The MbedTLS ECP and ECDSA sources are only built as part of the TLS bundle and their defines sit inside the MBEDTLS_LIB_TLS guard in mbedtls_def_config.h. Elliptic-curve support is therefore unavailable to anything but TLS even though the code is already in tree.
Add MBEDTLS_LIB_ECDSA and move the ECP/ECDSA configuration out of the TLS block. MBEDTLS_LIB_TLS now selects the new symbol and drops those objects from its own bundle so they are built exactly once. pk_ecc.o moves with them: defining MBEDTLS_ECP_C activates the EC key paths in pkparse.c, which is already built for X.509, so it is needed as soon as ECP is enabled rather than only under TLS. Curves are selected individually since the tables are sizeable. On qemu_arm64, P-256 costs about 24 KiB of .text and P-384 a further 6.5 KiB. Signed-off-by: Ayoub Zaki <[email protected]> --- lib/mbedtls/Kconfig | 30 ++++++++++++++++++++++++++++++ lib/mbedtls/Makefile | 14 +++++++++----- lib/mbedtls/mbedtls_def_config.h | 19 +++++++++++++++++++ 3 files changed, 58 insertions(+), 5 deletions(-) diff --git a/lib/mbedtls/Kconfig b/lib/mbedtls/Kconfig index 63ce9360d8e..5cede65b7f8 100644 --- a/lib/mbedtls/Kconfig +++ b/lib/mbedtls/Kconfig @@ -309,8 +309,38 @@ config MSCODE_PARSER_MBEDTLS endif # MBEDTLS_LIB_X509 +config MBEDTLS_LIB_ECDSA + bool "MbedTLS ECDSA library" + depends on MBEDTLS_LIB + select MBEDTLS_LIB_ASN1 + select MBEDTLS_LIB_BIGNUM + help + Enable the MbedTLS elliptic-curve (ECP) and ECDSA modules. This + provides ECDSA signature verification in software, for platforms + with no hardware or ROM-based ECDSA engine. + + The ECP code is sizeable, so enable only the curves actually in use. + +if MBEDTLS_LIB_ECDSA + +config MBEDTLS_ECP_DP_SECP256R1 + bool "NIST P-256 (prime256v1)" + default y + help + Support the NIST P-256 curve, used by the "ecdsa256" FIT signature + algorithm. This is the curve OpenSSL calls "prime256v1". + +config MBEDTLS_ECP_DP_SECP384R1 + bool "NIST P-384 (secp384r1)" + help + Support the NIST P-384 curve, used by the "ecdsa384" FIT signature + algorithm. + +endif # MBEDTLS_LIB_ECDSA + config MBEDTLS_LIB_TLS bool "MbedTLS TLS library" + select MBEDTLS_LIB_ECDSA depends on RSA_PUBLIC_KEY_PARSER_MBEDTLS depends on X509_CERTIFICATE_PARSER_MBEDTLS depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS diff --git a/lib/mbedtls/Makefile b/lib/mbedtls/Makefile index d77af928983..4eee0fcb846 100644 --- a/lib/mbedtls/Makefile +++ b/lib/mbedtls/Makefile @@ -61,13 +61,21 @@ mbedtls_lib_x509-$(CONFIG_$(PHASE_)X509_CERTIFICATE_PARSER_MBEDTLS) += \ mbedtls_lib_x509-$(CONFIG_$(PHASE_)PKCS7_MESSAGE_PARSER_MBEDTLS) += \ $(MBEDTLS_LIB_DIR)/pkcs7.o +# MbedTLS ECDSA library +obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_ECDSA) += mbedtls_lib_ecdsa.o +mbedtls_lib_ecdsa-y := \ + $(MBEDTLS_LIB_DIR)/ecdsa.o \ + $(MBEDTLS_LIB_DIR)/pk_ecc.o \ + $(MBEDTLS_LIB_DIR)/ecp.o \ + $(MBEDTLS_LIB_DIR)/ecp_curves.o \ + $(MBEDTLS_LIB_DIR)/ecp_curves_new.o + #mbedTLS TLS support obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_TLS) += mbedtls_lib_tls.o mbedtls_lib_tls-y := \ $(MBEDTLS_LIB_DIR)/mps_reader.o \ $(MBEDTLS_LIB_DIR)/mps_trace.o \ $(MBEDTLS_LIB_DIR)/net_sockets.o \ - $(MBEDTLS_LIB_DIR)/pk_ecc.o \ $(MBEDTLS_LIB_DIR)/ssl_cache.o \ $(MBEDTLS_LIB_DIR)/ssl_ciphersuites.o \ $(MBEDTLS_LIB_DIR)/ssl_client.o \ @@ -85,8 +93,4 @@ mbedtls_lib_tls-y := \ $(MBEDTLS_LIB_DIR)/cipher.o \ $(MBEDTLS_LIB_DIR)/cipher_wrap.o \ $(MBEDTLS_LIB_DIR)/ecdh.o \ - $(MBEDTLS_LIB_DIR)/ecdsa.o \ - $(MBEDTLS_LIB_DIR)/ecp.o \ - $(MBEDTLS_LIB_DIR)/ecp_curves.o \ - $(MBEDTLS_LIB_DIR)/ecp_curves_new.o \ $(MBEDTLS_LIB_DIR)/gcm.o \ diff --git a/lib/mbedtls/mbedtls_def_config.h b/lib/mbedtls/mbedtls_def_config.h index dda3f4dd6e4..62c6843cdce 100644 --- a/lib/mbedtls/mbedtls_def_config.h +++ b/lib/mbedtls/mbedtls_def_config.h @@ -91,6 +91,25 @@ #endif /* #if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */ +#if CONFIG_IS_ENABLED(MBEDTLS_LIB_ECDSA) + +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_ECP_C +#define MBEDTLS_ECDSA_C +#define MBEDTLS_OID_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C + +#if CONFIG_IS_ENABLED(MBEDTLS_ECP_DP_SECP256R1) +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#endif + +#if CONFIG_IS_ENABLED(MBEDTLS_ECP_DP_SECP384R1) +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#endif + +#endif /* #if CONFIG_IS_ENABLED(MBEDTLS_LIB_ECDSA) */ + #if CONFIG_IS_ENABLED(MBEDTLS_LIB_TLS) #include "rtc.h" -- 2.43.0
