Skip to content

Conversation

stevew817
Copy link
Contributor

Problem

  1. Platforms are locked in to using one of the main tree's crypto abstractions, which are currently only available for OpenSSL or mbedTLS APIs. Platforms may wish to back cryptographic primitives on their accelerated hardware, which is not necessarily exposed through one of the 'main' abstractions.
  2. [EFR32] The EFR32 SDK is moving to using the PSA Crypto abstraction layer for cryptographic operations, and continuing to use the mbedTLS APIs is resulting in significant overhead.
  3. [EFR32] EFR32 Vault parts support opaque key storage through their built-in hardware. A sample implementation of how to leverage that for securely storing the Matter operational keys was missing.

Change overview

  1. Build system change to allow the chip_crypto build system variable to take on the value of platform, which allows platforms to provide their own implementation of the functions implemented in CHIPCryptoPAL{backend}.cpp.
    • This change would also allow moving the SE050 backend out of the main tree and into its platform
  2. [EFR32] Implementation of the crypto backend based on the PSA Crypto library provided by the EFR32 SDK.
  3. [EFR32] Sample implementation of an operational key store backed by actual opaque keys where available, based on the PSA Crypto library provided by the EFR32 SDK.

Testing

Testing through existing unit tests & the EFR32 sample builds

stevew817 and others added 22 commits August 4, 2022 11:08
This saves quite some codespace by allowing to strip dead code dangling
from OpenThread's use of mbedtls_pk_parse_key (which, when PKCS5 is
enabled, will always include code for parsing password-protected PEM
files, but no such files are ever used in the context of Matter)
* Implemented persistence of operational key map and runtime resizing
  on key map should the setting change and be OTA'ed over.
* Changed namespacing to put EFR32 classes under the internal layer
* Added 'ConfigValueExists' overload to the config manager which returns
  the size of an object if it exists.
Moving the override of chip_crypto in case it isn't set into crypto's
BUILD.gn instead of crypto.gni means that the toplevel BUILD.gn no longer
can see which crypto instance it ends up building with. This was only used
to determine whether or not to build chip-cert tool by default.

This commit clarifies that by duplicating the exact logic that was backing
this into the tools.gni file under a more descriptive variable name. The
actual logic probably needs cleaning up, but that would be outside the scope
of this PR.
Instead of viewing crypto as a monolithic library, encode it more
granular to better allow platform crypto implementations. It now consists
of its public headers (which the crypto backends depend on), a static
library containing the abstractly-implemented functions, and a set
of source sets for each of the crypto backends provided by the main tree.
The EFR32 crypto backend (brought in by setting chip_crypto to platform)
now correctly advertises a dependency on the matter crypto PAL. It only
needs the intermediate layer of the crypto PAL, not a backend, which is
taken care of due to chip_crypto being set to platform.
Use GenerateCertificateSigningRequest instead of replicating the mbedTLS
implementation of CSR generation. Since there were no other parts of the
app depending on mbedTLS CSR writing functionality, this saved 3.5kB of
code space for the light sample app on EFR32 BRD4161A.
@jmartinez-silabs jmartinez-silabs force-pushed the platform_crypto_implementation branch from 707da42 to bad8469 Compare August 4, 2022 15:12
@github-actions
Copy link

github-actions bot commented Aug 4, 2022

PR #21415: Size comparison from a42dffb to bad8469

Increases above 0.2%:

