Commit 2f6ea8ed authored by Valerio Setti's avatar Valerio Setti Committed by Benjamin Cabé
Browse files

mbedtls: add Kconfig symbol CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS 

Adding the Kconfig symbol CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS
to allow Mbed TLS's PSA Crypto core to use static key buffers
to store key's material. This helps reducing heap memory
usage and, potentially, it also discard code implementing
heap memory management if there's no other module in the build
that makes use of it.

Signed-off-by: default avatarValerio Setti <vsetti@baylibre.com>
parent f0944a2b

doc/releases/release-notes-4.1.rst

+6 −0
Changes for doc/releases/release-notes-4.1.rst: 6 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -267,6 +267,12 @@ Libraries / Subsystems 


* Crypto



  * The Kconfig symbol :kconfig:option:`CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS` was

    added to allow Mbed TLS to use statically allocated buffers to store key material

    in its PSA Crypto core instead of heap-allocated ones. This can help reduce

    (or remove, if no other component makes use of it) heap memory requirements

    from the final application.



* CMSIS-NN



* FPGA

modules/mbedtls/Kconfig.tls-generic

+18 −1
Changes for modules/mbedtls/Kconfig.tls-generic: 18 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -554,9 +554,10 @@ config MBEDTLS_LMS 
	depends on MBEDTLS_SHA256

	select PSA_WANT_ALG_SHA_256



if MBEDTLS_PSA_CRYPTO_C



config MBEDTLS_PSA_P256M_DRIVER_ENABLED

	bool "P256-M driver"

	depends on MBEDTLS_PSA_CRYPTO_C

	imply PSA_WANT_ALG_SHA_256

	help

	  Enable support for the optimized sofware implementation of the secp256r1
@@ -570,6 +571,22 @@ config MBEDTLS_PSA_P256M_DRIVER_RAW 
	  Warning: Usage of this Kconfig option is prohibited in Zephyr's codebase.

	           Users can enable it in case of very memory-constrained devices, but be aware that the p256-m interface is absolutely not guaranted to remain stable over time.



config MBEDTLS_PSA_STATIC_KEY_SLOTS

	bool "Use statically allocated key buffers to store key material"

	default y if !MBEDTLS_ENABLE_HEAP

	help

	  By default Mbed TLS's PSA Crypto core uses heap memory to store the

	  key material for each key slot. This might impose an undesired

	  requirement to support heap memory and its management code, affecting

	  RAM and ROM footprints at the same time.

	  Enabling this symbol causes Mbed TLS to pre-allocate all the key slot

	  buffers that are used to store the key material at build time, thus

	  removing the need for heap memory. Each buffer will be sized to

	  contain the largest asymmetric/symmetric key type enabled in the build

	  through PSA_WANT symbols.



endif # MBEDTLS_PSA_CRYPTO_C



config MBEDTLS_SSL_DTLS_CONNECTION_ID

	bool "DTLS Connection ID extension"

	depends on MBEDTLS_DTLS

modules/mbedtls/configs/config-tls-generic.h

+4 −0
Changes for modules/mbedtls/configs/config-tls-generic.h: 4 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -494,6 +494,10 @@ 


#endif /* CONFIG_MBEDTLS_PSA_CRYPTO_C */



#if defined(CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS)

#define MBEDTLS_PSA_STATIC_KEY_SLOTS

#endif



#if defined(CONFIG_MBEDTLS_USE_PSA_CRYPTO)

#define MBEDTLS_USE_PSA_CRYPTO

#endif

tests/crypto/secp256r1/mbedtls.conf

+1 −0
Changes for tests/crypto/secp256r1/mbedtls.conf: 1 added line, 0 removed lines.
Original line number Diff line number Diff line 
CONFIG_MBEDTLS=y

CONFIG_MBEDTLS_PSA_CRYPTO_C=y

CONFIG_MBEDTLS_PSA_P256M_DRIVER_ENABLED=y

CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS=y



CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y

CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y

CRA Git | Maintained and supported by SUSTech CRA and CCSE