[nrf noup] Add dependency checks for PRNG #14
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
-The ECP_ALT file sets this variable so we will have a multiple definition if we enable it in ecp.h. Signed-off-by: Georgios Vasilakis <[email protected]>
-This removes the redefinition of the define PSA_VENDOR_ECC_MAX_CURVE_BITS which we allow to be set in our configuration file from nrf security. Signed-off-by: Georgios Vasilakis <[email protected]>
The hash interruptable caused some build warnings
for our build system because it enclosed 0 under {}.
The warning: "braces around scalar initializer"
Signed-off-by: Georgios Vasilakis <[email protected]>
The core doesn't include some brainpool key sizes, this change adds these bit sizes: 160 192 224 256 320 Signed-off-by: Georgios Vasilakis <[email protected]>
We don't use the file in our system, we use the generated headers (nrf-config.h and nrf-config-user.h) from nrf_security. Signed-off-by: Georgios Vasilakis <[email protected]>
Change the parameter psa_key_derivation_verify_key from psa_key_id_t to mbedtls_svc_key_id_t to be the same as all the other functions. Without this change we break the TF-M build. tracked by: oberon-microsystems/oberon-psa-crypto-nrf#9 Signed-off-by: Georgios Vasilakis <[email protected]>
The PSA driver for CryptoCell uses the PSA crypto driver wrapper calls for the hash operation. The Oberon context size therefore needs to be static. Signed-off-by: Georgios Vasilakis <[email protected]>
Signed-off-by: Georgios Vasilakis <[email protected]>
In Matter they use user/peer with id_len set to 0 and this made the Oberon PSA core to fail because our mbedtls_calloc returns a NULL pointer. tracked: oberon-microsystems/oberon-psa-crypto-nrf#10 Signed-off-by: Georgios Vasilakis <[email protected]>
This is similar to Mbed-TLS/mbedtls#8729 Signed-off-by: Vidar Lillebø <[email protected]>
The changes this commit brings are expected to be included in the next version. -Adds official version of PAKE APIs for SPAKE2+ (Matter and RFC), ECJPAKE and SRP (see note), based on PSA crypto SPEC 1.2.0 PAKE extension. -See documentation for API changes. NOTE: SRP support is given as experimental Signed-off-by: Frank Audun Kvamtrø <[email protected]>
The key_id is not int so don't set it with 0 since it produces a warning. oberon-microsystems/oberon-psa-crypto-nrf#13 Signed-off-by: Georgios Vasilakis <[email protected]>
Turn the repo into a Zephyr module so we can use the ZEPHYR_bla_bla_MODULE_DIR CMake variable. Signed-off-by: Sebastian Bøe <[email protected]>
Remove legacy header files from oberon-psa-crypto that alias headers from ncs/modules/crypto/mbedtls and are semantically identical to their aliased files. This is done to prevent mbedtls from accidentally using header files from Oberon. Signed-off-by: Sebastian Bøe <[email protected]>
Add code to build_info.h to make it match mbedtls. This will allow mbedtls legacy sources to use Oberon's legacy header files. Signed-off-by: Sebastian Bøe <[email protected]>
Patch to enable more key types for KDF. Signed-off-by: Vidar Lillebø <[email protected]>
Add experimental support for legacy and PSA APIs at the same time. This commit exist because some protocols use PSA APIs and some others still use the mbedTLS legacy APIs for crypto. When all the protocols (Bluetooth, WIFI, etc) port their code to use PSA APIs we can remove this. Signed-off-by: Georgios Vasilakis <[email protected]>
Fixes init-macros for PAKE operation and interruptable hash operations (not supported), to be compatible with client-view version of the structs. Signed-off-by: Vidar Lillebø <[email protected]>
Add checks for the key attributes, key sizes and a zero check for ecc keys for importing keys. Also a attribute check for psa_generate_key. Upstream PR:oberon-psa-crypto-nrf/pull/15 Ref: NCSDK-24820 Signed-off-by: Markus Swarowsky <[email protected]>
...code improvement The psa_crypto_storage_store retuns DATA_INVALID for all the error codes coming from psa_its_set. This causes some issues for our testing infanstructure since it doesn't follow the PSA spec recomendation for return codes. Upstream PR: pull/14 Signed-off-by: Georgios Vasilakis <[email protected]>
Run crypto and TF-M tests on sdk-nrf downstream Signed-off-by: Stephen Kingston <[email protected]>
-This adds mbedtls_ecc_group_of_psa to psa_util.h which exists in the Mbed TLS distribution, and is required for TLS/DTLS and X.509 The issue will be reported to Oberon, but is taken in here to ensure nRF54H20 can support TLS/DTLS and X.509 without a local PSA Core build. -This commit needs to be reverted in a coming version of Oberon PSA core Signed-off-by: Frank Audun Kvamtrø <[email protected]>
-This changes MBEDTLS_PSA_CRYPTO_C to MBEDTLS_PSA_CRYPTO_CLIENT for APIs used e.g. by TLS/DTLS and X.509 APIs in Mbed TLS for conversion of PSA crypto specific error codes and key types into legacy version. This is required for TLS/DTLS and X.509 in a core-less build for nRF54H20 Signed-off-by: Frank Audun Kvamtrø <[email protected]>
Opens the full range of vendor keys to be used via builtin key mechanism. Signed-off-by: Vidar Lillebø <[email protected]>
Adds the capability of import and destroying persistent keys that are "builtin" i.e. handled fully by PSA driver implementation. Signed-off-by: Vidar Lillebø <[email protected]>
Add experimental support for legacy and PSA APIs at the same time. This commit exist because some protocols use PSA APIs and some others still use the mbedTLS legacy APIs for crypto. When all the protocols (Bluetooth, WIFI, etc) port their code to use PSA APIs we can remove this. Signed-off-by: Georgios Vasilakis <[email protected]>
In line 568 of this file we use this function when either of these two defines are set: defined(PSA_NEED_OBERON_TLS12_PRF) || defined(PSA_NEED_OBERON_TLS12_PSK_TO_MS) Add these two defines here as well to avoid a missing function warning that we are getting. Upstream PR: oberon-psa-crypto-nrf/pull/16 Signed-off-by: Georgios Vasilakis <[email protected]>
Signed-off-by: Vidar Lillebø <[email protected]>
CONFIG_PSA_WANT_ALG_CTR_DRBG and CONFIG_PSA_WANT_ALG_HMAC_DRBG depend on CONFIG_PSA_WANT_GENERATE_RANDOM. Add build time check to return an error if CONFIG_PSA_WANT_GENERATE_RANDOM is not enabled. Ref: NCSDK-22856 Signed-off-by: Juha Ylinen <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CONFIG_PSA_WANT_ALG_CTR_DRBG and CONFIG_PSA_WANT_ALG_HMAC_DRBG depend on CONFIG_PSA_WANT_GENERATE_RANDOM. Add build time check to return an error if CONFIG_PSA_WANT_GENERATE_RANDOM is not enabled.
Ref: NCSDK-22856