platform target config section a42dffb bad8469 change % change
efr32 lighting-app BRD4161A (read/write) 1090780 1096460 5680 0.5
.text 955404 961524 6120 0.6
BRD4161A+rpc (read/write) 1145092 1150756 5664 0.5
.text 992820 998924 6104 0.6
BRD4161A+rs911x (read/write) 977384 985764 8380 0.9
.text 813528 821504 7976 1.0
lock-app BRD4161A+wf200 (read/write) 1130896 1136328 5432 0.5
.bss 144416 144824 408 0.3
.text 984400 989420 5020 0.5
window-app BRD4161A (read/write) 1082524 1088200 5676 0.5
.text 945664 951792 6128 0.6
Increases (19 builds for cc13x2_26x2, cyw30739, efr32, esp32, linux, mbed)
platform target config section a42dffb bad8469 change % change
cc13x2_26x2 lock-ftd LP_CC2652R7 (read/write) 168532 168540 8 0.0
lock-mtd LP_CC2652R7 (read/write) 181764 181788 24 0.0
pump-app LP_CC2652R7 (read/write) 159728 159736 8 0.0
pump-controller-app LP_CC2652R7 (read/write) 175400 175408 8 0.0
shell LP_CC2652R7 (read/write) 183676 183684 8 0.0
cyw30739 light cyw930739m2evb_01 (read/write) 584738 584746 8 0.0
.bss 65632 65640 8 0.0
lock cyw930739m2evb_01 .bss 70416 70424 8 0.0
efr32 lighting-app BRD4161A (read/write) 1090780 1096460 5680 0.5
.data 2064 2068 4 0.2
.text 955404 961524 6120 0.6
BRD4161A+rpc (read/write) 1145092 1150756 5664 0.5
.data 2276 2280 4 0.2
.text 992820 998924 6104 0.6
BRD4161A+rs911x (read/write) 977384 985764 8380 0.9
.bss 161784 162184 400 0.2
.data 2052 2056 4 0.2
.text 813528 821504 7976 1.0
lock-app BRD4161A+wf200 (read/write) 1130896 1136328 5432 0.5
.bss 144416 144824 408 0.3
.data 2060 2064 4 0.2
.text 984400 989420 5020 0.5
window-app BRD4161A (read/write) 1082524 1088200 5676 0.5
.data 2092 2096 4 0.2
.text 945664 951792 6128 0.6
esp32 all-clusters-app m5stack (read/write) 489232 489240 8 0.0
.dram0.bss 75832 75840 8 0.0
linux bridge-app debug+rpc (read only) 2367849 2367865 16 0.0
.text 2001506 2001522 16 0.0
lock-app debug (read only) 2574665 2574697 32 0.0
.rodata 236048 236080 32 0.0
shell debug (read/write) 141840 141872 32 0.0
.data.rel.ro 76976 77008 32 0.0
thermostat-no-ble arm64 (read only) 2347660 2347692 32 0.0
(read/write) 141601 141617 16 0.0
.got 5016 5024 8 0.2
.text 1970672 1970688 16 0.0
tv-app debug (read only) 3162681 3162697 16 0.0
.text 2715858 2715906 48 0.0
mbed lock-app CY8CPROTO_062_4343W+release (read/write) 2453424 2453472 48 0.0
.bss 214548 214556 8 0.0
.text 1416068 1416116 48 0.0
Decreases (27 builds for bl602, cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, nrfconnect, p6, telink)
platform target config section a42dffb bad8469 change % change
bl602 lighting-app bl602 .text 1048308 1048304 -4 -0.0
cc13x2_26x2 all-clusters-minimal-app LP_CC2652R7 (read only) 636079 636063 -16 -0.0
.rodata 77735 77727 -8 -0.0
.text 558020 558012 -8 -0.0
lock-ftd LP_CC2652R7 (read only) 673035 673027 -8 -0.0
.text 596008 596000 -8 -0.0
lock-mtd LP_CC2652R7 (read only) 655491 655467 -24 -0.0
.rodata 101443 101435 -8 -0.0
.text 553568 553552 -16 -0.0
pump-app LP_CC2652R7 (read only) 682647 682639 -8 -0.0
.text 592916 592908 -8 -0.0
pump-controller-app LP_CC2652R7 (read only) 667111 667103 -8 -0.0
