Skip to content

mbedtls: use static key slot buffers in the PSA Crypto core #80368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kartben merged 3 commits into from
Nov 25, 2024
Merged

mbedtls: use static key slot buffers in the PSA Crypto core #80368

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1918683
manifest: mbedtls: include patch for static key slots
valeriosetti Oct 24, 2024
c06a692
mbedtls: add Kconfig symbol CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS
valeriosetti Oct 24, 2024
7dc3c18
mbedtls: add Kconfig to select the number of key slot in PSA Crypto core
valeriosetti Oct 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions doc/releases/migration-guide-4.1.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,14 @@ Mbed TLS
:kconfig:option:`CONFIG_MBEDTLS_PSA_CRYPTO_LEGACY_RNG`. This helps in reducing
ROM/RAM footprint of the Mbed TLS library.

* The newly-added Kconfig option :kconfig:option:`CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT`
allows to specify the number of key slots available in the PSA Crypto core.
Previously this value was not explicitly set, so Mbed TLS's default value of
32 was used. The new Kconfig option defaults to 16 instead in order to find
a reasonable compromise between RAM consumption and most common use cases.
It can be further trimmed down to reduce RAM consumption if the final
application doesn't need that many key slots simultaneously.

Trusted Firmware-M
==================

Expand Down
12 changes: 12 additions & 0 deletions doc/releases/release-notes-4.1.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,6 +250,18 @@ Libraries / Subsystems

* Crypto

* The Kconfig symbol :kconfig:option:`CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS` was
added to allow Mbed TLS to use statically allocated buffers to store key material
in its PSA Crypto core instead of heap-allocated ones. This can help reduce
(or remove, if no other component makes use of it) heap memory requirements
from the final application.

* The Kconfig symbol :kconfig:option:`CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT` was
added to allow selecting the number of key slots available in the Mbed TLS
implementation of the PSA Crypto core. It defaults to 16. Since each
slot consumes RAM memory even if unused, this value can be tweaked in order
to minimize RAM usage.

* CMSIS-NN

* FPGA
Expand Down
32 changes: 31 additions & 1 deletion modules/mbedtls/Kconfig.tls-generic
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -554,9 +554,10 @@ config MBEDTLS_LMS
depends on MBEDTLS_SHA256
select PSA_WANT_ALG_SHA_256

if MBEDTLS_PSA_CRYPTO_C

config MBEDTLS_PSA_P256M_DRIVER_ENABLED
bool "P256-M driver"
depends on MBEDTLS_PSA_CRYPTO_C
imply PSA_WANT_ALG_SHA_256
help
Enable support for the optimized sofware implementation of the secp256r1
Expand All @@ -570,6 +571,35 @@ config MBEDTLS_PSA_P256M_DRIVER_RAW
Warning: Usage of this Kconfig option is prohibited in Zephyr's codebase.
Users can enable it in case of very memory-constrained devices, but be aware that the p256-m interface is absolutely not guaranted to remain stable over time.

config MBEDTLS_PSA_STATIC_KEY_SLOTS
bool "Use statically allocated key buffers to store key material"
default y if !MBEDTLS_ENABLE_HEAP
help
By default Mbed TLS's PSA Crypto core uses heap memory to store the
key material for each key slot. This might impose an undesired
requirement to support heap memory and its management code, affecting
RAM and ROM footprints at the same time.
Enabling this symbol causes Mbed TLS to pre-allocate all the key slot
buffers that are used to store the key material at build time, thus
removing the need for heap memory. Each buffer will be sized to
contain the largest asymmetric/symmetric key type enabled in the build
through PSA_WANT symbols.
Copy link
Contributor

@tomi-font tomi-font Nov 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't MBEDTLS_* symbols also affect this? e.g. if I enable some key type via that and not PSA_WANT.

Copy link
Contributor Author

@valeriosetti valeriosetti Nov 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would be true only if you build Mbed TLS with MBEDTLS_PSA_CRYPTO_C enabled but not MBEDTLS_PSA_CRYPTO_CONFIG so that PSA_WANTs are derived/guessed from legacy symbols, but this is not something we do in Zephyr

Copy link
Contributor

@tomi-font tomi-font Nov 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So with how we do it in Zephyr, PSA_WANTs are not enabled by Mbed TLS symbols? It's only the other way around?

Copy link
Contributor

@frkv frkv Nov 7, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since PSA crypto is the defacto crypto API in zephyr, the PSA_WANT_ALG_XXX etc. is the appropriate way forward.

