From d3b11571e2707624fb168b3ea106da70d3ba4522 Mon Sep 17 00:00:00 2001 From: Ryan Everett Date: Thu, 25 Apr 2024 14:34:33 +0100 Subject: [PATCH] Add a crypto-config file for symmetric-only Replaces legacy symbols with the PSA equivalents. This doesn't change the code generated when this config is active Signed-off-by: Ryan Everett --- configs/config-symmetric-only.h | 31 +++------------ configs/crypto-config-symmetric-only.h | 55 ++++++++++++++++++++++++++ 2 files changed, 60 insertions(+), 26 deletions(-) create mode 100644 configs/crypto-config-symmetric-only.h diff --git a/configs/config-symmetric-only.h b/configs/config-symmetric-only.h index 512dd7616c..ad6a4419c3 100644 --- a/configs/config-symmetric-only.h +++ b/configs/config-symmetric-only.h @@ -8,18 +8,17 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ +#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/crypto-config-symmetric-only.h" + +#define MBEDTLS_PSA_CRYPTO_CONFIG + /* System support */ //#define MBEDTLS_HAVE_ASM #define MBEDTLS_HAVE_TIME #define MBEDTLS_HAVE_TIME_DATE /* Mbed TLS feature support */ -#define MBEDTLS_CIPHER_MODE_CBC -#define MBEDTLS_CIPHER_MODE_CFB -#define MBEDTLS_CIPHER_MODE_CTR -#define MBEDTLS_CIPHER_MODE_OFB #define MBEDTLS_CIPHER_MODE_XTS -#define MBEDTLS_CIPHER_PADDING_PKCS7 #define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS #define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN #define MBEDTLS_CIPHER_PADDING_ZEROS @@ -31,47 +30,27 @@ #define MBEDTLS_VERSION_FEATURES /* Mbed TLS modules */ -#define MBEDTLS_AES_C #define MBEDTLS_ASN1_PARSE_C #define MBEDTLS_ASN1_WRITE_C #define MBEDTLS_BASE64_C -#define MBEDTLS_CAMELLIA_C -#define MBEDTLS_ARIA_C -#define MBEDTLS_CCM_C -#define MBEDTLS_CHACHA20_C -#define MBEDTLS_CHACHAPOLY_C #define MBEDTLS_CIPHER_C -#define MBEDTLS_CMAC_C #define MBEDTLS_CTR_DRBG_C -#define MBEDTLS_DES_C #define MBEDTLS_ENTROPY_C #define MBEDTLS_ERROR_C -#define MBEDTLS_GCM_C -#define MBEDTLS_HKDF_C #define MBEDTLS_HMAC_DRBG_C #define MBEDTLS_NIST_KW_C #define MBEDTLS_MD_C -#define MBEDTLS_MD5_C #define MBEDTLS_OID_C #define MBEDTLS_PEM_PARSE_C #define MBEDTLS_PEM_WRITE_C #define MBEDTLS_PKCS5_C #define MBEDTLS_PKCS12_C #define MBEDTLS_PLATFORM_C -#define MBEDTLS_POLY1305_C #define MBEDTLS_PSA_CRYPTO_C #define MBEDTLS_PSA_CRYPTO_SE_C #define MBEDTLS_PSA_CRYPTO_STORAGE_C #define MBEDTLS_PSA_ITS_FILE_C -#define MBEDTLS_RIPEMD160_C -#define MBEDTLS_SHA1_C -/* The library does not currently support enabling SHA-224 without SHA-256. - * A future version of the library will have this option disabled - * by default. */ -#define MBEDTLS_SHA224_C -#define MBEDTLS_SHA256_C -#define MBEDTLS_SHA384_C -#define MBEDTLS_SHA512_C + //#define MBEDTLS_THREADING_C #define MBEDTLS_TIMING_C #define MBEDTLS_VERSION_C diff --git a/configs/crypto-config-symmetric-only.h b/configs/crypto-config-symmetric-only.h new file mode 100644 index 0000000000..799890d4ef --- /dev/null +++ b/configs/crypto-config-symmetric-only.h @@ -0,0 +1,55 @@ +/** + * \file crypto-config-symmetric-only.h + * + * \brief Crypto configuration without any asymmetric cryptography. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +/** + * To be used in conjunction with configs/config-symmetric-only.h. */ + +#ifndef PSA_CRYPTO_CONFIG_H +#define PSA_CRYPTO_CONFIG_H + +#define PSA_WANT_ALG_CBC_NO_PADDING 1 +#define PSA_WANT_ALG_CBC_PKCS7 1 +#define PSA_WANT_ALG_CCM 1 +#define PSA_WANT_ALG_CCM_STAR_NO_TAG 1 +#define PSA_WANT_ALG_CFB 1 +#define PSA_WANT_ALG_CHACHA20_POLY1305 1 +#define PSA_WANT_ALG_CMAC 1 +#define PSA_WANT_ALG_CTR 1 +#define PSA_WANT_ALG_ECB_NO_PADDING 1 +#define PSA_WANT_ALG_GCM 1 +#define PSA_WANT_ALG_HKDF 1 +#define PSA_WANT_ALG_HKDF_EXTRACT 1 +#define PSA_WANT_ALG_HKDF_EXPAND 1 +#define PSA_WANT_ALG_HMAC 1 +#define PSA_WANT_ALG_MD5 1 +#define PSA_WANT_ALG_OFB 1 +#define PSA_WANT_ALG_RIPEMD160 1 +#define PSA_WANT_ALG_SHA_1 1 +#define PSA_WANT_ALG_STREAM_CIPHER 1 +#define PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS 1 +#define PSA_WANT_ALG_TLS12_PRF 1 +#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1 + +/* The library does not currently support enabling SHA-224 without SHA-256. + * A future version of the library will have this option disabled + * by default. */ +#define PSA_WANT_ALG_SHA_224 1 +#define PSA_WANT_ALG_SHA_256 1 +#define PSA_WANT_ALG_SHA_384 1 +#define PSA_WANT_ALG_SHA_512 1 + +#define PSA_WANT_KEY_TYPE_AES 1 +#define PSA_WANT_KEY_TYPE_ARIA 1 +#define PSA_WANT_KEY_TYPE_CAMELLIA 1 +#define PSA_WANT_KEY_TYPE_CHACHA20 1 +#define PSA_WANT_KEY_TYPE_DES 1 +#define PSA_WANT_KEY_TYPE_HMAC 1 + +#endif /* PSA_CRYPTO_CONFIG_H */