.text 581840 581832 -8 -0.0
shell LP_CC2652R7 (read only) 663226 663218 -8 -0.0
.text 577484 577476 -8 -0.0
cyw30739 lock cyw930739m2evb_01 .app_xip_area 462700 462692 -8 -0.0
ota-requestor-no-progress-logging cyw930739m2evb_01 (read/write) 589890 589882 -8 -0.0
.app_xip_area 467508 467500 -8 -0.0
efr32 lighting-app BRD4161A .bss 133292 132844 -448 -0.3
BRD4161A+rpc .bss 149972 149532 -440 -0.3
window-app BRD4161A .bss 134748 134292 -456 -0.3
esp32 all-clusters-app c3devkit (read only) 1025492 1025486 -6 -0.0
.flash.text 1025492 1025486 -6 -0.0
k32w light k32w0+release (read/write) 644324 644316 -8 -0.0
.bss 69720 69712 -8 -0.0
lock k32w0+release (read/write) 701668 701652 -16 -0.0
.text 626704 626688 -16 -0.0
linux lighting-app debug+rpc (read/write) 130232 130200 -32 -0.0
.data.rel.ro 72456 72440 -16 -0.0
shell debug (read only) 2591353 2590969 -384 -0.0
.rodata 233426 233042 -384 -0.2
tv-app debug .data.rel.ro 79104 79088 -16 -0.0
.rodata 257032 257000 -32 -0.0
tv-casting-app debug .data.rel.ro 98504 98488 -16 -0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 text 812620 812616 -4 -0.0
all-clusters-minimal-app nrf52840dk_nrf52840 text 801772 801768 -4 -0.0
p6 all-clusters-app default (read/write) 1690500 1690484 -16 -0.0
.text 1530296 1530280 -16 -0.0
all-clusters-minimal-app default (read/write) 1634692 1634676 -16 -0.0
.text 1475208 1475192 -16 -0.0
light-app default (read/write) 1554980 1554964 -16 -0.0
.text 1403816 1403800 -16 -0.0
lock-app default (read/write) 1592268 1592252 -16 -0.0
.text 1436608 1436592 -16 -0.0
telink light-switch-app tlsr9518adk80d text 569464 569462 -2 -0.0
lighting-app tlsr9518adk80d (read/write) 827332 827324 -8 -0.0
text 587306 587300 -6 -0.0
Full report (43 builds for bl602, cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
platform target config section a42dffb bad8469 change % change
bl602 lighting-app bl602 (read/write) 1380202 1380202 0 0.0
.bss 119746 119746 0 0.0
.data 4480 4480 0 0.0
.text 1048308 1048304 -4 -0.0
bl602+rpc (read/write) 1425458 1425458 0 0.0
.bss 127186 127186 0 0.0
.data 4600 4600 0 0.0
.text 1079808 1079808 0 0.0
cc13x2_26x2 all-clusters-app LP_CC2652R7 (read only) 670551 670551 0 0.0
(read/write) 180832 180832 0 0.0
.bss 74276 74276 0 0.0
.data 3372 3372 0 0.0
.rodata 88479 88479 0 0.0
.text 581756 581756 0 0.0
all-clusters-minimal-app LP_CC2652R7 (read only) 636079 636063 -16 -0.0
(read/write) 157844 157844 0 0.0
.bss 73556 73556 0 0.0
.data 3372 3372 0 0.0
.rodata 77735 77727 -8 -0.0
.text 558020 558012 -8 -0.0
lock-ftd LP_CC2652R7 (read only) 673035 673027 -8 -0.0
(read/write) 168532 168540 8 0.0
.bss 71348 71348 0 0.0
.data 3296 3296 0 0.0
.rodata 76547 76547 0 0.0
.text 596008 596000 -8 -0.0
lock-mtd LP_CC2652R7 (read only) 655491 655467 -24 -0.0
(read/write) 181764 181788 24 0.0
.bss 67036 67036 0 0.0
.data 3296 3296 0 0.0
.rodata 101443 101435 -8 -0.0
.text 553568 553552 -16 -0.0
pump-app LP_CC2652R7 (read only) 682647 682639 -8 -0.0
(read/write) 159728 159736 8 0.0
.bss 71388 71388 0 0.0
.data 3296 3296 0 0.0
