[Backport 3.6] PSA: use static key slots to store keys #9448

valeriosetti · 2024-08-05T14:47:24Z

Description

This is the backport of #9302 to the 3.6 LTS branch.

PR checklist

changelog provided
development PR provided PSA: use static key slots to store keys #9302
framework PR not required
3.6 PR here
2.28 PR not required (new feature, no bug fix)
tests provided

valeriosetti · 2024-08-06T03:25:24Z

I removed the need-ci label because the OpenCI is fine. Failures were only found in the InternalCI (which I cannot check), but since they are not confirmed by the OpenCI, I think they might be spurious failures.

tom-cosgrove-arm · 2024-08-14T09:28:58Z

Note: conflicts

gilles-peskine-arm · 2024-10-07T09:58:26Z

Now that the main PR has been approved, please complete and rebase this backport.

valeriosetti · 2024-10-08T12:58:44Z

I've just backported all the commits from #9302 to mbedtls-3.6. Only some of them required a manual fix, in particular a couple of *.data files (pkwrite and pkparse) that were moved in tf-psa-crypto in the development branch.

tom-cosgrove-arm · 2024-10-08T13:38:48Z

tests/suites/test_suite_pkwrite.data

-depends_on:MBEDTLS_RSA_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_PEM_WRITE_C
-pk_write_pubkey_check:"../framework/data_files/rsa4096_pub.pem":TEST_PEM
+depends_on:MBEDTLS_RSA_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_PEM_WRITE_C:MBEDTLS_TEST_PK_ALLOW_RSA_KEY_PAIR_4096
+pk_write_pubkey_check:"../../framework/data_files/rsa4096_pub.pem":TEST_PEM


How come this line needs ../../framework but line 7 only needs ../framework?

Ops, sorry, that's one of the 2 files who had conflicts during the rebase and apprently I missed a change here :/

…est symbols - MBEDTLS_TEST_STATIC_KEY_SLOTS_SUPPORT_RSA_[2048/4096] are always defined because they are only used in test_suite_psa_crypto tests. - MBEDTLS_TEST_ALLOW_RSA_4096 was renamed as MBEDTLS_TEST_PK_ALLOW_RSA_KEY_PAIR_4096 because this is only used in PK related test suites. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

…r size Instead of skipping some tests when !MBEDTLS_PSA_STATIC_KEY_SLOTS, add a proper check in the depends_on to verify if MBEDTLS_PSA_KEY_BUFFER_MAX_SIZE is actually large enough to contain the key used in such test. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

…EQUEST Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

…RT_RSA_xxx PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE() is not defined when there is no MBEDTLS_PSA_CRYPTO_CLIENT so we need this guard to define MBEDTLS_TEST_STATIC_KEY_SLOTS_SUPPORT_RSA_[2048/4096]. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

MBEDTLS_PSA_KEY_BUFFER_MAX_SIZE is only used in tests so it should not be defined in a public header such as "crypto_extra.h". "psa_crypto_helpers.h" is a better option. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

- psa_crypto_helpers.h mbedtls-3.6 branch misses some crypto client changes that has been done in the development branch since the LTS release. Therefore CRYPTO_C guard here is more accurate than CRYPTO_CLIENT. - entropy.h In the development branch MBEDTLS_ENTROPY_BLOCK_SIZE is defined when PSA_WANT_ALG_SHA_[256/512] is defined while in the mbedtls-3.6 branch is guarded by MBEDTLS_MD_CAN_SHA[256/512] which is slightly different. Since MBEDTLS_ENTROPY_BLOCK_SIZE is used in some tests's data files, we need to have it defined also if the related test is skipped. Therefore we add the PSA_WANT_ALG_SHA conditions together with the MBEDTLS_MD_CAN_SHA ones to mimic the development behavior. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

valeriosetti · 2024-10-22T11:32:21Z

I just backported the same changes done in development #9302 (comment)

gilles-peskine-arm

Looks good to me after rebase from my previous approval at b287a40 to the current head at 40859ac.

