Skip to content

Commit 8783ef8

Browse files
frkvtomi-font
frkv
authored and
tomi-font
committed
[nrf noup] mbedtls: Remove unsupported algorithms in PSA crypto
-This commit is a [nrf noup] because it removes configuration options for cryptographic algortihms available in Mbed TLS but which is not actively supported in nRF Connect SDK. The list of algorithms removed: - AES CFB - Cipher Feedback block cipher - AES OFB - Output Feedback block cipher - FFDH - RIPEMD160 - Aria - Camellia - DES The removal of these algorithms is based both on a wish to remove weaker cryptography and unsupported features in the products we have today. Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>
1 parent c575be8 commit 8783ef8

5 files changed

Lines changed: 1 addition & 94 deletions

File tree

‎modules/mbedtls/Kconfig.psa.auto‎

Lines changed: 0 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,6 @@ config PSA_WANT_ALG_CMAC
3030
bool "PSA_WANT_ALG_CMAC" if !MBEDTLS_PROMPTLESS
3131
default y if PSA_CRYPTO_ENABLE_ALL
3232

33-
config PSA_WANT_ALG_CFB
34-
bool "PSA_WANT_ALG_CFB" if !MBEDTLS_PROMPTLESS
35-
default y if PSA_CRYPTO_ENABLE_ALL
36-
3733
config PSA_WANT_ALG_CHACHA20_POLY1305
3834
bool "PSA_WANT_ALG_CHACHA20_POLY1305" if !MBEDTLS_PROMPTLESS
3935
default y if PSA_CRYPTO_ENABLE_ALL
@@ -54,10 +50,6 @@ config PSA_WANT_ALG_ECDH
5450
bool "PSA_WANT_ALG_ECDH" if !MBEDTLS_PROMPTLESS
5551
default y if PSA_CRYPTO_ENABLE_ALL
5652

57-
config PSA_WANT_ALG_FFDH
58-
bool "PSA_WANT_ALG_FFDH" if !MBEDTLS_PROMPTLESS
59-
default y if PSA_CRYPTO_ENABLE_ALL
60-
6153
config PSA_WANT_ALG_ECDSA
6254
bool "PSA_WANT_ALG_ECDSA" if !MBEDTLS_PROMPTLESS
6355
default y if PSA_CRYPTO_ENABLE_ALL
@@ -94,9 +86,6 @@ config PSA_WANT_ALG_MD5
9486
help
9587
The MD5 hash algorithm is weak, deprecated, and should not be used.
9688

97-
config PSA_WANT_ALG_OFB
98-
bool "PSA_WANT_ALG_OFB" if !MBEDTLS_PROMPTLESS
99-
default y if PSA_CRYPTO_ENABLE_ALL
10089

10190
config PSA_WANT_ALG_PBKDF2_HMAC
10291
bool "PSA_WANT_ALG_PBKDF2_HMAC" if !MBEDTLS_PROMPTLESS
@@ -108,9 +97,6 @@ config PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
10897
default y if PSA_CRYPTO_ENABLE_ALL
10998
depends on PSA_WANT_ALG_CMAC
11099

111-
config PSA_WANT_ALG_RIPEMD160
112-
bool "PSA_WANT_ALG_RIPEMD160" if !MBEDTLS_PROMPTLESS
113-
default y if PSA_CRYPTO_ENABLE_ALL
114100

115101
config PSA_WANT_ALG_RSA_OAEP
116102
bool "PSA_WANT_ALG_RSA_OAEP" if !MBEDTLS_PROMPTLESS
@@ -232,26 +218,6 @@ config PSA_WANT_ECC_SECP_R1_521
232218
bool "PSA_WANT_ECC_SECP_R1_521" if !MBEDTLS_PROMPTLESS
233219
default y if PSA_CRYPTO_ENABLE_ALL
234220

235-
config PSA_WANT_DH_RFC7919_2048
236-
bool "PSA_WANT_DH_RFC7919_2048" if !MBEDTLS_PROMPTLESS
237-
default y if PSA_CRYPTO_ENABLE_ALL
238-
239-
config PSA_WANT_DH_RFC7919_3072
240-
bool "PSA_WANT_DH_RFC7919_3072" if !MBEDTLS_PROMPTLESS
241-
default y if PSA_CRYPTO_ENABLE_ALL
242-
243-
config PSA_WANT_DH_RFC7919_4096
244-
bool "PSA_WANT_DH_RFC7919_4096" if !MBEDTLS_PROMPTLESS
245-
default y if PSA_CRYPTO_ENABLE_ALL
246-
247-
config PSA_WANT_DH_RFC7919_6144
248-
bool "PSA_WANT_DH_RFC7919_6144" if !MBEDTLS_PROMPTLESS
249-
default y if PSA_CRYPTO_ENABLE_ALL
250-
251-
config PSA_WANT_DH_RFC7919_8192
252-
bool "PSA_WANT_DH_RFC7919_8192" if !MBEDTLS_PROMPTLESS
253-
default y if PSA_CRYPTO_ENABLE_ALL
254-
255221
config PSA_WANT_KEY_TYPE_DERIVE
256222
bool "PSA_WANT_KEY_TYPE_DERIVE" if !MBEDTLS_PROMPTLESS
257223
default y if PSA_CRYPTO_ENABLE_ALL
@@ -272,14 +238,6 @@ config PSA_WANT_KEY_TYPE_AES
272238
bool "PSA_WANT_KEY_TYPE_AES" if !MBEDTLS_PROMPTLESS
273239
default y if PSA_CRYPTO_ENABLE_ALL
274240

