From 60769762d2440214e7b716a5ffcd9d3af44e88d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Thu, 26 Sep 2024 09:54:30 +0200 Subject: [PATCH] Clarify the superset rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Manuel Pégourié-Gonnard --- .../psa-migration/transition-guards.md | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/docs/architecture/psa-migration/transition-guards.md b/docs/architecture/psa-migration/transition-guards.md index 1193f75137..b72abfa140 100644 --- a/docs/architecture/psa-migration/transition-guards.md +++ b/docs/architecture/psa-migration/transition-guards.md @@ -88,9 +88,11 @@ domain, needs a hash. (Note that this includes `ENTROPY_C`, so in practice `MD_LIGHT` is enabled in most builds.) Note that there is a rule, enforced by `config_adjust_psa_superset_legacy.h`, -that all hashes that are enabled on the legacy side are also enabled on the -PSA side. So, in practice, when `MD_LIGHT` is enabled, `PSA_WANT_ALG_xxx` and -`MBEDTLS_MD_CAN_xxx` are equivalent. +that as soon as `PSA_CRYPTO_C` is enabled, all hashes that are enabled on the +legacy side are also enabled on the PSA side (the converse is not true: a hash +that's provided by a driver will typically be available only on the PSA side). So, in +practice, when `PSA_CRYPTO_C` and `MD_LIGHT` are both enabled, +`PSA_WANT_ALG_xxx` and `MBEDTLS_MD_CAN_xxx` are equivalent. **Legacy and `USE_PSA` domains:** for hashes, `MBEDTLS_MD_CAN_xxx` (where `xxx` is the legacy name of the hash) can be used everywhere (except in the @@ -220,9 +222,12 @@ this implies support for the corresponding key type). ECC --- -**Curves:** in `config_adjut_psa_superset_legacy.h` we ensure that all +**Curves:** in `config_adjut_psa_superset_legacy.h` we ensure that, as soon as +`PSA_CRYPTO_C` is enabled, all curves that are supported on the legacy side (`MBEDTLS_ECP_DP_xxx_ENABLED`) -are also supported on the PSA side (`PSA_WANT_ECC_xxx`). +are also supported on the PSA side (`PSA_WANT_ECC_xxx`). (The converse is not +true as a curve provided by a driver will typically only be available on the +PSA side). In `config_adjust_legacy_crypto.h` we define macros `MBEDTLS_ECP_HAVE_xxx`. These macros are useful for data and functions that have users in several