Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net: tcp: use PSA functions for ISN generation instead of legacy MbedTLS ones #71827

Merged
merged 7 commits into from
May 9, 2024
Merged

net: tcp: use PSA functions for ISN generation instead of legacy MbedTLS ones #71827

merged 7 commits into from
May 9, 2024

Commits on May 8, 2024

  1. net: tcp: use CS random generators to generate ISN 

    Use only cryptographically secure random number generators for ISN.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
    @valeriosetti
    valeriosetti committed May 8, 2024
    Configuration menu
    Copy the full SHA
    cce3976 View commit details
    Browse the repository at this point in the history

  2. mbedtls: add option to use CSPRNG as random source for PSA_CRYPTO_C 

    Add a choice to select between legacy modules
(i.e. ENTROPY + CTR_DRBG/HMAC_DRBG) and CSPRNG as random generators
for PSA_CRYPTO_C.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
    @valeriosetti
    valeriosetti committed May 8, 2024
    Configuration menu
    Copy the full SHA
    e6b68b1 View commit details
    Browse the repository at this point in the history

  3. mbedtls: add Kconfig option for PSA_WANT_ALG_SHA_256 

    Create a new Kconfig named CONFIG_PSA_WANT_ALG_SHA_256 which allows to
enable PSA_WANT_ALG_SHA_256. This allows to use PSA functions to
compute SHA256 hashes. When PSA is provided by TFM this allows also
to remove legacy mbedtls_sha256() support and therefore reduce
footprint for the NS side.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
    @valeriosetti
    valeriosetti committed May 8, 2024
    Configuration menu
    Copy the full SHA
    ccfb435 View commit details
    Browse the repository at this point in the history

  4. net: tcp: use PSA for SHA256 when BUILD_WITH_TFM 

    When BUILD_WITH_TFM is enabled we can dispatch hash computation
to TFM. This allows to remove the built-in support of SHA256 from
the non-secure side (if it's not used for any other purpose, of course).

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
    @valeriosetti
    valeriosetti committed May 8, 2024
    Configuration menu
    Copy the full SHA
    b7b92ff View commit details
    Browse the repository at this point in the history

  5. tests: mbedtls: add missing CONFIGS 

    CONFIG_MINIMAL_LIBC was required for:
- CONFIG_MINIMAL_LIBC_NON_REENTRANT_FUNCTIONS
- CONFIG_MINIMAL_LIBC_RAND

while CONFIG_ENTROPY_GENERATOR and CONFIG_MBEDTLS_ZEPHYR_ENTROPY
are required for CRYPTO_C.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
    @valeriosetti
    valeriosetti committed May 8, 2024
    Configuration menu
    Copy the full SHA
    57a1ec3 View commit details
    Browse the repository at this point in the history

  6. mbedtls: do not include PSA ITS when using PICOLIBC 

    PICOLIBC misses the dirent.h header which is required
to emulate ITS (internal trusted storage) in PSA APIs.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
    @valeriosetti
    valeriosetti committed May 8, 2024
    Configuration menu
    Copy the full SHA
    6addad9 View commit details
    Browse the repository at this point in the history

  7. mbedtls: add specific Kconfig option for MBEDTLS_USE_PSA_CRYPTO 

    MBEDTLS_PSA_CRYPTO_C and MBEDTLS_USE_PSA_CRYPTO are 2 different
things and the former should not automatically enable the
latter. The reson is that the user might want the MbedTLS
PSA crypto toolbox to be built, but at the same time he/she
does not want TLS/DTLS (and other intermediate modules such
as PK, MD and Cipher) to use PSA APIs.

For this reason this commit introduces a new Kconfig option
named CONFIG_MBEDTLS_USE_PSA_CRYPTO to enable the corresponding
build symbol. By default USE_PSA_CRYPTO is disabled. It is
only explicilty enabled in tests/samples that were previously
setting CRYPTO_C (since in those cases USE_PSA was set).

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
    @valeriosetti
    valeriosetti committed May 8, 2024
    Configuration menu
    Copy the full SHA
    1608b89 View commit details
    Browse the repository at this point in the history