.rodata 89247 89247 0 0.0
.text 592916 592908 -8 -0.0
pump-controller-app LP_CC2652R7 (read only) 667111 667103 -8 -0.0
(read/write) 175400 175408 8 0.0
.bss 71524 71524 0 0.0
.data 3292 3292 0 0.0
.rodata 84791 84791 0 0.0
.text 581840 581832 -8 -0.0
shell LP_CC2652R7 (read only) 663226 663218 -8 -0.0
(read/write) 183676 183684 8 0.0
.bss 76596 76596 0 0.0
.data 3376 3376 0 0.0
.rodata 85426 85426 0 0.0
.text 577484 577476 -8 -0.0
cyw30739 light cyw930739m2evb_01 (read/write) 584738 584746 8 0.0
.app_xip_area 461548 461548 0 0.0
.bss 65632 65640 8 0.0
.data 744 744 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
lock cyw930739m2evb_01 (read/write) 590674 590674 0 0.0
.app_xip_area 462700 462692 -8 -0.0
.bss 70416 70424 8 0.0
.data 748 748 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
ota-requestor-no-progress-logging cyw930739m2evb_01 (read/write) 589890 589882 -8 -0.0
.app_xip_area 467508 467500 -8 -0.0
.bss 64880 64880 0 0.0
.data 688 688 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
efr32 lighting-app BRD4161A (read/write) 1090780 1096460 5680 0.5
.bss 133292 132844 -448 -0.3
.data 2064 2068 4 0.2
.text 955404 961524 6120 0.6
BRD4161A+rpc (read/write) 1145092 1150756 5664 0.5
.bss 149972 149532 -440 -0.3
.data 2276 2280 4 0.2
.text 992820 998924 6104 0.6
BRD4161A+rs911x (read/write) 977384 985764 8380 0.9
.bss 161784 162184 400 0.2
.data 2052 2056 4 0.2
.text 813528 821504 7976 1.0
lock-app BRD4161A+wf200 (read/write) 1130896 1136328 5432 0.5
.bss 144416 144824 408 0.3
.data 2060 2064 4 0.2
.text 984400 989420 5020 0.5
window-app BRD4161A (read/write) 1082524 1088200 5676 0.5
.bss 134748 134292 -456 -0.3
.data 2092 2096 4 0.2
.text 945664 951792 6128 0.6
esp32 all-clusters-app c3devkit (read only) 1025492 1025486 -6 -0.0
(read/write) 1487234 1487234 0 0.0
.dram0.bss 70336 70336 0 0.0
.dram0.data 14600 14600 0 0.0
.flash.rodata 216864 216864 0 0.0
.flash.text 1025492 1025486 -6 -0.0
.iram0.text 62902 62902 0 0.0
m5stack (read only) 1078935 1078935 0 0.0
(read/write) 489232 489240 8 0.0
.dram0.bss 75832 75840 8 0.0
.dram0.data 34144 34144 0 0.0
.flash.rodata 247260 247260 0 0.0
.flash.text 1073551 1073551 0 0.0
.iram0.text 123267 123267 0 0.0
k32w light k32w0+release (read/write) 644324 644316 -8 -0.0
.bss 69720 69712 -8 -0.0
.data 2044 2044 0 0.0
.text 569832 569832 0 0.0
lock k32w0+release (read/write) 701668 701652 -16 -0.0
.bss 70184 70184 0 0.0
.data 2052 2052 0 0.0
.text 626704 626688 -16 -0.0
linux all-clusters-app debug (read only) 3020145 3020145 0 0.0
(read/write) 155688 155688 0 0.0
.bss 61888 61888 0 0.0
.data 2096 2096 0 0.0
.data.rel.ro 85352 85352 0 0.0
.dynamic 608 608 0 0.0
.got 4568 4568 0 0.0
.init 27 27 0 0.0
.init_array 1152 1152 0 0.0
.rodata 272491 272491 0 0.0
.text 2568770 2568770 0 0.0
all-clusters-minimal-app debug (read only) 2861977 2861977 0 0.0
(read/write) 147488 147488 0 0.0
.bss 61152 61152 0 0.0
.data 2064 2064 0 0.0
.data.rel.ro 77992 77992 0 0.0
.dynamic 608 608 0 0.0
.got 4488 4488 0 0.0
.init 27 27 0 0.0
.init_array 1144 1144 0 0.0
.rodata 272555 272555 0 0.0
