Commit Graph

51 Commits

Author SHA1 Message Date
Aditya Patwardhan
d66ad18853 Fix esp_tls: Prevent freeing of global ca store after each connection
when dynamic ssl buffers are enabled
2021-03-05 09:55:10 +05:30
Aditya Patwardhan
423e600d46 secure_element: atecc608_ecdsa example
* Replaced crypotoauthlib with esp-cryptoauthlib
* Added menuconfig option for esp-tls about using HSM
* Added error codes for HSM in esp-tls,
* Added support to select different type of ATECC608A chips
* Added README, updated docs
* tcp_transport: Added option to enable secure_element for ssl

Closes https://github.com/espressif/esp-idf/issues/4432
2020-05-21 13:08:30 +05:30
Bryan Hunt
4553f6c95d Add cryptoauthlib as a component with mbedtls integration
* Add options to mbedtls for hardware acceleration
* Disable mbedtls EC curves if hardware acceleration is selected
since the hardware will have to define the curves supported
* Add a hardware ecdsa example
2020-05-20 22:52:37 +05:30
Mahavir Jain
be3b6b7cb8 Merge branch 'feature/mbedtls_dynamic_memory' into 'master'
feat(mbedtls): add dynamic buffer and local resource managment to decrease SSL heap cost

See merge request espressif/esp-idf!8313
2020-05-18 13:55:05 +08:00
Shubham Kulkarni
ca3daa50de mbedtls: Add configuration options 2020-05-15 11:27:44 +05:30
Dong Heng
3d57bf30a2 feat(mbedtls): add dynamic buffer and local resource managment to decrease SSL heap cost 2020-05-14 11:45:09 +00:00
Piyush Shah
43b3def711 mbedtls_hkdf: Add a config option to enable HKDF 2020-05-11 11:49:14 +05:30
Piyush Shah
62e1d6712b mbedtls: Add config options for chacha20, poly1305 and chachapoly 2020-05-05 16:41:31 +00:00
kangping
4883010f40 mbedtls: add configuration options for EC-JPAKE
Closes https://github.com/espressif/esp-idf/pull/5106
2020-04-14 12:22:16 +00:00
Jeroen Domburg
419848549e Add fixes for gcc8 psram fix improvement 2020-03-27 20:04:47 +07:00
Marius Vikhammer
ffb9010cbe aes: Fixed tag sometime being wrong for HW GCM
The GCM hardware accelerated algorithm for S2 would sometimes output
the wrong tag.

Added additional tests for AES and GCM

Re-enable HW GCM as default option
2020-03-18 08:44:38 +08:00
Angus Gratton
9c430a17aa Merge branch 'feature/mpi_accel_s2' into 'master'
MPI/RSA accelerator bringup for S2 and bignum refactor

Closes IDF-803 and IDF-1174

See merge request espressif/esp-idf!7915
2020-03-17 13:16:05 +08:00
Marius Vikhammer
16b6a7a903 s2 sha hw: Fix bug where alloc would fail if input were of len 0 2020-03-16 19:29:59 +08:00
Marius Vikhammer
e21bef3f28 mpi: active hw accel for S2
Actives MPI/RSA hardware acceleratio for ESP32 S2.

Closes IDF-803
2020-03-13 18:33:18 +08:00
Marius Vikhammer
3351376a11 AES: optimize AES-GCM
HW acceleration for GCM is now enabled by default

Closes IDF-1443
2020-03-12 10:20:24 +08:00
Marius Vikhammer
37369a8a57 crypto: SHA and AES accelerator bring up for S2
Brings up, fixes and enables AES and SHA hardware acceleration.

Closes IDF-714
Closes IDF-716
2020-03-11 15:09:45 +08:00
Marius Vikhammer
947e3e94ed Add ESP certificate bundle feature
Adds the ESP certificate bundle feature that enables users to bundle a
root certificate bundle together with their application.

Default bundle includes all Mozilla root certificates

Closes IDF-296
2020-03-04 10:51:43 +08:00
Sachin Parekh
301dacfb33 Exception handlers for LoadStoreError and LoadStoreAlignmentError
Configurable option to use IRAM as byte accessible memory (in single core mode) using
load-store (non-word aligned and non-word size IRAM access specific) exception handlers.
This allows to use IRAM for use-cases where certain performance penalty
(upto 170 cpu cycles per load or store operation) is acceptable. Additional configuration
option has been provided to redirect mbedTLS specific in-out content length buffers to
IRAM (in single core mode), allows to save 20KB per TLS connection.
2020-02-26 20:21:59 +08:00
Ivan Grokhotkov
6e527fb763 mbedtls: temporary disable HW crypto for ESP32S2
To be re-enabled once HW crypto accelerators support is merged:
IDF-714, IDF-716, IDF-803.
2020-01-23 18:14:10 +01:00
Marius Vikhammer
c63684cf6c hw crypto: activated hardware acceleration for esp32s2beta
Activated AES, RSA and SHA hardware acceleration for esp32s2 and enabled related unit tests.

