Skip to content

Commit 1226e54

Browse files
degjorvadegjorva
committed
nrf_security: cracen: Size optimizations kmu
Add compiler definitions around algorithm selection This means only needed algorithms are checked at runtime Also means algorithm configs are required for importing keys Reduces size in most use cases Signed-off-by: Dag Erik Gjørvad <dag.erik.gjorvad@nordicsemi.no>
1 parent 4732c22 commit 1226e54

File tree

1 file changed

+60
-13
lines changed
  • subsys/nrf_security/src/drivers/cracen/cracenpsa/src

1 file changed

+60
-13
lines changed

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c

+60-13
Original file line numberDiff line numberDiff line change
@@ -487,44 +487,61 @@ static psa_status_t convert_to_psa_attributes(kmu_metadata *metadata,
487487
psa_set_key_usage_flags(key_attr, usage_flags);
488488

489489
switch (metadata->algorithm) {
490+
#ifdef PSA_WANT_ALG_CHACHA20
490491
case METADATA_ALG_CHACHA20:
491492
psa_set_key_type(key_attr, PSA_KEY_TYPE_CHACHA20);
492493
psa_set_key_algorithm(key_attr, PSA_ALG_STREAM_CIPHER);
493494
break;
495+
#endif
496+
#ifdef PSA_WANT_ALG_CHACHA20_POLY1305
494497
case METADATA_ALG_CHACHA20_POLY1305:
495498
psa_set_key_type(key_attr, PSA_KEY_TYPE_CHACHA20);
496499
psa_set_key_algorithm(key_attr, PSA_ALG_CHACHA20_POLY1305);
497500
break;
501+
#endif
502+
#ifdef PSA_WANT_ALG_AES_GCM
498503
case METADATA_ALG_AES_GCM:
499504
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
500505
psa_set_key_algorithm(key_attr, PSA_ALG_GCM);
501506
break;
507+
#endif
508+
#ifdef PSA_WANT_ALG_AES_CCM
502509
case METADATA_ALG_AES_CCM:
503510
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
504511
psa_set_key_algorithm(key_attr, PSA_ALG_CCM);
505512
break;
513+
#endif
514+
#ifdef PSA_WANT_ALG_AES_ECB
506515
case METADATA_ALG_AES_ECB:
507516
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
508517
psa_set_key_algorithm(key_attr, PSA_ALG_ECB_NO_PADDING);
509518
break;
519+
#endif
520+
#ifdef PSA_WANT_ALG_AES_CTR
510521
case METADATA_ALG_AES_CTR:
511522
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
512523
psa_set_key_algorithm(key_attr, PSA_ALG_CTR);
513524
break;
525+
#endif
526+
#ifdef PSA_WANT_ALG_AES_CBC
514527
case METADATA_ALG_AES_CBC:
515528
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
516529
psa_set_key_algorithm(key_attr, PSA_ALG_CBC_NO_PADDING);
517530
break;
518-
#ifdef PSA_ALG_SP800_108_COUNTER_CMAC
531+
#endif
532+
#ifdef PSA_WANT_ALG_SP800_108_COUNTER_CMAC
519533
case METADATA_ALG_SP800_108_COUNTER_CMAC:
520534
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
521535
psa_set_key_algorithm(key_attr, PSA_ALG_SP800_108_COUNTER_CMAC);
522536
break;
523537
#endif
538+
#ifdef PSA_WANT_ALG_ALG_CMAC
524539
case METADATA_ALG_CMAC:
525540
psa_set_key_type(key_attr, PSA_KEY_TYPE_AES);
526541
psa_set_key_algorithm(key_attr, PSA_ALG_CMAC);
527542
break;
543+
#endif
544+
#ifdef PSA_WANT_ALG_ED25519
528545
case METADATA_ALG_ED25519:
529546
/* If the key can sign it is assumed it is a private key */
530547
psa_set_key_type(
@@ -534,6 +551,8 @@ static psa_status_t convert_to_psa_attributes(kmu_metadata *metadata,
534551
: PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS));
535552
psa_set_key_algorithm(key_attr, PSA_ALG_PURE_EDDSA);
536553
break;
554+
#endif
555+
#ifdef PSA_WANT_ALG_ED25519PH
537556
case METADATA_ALG_ED25519PH:
538557
/* If the key can sign it is assumed it is a private key */
539558
psa_set_key_type(
@@ -543,17 +562,22 @@ static psa_status_t convert_to_psa_attributes(kmu_metadata *metadata,
543562
: PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS));
544563
psa_set_key_algorithm(key_attr, PSA_ALG_ED25519PH);
545564
break;
565+
#endif
566+
#ifdef PSA_WANT_ALG_ECDSA
546567
case METADATA_ALG_ECDSA:
547568
psa_set_key_type(key_attr,
548569
can_sign(key_attr)
549570
? PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)
550571
: PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_SECP_R1));
551572
psa_set_key_algorithm(key_attr, PSA_ALG_ECDSA(PSA_ALG_ANY_HASH));
552573
break;
574+
#endif
575+
#ifdef PSA_WANT_ALG_HMAC
553576
case METADATA_ALG_HMAC:
554577
psa_set_key_type(key_attr, PSA_KEY_TYPE_HMAC);
555578
psa_set_key_algorithm(key_attr, PSA_ALG_HMAC(PSA_ALG_SHA_256));
556579
break;
580+
#endif
557581
default:
558582
return PSA_ERROR_HARDWARE_FAILURE;
559583
}
@@ -628,89 +652,109 @@ static psa_status_t convert_from_psa_attributes(const psa_key_attributes_t *key_
628652
}
629653

