Skip to content

Commit 7880b16

Browse files
tomi-fontjfischer-no
tomi-font
authored and
jfischer-no
committed
[nrf fromlist] modules: mbedtls: make key exchange Kconfigs depend on, not select
Turn the MBEDTLS_RSA_FULL selects into depends on. This is how the other MBEDTLS_KEY_EXCHANGE_* Kconfig options are defined. This is done to avoid circular dependencies. At the same time update uses of the affected MBEDTLS_KEY_EXCHANGE_* Kconfig options to enable/disable the dependencies which used to be automatically handled. Upstream PR #: 89200 Signed-off-by: Tomi Fontanilles <[email protected]> (cherry picked from commit deacfa35eb7bd9d2731ef7f16aedc9b14d1cc3b7)
1 parent d51fcf9 commit 7880b16

File tree

9 files changed

+45
-18
lines changed

9 files changed

+45
-18
lines changed

‎modules/hostap/Kconfig‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,9 @@ config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
145145
select MBEDTLS_ECDH_C
146146
select MBEDTLS_ECDSA_C
147147
select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
148+
select MBEDTLS_RSA_C
149+
select MBEDTLS_PKCS1_V15
150+
select MBEDTLS_PKCS1_V21
148151
select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
149152
select MBEDTLS_NIST_KW_C
150153
select MBEDTLS_DHM_C

‎modules/mbedtls/Kconfig.mbedtls‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -50,30 +50,35 @@ comment "Supported key exchange modes"
5050

5151
config MBEDTLS_RSA_C
5252
bool "RSA base support"
53+
default y if UOSCORE || UEDHOC
5354

5455
if MBEDTLS_RSA_C
5556

5657
config MBEDTLS_PKCS1_V15
5758
bool "RSA PKCS1 v1.5"
59+
default y if UOSCORE || UEDHOC
5860

5961
config MBEDTLS_PKCS1_V21
6062
bool "RSA PKCS1 v2.1"
63+
default y if UOSCORE || UEDHOC
6164

6265
config MBEDTLS_GENPRIME_ENABLED
6366
bool "Prime number generation code"
6467

6568
endif # MBEDTLS_RSA_C
6669

6770
config MBEDTLS_RSA_FULL
68-
bool
69-
select MBEDTLS_RSA_C
70-
select MBEDTLS_PKCS1_V15
71-
select MBEDTLS_PKCS1_V21
71+
def_bool y
72+
depends on MBEDTLS_RSA_C && MBEDTLS_PKCS1_V15 && MBEDTLS_PKCS1_V21
7273

7374
if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
7475

7576
config MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
7677
bool "All available ciphersuite modes"
78+
select MBEDTLS_MD
79+
select MBEDTLS_RSA_C
80+
select MBEDTLS_PKCS1_V15
81+
select MBEDTLS_PKCS1_V21
7782
select MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
7883
select MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
7984
select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
@@ -98,7 +103,7 @@ config MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
98103

99104
config MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
100105
bool "RSA-PSK based ciphersuite modes"
101-
select MBEDTLS_RSA_FULL
106+
depends on MBEDTLS_RSA_FULL
102107

103108
endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
104109

@@ -114,8 +119,8 @@ if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
114119
config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
115120
bool "RSA-only based ciphersuite modes"
116121
default y if UOSCORE || UEDHOC
117-
select MBEDTLS_MD
118-
select MBEDTLS_RSA_FULL
122+
depends on MBEDTLS_MD
123+
depends on MBEDTLS_RSA_FULL
119124
select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY if PSA_CRYPTO_CLIENT
120125
select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT if PSA_CRYPTO_CLIENT
121126
select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT if PSA_CRYPTO_CLIENT
@@ -124,16 +129,16 @@ config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
124129

125130
config MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
126131
bool "DHE-RSA based ciphersuite modes"
127-
select MBEDTLS_RSA_FULL
132+
depends on MBEDTLS_RSA_FULL
128133

129134
config MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
130135
bool "ECDHE-RSA based ciphersuite modes"
131-
select MBEDTLS_RSA_FULL
136+
depends on MBEDTLS_RSA_FULL
132137
depends on MBEDTLS_ECDH_C
133138

134139
config MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
135140
bool "ECDHE-ECDSA based ciphersuite modes"
136-
depends on MBEDTLS_ECDH_C && MBEDTLS_ECDSA_C || (PSA_WANT_ALG_ECDH && PSA_WANT_ALG_ECDSA)
141+
depends on (MBEDTLS_ECDH_C && MBEDTLS_ECDSA_C) || (PSA_WANT_ALG_ECDH && PSA_WANT_ALG_ECDSA)
137142

138143
config MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
139144
bool "ECDH-ECDSA based ciphersuite modes"
@@ -272,15 +277,13 @@ config MBEDTLS_CIPHER_ALL_ENABLED
272277
select MBEDTLS_CHACHAPOLY_AEAD_ENABLED
273278

274279
config MBEDTLS_SOME_AEAD_CIPHER_ENABLED
275-
bool
276-
default y
280+
def_bool y
277281
depends on \
278282
MBEDTLS_CIPHER_AES_ENABLED || \
279283
MBEDTLS_CIPHER_CAMELLIA_ENABLED
280284

