doc: Fixed consistency of Mbed term

Size of slots `0x10000` - 64kb

MCUBootApp checks image integrity with SHA256, image authenticity with EC256 digital signature verification and uses completely SW implementation of cryptographic functions based on mbedTLS Library.

MCUBootApp checks image integrity with SHA256, image authenticity with EC256 digital signature verification and uses completely SW implementation of cryptographic functions based on Mbed TLS Library.

**Important**: make sure primary, secondary slot and bootloader app sizes are appropriate and correspond to flash area size defined in Applications' linker files.

### Hardware cryptography acceleration

Cypress PSOC6 MCU family supports hardware acceleration of cryptography based on mbedTLS Library via shim layer. Implementation of this layer is supplied as separate submodule `cy-mbedtls-acceleration`. HW acceleration of cryptography shortens boot time more then 4 times, comparing to software implementation (observation results).

Cypress PSOC6 MCU family supports hardware acceleration of cryptography based on Mbed TLS Library via shim layer. Implementation of this layer is supplied as separate submodule `cy-mbedtls-acceleration`. HW acceleration of cryptography shortens boot time more then 4 times, comparing to software implementation (observation results).

To enable hardware acceleration in `MCUBootApp` pass flag `USE_CRYPTO_HW=1` to `make` while build.

* MCUBooot Library (root repository)

* PSoC6 HAL Library

* PSoC6 Peripheral Drivers Library (PDL)

* mbedTLS Cryptographic Library

* Mbed TLS Cryptographic Library

To get submodules - run the following command:

**Encrypted Image Support**

To protect user image from unwanted read - Upgrade Image Encryption can be applied. The ECDH/HKDF with EC256 scheme is used in a given solution as well as mbedTLS as a crypto provider.

To protect user image from unwanted read - Upgrade Image Encryption can be applied. The ECDH/HKDF with EC256 scheme is used in a given solution as well as Mbed TLS as a crypto provider.

To enable image encryption support use `ENC_IMG=1` build flag (BlinkyApp should also be built with this flash set 1).

It is also possible to place secondary (upgrade) slots in external memory module. In this case primary slot can be doubled in size.

For more details about External Memory usage, please refer to separate guiding document `MCUBootApp/ExternalMemory.md`.

MCUBootApp checks image integrity with SHA256, image authenticity with EC256 digital signature verification and uses either completely software implementation of cryptographic functions or accelerated by hardware - both based on mbedTLS Library.

MCUBootApp checks image integrity with SHA256, image authenticity with EC256 digital signature verification and uses either completely software implementation of cryptographic functions or accelerated by hardware - both based on Mbed TLS Library.

### Downloading Solution's Assets

* MCUBooot Library (root repository)

* PSoC6 Peripheral Drivers Library (PDL)

* mbedTLS Cryptographic Library

* Mbed TLS Cryptographic Library

Those are represented as submodules.

* `MCUboot` doesn't bundle a cryptographic library, which means the target

  OS must already have it bundled. The supported libraries at the moment are

  either `mbed TLS` or the set `tinycrypt` + `mbed TLS` (where `mbed TLS` is

  either `Mbed TLS` or the set `tinycrypt` + `Mbed TLS` (where `Mbed TLS` is

  used to provide functionality not existing in `tinycrypt`).

# Steps to port

**Note:** As of writing, it is possible that MCUboot will open a flash area multiple times simultaneously (through nested calls to `flash_area_open`). As a result, MCUboot may call `flash_area_close` on a flash area that is still opened by another part of MCUboot. As a workaround when porting, it may be necessary to implement a counter of the number of times a given flash area has been opened by MCUboot. The `flash_area_close` implementation should only fully deinitialize the underlying flash area when the open counter is decremented to 0. See [this GitHub PR](https://github.com/mcu-tools/mcuboot/pull/894/) for a more detailed discussion.

## Memory management for mbed TLS

## Memory management for Mbed TLS

`mbed TLS` employs dynamic allocation of memory, making use of the pair

`calloc/free`. If `mbed TLS` is to be used for crypto, your target RTOS

`Mbed TLS` employs dynamic allocation of memory, making use of the pair

`calloc/free`. If `Mbed TLS` is to be used for crypto, your target RTOS

needs to provide this pair of function.

To configure the what functions are called when allocating/deallocating

memory `mbed TLS` uses the following call:

memory `Mbed TLS` uses the following call:

```

int mbedtls_platform_set_calloc_free (void *(*calloc_func)(size_t, size_t),

                                      void (*free_func)(void *));

```

For reference see [mbed TLS platform.h](https://tls.mbed.org/api/platform_8h.html).

For reference see [Mbed TLS platform.h](https://tls.mbed.org/api/platform_8h.html).

If your system already provides functions with compatible signatures, those can

be used directly here, otherwise create new functions that glue to your

`calloc/free` implementations.

shortcut was taken, and these signatures were padded to make them

always a fixed length.  Unfortunately, this padding was done in a way

that is not easily reversible.  Some crypto libraries are fairly

strict about the formatting of the ECDSA signature (specifically, mbed

strict about the formatting of the ECDSA signature (specifically, Mbed

TLS).  This currently means that the ECDSA SECP224R1 (EC) signature

checking code will fail to boot about 1 out of every 256 images,

because the signature itself will end in a 0x00 byte, and the code

    without padding), and the existing EC implementation will begin

    accepting padded and unpadded signatures.

  - An mbed TLS implementation of EC256 can be added, but will require

  - An Mbed TLS implementation of EC256 can be added, but will require

    the `--no-pad-sig` signature to be able to boot all generated

    images (without the argument 3 of out 4 images generated will have

    padding, and be considered invalid).

git submodule update --init --recursive --checkout boot/espressif/hal/esp-idf

```

3. Next, get the mbedtls submodule required by MCUboot.

3. Next, get the Mbed TLS submodule required by MCUboot.

```

git submodule update --init --recursive ext/mbedtls

```