include/mbedtls/config_adjust_psa_from_legacy.h

0001 /**
0002  * \file mbedtls/config_adjust_psa_from_legacy.h
0003  * \brief Adjust PSA configuration: construct PSA configuration from legacy
0004  *
0005  * This is an internal header. Do not include it directly.
0006  *
0007  * When MBEDTLS_PSA_CRYPTO_CONFIG is disabled, we automatically enable
0008  * cryptographic mechanisms through the PSA interface when the corresponding
0009  * legacy mechanism is enabled. In many cases, this just enables the PSA
0010  * wrapper code around the legacy implementation, but we also do this for
0011  * some mechanisms where PSA has its own independent implementation so
0012  * that high-level modules that can use either cryptographic API have the
0013  * same feature set in both cases.
0014  */
0015 /*
0016  *  Copyright The Mbed TLS Contributors
0017  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
0018  */
0019
0020 #ifndef MBEDTLS_CONFIG_ADJUST_PSA_FROM_LEGACY_H
0021 #define MBEDTLS_CONFIG_ADJUST_PSA_FROM_LEGACY_H
0022
0023 #if !defined(MBEDTLS_CONFIG_FILES_READ)
0024 #error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \
0025     "up to and including runtime errors such as buffer overflows. " \
0026     "If you're trying to fix a complaint from check_config.h, just remove " \
0027     "it from your configuration file: since Mbed TLS 3.0, it is included " \
0028     "automatically at the right point."
0029 #endif /* */
0030
0031 /*
0032  * Ensure PSA_WANT_* defines are setup properly if MBEDTLS_PSA_CRYPTO_CONFIG
0033  * is not defined
0034  */
0035
0036 #if defined(MBEDTLS_CCM_C)
0037 #define MBEDTLS_PSA_BUILTIN_ALG_CCM 1
0038 #define PSA_WANT_ALG_CCM 1
0039 #if defined(MBEDTLS_CIPHER_C)
0040 #define MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG 1
0041 #define PSA_WANT_ALG_CCM_STAR_NO_TAG 1
0042 #endif /* MBEDTLS_CIPHER_C */
0043 #endif /* MBEDTLS_CCM_C */
0044
0045 #if defined(MBEDTLS_CMAC_C)
0046 #define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1
0047 #define PSA_WANT_ALG_CMAC 1
0048 #endif /* MBEDTLS_CMAC_C */
0049
0050 #if defined(MBEDTLS_ECDH_C)
0051 #define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1
0052 #define PSA_WANT_ALG_ECDH 1
0053 #endif /* MBEDTLS_ECDH_C */
0054
0055 #if defined(MBEDTLS_ECDSA_C)
0056 #define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1
0057 #define PSA_WANT_ALG_ECDSA 1
0058 #define PSA_WANT_ALG_ECDSA_ANY 1
0059
0060 // Only add in DETERMINISTIC support if ECDSA is also enabled
0061 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
0062 #define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1
0063 #define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1
0064 #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
0065
0066 #endif /* MBEDTLS_ECDSA_C */
0067
0068 #if defined(MBEDTLS_ECP_C)
0069 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1
0070 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1
0071 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1
0072 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1
0073 /* Normally we wouldn't enable this because it's not implemented in ecp.c,
0074  * but since it used to be available any time ECP_C was enabled, let's enable
0075  * it anyway for the sake of backwards compatibility */
0076 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1
0077 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC 1
0078 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1
0079 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1
0080 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1
0081 /* See comment for PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE above. */
0082 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1
0083 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1
0084 #define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1
0085 #endif /* MBEDTLS_ECP_C */
0086
0087 #if defined(MBEDTLS_DHM_C)
0088 #define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC 1
0089 #define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT 1
0090 #define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT 1
0091 #define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE 1
0092 #define PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY 1
0093 #define PSA_WANT_ALG_FFDH 1
0094 #define PSA_WANT_DH_RFC7919_2048 1
0095 #define PSA_WANT_DH_RFC7919_3072 1
0096 #define PSA_WANT_DH_RFC7919_4096 1
0097 #define PSA_WANT_DH_RFC7919_6144 1
0098 #define PSA_WANT_DH_RFC7919_8192 1
0099 #define MBEDTLS_PSA_BUILTIN_ALG_FFDH 1
0100 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC 1
0101 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT 1
0102 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT 1
0103 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE 1
0104 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY 1
0105 #define MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 1
0106 #define MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 1
0107 #define MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 1
0108 #define MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 1
0109 #define MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 1
0110 #endif /* MBEDTLS_DHM_C */
0111
0112 #if defined(MBEDTLS_GCM_C)
0113 #define MBEDTLS_PSA_BUILTIN_ALG_GCM 1
0114 #define PSA_WANT_ALG_GCM 1
0115 #endif /* MBEDTLS_GCM_C */
0116
0117 /* Enable PSA HKDF algorithm if mbedtls HKDF is supported.