tom-cosgrove-arm

LGTM

This commit takes only the relevant part of PR Mbed-TLS/mbedtls#9448 that was merged in upstream Mbed TLS in the LTS branch "mbedtls-3.6". Since the original PR was made of several commits, but most of them were only affecting tests cases (not used in Zephyr), only relevant changes were extracted from the PR and squashed in a single commit. Changes introduced in this commit will be automatically included in 3.6.3, so by the time Zephyr's Mbed TLS fork repo is bumbed to that official release, this commit MUST be discarded. This commit introduces the possibility to use static key slot buffers in the PSA core instead of dynamically allocating them when needed. This helps reducing heap memory usage as well as potentially removing heap management ROM code if heap is not used anywhere else in the Zephyr application. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

This commit takes only relevant changes of PR Mbed-TLS/mbedtls#9448 that was merged in upstream Mbed TLS in the LTS branch "mbedtls-3.6". Since the original PR was made of several commits, but most of them were only affecting tests cases (not used in Zephyr), only changes belonging to the "include" and "library" folders were included here. == IMPORTANT == Changes introduced in this commit will be automatically part of Mbed TLS release 3.6.3, so by the time Zephyr's Mbed TLS fork repo is bumbed to that official release, this commit MUST be discarded. This commit introduces the possibility to use static key slot buffers in the PSA core instead of dynamically allocating them when needed. This helps reducing heap memory usage as well as potentially removing heap management ROM code if heap is not used anywhere else in the Zephyr application. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

This commit takes only relevant changes of PR Mbed-TLS/mbedtls#9448 that was merged in upstream Mbed TLS in the LTS branch "mbedtls-3.6". Since the original PR was made of several commits, but most of them were only affecting tests cases (not used in Zephyr), only changes belonging to the "include" and "library" folders were included here. == IMPORTANT == Changes introduced in this commit will be automatically part of Mbed TLS release 3.6.3, so by the time Zephyr's Mbed TLS fork repo is bumbed to that official release, this commit MUST be discarded. This commit introduces the possibility to use static key slot buffers in the PSA core instead of dynamically allocating them when needed. This helps reducing heap memory usage as well as potentially removing heap management ROM code if heap is not used anywhere else in the Zephyr application. Signed-off-by: Valerio Setti <vsetti@baylibre.com> Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no> (Cherry-picked from commit 4952e13)

This commit takes only relevant changes of PR Mbed-TLS/mbedtls#9448 that was merged in upstream Mbed TLS in the LTS branch "mbedtls-3.6". Since the original PR was made of several commits, but most of them were only affecting tests cases (not used in Zephyr), only changes belonging to the "include" and "library" folders were included here. == IMPORTANT == Changes introduced in this commit will be automatically part of Mbed TLS release 3.6.3, so by the time Zephyr's Mbed TLS fork repo is bumbed to that official release, this commit MUST be discarded. This commit introduces the possibility to use static key slot buffers in the PSA core instead of dynamically allocating them when needed. This helps reducing heap memory usage as well as potentially removing heap management ROM code if heap is not used anywhere else in the Zephyr application. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

valeriosetti requested a review from gilles-peskine-arm August 5, 2024 14:47

valeriosetti self-assigned this Aug 5, 2024

valeriosetti changed the base branch from development to mbedtls-3.6 August 5, 2024 14:47

valeriosetti removed the needs-ci Needs to pass CI tests label Aug 6, 2024

valeriosetti force-pushed the psa-use-static-slots-backport branch from 3b4b7bc to 1c68450 Compare August 6, 2024 13:18

valeriosetti requested a review from adeaarm August 16, 2024 08:28

This was referenced Oct 4, 2024

PSA: use static key slots to store keys #9302

Merged

enhance common_config.py and generate_test_code.py Mbed-TLS/mbedtls-framework#48

Merged

valeriosetti force-pushed the psa-use-static-slots-backport branch from 1c68450 to a65c8a0 Compare October 8, 2024 12:55

valeriosetti requested a review from tom-cosgrove-arm October 8, 2024 12:56

valeriosetti added needs-review Every commit must be reviewed by at least two team members, needs-ci Needs to pass CI tests and removed needs-work labels Oct 8, 2024

