modules: openthread: use PSA Crypto API as default choice for crypto

doc/releases/migration-guide-4.4.rst

@@ -52,6 +52,28 @@ Other subsystems
 Modules
 *******
 
+OpenThread
+==========
+
+* The following Kconfigs options were renamed:
+
+  * ``CONFIG_OPENTHREAD_MBEDTLS_CHOICE`` to
+    :kconfig:option:`CONFIG_OPENTHREAD_SECURITY_DEFAULT_CONFIG`
+  * ``CONFIG_CUSTOM_OPENTHREAD_SECURITY`` to
+    :kconfig:option:`CONFIG_OPENTHREAD_SECURITY_CUSTOM_CONFIG`
+
+* :kconfig:option:`CONFIG_OPENTHREAD_CRYPTO_PSA` no more depends on
+  :kconfig:option:`CONFIG_PSA_CRYPTO_CLIENT`, but instead selects
+  :kconfig:option:`CONFIG_PSA_CRYPTO`.
+
+* In builds without TF-M, :kconfig:option:`CONFIG_SECURE_STORAGE` is now automatically
+  implied if :kconfig:option:`CONFIG_OPENTHREAD_SECURITY_DEFAULT_CONFIG` and
+  :kconfig:option:`CONFIG_OPENTHREAD_CRYPTO_PSA` are set. This
+  guarantees that a PSA ITS implementation is available and it requires a backend
+  for Secure Storage (Settings, ZMS, or a custom one) to be configured.
+
+* :kconfig:option:`CONFIG_OPENTHREAD_CRYPTO_PSA` is now enabled by default.
+
 Trusted Firmware-M
 ==================
 

modules/mbedtls/Kconfig

@@ -192,7 +192,8 @@ if MBEDTLS_ENABLE_HEAP
 
 config MBEDTLS_HEAP_SIZE
 	int "Heap size for mbed TLS"
-	default 10240 if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
+	default 15360 if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
+	default 1024 if OPENTHREAD_CRYPTO_PSA
 	default 512
 	help
 	  The mbedtls routines will use this heap if enabled.

modules/mbedtls/Kconfig.mbedtls

@@ -134,7 +134,7 @@ config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
 
 config MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
 	bool "ECJPAKE based ciphersuite modes"
-	depends on MBEDTLS_ECJPAKE_C
+	depends on MBEDTLS_ECJPAKE_C || PSA_WANT_ALG_JPAKE
 
 if MBEDTLS_SSL_PROTO_TLS1_3
 

modules/openthread/Kconfig

@@ -147,54 +147,105 @@ config OPENTHREAD_SHELL
 	depends on SHELL
 
 config MBEDTLS_PROMPTLESS
-	default y if !CUSTOM_OPENTHREAD_SECURITY
+	default y if OPENTHREAD_SECURITY_DEFAULT_CONFIG
 
-choice OPENTHREAD_SECURITY
-	prompt "OpenThread security"
-	default OPENTHREAD_MBEDTLS_CHOICE
+choice OPENTHREAD_SECURITY_CONFIG
+	prompt "OpenThread security configuration"
+	default OPENTHREAD_SECURITY_DEFAULT_CONFIG
 
-config CUSTOM_OPENTHREAD_SECURITY
-	bool "Custom"
+config OPENTHREAD_SECURITY_CUSTOM_CONFIG
+	bool "Custom configuration"
 	help
 	  Security settings will be controlled directly by the user.
-	  Enabling this setting will give access to full control of mbed TLS
+	  Enabling this setting will give access to full control of Mbed TLS
 	  configuration.
 
-config OPENTHREAD_MBEDTLS_CHOICE
-	bool "mbed TLS built-in"
-	select OPENTHREAD_MBEDTLS
+config OPENTHREAD_SECURITY_DEFAULT_CONFIG
+	bool "Default configuration"
 	help
-	  Use the OpenThread mbed TLS configuration pre-defined security scheme.
+	  Use the OpenThread Mbed TLS configuration pre-defined security scheme.
 