Legacy CONFIGS converted to PSA crypto has code-size and ram size side-effects, and it also makes it difficult to optimize


config MBEDTLS_PSA_KEY_SLOT_COUNT
int "Number of key slots in PSA Crypto core"
default 16
Copy link
Contributor

@tomi-font tomi-font Nov 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What was the rationale for choosing 16? I'm wondering if we should make that default still a bit smaller.

Copy link
Contributor Author

@valeriosetti valeriosetti Nov 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@frkv suggested this so I'll leave the answer to him

Copy link
Contributor

@frkv frkv Nov 6, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that it will be very difficult to dictate a "one number that fits all" here, unless we start using depends on rules taking into consider the possibility of multiple supported protocols, number of consecutive links etc...

The default number of keys allocated in the current version of Mbed TLS is 32, and we have already reduced this number to half of that.

Please see:
https://github.com/Mbed-TLS/mbedtls/blob/107ea89daaefb9867ea9121002fbbdf926780e98/include/mbedtls/mbedtls_config.h#L4070

https://github.com/Mbed-TLS/mbedtls/blob/107ea89daaefb9867ea9121002fbbdf926780e98/include/psa/crypto_extra.h#L32

It is hard to answer definitely how many keys are needed at the same time, but if you set the default too low it may be a cause of runtime-failures that new users might waste precious time on...

If the end-product doesn't rely on that many keys, then it is adjustable down at will, when doing optimization...

Copy link
Contributor

@tomi-font tomi-font Nov 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was suggesting to set it down to ~12 because from my quick calculation (based on Valerio's showcase data in the PR description) it seemed that a number bigger than that would increase the RAM usage. Although in practice it actually depends on the key types enabled. So yeah, it's not that easy of a choice.

I was just trying to avoid increasing the footprint (because that goes against the original goal).
Maybe we could at least make sure to properly document this as a possible optimization path (so that users come across it easily).

help
Set the number of key slots that are available in the PSA Crypto core.
Be aware that each slot, even if unused, increases RAM consumption
by ~40 bytes plus:
* the length of the largest asymmetric/symmetric key type enabled in
the build through PSA_WANT symbols, if MBEDTLS_PSA_STATIC_KEY_SLOTS
is set. (This is all defined statically at build time).
* the heap-allocated memory to store the key material of a given slot,
if it is used and MBEDTLS_PSA_STATIC_KEY_SLOTS is not set.

endif # MBEDTLS_PSA_CRYPTO_C

config MBEDTLS_SSL_DTLS_CONNECTION_ID
bool "DTLS Connection ID extension"
depends on MBEDTLS_DTLS
Expand Down
9 changes: 8 additions & 1 deletion modules/mbedtls/configs/config-tls-generic.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -483,7 +483,6 @@
#endif

#if defined(CONFIG_ARCH_POSIX) && !defined(CONFIG_PICOLIBC)
#define MBEDTLS_PSA_KEY_SLOT_COUNT 64 /* for BLE Mesh tests */
#define MBEDTLS_PSA_ITS_FILE_C
#define MBEDTLS_FS_IO
#endif
Expand All @@ -494,6 +493,14 @@

#endif /* CONFIG_MBEDTLS_PSA_CRYPTO_C */

#if defined(CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS)
#define MBEDTLS_PSA_STATIC_KEY_SLOTS
#endif

#if defined(CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT)
#define MBEDTLS_PSA_KEY_SLOT_COUNT CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT
#endif

#if defined(CONFIG_MBEDTLS_USE_PSA_CRYPTO)
#define MBEDTLS_USE_PSA_CRYPTO
#endif
Expand Down
3 changes: 3 additions & 0 deletions tests/bsim/bluetooth/mesh/overlay_psa.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
# Enable PSA as a crypto backend in host
CONFIG_BT_USE_PSA_API=y

# Increase the number of key slots in PSA Crypto core
CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT=64

# Enable mbedTLS PSA as a crypto backend
CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
2 changes: 2 additions & 0 deletions tests/crypto/secp256r1/mbedtls.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_MBEDTLS_PSA_P256M_DRIVER_ENABLED=y
CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS=y
CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT=2

CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y
Expand Down
2 changes: 1 addition & 1 deletion west.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -280,7 +280,7 @@ manifest:
revision: 2b498e6f36d6b82ae1da12c8b7742e318624ecf5
path: modules/lib/gui/lvgl
- name: mbedtls
revision: a78176c6ff0733ba08018cba4447bd3f20de7978
revision: 4952e1328529ee549d412b498ea71c54f30aa3b1
path: modules/crypto/mbedtls
groups:
- crypto
Expand Down
Loading