Skip to content

Commit 35f7eda

Browse files
tomi-fontnashif
tomi-font
authored and
nashif
committed
modules: mbedtls: make key exchange Kconfigs depend on, not select
Turn the MBEDTLS_RSA_FULL selects into depends on. This is how the other MBEDTLS_KEY_EXCHANGE_* Kconfig options are defined. This is done to avoid circular dependencies. At the same time update uses of the affected MBEDTLS_KEY_EXCHANGE_* Kconfig options to enable/disable the dependencies which used to be automatically handled. Signed-off-by: Tomi Fontanilles <[email protected]>
1 parent bf2efc7 commit 35f7eda

File tree

9 files changed

+39
-12
lines changed

9 files changed

+39
-12
lines changed

‎modules/hostap/Kconfig‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,9 @@ config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
145145
select MBEDTLS_ECDH_C
146146
select MBEDTLS_ECDSA_C
147147
select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
148+
select MBEDTLS_RSA_C
149+
select MBEDTLS_PKCS1_V15
150+
select MBEDTLS_PKCS1_V21
148151
select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
149152
select MBEDTLS_NIST_KW_C
150153
select MBEDTLS_DHM_C

‎modules/mbedtls/Kconfig.mbedtls‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -46,28 +46,29 @@ comment "Supported key exchange modes"
4646

4747
config MBEDTLS_RSA_C
4848
bool "RSA base support"
49+
default y if UOSCORE || UEDHOC
4950

5051
if MBEDTLS_RSA_C
5152

5253
config MBEDTLS_PKCS1_V15
5354
bool "RSA PKCS1 v1.5"
55+
default y if UOSCORE || UEDHOC
5456

5557
config MBEDTLS_PKCS1_V21
5658
bool "RSA PKCS1 v2.1"
59+
default y if UOSCORE || UEDHOC
5760

5861
config MBEDTLS_GENPRIME_ENABLED
5962
bool "Prime number generation code"
6063

6164
endif # MBEDTLS_RSA_C
6265

63-
config MBEDTLS_RSA_FULL
64-
bool
66+
config MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
67+
bool "All available ciphersuite modes"
68+
select MBEDTLS_MD
6569
select MBEDTLS_RSA_C
6670
select MBEDTLS_PKCS1_V15
6771
select MBEDTLS_PKCS1_V21
68-
69-
config MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
70-
bool "All available ciphersuite modes"
7172
select MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
7273
select MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
7374
select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
@@ -92,7 +93,7 @@ config MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
9293

9394
config MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
9495
bool "RSA-PSK based ciphersuite modes"
95-
select MBEDTLS_RSA_FULL
96+
depends on MBEDTLS_PKCS1_V15 || MBEDTLS_PKCS1_V21
9697

9798
config MBEDTLS_PSK_MAX_LEN
9899
int "Max size of TLS pre-shared keys"
@@ -104,25 +105,25 @@ config MBEDTLS_PSK_MAX_LEN
104105
config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
105106
bool "RSA-only based ciphersuite modes"
106107
default y if UOSCORE || UEDHOC
107-
select MBEDTLS_MD
108-
select MBEDTLS_RSA_FULL
108+
depends on MBEDTLS_MD
109+
depends on PSA_CRYPTO_CLIENT || MBEDTLS_PKCS1_V15 || MBEDTLS_PKCS1_V21
109110
select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY if PSA_CRYPTO_CLIENT
110111
select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT if PSA_CRYPTO_CLIENT
111112
select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT if PSA_CRYPTO_CLIENT
112113
select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE if PSA_CRYPTO_CLIENT
113114

114115
config MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
115116
bool "DHE-RSA based ciphersuite modes"
116-
select MBEDTLS_RSA_FULL
117+
depends on MBEDTLS_PKCS1_V15 || MBEDTLS_PKCS1_V21
117118

118119
config MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
119120
bool "ECDHE-RSA based ciphersuite modes"
120-
select MBEDTLS_RSA_FULL
121+
depends on MBEDTLS_PKCS1_V15 || MBEDTLS_PKCS1_V21
121122
depends on MBEDTLS_ECDH_C
122123

123124
config MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
124125
bool "ECDHE-ECDSA based ciphersuite modes"
125-
depends on MBEDTLS_ECDH_C && MBEDTLS_ECDSA_C || (PSA_WANT_ALG_ECDH && PSA_WANT_ALG_ECDSA)
126+
depends on (MBEDTLS_ECDH_C && MBEDTLS_ECDSA_C) || (PSA_WANT_ALG_ECDH && PSA_WANT_ALG_ECDSA)
126127

127128
config MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
128129
bool "ECDH-ECDSA based ciphersuite modes"
@@ -397,6 +398,7 @@ config MBEDTLS_CIPHER
397398