0118  * PSA HKDF EXTRACT and PSA HKDF EXPAND have minimal cost when
0119  * PSA HKDF is enabled, so enable both algorithms together
0120  * with PSA HKDF. */
0121 #if defined(MBEDTLS_HKDF_C)
0122 #define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
0123 #define PSA_WANT_ALG_HMAC 1
0124 #define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1
0125 #define PSA_WANT_ALG_HKDF 1
0126 #define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT 1
0127 #define PSA_WANT_ALG_HKDF_EXTRACT 1
0128 #define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND 1
0129 #define PSA_WANT_ALG_HKDF_EXPAND 1
0130 #endif /* MBEDTLS_HKDF_C */
0131
0132 #define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
0133 #define PSA_WANT_ALG_HMAC 1
0134 #define PSA_WANT_KEY_TYPE_HMAC 1
0135
0136 #if defined(MBEDTLS_MD_C)
0137 #define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1
0138 #define PSA_WANT_ALG_TLS12_PRF 1
0139 #define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1
0140 #define PSA_WANT_ALG_TLS12_PSK_TO_MS 1
0141 #endif /* MBEDTLS_MD_C */
0142
0143 #if defined(MBEDTLS_MD5_C)
0144 #define MBEDTLS_PSA_BUILTIN_ALG_MD5 1
0145 #define PSA_WANT_ALG_MD5 1
0146 #endif
0147
0148 #if defined(MBEDTLS_ECJPAKE_C)
0149 #define MBEDTLS_PSA_BUILTIN_PAKE 1
0150 #define MBEDTLS_PSA_BUILTIN_ALG_JPAKE 1
0151 #define PSA_WANT_ALG_JPAKE 1
0152 #endif
0153
0154 #if defined(MBEDTLS_RIPEMD160_C)
0155 #define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1
0156 #define PSA_WANT_ALG_RIPEMD160 1
0157 #endif
0158
0159 #if defined(MBEDTLS_RSA_C)
0160 #if defined(MBEDTLS_PKCS1_V15)
0161 #define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1
0162 #define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1
0163 #define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1
0164 #define PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1
0165 #define PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW 1
0166 #endif /* MBEDTLS_PKCS1_V15 */
0167 #if defined(MBEDTLS_PKCS1_V21)
0168 #define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1
0169 #define PSA_WANT_ALG_RSA_OAEP 1
0170 #define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1
0171 #define PSA_WANT_ALG_RSA_PSS 1
0172 #endif /* MBEDTLS_PKCS1_V21 */
0173 #if defined(MBEDTLS_GENPRIME)
0174 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1
0175 #define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1
0176 #endif /* MBEDTLS_GENPRIME */
0177 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC 1
0178 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1
0179 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1
0180 #define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 1
0181 #define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1
0182 #define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1
0183 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1
0184 #define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1
0185 #endif /* MBEDTLS_RSA_C */
0186
0187 #if defined(MBEDTLS_SHA1_C)
0188 #define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1
0189 #define PSA_WANT_ALG_SHA_1 1
0190 #endif
0191
0192 #if defined(MBEDTLS_SHA224_C)
0193 #define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1
0194 #define PSA_WANT_ALG_SHA_224 1
0195 #endif
0196
0197 #if defined(MBEDTLS_SHA256_C)
0198 #define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1
0199 #define PSA_WANT_ALG_SHA_256 1
0200 #endif
0201
0202 #if defined(MBEDTLS_SHA384_C)
0203 #define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1
0204 #define PSA_WANT_ALG_SHA_384 1
0205 #endif
0206
0207 #if defined(MBEDTLS_SHA512_C)
0208 #define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1
0209 #define PSA_WANT_ALG_SHA_512 1
0210 #endif
0211
0212 #if defined(MBEDTLS_SHA3_C)
0213 #define MBEDTLS_PSA_BUILTIN_ALG_SHA3_224 1
0214 #define MBEDTLS_PSA_BUILTIN_ALG_SHA3_256 1
0215 #define MBEDTLS_PSA_BUILTIN_ALG_SHA3_384 1
0216 #define MBEDTLS_PSA_BUILTIN_ALG_SHA3_512 1
0217 #define PSA_WANT_ALG_SHA3_224 1
0218 #define PSA_WANT_ALG_SHA3_256 1
0219 #define PSA_WANT_ALG_SHA3_384 1
0220 #define PSA_WANT_ALG_SHA3_512 1
0221 #endif
0222
0223 #if defined(MBEDTLS_AES_C)
0224 #define PSA_WANT_KEY_TYPE_AES 1
0225 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1
0226 #endif
0227
0228 #if defined(MBEDTLS_ARIA_C)
0229 #define PSA_WANT_KEY_TYPE_ARIA 1
0230 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1
0231 #endif
0232
0233 #if defined(MBEDTLS_CAMELLIA_C)
0234 #define PSA_WANT_KEY_TYPE_CAMELLIA 1
0235 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1
