diff --git a/samples/crypto/ecdh/boards/nrf52840dk_nrf52840.conf b/samples/crypto/ecdh/boards/nrf52840dk_nrf52840.conf index 1506df21e88..ca47becd1e5 100644 --- a/samples/crypto/ecdh/boards/nrf52840dk_nrf52840.conf +++ b/samples/crypto/ecdh/boards/nrf52840dk_nrf52840.conf @@ -10,3 +10,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=6144 diff --git a/samples/crypto/ecdh/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/crypto/ecdh/boards/nrf5340dk_nrf5340_cpuapp.conf index 1506df21e88..ca47becd1e5 100644 --- a/samples/crypto/ecdh/boards/nrf5340dk_nrf5340_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf5340dk_nrf5340_cpuapp.conf @@ -10,3 +10,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=6144 diff --git a/samples/crypto/ecdh/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/samples/crypto/ecdh/boards/nrf5340dk_nrf5340_cpuapp_ns.conf index f56a4ee21a9..7ae624bdece 100644 --- a/samples/crypto/ecdh/boards/nrf5340dk_nrf5340_cpuapp_ns.conf +++ b/samples/crypto/ecdh/boards/nrf5340dk_nrf5340_cpuapp_ns.conf @@ -6,3 +6,5 @@ # Using hardware crypto accelerator CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf54h20dk_nrf54h20_cpuapp.conf b/samples/crypto/ecdh/boards/nrf54h20dk_nrf54h20_cpuapp.conf index 31be593f7ec..b8a84a38886 100644 --- a/samples/crypto/ecdh/boards/nrf54h20dk_nrf54h20_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf54h20dk_nrf54h20_cpuapp.conf @@ -13,3 +13,5 @@ CONFIG_PSA_SSF_CRYPTO_CLIENT=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l05_cpuapp.conf b/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l05_cpuapp.conf index fb825d567f3..d91af31d89e 100644 --- a/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l05_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l05_cpuapp.conf @@ -9,3 +9,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l10_cpuapp.conf b/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l10_cpuapp.conf index fb825d567f3..d91af31d89e 100644 --- a/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l10_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l10_cpuapp.conf @@ -9,3 +9,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l15_cpuapp.conf b/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l15_cpuapp.conf index fb825d567f3..d91af31d89e 100644 --- a/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l15_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf54l15dk_nrf54l15_cpuapp.conf @@ -9,3 +9,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf54lm20dk_nrf54lm20a_cpuapp.conf b/samples/crypto/ecdh/boards/nrf54lm20dk_nrf54lm20a_cpuapp.conf index 2645034fc65..5ffb74ecebc 100644 --- a/samples/crypto/ecdh/boards/nrf54lm20dk_nrf54lm20a_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf54lm20dk_nrf54lm20a_cpuapp.conf @@ -7,3 +7,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf54lm20dk_nrf54lm20b_cpuapp.conf b/samples/crypto/ecdh/boards/nrf54lm20dk_nrf54lm20b_cpuapp.conf index f21cc79a909..f859691d175 100644 --- a/samples/crypto/ecdh/boards/nrf54lm20dk_nrf54lm20b_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf54lm20dk_nrf54lm20b_cpuapp.conf @@ -7,3 +7,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf54ls05dk_nrf54ls05b_cpuapp.conf b/samples/crypto/ecdh/boards/nrf54ls05dk_nrf54ls05b_cpuapp.conf index 1c2555e825b..04e44b6d301 100644 --- a/samples/crypto/ecdh/boards/nrf54ls05dk_nrf54ls05b_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf54ls05dk_nrf54ls05b_cpuapp.conf @@ -7,3 +7,5 @@ # Mbed TLS heap configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf54lv10dk_nrf54lv10a_cpuapp.conf b/samples/crypto/ecdh/boards/nrf54lv10dk_nrf54lv10a_cpuapp.conf index fb825d567f3..d91af31d89e 100644 --- a/samples/crypto/ecdh/boards/nrf54lv10dk_nrf54lv10a_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf54lv10dk_nrf54lv10a_cpuapp.conf @@ -9,3 +9,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf7120dk_nrf7120_cpuapp.conf b/samples/crypto/ecdh/boards/nrf7120dk_nrf7120_cpuapp.conf index 1a85cae01d2..8030c06bae0 100644 --- a/samples/crypto/ecdh/boards/nrf7120dk_nrf7120_cpuapp.conf +++ b/samples/crypto/ecdh/boards/nrf7120dk_nrf7120_cpuapp.conf @@ -11,3 +11,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y # Configure MbedTLS CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf9151dk_nrf9151.conf b/samples/crypto/ecdh/boards/nrf9151dk_nrf9151.conf index 1506df21e88..ca47becd1e5 100644 --- a/samples/crypto/ecdh/boards/nrf9151dk_nrf9151.conf +++ b/samples/crypto/ecdh/boards/nrf9151dk_nrf9151.conf @@ -10,3 +10,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=6144 diff --git a/samples/crypto/ecdh/boards/nrf9151dk_nrf9151_ns.conf b/samples/crypto/ecdh/boards/nrf9151dk_nrf9151_ns.conf index f56a4ee21a9..7ae624bdece 100644 --- a/samples/crypto/ecdh/boards/nrf9151dk_nrf9151_ns.conf +++ b/samples/crypto/ecdh/boards/nrf9151dk_nrf9151_ns.conf @@ -6,3 +6,5 @@ # Using hardware crypto accelerator CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf9160dk_nrf9160.conf b/samples/crypto/ecdh/boards/nrf9160dk_nrf9160.conf index 1506df21e88..ca47becd1e5 100644 --- a/samples/crypto/ecdh/boards/nrf9160dk_nrf9160.conf +++ b/samples/crypto/ecdh/boards/nrf9160dk_nrf9160.conf @@ -10,3 +10,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=6144 diff --git a/samples/crypto/ecdh/boards/nrf9160dk_nrf9160_ns.conf b/samples/crypto/ecdh/boards/nrf9160dk_nrf9160_ns.conf index f56a4ee21a9..7ae624bdece 100644 --- a/samples/crypto/ecdh/boards/nrf9160dk_nrf9160_ns.conf +++ b/samples/crypto/ecdh/boards/nrf9160dk_nrf9160_ns.conf @@ -6,3 +6,5 @@ # Using hardware crypto accelerator CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/boards/nrf9161dk_nrf9161.conf b/samples/crypto/ecdh/boards/nrf9161dk_nrf9161.conf index 1506df21e88..ca47becd1e5 100644 --- a/samples/crypto/ecdh/boards/nrf9161dk_nrf9161.conf +++ b/samples/crypto/ecdh/boards/nrf9161dk_nrf9161.conf @@ -10,3 +10,5 @@ CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y # Mbedtls configuration CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=8192 + +CONFIG_MAIN_STACK_SIZE=6144 diff --git a/samples/crypto/ecdh/boards/nrf9161dk_nrf9161_ns.conf b/samples/crypto/ecdh/boards/nrf9161dk_nrf9161_ns.conf index f56a4ee21a9..7ae624bdece 100644 --- a/samples/crypto/ecdh/boards/nrf9161dk_nrf9161_ns.conf +++ b/samples/crypto/ecdh/boards/nrf9161dk_nrf9161_ns.conf @@ -6,3 +6,5 @@ # Using hardware crypto accelerator CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +CONFIG_MAIN_STACK_SIZE=4096 diff --git a/samples/crypto/ecdh/prj.conf b/samples/crypto/ecdh/prj.conf index 20efda34507..5c52903c5e1 100644 --- a/samples/crypto/ecdh/prj.conf +++ b/samples/crypto/ecdh/prj.conf @@ -6,7 +6,6 @@ # The Zephyr CMSIS emulation assumes that ticks are ms, currently CONFIG_SYS_CLOCK_TICKS_PER_SEC=1000 -CONFIG_MAIN_STACK_SIZE=4096 CONFIG_HEAP_MEM_POOL_SIZE=4096 # Enable logging diff --git a/subsys/nrf_security/cmake/psa_crypto_config.cmake b/subsys/nrf_security/cmake/psa_crypto_config.cmake index bb46f5fc3f6..baaa852a5f0 100644 --- a/subsys/nrf_security/cmake/psa_crypto_config.cmake +++ b/subsys/nrf_security/cmake/psa_crypto_config.cmake @@ -260,6 +260,14 @@ kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_HASH_DRIVER) kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_KEY_MANAGEMENT_DRIVER) kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_MAC_DRIVER) kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_ASYMMETRIC_SIGNATURE_DRIVER) +kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS) +kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY) +kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_KEY_TYPE_RSA_ANY) +kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_ECDH_WEIERSTRASS) +kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_ECDH_MONTGOMERY_255) +kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_ECDSA) +kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_PURE_EDDSA_TWISTED_EDWARDS_255) +kconfig_check_and_set_base_to_one(PSA_NEED_CC3XX_RSA_SIGN) # Convert nrf_oberon driver configurations diff --git a/subsys/nrf_security/configs/psa_crypto_config.h.template b/subsys/nrf_security/configs/psa_crypto_config.h.template index d07456130ae..aa3923a352f 100644 --- a/subsys/nrf_security/configs/psa_crypto_config.h.template +++ b/subsys/nrf_security/configs/psa_crypto_config.h.template @@ -30,6 +30,14 @@ #cmakedefine PSA_NEED_CC3XX_KEY_MANAGEMENT_DRIVER @PSA_NEED_CC3XX_KEY_MANAGEMENT_DRIVER@ #cmakedefine PSA_NEED_CC3XX_MAC_DRIVER @PSA_NEED_CC3XX_MAC_DRIVER@ #cmakedefine PSA_NEED_CC3XX_ASYMMETRIC_SIGNATURE_DRIVER @PSA_NEED_CC3XX_ASYMMETRIC_SIGNATURE_DRIVER@ +#cmakedefine PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS @PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS@ +#cmakedefine PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY @PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY@ +#cmakedefine PSA_NEED_CC3XX_KEY_TYPE_RSA_ANY @PSA_NEED_CC3XX_KEY_TYPE_RSA_ANY@ +#cmakedefine PSA_NEED_CC3XX_ECDH_WEIERSTRASS @PSA_NEED_CC3XX_ECDH_WEIERSTRASS@ +#cmakedefine PSA_NEED_CC3XX_ECDH_MONTGOMERY_255 @PSA_NEED_CC3XX_ECDH_MONTGOMERY_255@ +#cmakedefine PSA_NEED_CC3XX_ECDSA @PSA_NEED_CC3XX_ECDSA@ +#cmakedefine PSA_NEED_CC3XX_PURE_EDDSA_TWISTED_EDWARDS_255 @PSA_NEED_CC3XX_PURE_EDDSA_TWISTED_EDWARDS_255@ +#cmakedefine PSA_NEED_CC3XX_RSA_SIGN @PSA_NEED_CC3XX_RSA_SIGN@ /* * nrf_oberon driver configurations diff --git a/subsys/nrf_security/src/drivers/nrf_cc3xx/CMakeLists.txt b/subsys/nrf_security/src/drivers/nrf_cc3xx/CMakeLists.txt