398399
config MBEDTLS_MD
399400
bool "generic message digest layer."
401+
default y if UOSCORE || UEDHOC
400402

401403
config MBEDTLS_ASN1_PARSE_C
402404
bool "Support for ASN1 parser functions"

‎samples/net/cloud/mqtt_azure/prj.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=10240
3535
CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT=y
3636
CONFIG_MBEDTLS_SHA1=y
3737
CONFIG_MBEDTLS_SHA384=y
38+
CONFIG_MBEDTLS_RSA_C=y
39+
CONFIG_MBEDTLS_PKCS1_V15=y
40+
CONFIG_MBEDTLS_PKCS1_V21=y
3841
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y
3942
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED=y
4043
CONFIG_MBEDTLS_ECDH_C=y

‎samples/tfm_integration/psa_crypto/prj.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ CONFIG_MBEDTLS_ENTROPY_C=y
3939
CONFIG_MBEDTLS_ECP_C=y
4040
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED=y
4141
CONFIG_MBEDTLS_ECDSA_C=y
42+
CONFIG_MBEDTLS_MD=y
43+
CONFIG_MBEDTLS_RSA_C=y
44+
CONFIG_MBEDTLS_PKCS1_V15=y
45+
CONFIG_MBEDTLS_PKCS1_V21=y
4246
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
4347
CONFIG_MBEDTLS_PK_WRITE_C=y
4448

‎subsys/jwt/Kconfig‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ config JWT_SIGN_RSA_LEGACY
2020
bool "Use RSA signature (RS-256). Use Mbed TLS as crypto library."
2121
depends on CSPRNG_AVAILABLE
2222
select MBEDTLS
23+
select MBEDTLS_MD
24+
select MBEDTLS_RSA_C
25+
select MBEDTLS_PKCS1_V15
26+
select MBEDTLS_PKCS1_V21
2327
select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
2428

2529
config JWT_SIGN_RSA_PSA

‎subsys/net/lib/sockets/Kconfig‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,10 @@ config NET_SOCKETS_SOCKOPT_TLS
116116
imply TLS_CREDENTIALS
117117
select MBEDTLS if NET_NATIVE
118118
imply MBEDTLS_TLS_VERSION_1_2 if !NET_L2_OPENTHREAD
119+
imply MBEDTLS_MD if !NET_L2_OPENTHREAD
120+
imply MBEDTLS_RSA_C if !NET_L2_OPENTHREAD
121+
imply MBEDTLS_PKCS1_V15 if !NET_L2_OPENTHREAD
122+
imply MBEDTLS_PKCS1_V21 if !NET_L2_OPENTHREAD
119123
imply MBEDTLS_KEY_EXCHANGE_RSA_ENABLED if !NET_L2_OPENTHREAD
120124
imply MBEDTLS_CIPHER_AES_ENABLED if !NET_L2_OPENTHREAD
121125
imply PSA_WANT_KEY_TYPE_AES if !NET_L2_OPENTHREAD && PSA_CRYPTO_CLIENT

‎tests/net/lib/lwm2m/interop/prj.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ CONFIG_MBEDTLS_HEAP_SIZE=7168
8282
CONFIG_MBEDTLS_CIPHER_AES_ENABLED=y
8383
CONFIG_MBEDTLS_CIPHER_CCM_ENABLED=y
8484
# Disable RSA, we don't parse certs: saves flash/memory
85-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=n
85+
CONFIG_MBEDTLS_RSA_C=n
8686
# Enable PSK instead
8787
CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=y
8888
CONFIG_LWM2M_SECURITY_DTLS_TLS_CIPHERSUITE_MAX=3

‎tests/net/socket/tls_configurations/overlay-rsa.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
CONFIG_MBEDTLS_MD=y
2+
CONFIG_MBEDTLS_RSA_C=y
3+
CONFIG_MBEDTLS_PKCS1_V15=y
4+
CONFIG_MBEDTLS_PKCS1_V21=y
5+
16
CONFIG_PSA_WANT_ALG_RSA_OAEP=y
27
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT=y
38
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=y

‎tests/net/socket/tls_configurations/prj.conf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ CONFIG_ENTROPY_GENERATOR=y
3737
# support in overlay files.
3838
CONFIG_MBEDTLS_TLS_VERSION_1_2=n
3939
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=n
40+
CONFIG_MBEDTLS_MD=n
41+
CONFIG_MBEDTLS_RSA_C=n
4042
CONFIG_MBEDTLS_CIPHER_AES_ENABLED=n
4143
CONFIG_PSA_WANT_KEY_TYPE_AES=n
4244
CONFIG_PSA_WANT_ALG_CBC_NO_PADDING=n

0 commit comments

Comments
 (0)