275-
config PSA_WANT_KEY_TYPE_ARIA
276-
bool "PSA_WANT_KEY_TYPE_ARIA" if !MBEDTLS_PROMPTLESS
277-
default y if PSA_CRYPTO_ENABLE_ALL
278-
279-
config PSA_WANT_KEY_TYPE_CAMELLIA
280-
bool "PSA_WANT_KEY_TYPE_CAMELLIA" if !MBEDTLS_PROMPTLESS
281-
default y if PSA_CRYPTO_ENABLE_ALL
282-
283241
config PSA_WANT_KEY_TYPE_CHACHA20
284242
bool "PSA_WANT_KEY_TYPE_CHACHA20" if !MBEDTLS_PROMPTLESS
285243
default y if PSA_CRYPTO_ENABLE_ALL
@@ -290,10 +248,6 @@ config PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY
290248
bool "PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY" if !MBEDTLS_PROMPTLESS
291249
default y if PSA_CRYPTO_ENABLE_ALL
292250

293-
config PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY
294-
bool "PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY" if !MBEDTLS_PROMPTLESS
295-
default y if PSA_CRYPTO_ENABLE_ALL
296-
297251
config PSA_WANT_KEY_TYPE_RAW_DATA
298252
bool "PSA_WANT_KEY_TYPE_RAW_DATA" if !MBEDTLS_PROMPTLESS
299253
default y if PSA_CRYPTO_ENABLE_ALL
@@ -330,16 +284,4 @@ config PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
330284
bool "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE" if !MBEDTLS_PROMPTLESS
331285
default y if PSA_CRYPTO_ENABLE_ALL
332286

333-
config PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT
334-
bool "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT" if !MBEDTLS_PROMPTLESS
335-
default y if PSA_CRYPTO_ENABLE_ALL
336-
337-
config PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT
338-
bool "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT" if !MBEDTLS_PROMPTLESS
339-
default y if PSA_CRYPTO_ENABLE_ALL
340-
341-
config PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE
342-
bool "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE" if !MBEDTLS_PROMPTLESS
343-
default y if PSA_CRYPTO_ENABLE_ALL
344-
345287
endif # PSA_CRYPTO

‎modules/mbedtls/Kconfig.psa.logic‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,3 @@ config PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
4747
depends on PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT || \
4848
PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT || \
4949
PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
50-
51-
config PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC
52-
bool
53-
default y
54-
depends on PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT || \
55-
PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT || \
56-
PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE

‎modules/mbedtls/Kconfig.tf-psa-crypto‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ comment "Supported ciphers and cipher modes"
2727
config MBEDTLS_CIPHER_ALL_ENABLED
2828
bool "All available ciphers and modes"
2929
select PSA_WANT_KEY_TYPE_AES
30-
select PSA_WANT_KEY_TYPE_CAMELLIA
3130
select PSA_WANT_KEY_TYPE_CHACHA20
3231
select PSA_WANT_ALG_GCM
3332
select PSA_WANT_ALG_CCM
@@ -40,8 +39,7 @@ config MBEDTLS_SOME_AEAD_CIPHER_ENABLED
4039
bool
4140
default y
4241
depends on \
43-
PSA_WANT_KEY_TYPE_AES || \
44-
PSA_WANT_KEY_TYPE_CAMELLIA
42+
PSA_WANT_KEY_TYPE_AES
4543

4644
config MBEDTLS_SOME_CIPHER_ENABLED
4745
bool

‎tests/benchmarks/mbedtls/prj.conf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ CONFIG_PSA_WANT_ALG_SHA_384=y
1010
CONFIG_PSA_WANT_ALG_SHA_512=y
1111

1212
CONFIG_PSA_WANT_KEY_TYPE_AES=y
13-
CONFIG_PSA_WANT_KEY_TYPE_ARIA=y
14-
CONFIG_PSA_WANT_KEY_TYPE_CAMELLIA=y
1513
CONFIG_PSA_WANT_ALG_ECB_NO_PADDING=y
1614

1715
CONFIG_MAIN_STACK_SIZE=4096

‎tests/benchmarks/mbedtls/src/benchmark.c‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -112,30 +112,6 @@ int main(void)
112112
printk("Failed to import AES key (%d)", status);
113113
}
114114

115-
status = make_cipher_key(PSA_KEY_TYPE_ARIA, PSA_ALG_ECB_NO_PADDING, &key_id);
116-
if (status == PSA_SUCCESS) {
117-
COMPUTE_THROUGHPUT("ARIA-256-ECB",
118-
psa_cipher_encrypt(key_id, PSA_ALG_ECB_NO_PADDING,
119-
in_buf, sizeof(in_buf),
120-
out_buf, sizeof(out_buf), &out_len)
121-
);
122-
psa_destroy_key(key_id);
123-
} else {
124-
printk("Failed to import ARIA key (%d)", status);
125-
}
126-
127-
status = make_cipher_key(PSA_KEY_TYPE_CAMELLIA, PSA_ALG_ECB_NO_PADDING, &key_id);
128-
if (status == PSA_SUCCESS) {
129-
COMPUTE_THROUGHPUT("CAMELLIA-256-ECB",
130-
psa_cipher_encrypt(key_id, PSA_ALG_ECB_NO_PADDING,
131-
in_buf, sizeof(in_buf),
132-
out_buf, sizeof(out_buf), &out_len)
133-
);
134-
psa_destroy_key(key_id);
135-
} else {
136-
printk("Failed to import Camellia key (%d)", status);
137-
}
138-
139115
printk("Benchmark completed\n");
140116
return 0;
141117
}

0 commit comments

Comments
 (0)