net: openthread: Add crypto backend based on PSA API

OpenThread has lately got an option to provide a custom
crypto backend that replaces the default, based on mbedTLS
API. Implement a backend based on ARM PSA crypto API that
is better suited for applications willing to take advantage
of the ARM trust zone technology.

Add Kconfig option: OPENTHREAD_CRYPTO_PSA_ENABLE which
enables that backend.

Also, another Kconfig option:
OPENTHREAD_PLATFORM_KEY_REFERENCES_ENABLE, implied by the
former, which enables usage of key references instead of
literal keys in OpenThread. It will eventually allow
OpenThread applications to keep sensitive data such as
encryption keys in the secure storage, accessible from the
secure world only.

Signed-off-by: Damian Krolik <[email protected]>

Author: Damian-Nordic

subsys/net/l2/openthread/Kconfig

@@ -306,4 +306,18 @@ config OPENTHREAD_MAC_SOFTWARE_CSMA_BACKOFF_ENABLE
 	  Set y to enable software CSMA backoff. The option can be disabled if
 	  the radio has hardware support for this feature (IEEE802154_HW_CSMA).
 
+config OPENTHREAD_CRYPTO_PSA
+	bool "Enable ARM PSA crypto API"
+	depends on BUILD_WITH_TFM
+	select OPENTHREAD_PLATFORM_KEY_REFERENCES_ENABLE
+	help
+	  Enable crypto backend library implementation based on ARM PSA crypto
+	  API instead of the default, using mbedTLS.
+
+config OPENTHREAD_PLATFORM_KEY_REFERENCES_ENABLE
+	bool "Enable cryptographic key reference support"
+	help
+	  Enable usage of cryptographic key references instead of literal keys
+	  This requires a crypto backend library that supports key references.
+
 endif # NET_L2_OPENTHREAD

subsys/net/lib/openthread/platform/CMakeLists.txt

@@ -13,6 +13,7 @@ zephyr_library_sources(
 
 zephyr_library_sources_ifdef(CONFIG_OPENTHREAD_DIAG diag.c)
 zephyr_library_sources_ifdef(CONFIG_OPENTHREAD_COPROCESSOR uart.c)
+zephyr_library_sources_ifdef(CONFIG_OPENTHREAD_CRYPTO_PSA crypto_psa.c)
 zephyr_library_sources_ifdef(CONFIG_OPENTHREAD_SHELL shell.c)
 zephyr_library_sources_ifdef(CONFIG_OPENTHREAD_EXTERNAL_HEAP memory.c)
 zephyr_library_sources_ifndef(CONFIG_LOG_BACKEND_SPINEL logging.c)