0236 #endif
0237
0238 #if defined(MBEDTLS_DES_C)
0239 #define PSA_WANT_KEY_TYPE_DES 1
0240 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1
0241 #endif
0242
0243 #if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
0244 #define MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS 1
0245 #define PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS 1
0246 #endif
0247
0248 #if defined(MBEDTLS_CHACHA20_C)
0249 #define PSA_WANT_KEY_TYPE_CHACHA20 1
0250 #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1
0251 /* ALG_STREAM_CIPHER requires CIPHER_C in order to be supported in PSA */
0252 #if defined(MBEDTLS_CIPHER_C)
0253 #define PSA_WANT_ALG_STREAM_CIPHER 1
0254 #define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1
0255 #endif
0256 #if defined(MBEDTLS_CHACHAPOLY_C)
0257 #define PSA_WANT_ALG_CHACHA20_POLY1305 1
0258 #define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1
0259 #endif
0260 #endif
0261
0262 #if defined(MBEDTLS_CIPHER_MODE_CBC)
0263 #define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1
0264 #define PSA_WANT_ALG_CBC_NO_PADDING 1
0265 #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
0266 #define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1
0267 #define PSA_WANT_ALG_CBC_PKCS7 1
0268 #endif
0269 #endif
0270
0271 #if (defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) || \
0272     defined(MBEDTLS_ARIA_C) || defined(MBEDTLS_CAMELLIA_C)) && \
0273     defined(MBEDTLS_CIPHER_C)
0274 #define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1
0275 #define PSA_WANT_ALG_ECB_NO_PADDING 1
0276 #endif
0277
0278 #if defined(MBEDTLS_CIPHER_MODE_CFB)
0279 #define MBEDTLS_PSA_BUILTIN_ALG_CFB 1
0280 #define PSA_WANT_ALG_CFB 1
0281 #endif
0282
0283 #if defined(MBEDTLS_CIPHER_MODE_CTR)
0284 #define MBEDTLS_PSA_BUILTIN_ALG_CTR 1
0285 #define PSA_WANT_ALG_CTR 1
0286 #endif
0287
0288 #if defined(MBEDTLS_CIPHER_MODE_OFB)
0289 #define MBEDTLS_PSA_BUILTIN_ALG_OFB 1
0290 #define PSA_WANT_ALG_OFB 1
0291 #endif
0292
0293 #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
0294 #define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1
0295 #define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1
0296 #endif
0297
0298 #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
0299 #define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1
0300 #define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1
0301 #endif
0302
0303 #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
0304 #define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1
0305 #define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1
0306 #endif
0307
0308 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
0309 #define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1
0310 #define PSA_WANT_ECC_MONTGOMERY_255 1
0311 #endif
0312
0313 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
0314 #define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1
0315 #define PSA_WANT_ECC_MONTGOMERY_448 1
0316 #endif
0317
0318 #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
0319 #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1
0320 #define PSA_WANT_ECC_SECP_R1_192 1
0321 #endif
0322
0323 #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
0324 #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1
0325 #define PSA_WANT_ECC_SECP_R1_224 1
0326 #endif
0327
0328 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
0329 #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1
0330 #define PSA_WANT_ECC_SECP_R1_256 1
0331 #endif
0332
0333 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
0334 #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1
0335 #define PSA_WANT_ECC_SECP_R1_384 1
0336 #endif
0337
0338 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
0339 #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1
0340 #define PSA_WANT_ECC_SECP_R1_521 1
0341 #endif
0342
0343 #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
0344 #define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1
0345 #define PSA_WANT_ECC_SECP_K1_192 1
0346 #endif
0347
0348 /* SECP224K1 is buggy via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/3541) */
0349 #if 0 && defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
0350 #define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1
0351 #define PSA_WANT_ECC_SECP_K1_224 1
0352 #endif
0353
0354 #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
0355 #define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1
0356 #define PSA_WANT_ECC_SECP_K1_256 1
0357 #endif
0358
0359 #endif /* MBEDTLS_CONFIG_ADJUST_PSA_FROM_LEGACY_H */