[nrf noup] make changes needed for CONFIG_BOOT_SIGNATURE_TYPE_RSA

Make it work with TF-PSA-Crypto.

This is not a proper way to go about it but MCUboot is so deep in
legacy usage that we just make the least amount of adjustments, but
the migration should be done properly by the MCUboot team to use only
PSA Crypto and get rid of all the Mbed TLS stuff.

Legacy SHA-256 and RSA is made available to MCUboot through
CONFIG_MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS and other configuration
options.

With these changes MCUboot builds and links but functionality remains
to be tested and confirmed (because for example `mbedtls_rsa_context`
lost its `ver` field).

Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Author: tomi-font

boot/bootutil/include/bootutil/crypto/aes_ctr.h

@@ -22,7 +22,7 @@
 #include "bootutil/enc_key_public.h"
 
 #if defined(MCUBOOT_USE_MBED_TLS)
-    #include <mbedtls/aes.h>
+    #include <mbedtls/private/aes.h>
     #define BOOT_ENC_BLOCK_SIZE (16)
 #endif /* MCUBOOT_USE_MBED_TLS */
 

boot/bootutil/include/bootutil/crypto/aes_kw.h

@@ -18,7 +18,7 @@
 #endif
 
 #if defined(MCUBOOT_USE_MBED_TLS)
-    #include <mbedtls/aes.h>
+    #include <mbedtls/private/aes.h>
     #include <mbedtls/nist_kw.h>
 #endif /* MCUBOOT_USE_MBED_TLS */
 

boot/bootutil/include/bootutil/crypto/common.h

@@ -10,7 +10,10 @@
 /* The check below can be performed even for those cases
  * where MCUBOOT_USE_MBED_TLS has not been defined
  */
-#include "mbedtls/version.h"
+#ifndef MBEDTLS_VERSION_NUMBER
+#define MBEDTLS_VERSION_NUMBER 0x04010000
+#endif
+
 #if MBEDTLS_VERSION_NUMBER >= 0x03000000
 #define MBEDTLS_CONTEXT_MEMBER(X) MBEDTLS_PRIVATE(X)
 #else

boot/bootutil/include/bootutil/crypto/ecdsa.h

@@ -72,7 +72,7 @@
 /* Universal defines */
 #define BOOTUTIL_CRYPTO_ECDSA_P256_HASH_SIZE (32)
 
-#include "mbedtls/oid.h"
+#include <crypto_oid.h>
 #include "mbedtls/asn1.h"
 #include "bootutil/sign_key.h"
 #if !defined(MCUBOOT_USE_PSA_CRYPTO)

boot/bootutil/include/bootutil/crypto/mbedtls-compat-2.x.h

@@ -0,0 +1,46 @@
+/**
+ * \file compat-2.x.h
+ *
+ * \brief Compatibility definitions
+ *
+ * \deprecated Use the new names directly instead
+ */
+/*
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#if defined(MBEDTLS_DEPRECATED_WARNING)
+#warning "Including compat-2.x.h is deprecated"
+#endif
+
+#ifndef MBEDTLS_COMPAT2X_H
+#define MBEDTLS_COMPAT2X_H
+
+/*
+ * Macros for renamed functions
+ */
+#define mbedtls_ctr_drbg_update_ret   mbedtls_ctr_drbg_update
+#define mbedtls_hmac_drbg_update_ret  mbedtls_hmac_drbg_update
+#define mbedtls_md5_starts_ret        mbedtls_md5_starts
+#define mbedtls_md5_update_ret        mbedtls_md5_update
+#define mbedtls_md5_finish_ret        mbedtls_md5_finish
+#define mbedtls_md5_ret               mbedtls_md5
+#define mbedtls_ripemd160_starts_ret  mbedtls_ripemd160_starts
+#define mbedtls_ripemd160_update_ret  mbedtls_ripemd160_update
+#define mbedtls_ripemd160_finish_ret  mbedtls_ripemd160_finish
+#define mbedtls_ripemd160_ret         mbedtls_ripemd160
+#define mbedtls_sha1_starts_ret       mbedtls_sha1_starts
+#define mbedtls_sha1_update_ret       mbedtls_sha1_update
+#define mbedtls_sha1_finish_ret       mbedtls_sha1_finish
+#define mbedtls_sha1_ret              mbedtls_sha1
+#define mbedtls_sha256_starts_ret     mbedtls_sha256_starts
+#define mbedtls_sha256_update_ret     mbedtls_sha256_update
+#define mbedtls_sha256_finish_ret     mbedtls_sha256_finish
+#define mbedtls_sha256_ret            mbedtls_sha256
+#define mbedtls_sha512_starts_ret     mbedtls_sha512_starts
+#define mbedtls_sha512_update_ret     mbedtls_sha512_update
+#define mbedtls_sha512_finish_ret     mbedtls_sha512_finish
+#define mbedtls_sha512_ret            mbedtls_sha512
+
+#endif /* MBEDTLS_COMPAT2X_H */