.text 2413170 2413170 0 0.0
bridge-app debug+rpc (read only) 2367849 2367865 16 0.0
(read/write) 127584 127584 0 0.0
.bss 50592 50592 0 0.0
.data 3600 3600 0 0.0
.data.rel.ro 67544 67544 0 0.0
.dynamic 608 608 0 0.0
.got 4392 4392 0 0.0
.init 27 27 0 0.0
.init_array 824 824 0 0.0
.rodata 203336 203336 0 0.0
.text 2001506 2001522 16 0.0
chip-tool debug (read only) 10442433 10442433 0 0.0
(read/write) 646368 646368 0 0.0
.bss 24856 24856 0 0.0
.data 3266 3266 0 0.0
.data.rel.ro 611704 611704 0 0.0
.dynamic 608 608 0 0.0
.got 5104 5104 0 0.0
.init 27 27 0 0.0
.init_array 768 768 0 0.0
.rodata 531349 531349 0 0.0
.text 8414916 8414916 0 0.0
chip-tool-ipv6only arm64 (read only) 9849660 9849660 0 0.0
(read/write) 694033 694033 0 0.0
.bss 32897 32897 0 0.0
.data 3272 3272 0 0.0
.data.rel.ro 639264 639264 0 0.0
.dynamic 560 560 0 0.0
.got 13624 13624 0 0.0
.init 24 24 0 0.0
.init_array 192 192 0 0.0
.rodata 463452 463452 0 0.0
.text 7759204 7759204 0 0.0
lighting-app debug+rpc (read only) 2590449 2590449 0 0.0
(read/write) 130232 130200 -32 -0.0
.bss 49728 49728 0 0.0
.data 2096 2096 0 0.0
.data.rel.ro 72456 72440 -16 -0.0
.dynamic 608 608 0 0.0
.got 4392 4392 0 0.0
.init 27 27 0 0.0
.init_array 912 912 0 0.0
.rodata 219088 219088 0 0.0
.text 2200290 2200290 0 0.0
lock-app debug (read only) 2574665 2574697 32 0.0
(read/write) 125568 125568 0 0.0
.bss 48256 48256 0 0.0
.data 1712 1712 0 0.0
.data.rel.ro 69592 69592 0 0.0
.dynamic 608 608 0 0.0
.got 4464 4464 0 0.0
.init 27 27 0 0.0
.init_array 888 888 0 0.0
.rodata 236048 236080 32 0.0
.text 2171602 2171602 0 0.0
ota-provider-app debug (read only) 2354785 2354785 0 0.0
(read/write) 119048 119048 0 0.0
.bss 47808 47808 0 0.0
.data 1936 1936 0 0.0
.data.rel.ro 63416 63416 0 0.0
.dynamic 608 608 0 0.0
.got 4488 4488 0 0.0
.init 27 27 0 0.0
.init_array 768 768 0 0.0
.rodata 209176 209176 0 0.0
.text 1981730 1981730 0 0.0
ota-requestor-app debug (read only) 2475329 2475329 0 0.0
(read/write) 126440 126440 0 0.0
.bss 50176 50176 0 0.0
.data 2240 2240 0 0.0
.data.rel.ro 68072 68072 0 0.0
.dynamic 608 608 0 0.0
.got 4480 4480 0 0.0
.init 27 27 0 0.0
.init_array 832 832 0 0.0
.rodata 212672 212672 0 0.0
.text 2090162 2090162 0 0.0
shell debug (read only) 2591353 2590969 -384 -0.0
(read/write) 141840 141872 32 0.0
.bss 57800 57800 0 0.0
.data 1264 1264 0 0.0
.data.rel.ro 76976 77008 32 0.0
.dynamic 608 608 0 0.0
.got 4136 4136 0 0.0
.init 27 27 0 0.0
.init_array 1024 1024 0 0.0
.rodata 233426 233042 -384 -0.2
.text 2199698 2199698 0 0.0
thermostat-no-ble arm64 (read only) 2347660 2347692 32 0.0
(read/write) 141601 141617 16 0.0
.bss 55313 55313 0 0.0
.data 1672 1672 0 0.0
.data.rel.ro 75832 75832 0 0.0
.dynamic 560 560 0 0.0
.got 5016 5024 8 0.2
.init 24 24 0 0.0
.init_array 408 408 0 0.0
.rodata 139572 139572 0 0.0
.text 1970672 1970688 16 0.0
tv-app debug (read only) 3162681 3162697 16 0.0
(read/write) 257736 257736 0 0.0
.bss 167352 167352 0 0.0
.data 4736 4736 0 0.0
.data.rel.ro 79104 79088 -16 -0.0
.dynamic 608 608 0 0.0
.got 4864 4864 0 0.0
.init 27 27 0 0.0
