Skip to content

nrf_security: Refactor builtin key handling #17973

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 22, 2024
Merged

nrf_security: Refactor builtin key handling #17973

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2f35117
nrf_security: Refactor builtin key handling
Vge0rge Oct 17, 2024
7bbb88e
tfm: Fix licence issue
Vge0rge Oct 17, 2024
dd3a5f8
nrf_security: Always enable builtin keys for 54L
Vge0rge Oct 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions modules/trusted-firmware-m/tfm_boards/external_core.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
#-------------------------------------------------------------------------------
# Copyright (c) 2024, Arm Limited. All rights reserved.
# Copyright (c) 2024, Nordic Semiconductor ASA.
# Copyright (c) 2024, Nordic Semiconductor
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#
Expand Down Expand Up @@ -93,7 +92,6 @@ if(TARGET psa_crypto_library_config)
target_compile_definitions(psa_crypto_library_config
INTERFACE
MBEDTLS_PSA_CRYPTO_DRIVERS
MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
$<$<BOOL:${CRYPTO_TFM_BUILTIN_KEYS_DRIVER}>:PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER>
)
endif()
Expand Down
8 changes: 0 additions & 8 deletions subsys/nrf_security/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,14 +117,6 @@ target_compile_definitions(psa_crypto_library_config
# The name and intent of this comes from TF-M distribution
add_library(psa_interface INTERFACE)

if(CONFIG_MBEDTLS_ENABLE_BUILTIN_KEYS)
# Add config files required for PSA crypto interface
target_compile_definitions(psa_interface
INTERFACE
MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
)
endif()

# Add the includes from nrf_security, Oberon PSA core, and Arm Mbed TLS
# to the psa_interface library
target_include_directories(psa_interface
Expand Down
6 changes: 3 additions & 3 deletions subsys/nrf_security/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,12 +53,12 @@ config PSA_PROMPTLESS

if NRF_SECURITY

config MBEDTLS_ENABLE_BUILTIN_KEYS
config MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
bool
default y if SOC_SERIES_NRF54LX && (HW_UNIQUE_KEY || IDENTITY_KEY)
default y if SOC_SERIES_NRF54LX && PSA_CRYPTO_DRIVER_CRACEN
default y if SOC_SERIES_NRF54HX && (SOC_NRF54H20_CPUSEC || SOC_NRF54H20_ENGB_CPUSEC)
help
Promptless option used to control if MBEDTLS should have support for builtin keys or not.
Promptless option used to control if the PSA Crypto core should have support for builtin keys or not.

config MBEDTLS_CFG_FILE
string "mbed TLS configuration file"
Expand Down
1 change: 1 addition & 0 deletions subsys/nrf_security/cmake/nrf_config.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ kconfig_check_and_set_base(MBEDTLS_PSA_CRYPTO_CLIENT)
kconfig_check_and_set_base(MBEDTLS_PSA_CRYPTO_C)
kconfig_check_and_set_base(MBEDTLS_USE_PSA_CRYPTO)
kconfig_check_and_set_base(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
kconfig_check_and_set_base(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS)

# Platform
kconfig_check_and_set_base(MBEDTLS_PLATFORM_C)
Expand Down
16 changes: 0 additions & 16 deletions subsys/nrf_security/configs/legacy_crypto_config.h.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1114,22 +1114,6 @@
*/
#cmakedefine MBEDTLS_PKCS1_V21

/** \def MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
*
* Enable support for platform built-in keys. If you enable this feature,
* you must implement the function mbedtls_psa_platform_get_builtin_key().
* See the documentation of that function for more information.
*
* Built-in keys are typically derived from a hardware unique key or
* stored in a secure element.
*
* Requires: MBEDTLS_PSA_CRYPTO_C.
*
* \warning This interface is experimental and may change or be removed
* without notice.
*/
//#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS

/** \def MBEDTLS_PSA_CRYPTO_CLIENT
*
* Enable support for PSA crypto client.
Expand Down
1 change: 1 addition & 0 deletions subsys/nrf_security/configs/nrf-config.h.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
#cmakedefine MBEDTLS_PSA_CRYPTO_CLIENT
#cmakedefine MBEDTLS_PSA_CRYPTO_C
#cmakedefine MBEDTLS_USE_PSA_CRYPTO
#cmakedefine MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
/* Avoid redefinition as TF-M defines this on the command line */
#ifndef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
#cmakedefine MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
Expand Down
2 changes: 1 addition & 1 deletion subsys/nrf_security/src/drivers/cracen/cracenpsa/cracenpsa.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ if(CONFIG_PSA_NEED_CRACEN_MAC_DRIVER)
)
endif()

if(CONFIG_PSA_NEED_CRACEN_KEY_MANAGEMENT_DRIVER OR CONFIG_PSA_NEED_CRACEN_KMU_DRIVER)
if(CONFIG_PSA_NEED_CRACEN_KEY_MANAGEMENT_DRIVER OR CONFIG_PSA_NEED_CRACEN_KMU_DRIVER OR CONFIG_MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS)
list(APPEND cracen_driver_sources
${CMAKE_CURRENT_LIST_DIR}/src/key_management.c
)
Expand Down
Loading