boot/bootutil/include/bootutil/crypto/rsa.h

@@ -43,14 +43,9 @@
 
 #elif defined(MCUBOOT_USE_MBED_TLS)
 
-#include "mbedtls/rsa.h"
-#include "mbedtls/version.h"
+#include "mbedtls/private/rsa.h"
 #if defined(BOOTUTIL_CRYPTO_RSA_CRYPT_ENABLED)
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
 #include "rsa_alt_helpers.h"
-#else
-#include "mbedtls/rsa_internal.h"
-#endif
 #endif /* BOOTUTIL_CRYPTO_RSA_CRYPT_ENABLED */
 #include "mbedtls/asn1.h"
 #include "bootutil/crypto/common.h"
@@ -235,9 +230,7 @@ bootutil_rsa_parse_private_key(bootutil_rsa_context *ctx, uint8_t **p, uint8_t *
     }
 
     /* Non-optional fields. */
-    if ( /* version */
-        mbedtls_asn1_get_int(p, end, &ctx->MBEDTLS_CONTEXT_MEMBER(ver)) != 0 ||
-         /* public modulus */
+    if ( /* public modulus */
         mbedtls_asn1_get_mpi(p, end, &ctx->MBEDTLS_CONTEXT_MEMBER(N)) != 0 ||
          /* public exponent */
         mbedtls_asn1_get_mpi(p, end, &ctx->MBEDTLS_CONTEXT_MEMBER(E)) != 0 ||
@@ -288,6 +281,31 @@ bootutil_rsa_parse_private_key(bootutil_rsa_context *ctx, uint8_t **p, uint8_t *
 #endif /* BOOTUTIL_CRYPTO_RSA_CRYPT_ENABLED */
 
 #if defined(BOOTUTIL_CRYPTO_RSA_SIGN_ENABLED)
+
+#include <mbedtls/private/error_common.h>
+
+static int mbedtls_rsa_import(mbedtls_rsa_context *ctx,
+                       const mbedtls_mpi *N,
+                       const mbedtls_mpi *P, const mbedtls_mpi *Q,
+                       const mbedtls_mpi *D, const mbedtls_mpi *E)
+{
+    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+
+    if ((N != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(N), N)) != 0) ||
+        (P != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(P), P)) != 0) ||
+        (Q != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(Q), Q)) != 0) ||
+        (D != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(D), D)) != 0) ||
+        (E != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(E), E)) != 0)) {
+        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret);
+    }
+
+    if (N != NULL) {
+        ctx->MBEDTLS_CONTEXT_MEMBER(len) = mbedtls_mpi_size(&ctx->MBEDTLS_CONTEXT_MEMBER(N));
+    }
+
+    return 0;
+}
+
 /*
  * Parse a RSA public key with format specified in RFC3447 A.1.1
  */

boot/bootutil/include/bootutil/crypto/sha.h

@@ -60,13 +60,10 @@
 #ifdef MCUBOOT_SHA512
 #include <mbedtls/sha512.h>
 #else
-#include <mbedtls/sha256.h>
+#include <mbedtls/private/sha256.h>
 #endif
 