Updated with changes made for ESP32 from 0a04034, 961f59f and caea288.

Added performance targets for esp32s2beta

Closes IDF-757
2019-12-12 12:37:29 +08:00
Ryan Kurte
4ee78f8496 added KConfig option to allow loading CA certs with unsupported extensions
Close https://github.com/espressif/esp-idf/pull/4445
2019-12-10 08:47:26 +05:30
Angus Gratton
5b33d6cf94 Merge branch 'feature/mbedtls_add_faster_modexp' into 'master'
mbedtls: Add a new (X^Y) mod M implementation (HAC 14.94)

Closes IDF-965

See merge request espressif/esp-idf!6418
2019-11-06 15:51:28 +08:00
KonstantinKondrashov
5ed8388f6b mbedtls: Add Montgomery exponentiation implementation (HAC 14.94)
It gave us a better performance of RSA operations. (2~11 times)

The old modexp implementation (Z = X ^ Y mod M) loaded all the data into
the hw registers and was waiting for completion, but due to
the hardware RSA implementation, the calculations always started with 4096 bit,
which took a lot of time.
Measurement results (measurements were made for keys: 2048, 3072 and 4096 bits)
(Old) - Sliding-window exponentiation (HAC 14.85):
keysize = 2048 bits
RSA key operation (performance): public [93206 us], private [280189 us]
keysize = 3072 bits
RSA key operation (performance): public [293614 us], private [858157 us]
 keysize = 4096 bits
RSA key operation (performance): public [653192 us], private [1912126 us]

Instead (Old) - Sliding-window exponentiation (HAC 14.85) was implemented
(New) - Montgomery exponentiation (HAC 14.94) which showed
better performance on private and public keys.
keysize = 2048 bits
RSA key operation (performance): public [14504 us], private [149456 us]
keysize = 3072 bits
RSA key operation (performance): public [35073 us], private [392743 us]
keysize = 4096 bits
RSA key operation (performance): public [58650 us], private [787186 us]

For this reason, the old implementation was removed
and the MBEDTLS_HARDWARE_MPI option was turned on by default.

Why the MPI_INTERRUPT option is removed:
the old implementation used calculations on the hardware and
it took a lot of time (10ms - 500ms). And in order not to stand idle
while waiting for completion, an interrupt option was added.
This made it possible to carry out other tasks during the calculation,
and this one to block. The new method is free from such a drawback and
the maximum duration of one RSA HW operation does not exceed 70us (usually 2-70 μs).
This option is no longer needed.

