Hi Philippe, On Tue, Mar 31, 2026 at 9:00 AM Philippe Reynes <[email protected]> wrote: > > Hi Raymond, > > > Sorry for this very later answer. > > > Le 20/02/2026 à 16:18, Raymond Mao a écrit : > > This Mail comes from Outside of SoftAtHome: Do not answer, click links or > > open attachments unless you recognize the sender and know the content is > > safe. > > > > Hi Philippe, > > > > On Thu, Feb 19, 2026 at 8:26 AM Philippe Reynes > > <[email protected]> wrote: > >> Enables the support of ecc in mbedtls. > >> > >> Signed-off-by: Philippe Reynes <[email protected]> > >> --- > >> v2: > >> - move ecdsa to MBEDTLS_LIB_X509 > >> - enhance depencendies > >> > >> configs/amd_versal2_virt_defconfig | 1 + > >> configs/qemu_arm64_lwip_defconfig | 1 + > >> configs/starfive_visionfive2_defconfig | 1 + > >> configs/xilinx_versal_net_virt_defconfig | 1 + > >> configs/xilinx_versal_virt_defconfig | 1 + > >> configs/xilinx_zynqmp_kria_defconfig | 1 + > >> configs/xilinx_zynqmp_virt_defconfig | 1 + > >> lib/mbedtls/Kconfig | 16 ++++++++++++++++ > >> lib/mbedtls/Makefile | 16 +++++++++------- > >> lib/mbedtls/mbedtls_def_config.h | 18 ++++++++++++++++++ > >> 10 files changed, 50 insertions(+), 7 deletions(-) > >> > >> diff --git a/configs/amd_versal2_virt_defconfig > >> b/configs/amd_versal2_virt_defconfig > >> index 0344089030c..702bf28405d 100644 > >> --- a/configs/amd_versal2_virt_defconfig > >> +++ b/configs/amd_versal2_virt_defconfig > >> @@ -164,6 +164,7 @@ CONFIG_VIRTIO_MMIO=y > >> CONFIG_VIRTIO_NET=y > >> CONFIG_VIRTIO_BLK=y > >> CONFIG_MBEDTLS_LIB=y > >> +CONFIG_ECDSA=y > >> CONFIG_TPM=y > >> # CONFIG_OPTEE_LIB is not set > >> CONFIG_TOOLS_MKFWUMDATA=y > >> diff --git a/configs/qemu_arm64_lwip_defconfig > >> b/configs/qemu_arm64_lwip_defconfig > >> index a974970c3d3..ab6302b67eb 100644 > >> --- a/configs/qemu_arm64_lwip_defconfig > >> +++ b/configs/qemu_arm64_lwip_defconfig > >> @@ -11,3 +11,4 @@ CONFIG_CMD_WGET=y > >> CONFIG_EFI_HTTP_BOOT=y > >> CONFIG_WGET_HTTPS=y > >> CONFIG_WGET_CACERT=y > >> +CONFIG_ECDSA=y > >> diff --git a/configs/starfive_visionfive2_defconfig > >> b/configs/starfive_visionfive2_defconfig > >> index a754134a313..508bd465704 100644 > >> --- a/configs/starfive_visionfive2_defconfig > >> +++ b/configs/starfive_visionfive2_defconfig > >> @@ -156,3 +156,4 @@ CONFIG_USB_GADGET=y > >> CONFIG_WDT=y > >> CONFIG_WDT_STARFIVE=y > >> CONFIG_MBEDTLS_LIB=y > >> +CONFIG_ECDSA=y > >> diff --git a/configs/xilinx_versal_net_virt_defconfig > >> b/configs/xilinx_versal_net_virt_defconfig > >> index 323b5606566..8b760beab03 100644 > >> --- a/configs/xilinx_versal_net_virt_defconfig > >> +++ b/configs/xilinx_versal_net_virt_defconfig > >> @@ -154,4 +154,5 @@ CONFIG_VIRTIO_MMIO=y > >> CONFIG_VIRTIO_NET=y > >> CONFIG_VIRTIO_BLK=y > >> CONFIG_MBEDTLS_LIB=y > >> +CONFIG_ECDSA=y > >> CONFIG_TPM=y > >> diff --git a/configs/xilinx_versal_virt_defconfig > >> b/configs/xilinx_versal_virt_defconfig > >> index 652121e27a0..6dd8620cf51 100644 > >> --- a/configs/xilinx_versal_virt_defconfig > >> +++ b/configs/xilinx_versal_virt_defconfig > >> @@ -168,5 +168,6 @@ CONFIG_VIRTIO_MMIO=y > >> CONFIG_VIRTIO_NET=y > >> CONFIG_VIRTIO_BLK=y > >> CONFIG_MBEDTLS_LIB=y > >> +CONFIG_ECDSA=y > >> CONFIG_TPM=y > >> CONFIG_TOOLS_MKFWUMDATA=y > >> diff --git a/configs/xilinx_zynqmp_kria_defconfig > >> b/configs/xilinx_zynqmp_kria_defconfig > >> index 8ad05e37189..d23452e96d0 100644 > >> --- a/configs/xilinx_zynqmp_kria_defconfig > >> +++ b/configs/xilinx_zynqmp_kria_defconfig > >> @@ -219,6 +219,7 @@ CONFIG_VIRTIO_BLK=y > >> CONFIG_BINMAN_DTB="./arch/arm/dts/zynqmp-binman-som.dtb" > >> CONFIG_PANIC_HANG=y > >> CONFIG_MBEDTLS_LIB=y > >> +CONFIG_ECDSA=y > >> CONFIG_TPM=y > >> CONFIG_SPL_GZIP=y > >> CONFIG_TOOLS_MKFWUMDATA=y > >> diff --git a/configs/xilinx_zynqmp_virt_defconfig > >> b/configs/xilinx_zynqmp_virt_defconfig > >> index bb79ddf989e..01370a215d4 100644 > >> --- a/configs/xilinx_zynqmp_virt_defconfig > >> +++ b/configs/xilinx_zynqmp_virt_defconfig > >> @@ -237,6 +237,7 @@ CONFIG_VIRTIO_BLK=y > >> CONFIG_BINMAN_DTB="./arch/arm/dts/zynqmp-binman.dtb" > >> CONFIG_PANIC_HANG=y > >> CONFIG_MBEDTLS_LIB=y > >> +CONFIG_ECDSA=y > >> CONFIG_TPM=y > >> CONFIG_SPL_GZIP=y > >> CONFIG_TOOLS_MKFWUMDATA=y > >> diff --git a/lib/mbedtls/Kconfig b/lib/mbedtls/Kconfig > >> index 789721ee6cd..8bf8809198f 100644 > >> --- a/lib/mbedtls/Kconfig > >> +++ b/lib/mbedtls/Kconfig > >> @@ -242,11 +242,16 @@ config MBEDTLS_LIB_X509 > >> select X509_CERTIFICATE_PARSER_MBEDTLS if X509_CERTIFICATE_PARSER > >> select PKCS7_MESSAGE_PARSER_MBEDTLS if PKCS7_MESSAGE_PARSER > >> select MSCODE_PARSER_MBEDTLS if MSCODE_PARSER > >> + select ECDSA_MBEDTLS if ECDSA > >> help > >> Enable MbedTLS certificate libraries. > >> > >> if MBEDTLS_LIB_X509 > >> > >> +config BIGNUM_MBEDTLS > >> + bool > >> + default n > >> + > >> config ASN1_DECODER_MBEDTLS > >> bool "ASN1 decoder with MbedTLS certificate library" > >> depends on MBEDTLS_LIB_X509 && ASN1_DECODER > >> @@ -264,6 +269,7 @@ config RSA_PUBLIC_KEY_PARSER_MBEDTLS > >> bool "RSA public key parser with MbedTLS certificate library" > >> depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS > >> select ASN1_DECODER_MBEDTLS > >> + select BIGNUM_MBEDTLS > >> help > >> This option chooses