630654
switch (psa_get_key_algorithm(key_attr)) {
655+
#ifdef PSA_WANT_ALG_STREAM_CIPHER
631656
case PSA_ALG_STREAM_CIPHER:
632657
metadata->algorithm = METADATA_ALG_CHACHA20;
633658
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_CHACHA20) {
634659
return PSA_ERROR_NOT_SUPPORTED;
635660
}
636661
break;
662+
#endif
663+
#ifdef PSA_WANT_ALG_CHACHA20_POLY1305
637664
case PSA_ALG_CHACHA20_POLY1305:
638665
metadata->algorithm = METADATA_ALG_CHACHA20_POLY1305;
639666
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_CHACHA20) {
640667
return PSA_ERROR_NOT_SUPPORTED;
641668
}
642669
break;
670+
#endif
671+
#ifdef PSA_WANT_ALG_ALG_GCM
643672
case PSA_ALG_GCM:
644673
metadata->algorithm = METADATA_ALG_AES_GCM;
645674
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
646675
return PSA_ERROR_NOT_SUPPORTED;
647676
}
648677
break;
678+
#endif
679+
#ifdef PSA_WANT_ALG_CCM
649680
case PSA_ALG_CCM:
650681
metadata->algorithm = METADATA_ALG_AES_CCM;
651682
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
652683
return PSA_ERROR_NOT_SUPPORTED;
653684
}
654685
break;
686+
#endif
687+
#ifdef PSA_WANT_ALG_ECB_NO_PADDING
655688
case PSA_ALG_ECB_NO_PADDING:
656689
metadata->algorithm = METADATA_ALG_AES_ECB;
657690
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
658691
return PSA_ERROR_NOT_SUPPORTED;
659692
}
660693
break;
694+
#endif
695+
#ifdef PSA_WANT_ALG_CTR
661696
case PSA_ALG_CTR:
662697
metadata->algorithm = METADATA_ALG_AES_CTR;
663698
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
664699
return PSA_ERROR_NOT_SUPPORTED;
665700
}
666701
break;
702+
#endif
703+
#ifdef PSA_WANT_ALG_CBC_NO_PADDING
667704
case PSA_ALG_CBC_NO_PADDING:
668705
metadata->algorithm = METADATA_ALG_AES_CBC;
669706
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
670707
return PSA_ERROR_NOT_SUPPORTED;
671708
}
672709
break;
673-
#ifdef PSA_ALG_SP800_108_COUNTER_CMAC
710+
#endif
711+
#ifdef PSA_WANT_ALG_SP800_108_COUNTER_CMAC
674712
case PSA_ALG_SP800_108_COUNTER_CMAC:
675713
metadata->algorithm = METADATA_ALG_SP800_108_COUNTER_CMAC;
676714
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
677715
return PSA_ERROR_NOT_SUPPORTED;
678716
}
679717
break;
680718
#endif
719+
#ifdef PSA_WANT_ALG_CMAC
681720
case PSA_ALG_CMAC:
682721
metadata->algorithm = METADATA_ALG_CMAC;
683722
if (psa_get_key_type(key_attr) != PSA_KEY_TYPE_AES) {
684723
return PSA_ERROR_NOT_SUPPORTED;
685724
}
686725
break;
687726