Closes: IDF-965
2019-11-05 16:33:11 +08:00
Ivan Grokhotkov
71b73e61e1 mbedtls: Enable SHA hardware acceleration by default 2019-11-04 10:48:08 +01:00
Ivan Grokhotkov
5830f529d8 Merge branch 'master' into feature/esp32s2beta_merge 2019-10-02 19:01:39 +02:00
Prasad Alatkar
fe08f435dc NimBLE: Add optional mbedTLS support to NimBLE
- Additional menuconfig option to select either mbedTLS or Tinycrypt from NimBLE.
- Addition of `CMAC` and `ECP_RESTARTABLE` to mbedTLS menuconfig option and
  `esp_config.h`.
- Changes NimBLE `component.mk` and `CMakeLists.txt` to support mbedTLS option.
- Minor changes to `app_mesh.c` application.
2019-09-30 14:15:43 +08:00
Angus Gratton
438d513a95 Merge branch 'master' into feature/esp32s2beta_merge 2019-09-16 16:18:48 +10:00
Angus Gratton
6123f78897 mbedtls: Make ECDHE-PSK config item depend on ECDHE 2019-08-30 15:01:53 +10:00
Mahavir Jain
5582878f8e mbedtls: keep asymmetric tls buffer length option enabled by default 2019-08-28 06:23:33 +00:00
Xia Xiaotian
99ef587a05 run WiFi on ESP32SBETA 2019-06-28 11:34:49 +08:00
Mahavir Jain
0a5dfd3717 mbedtls: add config option for setting debug level
Closes https://github.com/espressif/esp-idf/issues/3521
2019-06-06 18:28:19 +05:30
Stephen Bird
058c6afd3c Add option to disable server side SSL session tickets as well as client
Closes https://github.com/espressif/esp-idf/pull/2570
2019-05-29 18:02:18 +05:30
Roland Dobai
0ae53691ba Rename Kconfig options (components/esp32) 2019-05-21 09:09:01 +02:00
Roland Dobai
37126d3451 Correct Kconfigs according to the coding style 2019-01-29 13:37:01 +01:00
Peter Meerwald-Stadler
6a197d305f Fix some typos related to ethernet documentation and Kconfig. Closes https://github.com/espressif/esp-idf/pull/2642 2018-10-28 21:12:09 +01:00
Mahavir Jain
54382277b6 mbedtls: configurable options for controlling dynamic memory allocations
Modifies https://github.com/espressif/esp-idf/pull/2237
2018-09-24 11:17:48 +05:30
Jason von Nieda
d7a17ac941 Adds a Kconfig option for mbedtls' MBEDTLS_PLATFORM_MEMORY define. This makes it possible to override the mbedtls allocator with your own.
Merges https://github.com/espressif/esp-idf/pull/2237
2018-08-01 11:28:28 +10:00
Angus Gratton
0ea4cd67dd mbedtls: Remove "unsafe" warning, enable AES by default & make SHA/MPI optional 2017-08-25 16:08:03 +10:00
Ivan Grokhotkov
08e787dc4d mbedtls: remove duplicate Kconfig options 2017-08-22 15:12:35 +08:00
Angus Gratton
66ad84d318 mbedtls: Add more config options to disable Elliptic Curve features
Can save up to an additional 20KB when not using EC in TLS, or disable
unwanted features as needed.
2017-08-18 17:44:33 +10:00
Angus Gratton
c0f65f6680 mbedtls: Expose compile-time config, disable some things by default
* Disables 3DES, Camellia, Blowfish, RC4, RIPEMD160, SSLv3, TLS-PSK modes, DTLS by default
* Saves about 40KB from the default TLS client code size
* Defaults no longer get "Bad" howsmyssl.com rating (no more vulnerable 3DES)
  (ping https://github.com/espressif/arduino-esp32/issues/575 )
* Allows up to another 20-30KB code size to be trimmed without security
  implications if using DER formatted certificates, RSA ciphersuites only,
  etc.
* Can save up to another 8KB by setting the TLS Role to Server or Client only.
2017-08-18 17:15:08 +10:00
Angus Gratton
c35aa1d9a2 mbedtls: Temporarily disable hardware acceleration in dual-core mode
Temporary fix, until DPORT bugs in crypto accelerators are completely fixed.
2017-07-05 12:03:00 +08:00
Angus Gratton
0b7058d8ef mbedTLS: Add generic support for mbedTLS debug output via the esp_log functionality 2017-03-07 10:18:47 +11:00
Jeroen Domburg
bf57594ebe Merge branch 'feature/intr_alloc' into 'master'
Add dynamic interrupt allocation mechanism

This adds:
- Dynamic allocation of interrupts. Pass it the features of the interrupt you want, it'll set you up with an int.
- Shared interrupts. Enables multiple peripheral drivers to use the same interrupt. 
- Marking what interrupts are fully executable from IRAM; if an int isn't marked like that it will get disabled once flash cache gets disabled.

Also:
- Modifies driver to be in line with these changes

See merge request !254
2016-12-09 14:00:39 +08:00
Liu Han
c1802eaa98 components/mbedtls: add time and time data configuration at menuconfig 2016-12-08 13:33:47 +08:00
Jeroen Domburg
32fa94935d Changes according to merge request 2016-12-08 12:39:33 +08:00
Angus Gratton
c48612e516 mbedTLS SHA acceleration: Allow concurrent digest calculation, works with TLS
SHA hardware allows each of SHA1, SHA256, SHA384&SHA512 to calculate digests
concurrently.

Currently incompatible with AES acceleration due to a hardware reset problem.

Ref TW7111.
2016-11-22 20:42:38 +11:00
Angus Gratton
36f29017b6 mbedtls hardware bignum: Support "RSA" interrupt for end of operation
Allows CPU to do other things which bignum operation is in
progress.
2016-11-18 15:53:00 +11:00
Angus Gratton
68d370542a mbedtls hardware RSA: Put into menuconfig, squash warnings
All combinations of enabling/disabling hardware acceleration no longer
show unused warnings.
2016-11-18 15:50:45 +11:00
Wu Jian Gang
ed0a85ab4d Kconfig: use 4 spaces to instead 1 tab
In some Kconfig file, both 4 spaces and 1 tab are used mix, let's just
use 4 space, it will be clean in some editor.
2016-09-28 13:24:58 +08:00