MbedTLS certificate library for RSA public > >> key > >> parser. > >> @@ -292,6 +298,15 @@ config MSCODE_PARSER_MBEDTLS > >> This option chooses MbedTLS certificate library for MS > >> authenticode > >> parser. > >> > >> +config ECDSA_MBEDTLS > >> + bool "Enable ECDSA support with MbedTLS certificate library" > >> + depends on MBEDTLS_LIB_X509 > >> + select ASN1_DECODER > > This should be ASN1_DECODER_MBEDTLS. > > It was my first try, but I reach an issue. > If ASN1_DECODER is not selected and we select ASN1_DECODER_MBEDTLS, > there is a conflict because > ASN1_DECODER_MBEDTLS depends on ASN1_DECODER. So to avoid this issue, I > have kept ASN1_DECODER in V3. >
The dependency is intentional, I think you should have something like: config ECDSA select ASN1_DECODER config MBEDTLS_LIB_X509 select ASN1_DECODER_MBEDTLS if ASN1_DECODER config ECDSA_MBEDTLS select ECDSA select MBEDTLS_LIB_X509 This makes the kconfig dependency clear - all _MBEDTLS switches are under their origin. Regards, Raymond > Regards, > Philippe > > > > > > > >> + select BIGNUM_MBEDTLS > >> + help > >> + This option enables support of ECDSA with the MbedTLS certificate > >> + library. > >> + > >> endif # MBEDTLS_LIB_X509 > >> > >> config MBEDTLS_LIB_TLS > >> @@ -301,6 +316,7 @@ config MBEDTLS_LIB_TLS > >> depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS > >> depends on ASN1_DECODER_MBEDTLS > >> depends on MBEDTLS_LIB > >> + depends on ECDSA_MBEDTLS > >> help > >> Enable MbedTLS TLS library. Required for HTTPs support > >> in wget > >> diff --git a/lib/mbedtls/Makefile b/lib/mbedtls/Makefile > >> index c5b445bd85c..5433e17cc64 100644 > >> --- a/lib/mbedtls/Makefile > >> +++ b/lib/mbedtls/Makefile > >> @@ -39,13 +39,14 @@ mbedtls_lib_crypto-$(CONFIG_$(PHASE_)HKDF_MBEDTLS) += \ > >> # MbedTLS X509 library > >> obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_X509) += mbedtls_lib_x509.o > >> mbedtls_lib_x509-y := $(MBEDTLS_LIB_DIR)/x509.o > >> +mbedtls_lib_x509-$(CONFIG_$(PHASE_)BIGNUM_MBEDTLS) += \ > >> + $(MBEDTLS_LIB_DIR)/bignum.o \ > >> + $(MBEDTLS_LIB_DIR)/bignum_core.o > >> mbedtls_lib_x509-$(CONFIG_$(PHASE_)ASN1_DECODER_MBEDTLS) += \ > >> $(MBEDTLS_LIB_DIR)/asn1parse.o \ > >> $(MBEDTLS_LIB_DIR)/asn1write.o \ > >> $(MBEDTLS_LIB_DIR)/oid.o > >> mbedtls_lib_x509-$(CONFIG_$(PHASE_)RSA_PUBLIC_KEY_PARSER_MBEDTLS) += \ > >> - $(MBEDTLS_LIB_DIR)/bignum.o \ > >> - $(MBEDTLS_LIB_DIR)/bignum_core.o \ > >> $(MBEDTLS_LIB_DIR)/rsa.o \ > >> $(MBEDTLS_LIB_DIR)/rsa_alt_helpers.o > >> mbedtls_lib_x509-$(CONFIG_$(PHASE_)ASYMMETRIC_PUBLIC_KEY_MBEDTLS) += \ > >> @@ -57,6 +58,12 @@ > >> mbedtls_lib_x509-$(CONFIG_$(PHASE_)X509_CERTIFICATE_PARSER_MBEDTLS) += \ > >> $(MBEDTLS_LIB_DIR)/x509_crt.o > >> mbedtls_lib_x509-$(CONFIG_$(PHASE_)PKCS7_MESSAGE_PARSER_MBEDTLS) += \ > >> $(MBEDTLS_LIB_DIR)/pkcs7.o > >> +mbedtls_lib_x509-$(CONFIG_$(PHASE_)ECDSA_MBEDTLS) += \ > >> + $(MBEDTLS_LIB_DIR)/ecdsa.o \ > >> + $(MBEDTLS_LIB_DIR)/ecp.o \ > >> + $(MBEDTLS_LIB_DIR)/ecp_curves.o \ > >> + $(MBEDTLS_LIB_DIR)/ecp_curves_new.o \ > >> + $(MBEDTLS_LIB_DIR)/pk_ecc.o > >> > >> #mbedTLS TLS support > >> obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_TLS) += mbedtls_lib_tls.o > >> @@ -64,7 +71,6 @@ mbedtls_lib_tls-y := \ > >> $(MBEDTLS_LIB_DIR)/mps_reader.o \ > >> $(MBEDTLS_LIB_DIR)/mps_trace.o \ > >> $(MBEDTLS_LIB_DIR)/net_sockets.o \ > >> - $(MBEDTLS_LIB_DIR)/pk_ecc.o \ > >> $(MBEDTLS_LIB_DIR)/ssl_cache.o \ > >> $(MBEDTLS_LIB_DIR)/ssl_ciphersuites.o \ > >> $(MBEDTLS_LIB_DIR)/ssl_client.o \ > >> @@ -82,8 +88,4 @@ mbedtls_lib_tls-y := \ > >> $(MBEDTLS_LIB_DIR)/cipher.o \ > >> $(MBEDTLS_LIB_DIR)/cipher_wrap.o \ > >> $(MBEDTLS_LIB_DIR)/ecdh.o \ > >> - $(MBEDTLS_LIB_DIR)/ecdsa.o \ > >> - $(MBEDTLS_LIB_DIR)/ecp.o \ > >> - $(MBEDTLS_LIB_DIR)/ecp_curves.o \ > >> - $(MBEDTLS_LIB_DIR)/ecp_curves_new.o \ > >> $(MBEDTLS_LIB_DIR)/gcm.o \ > >> diff --git a/lib/mbedtls/mbedtls_def_config.h > >> b/lib/mbedtls/mbedtls_def_config.h > >> index dda3f4dd6e4..7d60bcc52aa 100644 > >> --- a/lib/mbedtls/mbedtls_def_config.h > >> +++ b/lib/mbedtls/mbedtls_def_config.h > >> @@ -89,6 +89,24 @@ > >> #define MBEDTLS_ASN1_WRITE_C > >> #endif > >> > >> +#if CONFIG_IS_ENABLED(ECDSA_MBEDTLS) > > In the 'mbedtls_def_config.h' file, we use the kconfigs without the > > '_MBEDTLS' postfix. > > > > Regards, > > Raymond > > > >> +#define MBEDTLS_ECDSA_C > >> +#define MBEDTLS_ECP_C > >> +#define MBEDTLS_BIGNUM_C > >> +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED > >> +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED > >> +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED > >> +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED > >> +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED > >> +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED > >> +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED > >> +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED > >> +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED > >> +#define MBEDTLS_ECP_DP_BP256R1_ENABLED > >> +#define MBEDTLS_ECP_DP_BP384R1_ENABLED > >> +#define MBEDTLS_ECP_DP_BP512R1_ENABLED > >> +#endif > >> + > >> #endif /* #if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */ > >> > >> #if CONFIG_IS_ENABLED(MBEDTLS_LIB_TLS) > >> -- > >> 2.43.0 > >>