688-
case PSA_ALG_PURE_EDDSA:
727+
#endif
728+
#ifdef PSA_WANT_ALG_ED25519PH
729+
case PSA_ALG_ED25519PH:
689730
if (PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(key_attr)) !=
690-
PSA_ECC_FAMILY_TWISTED_EDWARDS) {
731+
PSA_ECC_FAMILY_TWISTED_EDWARDS) {
691732
return PSA_ERROR_NOT_SUPPORTED;
692733
}
693734
/* Don't support private keys that are only used for verify */
694735
if (!can_sign(key_attr) &&
695-
PSA_KEY_TYPE_IS_ECC_KEY_PAIR(psa_get_key_type(key_attr))) {
736+
PSA_KEY_TYPE_IS_ECC_KEY_PAIR(psa_get_key_type(key_attr))) {
696737
return PSA_ERROR_NOT_SUPPORTED;
697738
}
698-
metadata->algorithm = METADATA_ALG_ED25519;
699-
break;
700-
701-
case PSA_ALG_ED25519PH:
739+
metadata->algorithm = METADATA_ALG_ED25519PH;
740+
break;
741+
#endif
742+
#ifdef PSA_WANT_ALG_PURE_EDDSA
743+
case PSA_ALG_PURE_EDDSA:
702744
if (PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(key_attr)) !=
703-
PSA_ECC_FAMILY_TWISTED_EDWARDS) {
745+
PSA_ECC_FAMILY_TWISTED_EDWARDS) {
704746
return PSA_ERROR_NOT_SUPPORTED;
705747
}
706748
/* Don't support private keys that are only used for verify */
707749
if (!can_sign(key_attr) &&
708-
PSA_KEY_TYPE_IS_ECC_KEY_PAIR(psa_get_key_type(key_attr))) {
750+
PSA_KEY_TYPE_IS_ECC_KEY_PAIR(psa_get_key_type(key_attr))) {
709751
return PSA_ERROR_NOT_SUPPORTED;
710752
}
711-
metadata->algorithm = METADATA_ALG_ED25519PH;
712-
break;
753+
metadata->algorithm = METADATA_ALG_ED25519;
754+
break;
713755

756+
#endif
757+
#ifdef PSA_WANT_ALG_ECDSA
714758
case PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):
715759
case PSA_ALG_ECDSA(PSA_ALG_SHA_256):
716760
if (PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(key_attr)) !=
@@ -725,12 +769,15 @@ static psa_status_t convert_from_psa_attributes(const psa_key_attributes_t *key_
725769
}
726770
metadata->algorithm = METADATA_ALG_ECDSA;
727771
break;
772+
#endif
773+
#ifdef PSA_WANT_ALG_HMAC
728774
case PSA_ALG_HMAC(PSA_ALG_SHA_256):
729775
if (!can_sign(key_attr) && PSA_ALG_IS_HMAC(psa_get_key_type(key_attr))) {
730776
return PSA_ERROR_NOT_SUPPORTED;
731777
}
732778
metadata->algorithm = METADATA_ALG_HMAC;
733779
break;
780+
#endif
734781
default:
735782
return PSA_ERROR_NOT_SUPPORTED;
736783
}

0 commit comments

Comments
 (0)