281285
config MBEDTLS_SOME_CIPHER_ENABLED
282-
bool
283-
default y
286+
def_bool y
284287
depends on \
285288
MBEDTLS_SOME_AEAD_CIPHER_ENABLED || \
286289
MBEDTLS_CIPHER_DES_ENABLED || \
@@ -423,6 +426,7 @@ if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
423426

424427
config MBEDTLS_MD
425428
bool "generic message digest layer."
429+
default y if UOSCORE || UEDHOC
426430

427431
endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
428432

@@ -634,8 +638,7 @@ config MBEDTLS_USE_PSA_CRYPTO
634638
"intermediate" modules such as PK, MD and Cipher.
635639

636640
config MBEDTLS_PSA_CRYPTO_CLIENT
637-
bool
638-
default y
641+
def_bool y
639642
depends on BUILD_WITH_TFM || MBEDTLS_PSA_CRYPTO_C
640643
select PSA_CRYPTO_CLIENT
641644

‎samples/net/cloud/mqtt_azure/prj.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=10240
3535
CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT=y
3636
CONFIG_MBEDTLS_SHA1=y
3737
CONFIG_MBEDTLS_SHA384=y
38+
CONFIG_MBEDTLS_RSA_C=y
39+
CONFIG_MBEDTLS_PKCS1_V15=y
40+
CONFIG_MBEDTLS_PKCS1_V21=y
3841
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y
3942
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED=y
4043
CONFIG_MBEDTLS_ECDH_C=y

‎samples/tfm_integration/psa_crypto/prj.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ CONFIG_MBEDTLS_ENTROPY_C=y
3939
CONFIG_MBEDTLS_ECP_C=y
4040
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED=y
4141
CONFIG_MBEDTLS_ECDSA_C=y
42+
CONFIG_MBEDTLS_MD=y
43+
CONFIG_MBEDTLS_RSA_C=y
44+
CONFIG_MBEDTLS_PKCS1_V15=y
45+
CONFIG_MBEDTLS_PKCS1_V21=y
4246
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
4347
CONFIG_MBEDTLS_PK_WRITE_C=y
4448

‎subsys/jwt/Kconfig‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ config JWT_SIGN_RSA_LEGACY
2020
bool "Use RSA signature (RS-256). Use Mbed TLS as crypto library."
2121
depends on CSPRNG_AVAILABLE
2222
select MBEDTLS
23+
select MBEDTLS_MD
24+
select MBEDTLS_RSA_C
25+
select MBEDTLS_PKCS1_V15
26+
select MBEDTLS_PKCS1_V21
2327
select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
2428

2529
config JWT_SIGN_RSA_PSA

‎subsys/net/lib/sockets/Kconfig‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,10 @@ config NET_SOCKETS_SOCKOPT_TLS
116116
imply TLS_CREDENTIALS
117117
select MBEDTLS if NET_NATIVE
118118
imply MBEDTLS_TLS_VERSION_1_2 if !NET_L2_OPENTHREAD
119+
imply MBEDTLS_MD if !NET_L2_OPENTHREAD
120+
imply MBEDTLS_RSA_C if !NET_L2_OPENTHREAD
121+
imply MBEDTLS_PKCS1_V15 if !NET_L2_OPENTHREAD
122+
imply MBEDTLS_PKCS1_V21 if !NET_L2_OPENTHREAD
119123
imply MBEDTLS_KEY_EXCHANGE_RSA_ENABLED if !NET_L2_OPENTHREAD
120124
imply MBEDTLS_CIPHER_AES_ENABLED if !NET_L2_OPENTHREAD
121125
imply PSA_WANT_KEY_TYPE_AES if !NET_L2_OPENTHREAD && PSA_CRYPTO_CLIENT

‎tests/net/lib/lwm2m/interop/prj.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ CONFIG_MBEDTLS_HEAP_SIZE=7168
8282
CONFIG_MBEDTLS_CIPHER_AES_ENABLED=y
8383
CONFIG_MBEDTLS_CIPHER_CCM_ENABLED=y
8484
# Disable RSA, we don't parse certs: saves flash/memory
85-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=n
85+
CONFIG_MBEDTLS_RSA_C=n
8686
# Enable PSK instead
8787
CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=y
8888
CONFIG_LWM2M_SECURITY_DTLS_TLS_CIPHERSUITE_MAX=3

‎tests/net/socket/tls_configurations/overlay-rsa.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
CONFIG_MBEDTLS_MD=y
2+
CONFIG_MBEDTLS_RSA_C=y
3+
CONFIG_MBEDTLS_PKCS1_V15=y
4+
CONFIG_MBEDTLS_PKCS1_V21=y
5+
16
CONFIG_PSA_WANT_ALG_RSA_OAEP=y
27
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT=y
38
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=y

‎tests/net/socket/tls_configurations/prj.conf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@ CONFIG_ENTROPY_GENERATOR=y
3636
# have a basic configuration in this "prj.conf" file and then add algorithm
3737
# support in overlay files.
3838
CONFIG_MBEDTLS_TLS_VERSION_1_2=n
39-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=n
39+
CONFIG_MBEDTLS_MD=n
40+
CONFIG_MBEDTLS_RSA_C=n
4041
CONFIG_MBEDTLS_CIPHER_AES_ENABLED=n
4142
CONFIG_PSA_WANT_KEY_TYPE_AES=n
4243
CONFIG_PSA_WANT_ALG_CBC_NO_PADDING=n

0 commit comments

Comments
 (0)