[nrf noup] bootloader: Add RSA FW encryption support

-Add encrypted_psa.c to build when RSA encryption and signature is
 used to get access to APIs used to encrypt/decrypt images using
 AES CTR.
-Wrap boot_decrypt_key in encrypted_psa.c because it is only
 usable when ECDH using secp256r1 or X25519 is used.
-Add Kconfig for selecting RSA encryption dependencies when
 BOOT_ENCRYPT_IMAGE and RSA signatures are enabled.

Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>

Author: frkv

boot/bootutil/src/encrypted_psa.c

@@ -200,6 +200,8 @@ void bootutil_aes_ctr_init(bootutil_aes_ctr_context *ctx)
 
 #if defined(MCUBOOT_ENC_IMAGES)
 extern const struct bootutil_key bootutil_enc_key;
+
+#if defined(MCUBOOT_ENCRYPT_EC256) || defined(MCUBOOT_ENCRYPT_X25519)
 /*
  * Decrypt an encryption key TLV.
  *
@@ -389,6 +391,8 @@ boot_decrypt_key(const uint8_t *buf, uint8_t *enckey)
     return 0;
 }
 
+#endif /* defined(MCUBOOT_ENCRYPT_EC256) || defined(MCUBOOT_ENCRYPT_X25519) */
+
 int bootutil_aes_ctr_encrypt(bootutil_aes_ctr_context *ctx, uint8_t *counter,
         const uint8_t *m, uint32_t mlen, size_t blk_off, uint8_t *c)
 {

boot/zephyr/CMakeLists.txt

@@ -128,7 +128,8 @@ zephyr_library_sources(
   )
 
 if((CONFIG_BOOT_ENCRYPT_X25519 AND CONFIG_BOOT_ED25519_PSA)
-   OR (CONFIG_BOOT_ENCRYPT_EC256 AND CONFIG_BOOT_ECDSA_PSA))
+   OR (CONFIG_BOOT_ENCRYPT_EC256 AND CONFIG_BOOT_ECDSA_PSA)
+   OR (CONFIG_BOOT_ENCRYPT_RSA AND CONFIG_BOOT_SIGNATURE_TYPE_RSA))
   zephyr_library_sources(${BOOT_DIR}/bootutil/src/encrypted_psa.c)
 endif()
 

boot/zephyr/Kconfig

@@ -131,6 +131,17 @@ config BOOT_X25519_PSA_DEPENDENCIES
 	  to use with it; the others are used for shared key decryption
 	  and derivation.
 
+config BOOT_RSA_ENCRYPT_PSA_DEPENDENCIES
+	bool
+	select PSA_WANT_ALG_RSA_OAEP
+	select PSA_WANT_ALG_CTR
+	select PSA_WANT_KEY_TYPE_AES
+	select PSA_WANT_AES_KEY_SIZE_128
+	select PSA_WANT_AES_KEY_SIZE_256
+	select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT
+	help
+	  Dependencies for RSA encryption support.
+
 endif # BOOT_ENCRYPT_IMAGE
 
 config BOOT_ECDSA_PSA_DEPENDENCIES
@@ -278,6 +289,8 @@ config BOOT_SIGNATURE_TYPE_RSA
 	select PSA_WANT_ALG_RSA_PSS
 	select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 	select BOOT_IMG_HASH_ALG_SHA256_ALLOW
+	select BOOT_ENCRYPTION_SUPPORT
+	select BOOT_RSA_ENCRYPT_PSA_DEPENDENCIES if BOOT_ENCRYPT_IMAGE
 
 if BOOT_SIGNATURE_TYPE_RSA
 config BOOT_SIGNATURE_TYPE_RSA_LEN