-endchoice
+endchoice # OPENTHREAD_SECURITY
+
+config OPENTHREAD_CRYPTO_PSA
+	bool "PSA Crypto API"
+	default y
+	select PSA_CRYPTO
+	select OPENTHREAD_PLATFORM_KEY_REF if !OPENTHREAD_COPROCESSOR_RCP
+	imply OPENTHREAD_PLATFORM_KEYS_EXPORTABLE_ENABLE
+	help
+	  Use PSA Crypto API as backend for cryptographic operations instead
+	  of legacy Mbed TLS.
 
-config OPENTHREAD_MBEDTLS
+if OPENTHREAD_SECURITY_DEFAULT_CONFIG
+
+config OPENTHREAD_CRYPTO_PSA_CONFIG
 	bool
-	select MBEDTLS
-	select MBEDTLS_ENABLE_HEAP
+	default y if OPENTHREAD_CRYPTO_PSA
+	imply SECURE_STORAGE if !BUILD_WITH_TFM
+	select PSA_WANT_KEY_TYPE_AES
+	select PSA_WANT_ALG_ECB_NO_PADDING
+	select PSA_WANT_KEY_TYPE_HMAC
+	select PSA_WANT_ALG_HMAC
+	select PSA_WANT_ALG_CCM
+	select PSA_WANT_ALG_SHA_256
+	select PSA_WANT_ALG_CMAC
+	select PSA_WANT_ALG_JPAKE if OPENTHREAD_COMMISSIONER_JOINER
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT if OPENTHREAD_COMMISSIONER_JOINER || \
+							OPENTHREAD_ECDSA
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT if OPENTHREAD_COMMISSIONER_JOINER || \
+							OPENTHREAD_ECDSA
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE if OPENTHREAD_COMMISSIONER_JOINER || \
+							  OPENTHREAD_ECDSA
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE if OPENTHREAD_COMMISSIONER_JOINER || \
+							OPENTHREAD_ECDSA
+	select PSA_WANT_ECC_SECP_R1_256 if OPENTHREAD_COMMISSIONER_JOINER || \
+					   OPENTHREAD_SRP
+	select PSA_WANT_ALG_ECDSA if OPENTHREAD_ECDSA
+	select PSA_WANT_ALG_DETERMINISTIC_ECDSA if OPENTHREAD_ECDSA
+	select PSA_WANT_ALG_ECDH if OPENTHREAD_ECDSA
+	select PSA_WANT_ALG_TLS12_PRF if OPENTHREAD_COMMISSIONER_JOINER
+	select PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS if OPENTHREAD_COMMISSIONER_JOINER
+	select PSA_WANT_ALG_HKDF if OPENTHREAD_TREL
+	select PSA_WANT_ALG_HKDF_EXTRACT if OPENTHREAD_TREL
+	select PSA_WANT_ALG_HKDF_EXPAND if OPENTHREAD_TREL
+
+config OPENTHREAD_CRYPTO_LEGACY_MBEDTLS_CONFIG
+	bool
+	default y if !OPENTHREAD_CRYPTO_PSA
 	select MBEDTLS_CIPHER_AES_ENABLED
 	select MBEDTLS_CIPHER_CCM_ENABLED
 	select MBEDTLS_SHA256
 	select MBEDTLS_ENTROPY_C
 	select MBEDTLS_CMAC
 	select MBEDTLS_CIPHER
-	select MBEDTLS_MD_C
-	select MBEDTLS_SSL_PROTO_TLS1_2 if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
-	select MBEDTLS_SSL_PROTO_DTLS if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
-	select MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
-	select MBEDTLS_ECJPAKE_C if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
-	select MBEDTLS_ECP_DP_SECP256R1_ENABLED if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER || \
-	    OPENTHREAD_SRP_CLIENT || OPENTHREAD_SRP_SERVER
-	select MBEDTLS_ECP_NIST_OPTIM if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
-	select MBEDTLS_CTR_DRBG_C if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
-	select MBEDTLS_HMAC_DRBG_C if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER || \
-	    OPENTHREAD_SRP_CLIENT || OPENTHREAD_SRP_SERVER
-	select MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED if OPENTHREAD_ECDSA
+	select MBEDTLS_ECJPAKE_C if OPENTHREAD_COMMISSIONER_JOINER
+	select MBEDTLS_ECP_C if OPENTHREAD_COMMISSIONER_JOINER || OPENTHREAD_ECDSA
+	select MBEDTLS_ECP_DP_SECP256R1_ENABLED if OPENTHREAD_COMMISSIONER_JOINER || \
+						   OPENTHREAD_SRP
 	select MBEDTLS_ECDH_C if OPENTHREAD_ECDSA
 	select MBEDTLS_ECDSA_C if OPENTHREAD_ECDSA
 	select MBEDTLS_ECDSA_DETERMINISTIC if OPENTHREAD_ECDSA
+	select MBEDTLS_ECP_NIST_OPTIM if OPENTHREAD_COMMISSIONER_JOINER
+	select MBEDTLS_CTR_DRBG_C if OPENTHREAD_COMMISSIONER_JOINER
+	select MBEDTLS_HMAC_DRBG_C if OPENTHREAD_COMMISSIONER_JOINER || \
+				      OPENTHREAD_SRP
+
+config OPENTHREAD_MBEDTLS_TLS_CONFIG
+	bool
+	default y
+	select MBEDTLS
+	select MBEDTLS_ENABLE_HEAP
+	select MBEDTLS_MD_C
+	select MBEDTLS_SSL_PROTO_TLS1_2 if OPENTHREAD_COMMISSIONER_JOINER
+	select MBEDTLS_SSL_PROTO_DTLS if OPENTHREAD_COMMISSIONER_JOINER
+	select MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED if OPENTHREAD_COMMISSIONER_JOINER
+	select MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED if OPENTHREAD_ECDSA
 	select MBEDTLS_PK_WRITE_C if OPENTHREAD_ECDSA
-	select MBEDTLS_ECP_C if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER || OPENTHREAD_ECDSA
+	help
+	  TLS configuration of Mbed TLS.
+
+endif # OPENTHREAD_SECURITY_DEFAULT_CONFIG
 
