 @@ static psa_status_t cracen_load_ikg_keyref(const psa_key_attributes_t *attribute
774713
k->prepare_key = cracen_prepare_ik_key;
775714
k->clean_key = cracen_clean_ik_key;
776715

777-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
778-
if (key_buffer_size != sizeof(ikg_opaque_key)) {
779-
return PSA_ERROR_INVALID_ARGUMENT;
780-
}
781-
782-
k->cfg = ((ikg_opaque_key *)key_buffer)->slot_number;
783-
k->owner_id = ((ikg_opaque_key *)key_buffer)->owner_id;
784-
#else
785716
/* IKG keys are identified from the ID */
786717
(void)key_buffer;
787718
(void)key_buffer_size;
@@ -798,7 +729,6 @@ static psa_status_t cracen_load_ikg_keyref(const psa_key_attributes_t *attribute
798729
};
799730

800731
k->owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(psa_get_key_id(attributes));
801-
#endif
802732
k->user_data = (uint8_t *)&k->owner_id;
803733
return PSA_SUCCESS;
804734
}
@@ -878,9 +808,6 @@ psa_status_t cracen_load_keyref(const psa_key_attributes_t *attributes, const ui
878808
static psa_status_t cracen_get_ikg_opaque_key_size(const psa_key_attributes_t *attributes,
879809
size_t *key_size)
880810
{
881-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
882-
return cracen_platform_keys_get_size(attributes, key_size);
883-
#else
884811
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
885812
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
886813
if (psa_get_key_type(attributes) ==
@@ -899,7 +826,6 @@ static psa_status_t cracen_get_ikg_opaque_key_size(const psa_key_attributes_t *a
899826
}
900827

901828
return PSA_ERROR_INVALID_ARGUMENT;
902-
#endif /* PSA_NEED_CRACEN_PLATFORM_KEYS */
903829
}
904830

905831
psa_status_t cracen_get_opaque_size(const psa_key_attributes_t *attributes, size_t *key_size)

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c‎

Lines changed: 0 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
#include <cracen_psa_montgomery.h>
1515
#include <cracen_psa_ikg.h>
1616
#include <cracen_psa_rsa_keygen.h>
17-
#include "platform_keys/platform_keys.h"
1817
#include <nrf_security_mutexes.h>
1918
#include "ecc.h"
2019
#include <silexpk/sxops/rsa.h>
@@ -989,35 +988,6 @@ psa_status_t cracen_import_key(const psa_key_attributes_t *attributes, const uin
989988
return status;
990989
}
991990
#endif
992-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
993-
if (location == PSA_KEY_LOCATION_CRACEN) {
994-
psa_key_lifetime_t lifetime;
995-
psa_drv_slot_number_t slot_id;
996-
psa_key_attributes_t stored_attributes;
997-
psa_status_t status = cracen_platform_keys_provision(attributes, data, data_length);
998-
999-
if (status != PSA_SUCCESS) {
1000-
return status;
1001-
}
1002-
status = cracen_platform_get_key_slot(psa_get_key_id(attributes), &lifetime,
1003-
&slot_id);
1004-
1005-
if (status != PSA_SUCCESS) {
1006-
return status;
1007-
}
1008-
1009-
status = cracen_platform_get_builtin_key(slot_id, &stored_attributes, key_buffer,
1010-
key_buffer_size, key_buffer_length);
1011-
1012-
if (status != PSA_SUCCESS) {
1013-
return status;
1014-
}
1015-
1016-
*key_bits = psa_get_key_bits(&stored_attributes);
1017-
1018-
return status;
1019-
}
1020-
#endif
1021991

1022992
if (location != PSA_KEY_LOCATION_LOCAL_STORAGE) {
1023993
return PSA_ERROR_NOT_SUPPORTED;
@@ -1374,9 +1344,6 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
13741344
#ifdef PSA_NEED_CRACEN_KMU_DRIVER
13751345
return cracen_kmu_get_builtin_key(slot_number, attributes, key_buffer,
13761346
key_buffer_size, key_buffer_length);
1377-
#elif PSA_NEED_CRACEN_PLATFORM_KEYS
1378-
return cracen_platform_get_builtin_key(slot_number, attributes, key_buffer,
1379-
key_buffer_size, key_buffer_length);
13801347
#else
13811348
return PSA_ERROR_DOES_NOT_EXIST;
13821349
#endif
@@ -1387,17 +1354,6 @@ psa_status_t mbedtls_psa_platform_get_builtin_key(mbedtls_svc_key_id_t key_id,
13871354
psa_key_lifetime_t *lifetime,
13881355
psa_drv_slot_number_t *slot_number)
13891356
{
1390-
/* For nRF54H20 devices all the builtin keys are considered platform keys,
1391-
* these include the IKG keys. The IKG keys in these devices don't directly
1392-
* use the CRACEN_BUILTIN_ ids, they use the IDs defined in the file
1393-
* nrf_platform_key_ids.h.
1394-
* The function cracen_platform_get_key_slot will do the matching between the
1395-
* platform key ids and the Cracen bulitin ids.
1396-
*/
1397-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
1398-
return cracen_platform_get_key_slot(key_id, lifetime, slot_number);
1399-
#else
1400-
14011357
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key_id)) {
14021358
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
14031359
*slot_number = CRACEN_BUILTIN_IDENTITY_KEY_ID;
@@ -1420,7 +1376,6 @@ psa_status_t mbedtls_psa_platform_get_builtin_key(mbedtls_svc_key_id_t key_id,
14201376
PSA_KEY_LOCATION_CRACEN);
14211377

14221378
return PSA_SUCCESS;
1423-
#endif /* PSA_NEED_CRACEN_PLATFORM_KEYS */
14241379
}
14251380

14261381
psa_status_t cracen_export_key(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
@@ -1537,9 +1492,6 @@ psa_status_t cracen_destroy_key(const psa_key_attributes_t *attributes)
15371492
#ifdef PSA_NEED_CRACEN_KMU_DRIVER
15381493
return cracen_kmu_destroy_key(attributes);
15391494
#endif
1540-
#ifdef PSA_NEED_CRACEN_PLATFORM_KEYS
1541-
return cracen_platform_destroy_key(attributes);
1542-
#endif
15431495

15441496
return PSA_ERROR_DOES_NOT_EXIST;
15451497
}

0 commit comments

Comments
 (0)