tom-cosgrove-arm reviewed Oct 8, 2024

View reviewed changes

valeriosetti force-pushed the psa-use-static-slots-backport branch from a65c8a0 to c6e50d0 Compare October 8, 2024 15:03

valeriosetti requested a review from tom-cosgrove-arm October 8, 2024 15:04

valeriosetti added 12 commits October 22, 2024 13:31

components-basic-checks: add new exception for MBEDTLS_CTR_DRBG_MAX_R…

5fbb0e8

…EQUEST Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

test_suite_psa_crypto.data: fix some depends_on

0c4cacc

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

psa: move definition of MBEDTLS_PSA_KEY_BUFFER_MAX_SIZE

bdfb80b

MBEDTLS_PSA_KEY_BUFFER_MAX_SIZE is only used in tests so it should not be defined in a public header such as "crypto_extra.h". "psa_crypto_helpers.h" is a better option. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Documentation: fix some nits

fe0f09e

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

changelog: describe support for static key slot buffers

d65ed17

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

changelog: updated description

cc27702

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

changelog: updated description

d218b57

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

changelog: fix typo

a71c75f

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

valeriosetti dismissed gilles-peskine-arm’s stale review via 40859ac October 22, 2024 11:31

valeriosetti force-pushed the psa-use-static-slots-backport branch from b287a40 to 40859ac Compare October 22, 2024 11:31

valeriosetti requested a review from gilles-peskine-arm October 22, 2024 11:31

gilles-peskine-arm approved these changes Oct 23, 2024

View reviewed changes

tom-cosgrove-arm approved these changes Oct 24, 2024

View reviewed changes

tom-cosgrove-arm added approved Design and code approved - may be waiting for CI or backports and removed needs-review Every commit must be reviewed by at least two team members, labels Oct 24, 2024

gilles-peskine-arm added this pull request to the merge queue Oct 24, 2024

Merged via the queue into Mbed-TLS:mbedtls-3.6 with commit 0b8b7a1 Oct 24, 2024
4 of 5 checks passed

valeriosetti mentioned this pull request Oct 24, 2024

psa: use static key slot buffers to store key material zephyrproject-rtos/mbedtls#64

Merged

valeriosetti deleted the psa-use-static-slots-backport branch December 6, 2024 08:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Backport 3.6] PSA: use static key slots to store keys #9448

[Backport 3.6] PSA: use static key slots to store keys #9448

Uh oh!

valeriosetti commented Aug 5, 2024 •

edited by gilles-peskine-arm

Loading

Uh oh!

valeriosetti commented Aug 6, 2024

Uh oh!

tom-cosgrove-arm commented Aug 14, 2024

Uh oh!

gilles-peskine-arm commented Oct 7, 2024

Uh oh!

valeriosetti commented Oct 8, 2024

Uh oh!

tom-cosgrove-arm Oct 8, 2024

Uh oh!

valeriosetti Oct 8, 2024

Uh oh!

valeriosetti commented Oct 22, 2024

Uh oh!

gilles-peskine-arm left a comment

Uh oh!

tom-cosgrove-arm left a comment

Uh oh!

Uh oh!

Uh oh!

[Backport 3.6] PSA: use static key slots to store keys #9448

[Backport 3.6] PSA: use static key slots to store keys #9448

Uh oh!

Conversation

valeriosetti commented Aug 5, 2024 • edited by gilles-peskine-arm Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

PR checklist

Uh oh!

valeriosetti commented Aug 6, 2024

Uh oh!

tom-cosgrove-arm commented Aug 14, 2024

Uh oh!

gilles-peskine-arm commented Oct 7, 2024

Uh oh!

valeriosetti commented Oct 8, 2024

Uh oh!

tom-cosgrove-arm Oct 8, 2024

Choose a reason for hiding this comment

Uh oh!

valeriosetti Oct 8, 2024

Choose a reason for hiding this comment

Uh oh!

valeriosetti commented Oct 22, 2024

Uh oh!

gilles-peskine-arm left a comment

Choose a reason for hiding this comment

Uh oh!

tom-cosgrove-arm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

valeriosetti commented Aug 5, 2024 •

edited by gilles-peskine-arm

Loading