index 97eceafb992..2d6b476dea8 100644 --- a/subsys/nrf_security/src/drivers/nrf_cc3xx/CMakeLists.txt +++ b/subsys/nrf_security/src/drivers/nrf_cc3xx/CMakeLists.txt @@ -5,7 +5,7 @@ # # Get the include-folders from the imported CC3XX library -get_target_property(NRF_CC3XX_MBEDCRYPTO_INCLUDE_PATH +get_target_property(NRF_CC3XX_MBEDCRYPTO_INCLUDE_PATH nrf_cc3xx_core_imported INTERFACE_INCLUDE_DIRECTORIES) # Add nrf_cc3xx PSA Crypto Driver includes to psa_crypto_library_config @@ -14,9 +14,58 @@ target_include_directories(psa_crypto_library_config ${NRF_CC3XX_MBEDCRYPTO_INCLUDE_PATH} ) +if(CONFIG_PSA_NEED_CC3XX_ASYMMETRIC_SIGNATURE_DRIVER) + list(APPEND src_crypto_cc3xx + public_cc3xx_psa_asymmetric_signature.c + ) +endif() + +if(CONFIG_PSA_NEED_CC3XX_KEY_AGREEMENT_DRIVER) + list(APPEND src_crypto_cc3xx + public_cc3xx_psa_key_agreement.c + ) +endif() + +if(CONFIG_PSA_NEED_CC3XX_KEY_MANAGEMENT_DRIVER) + list(APPEND src_crypto_cc3xx + public_cc3xx_psa_key_management.c + ) +endif() + +# Add the PSA crypto driver only if any of the source files are added +if(src_crypto_cc3xx) + add_library(cc3xx_psa_driver STATIC + ${src_crypto_cc3xx} + ) + + # Link to the PSA interface and library PSA crypto configurations + target_link_libraries(cc3xx_psa_driver + PRIVATE + psa_crypto_library_config + psa_interface + ) + + # Link psa_core with this driver + target_link_libraries(psa_core + PRIVATE + cc3xx_psa_driver + ) + + # Link to imported libraries for CC3XX APIs. + target_link_libraries(cc3xx_psa_driver + PRIVATE + nrf_cc3xx_psa_crypto_imported + nrf_cc3xx_core_imported + nrf_security_utils + ) + + nrf_security_add_zephyr_options_library(cc3xx_psa_driver) +endif() + # Link psa_core with the imported libraries target_link_libraries(psa_core INTERFACE + $ nrf_cc3xx_psa_crypto_imported nrf_cc3xx_core_imported c diff --git a/subsys/nrf_security/src/drivers/nrf_cc3xx/Kconfig b/subsys/nrf_security/src/drivers/nrf_cc3xx/Kconfig index 826a4ee1d78..256307586ee 100644 --- a/subsys/nrf_security/src/drivers/nrf_cc3xx/Kconfig +++ b/subsys/nrf_security/src/drivers/nrf_cc3xx/Kconfig @@ -149,6 +149,14 @@ config PSA_NEED_CC3XX_ECDH_BRAINPOOL_P_R1_256 depends on PSA_WANT_ECC_BRAINPOOL_P_R1_256 depends on PSA_USE_CC3XX_KEY_AGREEMENT_DRIVER +config PSA_NEED_CC3XX_ECDH_WEIERSTRASS + bool + default y + depends on PSA_NEED_CC3XX_ECDH_SECP_R1_224 || \ + PSA_NEED_CC3XX_ECDH_SECP_R1_256 || \ + PSA_NEED_CC3XX_ECDH_SECP_R1_384 || \ + PSA_NEED_CC3XX_ECDH_BRAINPOOL_P_R1_256 + config PSA_NEED_CC3XX_KEY_AGREEMENT_DRIVER bool default y @@ -218,6 +226,16 @@ config PSA_NEED_CC3XX_ECDSA_BRAINPOOL_P_R1_256 depends on PSA_WANT_ECC_BRAINPOOL_P_R1_256 depends on PSA_USE_CC3XX_ASYMMETRIC_SIGNATURE_DRIVER +config PSA_NEED_CC3XX_ECDSA + bool + default y + depends on PSA_NEED_CC3XX_ECDSA_SECP_R1_224 || \ + PSA_NEED_CC3XX_ECDSA_SECP_R1_256 || \ + PSA_NEED_CC3XX_ECDSA_SECP_R1_384 || \ + PSA_NEED_CC3XX_ECDSA_SECP_K1_224 || \ + PSA_NEED_CC3XX_ECDSA_SECP_K1_256 || \ + PSA_NEED_CC3XX_ECDSA_BRAINPOOL_P_R1_256 + config PSA_NEED_CC3XX_RSA_PKCS1V15_SIGN bool default y @@ -250,6 +268,12 @@ config PSA_NEED_CC3XX_RSA_PSS depends on PSA_WANT_ALG_RSA_PSS depends on PSA_USE_CC3XX_ASYMMETRIC_SIGNATURE_DRIVER +config PSA_NEED_CC3XX_RSA_SIGN + bool + default y + depends on PSA_NEED_CC3XX_RSA_PKCS1V15_SIGN || \ + PSA_NEED_CC3XX_RSA_PSS + config PSA_NEED_CC3XX_PURE_EDDSA_TWISTED_EDWARDS_255 bool default y @@ -357,7 +381,7 @@ config PSA_NEED_CC3XX_KEY_TYPE_RSA_ANY PSA_WANT_RSA_KEY_SIZE_2048 || \ (PSA_WANT_RSA_KEY_SIZE_3072 && HAS_HW_NRF_CC312) -config PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY +config PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS bool default y # R1 224 @@ -390,35 +414,40 @@ config PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE_SECP_K1_256 select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE_SECP_K1_256 select PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY_SECP_K1_256 - # Twisted edwards 255 - select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT_TWISTED_EDWARDS_255 - select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT_TWISTED_EDWARDS_255 - select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE_TWISTED_EDWARDS_255 - select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE_TWISTED_EDWARDS_255 - select PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY_TWISTED_EDWARDS_255 - # Montgomery 255 - select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT_MONTGOMERY_255 - select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT_MONTGOMERY_255 - select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE_MONTGOMERY_255 - select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE_MONTGOMERY_255 - select PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY_MONTGOMERY_255 # Brainpool 256 select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT_BRAINPOOL_P_R1_256 select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT_BRAINPOOL_P_R1_256 select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE_BRAINPOOL_P_R1_256 select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE_BRAINPOOL_P_R1_256 select PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY_BRAINPOOL_P_R1_256 - # Depends depends on PSA_WANT_ECC_SECP_R1_224 || \ PSA_WANT_ECC_SECP_R1_256 || \ PSA_WANT_ECC_SECP_R1_384 || \ PSA_WANT_ECC_SECP_K1_224 || \ PSA_WANT_ECC_SECP_K1_256 || \ - PSA_WANT_ECC_MONTGOMERY_255 || \ - PSA_WANT_ECC_TWISTED_EDWARDS_255 || \ PSA_WANT_ECC_BRAINPOOL_P_R1_256 depends on PSA_USE_CC3XX_KEY_MANAGEMENT_DRIVER +config PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY + bool + default y + # Twisted edwards 255 + select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT_TWISTED_EDWARDS_255 + select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT_TWISTED_EDWARDS_255 + select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE_TWISTED_EDWARDS_255 + select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE_TWISTED_EDWARDS_255 + select PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY_TWISTED_EDWARDS_255 + # Montgomery 255 + select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT_MONTGOMERY_255 + select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT_MONTGOMERY_255 + select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE_MONTGOMERY_255 + select PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE_MONTGOMERY_255 + select PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY_MONTGOMERY_255 + depends on PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS || \ + PSA_WANT_ECC_MONTGOMERY_255 || \ + PSA_WANT_ECC_TWISTED_EDWARDS_255 + depends on PSA_USE_CC3XX_KEY_MANAGEMENT_DRIVER + config PSA_NEED_CC3XX_KEY_MANAGEMENT_DRIVER bool default y diff --git a/subsys/nrf_security/src/drivers/nrf_cc3xx/public_cc3xx_psa_asymmetric_signature.c b/subsys/nrf_security/src/drivers/nrf_cc3xx/public_cc3xx_psa_asymmetric_signature.c new file mode 100644 index 00000000000..ca14f93325d --- /dev/null +++ b/subsys/nrf_security/src/drivers/nrf_cc3xx/public_cc3xx_psa_asymmetric_signature.c @@ -0,0 +1,150 @@ +/* + * Copyright (c) 2021, Arm Limited. All rights reserved. + * Copyright (c) 2026 Nordic Semiconductor ASA. + * + * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause + */ + +/** \file cc3xx_psa_asymmetric_signature.c + * + * This file contains the implementation of the entry points associated to the + * asymmetric signature capability as described by the PSA Cryptoprocessor + * Driver interface specification + * + */ + +#include +#include +#include +#include +#include + +#define HASH_SHA512_BLOCK_SIZE_IN_BYTES 128 + +/** \defgroup psa_asym_sign PSA driver entry points for asymmetric sign/verify + * + * Entry points for asymmetric message signing and signature verification as + * described by the PSA Cryptoprocessor Driver interface specification + * + * @{ + */ +psa_status_t cc3xx_sign_hash(const psa_key_attributes_t *attributes, const uint8_t *key, + size_t key_length, psa_algorithm_t alg, const uint8_t *input, + size_t input_length, uint8_t *signature, size_t signature_size, + size_t *signature_length) +{ + if (alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW && + input_length != PSA_HASH_LENGTH(PSA_ALG_SIGN_GET_HASH(alg))) { + return PSA_ERROR_INVALID_ARGUMENT; + } + + if (!PSA_KEY_TYPE_IS_ASYMMETRIC(psa_get_key_type(attributes))) { + return PSA_ERROR_NOT_SUPPORTED; + } + + if (IS_ENABLED(PSA_NEED_CC3XX_ECDSA) && PSA_ALG_IS_ECDSA(alg)) { + return cc3xx_internal_ecdsa_sign(attributes, key, key_length, alg, input, + input_length, signature, signature_size, + signature_length, false); + } else if (IS_ENABLED(PSA_NEED_CC3XX_RSA_SIGN) && + (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || PSA_ALG_IS_RSA_PSS(alg))) { + return cc3xx_internal_rsa_sign(attributes, key, key_length, alg, input, + input_length, signature, signature_size, + signature_length, false); + } else { + return PSA_ERROR_NOT_SUPPORTED; + } +} + +psa_status_t cc3xx_verify_hash(const psa_key_attributes_t *attributes, const uint8_t *key, + size_t key_length, psa_algorithm_t alg, const uint8_t *hash, + size_t hash_length, const uint8_t *signature, + size_t signature_length) +{ + if (alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW && + hash_length != PSA_HASH_LENGTH(PSA_ALG_SIGN_GET_HASH(alg))) { + return PSA_ERROR_INVALID_ARGUMENT; + } + + if (!PSA_KEY_TYPE_IS_ASYMMETRIC(psa_get_key_type(attributes))) { + return PSA_ERROR_NOT_SUPPORTED; + } + + if (IS_ENABLED(PSA_NEED_CC3XX_ECDSA) && PSA_ALG_IS_ECDSA(alg)) { + return cc3xx_internal_ecdsa_verify(attributes, key, key_length, alg, hash, + hash_length, signature, signature_length, false); + } else if (IS_ENABLED(PSA_NEED_CC3XX_RSA_SIGN) && + (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || PSA_ALG_IS_RSA_PSS(alg))) { + return cc3xx_internal_rsa_verify(attributes, key, key_length, alg, hash, + hash_length, signature, signature_length, false); + } else { + return PSA_ERROR_NOT_SUPPORTED; + } +} + +psa_status_t cc3xx_sign_message(const psa_key_attributes_t *attributes, const uint8_t *key, + size_t key_length, psa_algorithm_t alg, const uint8_t *input, + size_t input_length, uint8_t *signature, size_t signature_size, + size_t *signature_length) +{ + psa_status_t ret; + uint8_t hash[HASH_SHA512_BLOCK_SIZE_IN_BYTES]; + size_t hash_len; + + if (!PSA_KEY_TYPE_IS_ASYMMETRIC(psa_get_key_type(attributes))) { + return PSA_ERROR_NOT_SUPPORTED; + } + + if (PSA_ALG_IS_DETERMINISTIC_ECDSA(alg)) { + ret = cc3xx_hash_compute(PSA_ALG_SIGN_GET_HASH(alg), input, input_length, hash, + sizeof(hash), &hash_len); + if (ret != PSA_SUCCESS) { + return ret; + } + + return cc3xx_internal_ecdsa_sign(attributes, key, key_length, alg, hash, hash_len, + signature, signature_size, signature_length, + false); + } else if (IS_ENABLED(PSA_NEED_CC3XX_ECDSA) && PSA_ALG_IS_ECDSA(alg)) { + return cc3xx_internal_ecdsa_sign(attributes, key, key_length, alg, input, + input_length, signature, signature_size, + signature_length, true); + } else if (IS_ENABLED(PSA_NEED_CC3XX_PURE_EDDSA_TWISTED_EDWARDS_255) && + alg == PSA_ALG_PURE_EDDSA) { + return cc3xx_internal_eddsa_sign(attributes, key, key_length, alg, input, + input_length, signature, signature_size, + signature_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_RSA_SIGN) && + (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || PSA_ALG_IS_RSA_PSS(alg))) { + return cc3xx_internal_rsa_sign(attributes, key, key_length, alg, input, + input_length, signature, signature_size, + signature_length, true); + } else { + return PSA_ERROR_NOT_SUPPORTED; + } +} + +psa_status_t cc3xx_verify_message(const psa_key_attributes_t *attributes, const uint8_t *key, + size_t key_length, psa_algorithm_t alg, const uint8_t *input, + size_t input_length, const uint8_t *signature, + size_t signature_length) +{ + if (!PSA_KEY_TYPE_IS_ASYMMETRIC(psa_get_key_type(attributes))) { + return PSA_ERROR_NOT_SUPPORTED; + } + + if (IS_ENABLED(PSA_NEED_CC3XX_ECDSA) && PSA_ALG_IS_ECDSA(alg)) { + return cc3xx_internal_ecdsa_verify(attributes, key, key_length, alg, input, + input_length, signature, signature_length, true); + } else if (IS_ENABLED(PSA_NEED_CC3XX_PURE_EDDSA_TWISTED_EDWARDS_255) && + alg == PSA_ALG_PURE_EDDSA) { + return cc3xx_internal_eddsa_verify(attributes, key, key_length, alg, input, + input_length, signature, signature_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_RSA_SIGN) && + (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || PSA_ALG_IS_RSA_PSS(alg))) { + return cc3xx_internal_rsa_verify(attributes, key, key_length, alg, input, + input_length, signature, signature_length, true); + } else { + return PSA_ERROR_NOT_SUPPORTED; + } +} diff --git a/subsys/nrf_security/src/drivers/nrf_cc3xx/public_cc3xx_psa_key_agreement.c b/subsys/nrf_security/src/drivers/nrf_cc3xx/public_cc3xx_psa_key_agreement.c new file mode 100644 index 00000000000..214282c3b3c --- /dev/null +++ b/subsys/nrf_security/src/drivers/nrf_cc3xx/public_cc3xx_psa_key_agreement.c @@ -0,0 +1,76 @@ +/* + * Copyright (c) 2021, Arm Limited. All rights reserved. + * Copyright (c) 2026 Nordic Semiconductor ASA. + * + * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause + * + */ + +/** \file cc3xx_psa_key_agreement.c + * + * This file contains the implementation of the entry points associated to the + * raw key agreement (i.e. ECDH) as described by the PSA Cryptoprocessor Driver + * interface specification + * + */ + +#include "cc3xx_psa_key_agreement.h" +#include "cc3xx_ecdh_util.h" +#include + +/** \defgroup psa_key_agreement PSA driver entry points for raw key agreement + * + * Entry points for raw key agreement as described by the PSA Cryptoprocessor + * Driver interface specification + * + * @{ + */ +psa_status_t cc3xx_key_agreement(const psa_key_attributes_t *attributes, + const uint8_t *priv_key, size_t priv_key_size, + const uint8_t *publ_key, size_t publ_key_size, + uint8_t *output, size_t output_size, size_t *output_length, + psa_algorithm_t alg) +{ + psa_status_t ret = PSA_ERROR_CORRUPTION_DETECTED; + psa_key_type_t key_type = psa_get_key_type(attributes); + psa_key_bits_t key_bits = psa_get_key_bits(attributes); + psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type); + + if (output_length == NULL) { + return PSA_ERROR_INVALID_ARGUMENT; + } + + /* Will be used as an input output parameter for the internal calls */ + *output_length = output_size; + + switch (alg) { + case PSA_ALG_ECDH: + /* CC-312 only supports the X25519 function w/bit size m = 255 */ + if (IS_ENABLED(PSA_NEED_CC3XX_ECDH_MONTGOMERY_255) && + curve == PSA_ECC_FAMILY_MONTGOMERY && key_bits == 255) { + ret = cc3xx_ecdh_calc_secret_mont(priv_key, priv_key_size, + publ_key, publ_key_size, + output, output_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_ECDH_WEIERSTRASS) && + PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) { + ret = cc3xx_ecdh_calc_secret_wrst(curve, key_bits, + priv_key, priv_key_size, + publ_key, publ_key_size, + output, output_size, output_length); + } else { + /* ECC type did not match supported features */ + ret = PSA_ERROR_NOT_SUPPORTED; + } + break; + default: + *output_length = 0; + return PSA_ERROR_NOT_SUPPORTED; + } + + if (ret != PSA_SUCCESS) { + *output_length = 0; + } + + return ret; +} +/** @} */ diff --git a/subsys/nrf_security/src/drivers/nrf_cc3xx/public_cc3xx_psa_key_management.c b/subsys/nrf_security/src/drivers/nrf_cc3xx/public_cc3xx_psa_key_management.c new file mode 100644 index 00000000000..c67243f3672 --- /dev/null +++ b/subsys/nrf_security/src/drivers/nrf_cc3xx/public_cc3xx_psa_key_management.c @@ -0,0 +1,375 @@ +/* + * Copyright (c) 2021, Arm Limited. All rights reserved. + * Copyright (c) 2026 Nordic Semiconductor ASA. + * + * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause + * + */ + +/** \file cc3xx_psa_key_generation.c + * + * This file contains the implementation of the entry points associated to the + * key generation (i.e. random generation and extraction of public keys) as + * described by the PSA Cryptoprocessor Driver interface specification + * + */ +#include +#include +#include +#include +#include +#include +#include +#include + +static size_t calculate_rsa_key_size(const uint8_t *key_data, size_t key_data_len, bool is_keypair) +{ + int ret; + uint8_t **key_start_pnt = (unsigned char **)&key_data; + uint8_t *key_end_pnt = (unsigned char *)key_data + key_data_len; + size_t len; + + /* Move the pointer after the sequence */ + ret = cc3xx_asn1_get_tag(key_start_pnt, key_end_pnt, &len, + 0x20 | /* Constructed */ + 0x10); /* Sequence */ + if (ret < 0) { + return 0; + } + + if (is_keypair) { + /* The key pair has a version number as an integer */ + ret = cc3xx_asn1_get_tag(key_start_pnt, key_end_pnt, &len, 0x2); /* Integer */ + if (ret < 0) { + return 0; + } + + *key_start_pnt += len; + } + + /* Get the modulus n */ + ret = cc3xx_asn1_get_tag(key_start_pnt, key_end_pnt, &len, 0x2); /* Integer */ + if (ret < 0) { + return 0; + } + + if (*key_start_pnt[0] == 0x00) { + len -= 1; + } + + /* The buffer size for the modulus n is the RSA key size */ + return PSA_BYTES_TO_BITS(len); +} + +static size_t calculate_ecc_key_size(size_t key_data_len, psa_ecc_family_t curve_family, + bool is_keypair) +{ + /** + * For montgomery and twisted edwards curve the bits should be equal to the buffer -1. + * The -1 is because the key size is 255 bits but the buffer size will always be a multiple + * of 8 (256 bits). Private and public keys use the same structure and size so no need to + * distinguish between them. + */ + if (curve_family == PSA_ECC_FAMILY_MONTGOMERY || + curve_family == PSA_ECC_FAMILY_TWISTED_EDWARDS) { + return PSA_BYTES_TO_BITS(key_data_len) - 1; + } + + /* Keypairs are generaly simpler because only the private key is used */ + if (is_keypair) { + /* 521 bit curves are a special case since they are not a multiple of 8 */ + if (key_data_len == PSA_BITS_TO_BYTES(521)) { + return 521; + } + + return PSA_BYTES_TO_BITS(key_data_len); + } + + /** + * For the SECP_R1, SECP_R2, SECP_K1 the public key has the structure + * 04 | X | Y + * and the bit size of the curve is equivalent to the X/Y length. + */ + + /* 521 bit curves are a special case since they are not a multiple of 8 */ + if (key_data_len == (1 + 2 * PSA_BITS_TO_BYTES(521))) { + return 521; + } + + return PSA_BYTES_TO_BITS(key_data_len - 1) / 2; +} + +static size_t calculate_key_size(psa_key_type_t key_type, const uint8_t *key_buff, + size_t key_buff_len) +{ + /* For unstructured keys we can only rely on the buffer size to calculate the key size */ + if (PSA_KEY_TYPE_IS_UNSTRUCTURED(key_type)) { + return PSA_BYTES_TO_BITS(key_buff_len); + } + + /* For RSA keys we need to parse the ASN1 and get the modulus n */ + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_RSA_ANY) && PSA_KEY_TYPE_IS_RSA(key_type)) { + return calculate_rsa_key_size(key_buff, key_buff_len, + key_type == PSA_KEY_TYPE_RSA_KEY_PAIR); + } + + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY) && PSA_KEY_TYPE_IS_ECC(key_type)) { + psa_ecc_family_t curve_family = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type); + + return calculate_ecc_key_size(key_buff_len, curve_family, + PSA_KEY_TYPE_IS_KEY_PAIR(key_type)); + } + + return PSA_ERROR_INVALID_ARGUMENT; +} + +static psa_status_t validate_ecc_key_size(psa_ecc_family_t curve, size_t bits) +{ + switch (curve) { + case PSA_ECC_FAMILY_SECP_R1: + if (bits != 160 && bits != 192 && bits != 224 && bits != 256 && bits != 384 && + bits != 521) { + return PSA_ERROR_INVALID_ARGUMENT; + } + + return PSA_SUCCESS; + case PSA_ECC_FAMILY_SECP_K1: + if (bits != 160 && bits != 192 && bits != 224 && bits != 256) { + return PSA_ERROR_INVALID_ARGUMENT; + } + + return PSA_SUCCESS; + case PSA_ECC_FAMILY_MONTGOMERY: + case PSA_ECC_FAMILY_TWISTED_EDWARDS: + if (bits != 255) { + return PSA_ERROR_NOT_SUPPORTED; + } + + return PSA_SUCCESS; + case PSA_ECC_FAMILY_BRAINPOOL_P_R1: + /** + * The driver should only return not supported, while the core handles + * invalid checks, as it might choose another driver if e.g. a 192r1 is + * chosen + */ + if (bits != 256) { + return PSA_ERROR_NOT_SUPPORTED; + } + + return PSA_SUCCESS; + default: + return PSA_ERROR_NOT_SUPPORTED; + } +} + +static psa_status_t cc3xx_generate_key_ecc(const psa_key_attributes_t *attributes, + uint8_t *key_buffer, size_t key_buffer_size, + size_t *key_buffer_length) +{ + psa_key_type_t key_type = psa_get_key_type(attributes); + psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type); + + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS) && + PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) { + return cc3xx_internal_gen_ecc_wstr_keypair(attributes, key_buffer, key_buffer_size, + key_buffer_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_ECDH_MONTGOMERY_255) && + curve == PSA_ECC_FAMILY_MONTGOMERY) { + return cc3xx_internal_gen_ecc_mont_keypair(attributes, key_buffer, key_buffer_size); + } else if (IS_ENABLED(PSA_NEED_CC3XX_PURE_EDDSA_TWISTED_EDWARDS_255) && + curve == PSA_ECC_FAMILY_TWISTED_EDWARDS) { + return cc3xx_internal_gen_ecc_edwards_keypair(attributes, key_buffer, + key_buffer_size); + } + + return PSA_ERROR_NOT_SUPPORTED; + +} + +static psa_status_t cc3xx_import_key_ecc(const psa_key_attributes_t *attributes, size_t attr_bits, + const uint8_t *data, size_t data_length, + uint8_t *key_buffer, size_t key_buffer_size, + size_t *key_buffer_length, size_t *key_bits) +{ + psa_key_type_t key_type = psa_get_key_type(attributes); + psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type); + + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS) && + PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) { + return cc3xx_internal_check_wrst_key(curve, attr_bits, key_type, data, data_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_ECDH_MONTGOMERY_255) && + curve == PSA_ECC_FAMILY_MONTGOMERY) { + return cc3xx_internal_check_mont_key(key_type, data, data_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_PURE_EDDSA_TWISTED_EDWARDS_255) && + curve == PSA_ECC_FAMILY_TWISTED_EDWARDS) { + return cc3xx_internal_check_edw_key(key_type, data, data_length); + } + + return PSA_ERROR_NOT_SUPPORTED; + +} + +static psa_status_t cc3xx_export_public_key_ecc(const psa_key_attributes_t *attributes, + const uint8_t *key_buffer, size_t key_buffer_size, + uint8_t *data, size_t data_size, + size_t *data_length) +{ + psa_key_type_t key_type = psa_get_key_type(attributes); + psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type); + + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS) && + PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) { + return cc3xx_internal_export_ecc_wrst_public_key( + attributes, key_buffer, key_buffer_size, + data, data_size, data_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_ECDH_MONTGOMERY_255) && + curve == PSA_ECC_FAMILY_MONTGOMERY) { + return cc3xx_internal_export_ecc_mont_public_key( + attributes, key_buffer, key_buffer_size, + data, data_size, data_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_PURE_EDDSA_TWISTED_EDWARDS_255) && + curve == PSA_ECC_FAMILY_TWISTED_EDWARDS) { + return cc3xx_internal_export_ecc_edwards_public_key( + attributes, key_buffer, key_buffer_size, + data, data_size, data_length); + } + + return PSA_ERROR_NOT_SUPPORTED; +} + +static psa_status_t validate_key_size(psa_key_type_t type, size_t bits) +{ + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY) && PSA_KEY_TYPE_IS_ECC(type)) { + psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(type); + + return validate_ecc_key_size(curve, bits); + } + + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_RSA_ANY)) { + switch (type) { + case PSA_KEY_TYPE_RSA_KEY_PAIR: + case PSA_KEY_TYPE_RSA_PUBLIC_KEY: + return cc3xx_check_rsa_key_size(bits); + default: + break; + } + } + + return PSA_ERROR_NOT_SUPPORTED; +} + +/** \defgroup psa_key_generation PSA driver entry points for key handling + * + * Entry points for random key generation and key format manipulation and + * translation as described by the PSA Cryptoprocessor Driver interface + * specification + * + * @{ + */ +psa_status_t cc3xx_generate_key(const psa_key_attributes_t *attributes, uint8_t *key_buffer, + size_t key_buffer_size, size_t *key_buffer_length) +{ + psa_key_type_t key_type = psa_get_key_type(attributes); + size_t key_bits = psa_get_key_bits(attributes); + psa_status_t err = PSA_ERROR_NOT_SUPPORTED; + + if (key_buffer_size < PSA_BITS_TO_BYTES(key_bits)) { + return PSA_ERROR_BUFFER_TOO_SMALL; + } + + err = validate_key_size(key_type, key_bits); + if (err != PSA_SUCCESS) { + return err; + } + + if (!PSA_KEY_TYPE_IS_KEY_PAIR(key_type)) { + return PSA_ERROR_NOT_SUPPORTED; + } + + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY) && PSA_KEY_TYPE_IS_ECC(key_type)) { + return cc3xx_generate_key_ecc(attributes, key_buffer, key_buffer_size, + key_buffer_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_RSA_ANY) && PSA_KEY_TYPE_IS_RSA(key_type)) { + return cc3xx_internal_gen_rsa_keypair(attributes, key_buffer, + key_buffer_size, key_buffer_length); + } else { + return PSA_ERROR_NOT_SUPPORTED; + } +} + +psa_status_t cc3xx_import_key(const psa_key_attributes_t *attributes, const uint8_t *data, + size_t data_length, uint8_t *key_buffer, size_t key_buffer_size, + size_t *key_buffer_length, size_t *key_bits) +{ + psa_status_t err = PSA_ERROR_CORRUPTION_DETECTED; + size_t attr_bits = psa_get_key_bits(attributes); + psa_key_type_t key_type = psa_get_key_type(attributes); + + if (data == NULL || key_buffer == NULL || key_buffer_length == NULL || key_bits == NULL || + data_length == 0) { + return PSA_ERROR_INVALID_ARGUMENT; + } + + if (data_length > key_buffer_size) { + return PSA_ERROR_INVALID_ARGUMENT; + } + + /* if the bits are not set we need to calculate it */ + if (attr_bits == 0) { + attr_bits = calculate_key_size(key_type, data, data_length); + } + + /* Validate ECC or RSA key size */ + err = validate_key_size(key_type, attr_bits); + if (err != PSA_SUCCESS) { + return err; + } + + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY) && PSA_KEY_TYPE_IS_ECC(key_type)) { + err = cc3xx_import_key_ecc(attributes, attr_bits, data, data_length, key_buffer, + key_buffer_size, key_buffer_length, key_bits); + + if (err != PSA_SUCCESS) { + return err; + } + } + + memcpy(key_buffer, data, data_length); + *key_bits = attr_bits; + *key_buffer_length = data_length; + + return PSA_SUCCESS; +} + +psa_status_t cc3xx_export_public_key(const psa_key_attributes_t *attributes, + const uint8_t *key_buffer, size_t key_buffer_size, + uint8_t *data, size_t data_size, size_t *data_length) +{ + psa_key_type_t key_type = psa_get_key_type(attributes); + size_t key_bits = psa_get_key_bits(attributes); + psa_status_t err = PSA_ERROR_CORRUPTION_DETECTED; + + /* Initialise the return value to 0 */ + *data_length = 0; + + err = validate_key_size(key_type, key_bits); + if (err != PSA_SUCCESS) { + return err; + } + + if (PSA_KEY_TYPE_IS_PUBLIC_KEY(key_type)) { + /* Revert to software driver when the key is public (no conversion needed) */ + return PSA_ERROR_NOT_SUPPORTED; + } + + if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY) && PSA_KEY_TYPE_IS_ECC(key_type)) { + return cc3xx_export_public_key_ecc(attributes, key_buffer, key_buffer_size, + data, data_size, data_length); + } else if (IS_ENABLED(PSA_NEED_CC3XX_KEY_TYPE_RSA_ANY) && PSA_KEY_TYPE_IS_RSA(key_type)) { + return cc3xx_rsa_psa_priv_to_psa_publ((uint8_t *)key_buffer, key_buffer_size, + data, data_size, data_length); + } else { + /* ECC type did not match supported features */ + return PSA_ERROR_NOT_SUPPORTED; + } +} diff --git a/tests/crypto/prj.conf b/tests/crypto/prj.conf index 9512608a106..54dced9746d 100644 --- a/tests/crypto/prj.conf +++ b/tests/crypto/prj.conf @@ -27,3 +27,7 @@ CONFIG_MBEDTLS_ECP_C=y CONFIG_MBEDTLS_ECDH_C=y CONFIG_MBEDTLS_ECDSA_C=y CONFIG_MBEDTLS_CMAC_C=y +CONFIG_MBEDTLS_CHACHA20_C=y +CONFIG_MBEDTLS_POLY1305_C=y +CONFIG_MBEDTLS_CHACHAPOLY_C=y +CONFIG_MBEDTLS_GCM_C=y diff --git a/west.yml b/west.yml index 6ba464f96e2..cc85e2ca010 100644 --- a/west.yml +++ b/west.yml @@ -145,7 +145,7 @@ manifest: - name: nrfxlib repo-path: sdk-nrfxlib path: nrfxlib - revision: 0178b40672cb53ad50dda43c7ee9520f6b04f172 + revision: 332808f18c01d7a418105274e2526f0dc05e111b - name: trusted-firmware-m repo-path: sdk-trusted-firmware-m path: modules/tee/tf-m/trusted-firmware-m