 config OPENTHREAD_MBEDTLS_LIB_NAME
 	string "mbedtls lib name"
@@ -318,15 +369,6 @@ config OPENTHREAD_MAC_SOFTWARE_CSMA_BACKOFF_ENABLE
 	  Set y to enable software CSMA backoff. The option can be disabled if
 	  the radio has hardware support for this feature (IEEE802154_HW_CSMA).
 
-config OPENTHREAD_CRYPTO_PSA
-	bool "ARM PSA crypto API"
-	depends on PSA_CRYPTO_CLIENT
-	select OPENTHREAD_PLATFORM_KEY_REF if !OPENTHREAD_COPROCESSOR_RCP
-	imply OPENTHREAD_PLATFORM_KEYS_EXPORTABLE_ENABLE
-	help
-	  Enable crypto backend library implementation based on ARM PSA crypto
-	  API instead of the default, using mbedTLS.
-
 config OPENTHREAD_PLATFORM_KEYS_EXPORTABLE_ENABLE
 	bool "Make MAC keys exportable"
 	depends on OPENTHREAD_PLATFORM_KEY_REF

modules/openthread/Kconfig.features

@@ -215,6 +215,11 @@ config OPENTHREAD_JOINER
 	  mbedTLS heap than the default value. A minimum recommended value of
 	  CONFIG_MBEDTLS_HEAP_SIZE for the commissioning is 10KB.
 
+config OPENTHREAD_COMMISSIONER_JOINER
+	bool
+	default y
+	depends on OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
+
 config OPENTHREAD_LEGACY
 	bool "Legacy network support"
 
@@ -397,6 +402,11 @@ config OPENTHREAD_SRP_SERVER
 	select OPENTHREAD_NETDATA_PUBLISHER
 	select OPENTHREAD_ECDSA
 
+config OPENTHREAD_SRP
+	bool
+	default y
+	depends on OPENTHREAD_SRP_CLIENT || OPENTHREAD_SRP_SERVER
+
 config OPENTHREAD_SRP_SERVER_FAST_START
 	bool "SRP server fast start"