-#include <mbedtls/version.h>
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
-#include <mbedtls/compat-2.x.h>
-#endif
+#include "mbedtls-compat-2.x.h"
 
 #endif /* MCUBOOT_USE_MBED_TLS */
 

boot/bootutil/zephyr/CMakeLists.txt

@@ -13,6 +13,11 @@ target_include_directories(MCUBOOT_BOOTUTIL INTERFACE
 )
 
 zephyr_library_named(mcuboot_util)
+
+if(CONFIG_NRF_SECURITY)
+  zephyr_library_link_libraries(mbedcrypto)
+endif()
+
 zephyr_library_sources(
   ../src/bootutil_public.c
     )

boot/zephyr/CMakeLists.txt

@@ -57,16 +57,14 @@ add_subdirectory(uuid)
 # Include the IronSide-based HW counters implementation
 add_subdirectory_ifdef(CONFIG_NRF_MCUBOOT_IRONSIDE_COUNTERS ironside_counters)
 
+if(CONFIG_NRF_SECURITY)
+  zephyr_library_link_libraries(mbedcrypto)
+endif()
+
 zephyr_library_include_directories(
   include
   )
 
-if(DEFINED CONFIG_MBEDTLS)
-  zephyr_library_include_directories(
-    ${ZEPHYR_MBEDTLS_MODULE_DIR}/include
-  )
-endif()
-
 # Zephyr port-specific sources.
 zephyr_library_sources(
   main.c
@@ -239,7 +237,7 @@ if(CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256 OR CONFIG_BOOT_ENCRYPT_EC256)
   # When ECDSA PSA is used, do not pull in additional ASN.1 include
   # directories or sources, as it would cause incorrect header files
   # to be included.
-  if(MBEDTLS_ASN1_DIR AND NOT CONFIG_BOOT_ECDSA_PSA)
+  if(MBEDTLS_ASN1_DIR AND NOT CONFIG_NRF_SECURITY)
     zephyr_library_include_directories(
       ${MBEDTLS_ASN1_DIR}/include
     )

boot/zephyr/Kconfig

@@ -262,19 +262,21 @@ config BOOT_SIGNATURE_TYPE_NONE
 config BOOT_SIGNATURE_TYPE_RSA
 	bool "RSA signatures"
 	select BOOT_USE_MBEDTLS
-	select MBEDTLS
-	select MBEDTLS_ASN1_PARSE_C if MBEDTLS_BUILTIN
-	select MBEDTLS_MD_C if MBEDTLS_BUILTIN
-	select MBEDTLS_SHA256 if MBEDTLS_BUILTIN
-	select MBEDTLS_RSA_C if MBEDTLS_BUILTIN
-	select MBEDTLS_PKCS1_V15 if MBEDTLS_BUILTIN
-	select MBEDTLS_PKCS1_V21 if MBEDTLS_BUILTIN
-	select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED if MBEDTLS_BUILTIN
-	select MBEDTLS_PLATFORM_NO_STD_FUNCTIONS if MBEDTLS_BUILTIN
-	select MBEDTLS_PLATFORM_SNPRINTF_ALT if MBEDTLS_BUILTIN
+	select PSA_CRYPTO
+	select PSA_WANT_KEY_TYPE_AES
+	select PSA_WANT_ALG_CTR
+	select MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
+	select MBEDTLS_ASN1_PARSE_C
+	select MBEDTLS_MD_C
+	select MBEDTLS_SHA256_C
+	select MBEDTLS_RSA_C
+	select MBEDTLS_PKCS1_V15
+	select MBEDTLS_PKCS1_V21
+	select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED if NRF_SECURITY
+	select MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
+	select MBEDTLS_PLATFORM_SNPRINTF_ALT
 	select BOOT_ENCRYPTION_SUPPORT
 	select BOOT_IMG_HASH_ALG_SHA256_ALLOW
-	select BOOT_AES_MBEDTLS_DEPENDENCIES if MBEDTLS_BUILTIN && BOOT_ENCRYPT_IMAGE
 
 if BOOT_SIGNATURE_TYPE_RSA
 config BOOT_SIGNATURE_TYPE_RSA_LEN