.init_array 1064 1064 0 0.0
.rodata 257032 257000 -32 -0.0
.text 2715858 2715906 48 0.0
tv-casting-app debug (read only) 5400569 5400569 0 0.0
(read/write) 158728 158728 0 0.0
.bss 51384 51384 0 0.0
.data 2432 2432 0 0.0
.data.rel.ro 98504 98488 -16 -0.0
.dynamic 608 608 0 0.0
.got 4752 4752 0 0.0
.init 27 27 0 0.0
.init_array 1032 1032 0 0.0
.rodata 340337 340337 0 0.0
.text 4792722 4792722 0 0.0
mbed lock-app CY8CPROTO_062_4343W+release (read only) 6224 6224 0 0.0
(read/write) 2453424 2453472 48 0.0
.bss 214548 214556 8 0.0
.data 5872 5872 0 0.0
.text 1416068 1416116 48 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 (read/write) 1177391 1177391 0 0.0
bss 143222 143222 0 0.0
rodata 142704 142704 0 0.0
text 812620 812616 -4 -0.0
all-clusters-minimal-app nrf52840dk_nrf52840 (read/write) 1157447 1157447 0 0.0
bss 142460 142460 0 0.0
rodata 134400 134400 0 0.0
text 801772 801768 -4 -0.0
p6 all-clusters-app default (read only) 881528 881528 0 0.0
(read/write) 1690500 1690484 -16 -0.0
.bss 149168 149168 0 0.0
.data 2648 2648 0 0.0
.text 1530296 1530280 -16 -0.0
all-clusters-minimal-app default (read only) 882248 882248 0 0.0
(read/write) 1634692 1634676 -16 -0.0
.bss 148448 148448 0 0.0
.data 2648 2648 0 0.0
.text 1475208 1475192 -16 -0.0
light-app default (read only) 890568 890568 0 0.0
(read/write) 1554980 1554964 -16 -0.0
.bss 140336 140336 0 0.0
.data 2440 2440 0 0.0
.text 1403816 1403800 -16 -0.0
lock-app default (read only) 886072 886072 0 0.0
(read/write) 1592268 1592252 -16 -0.0
.bss 144816 144816 0 0.0
.data 2456 2456 0 0.0
.text 1436608 1436592 -16 -0.0
telink light-switch-app tlsr9518adk80d (read/write) 805660 805660 0 0.0
bss 70976 70976 0 0.0
noinit 43488 43488 0 0.0
text 569464 569462 -2 -0.0
lighting-app tlsr9518adk80d (read/write) 827332 827324 -8 -0.0
bss 71820 71820 0 0.0
noinit 43488 43488 0 0.0
text 587306 587300 -6 -0.0

@jmartinez-silabs jmartinez-silabs merged commit 3dc97f0 into project-chip:master Aug 4, 2022
isiu-apple pushed a commit to isiu-apple/connectedhomeip that referenced this pull request Sep 16, 2022
…Crypto and opaque keys for [EFR32] (project-chip#21415)

* Remove unused member from struct

* Add a way to use a platform-defined crypto backend

* Moving the checks and defaulting to the BUILD.gn file, to allow
  both platform and commandline overriding of the chip_crypto setting
* Add an option 'platform' which skips adding dependencies and compiling
  'CHIPCryptoPALxxx.cpp' into the library. Whoever/whatever is setting
  chip_crypto to platform is responsible for maintaining their own
  dependencies and keeping their implementation up to date with
  CHIPCryptoPAL.h

* [EFR32] Add a PSA Crypto backend for EFR32

The EFR32 SDK has an SDK-supplied implementation of PSA which is hardware
backed.

* [EFR32] Speed and size improvements by going straight for the driver layer

Considering all keys pass in plaintext through this abstraction, this
doesn't really matter all that much for the time being.

* [EFR32] Finetune PSA Crypto configuration

Remove blanket 'BUILTIN_ALG' defines since they will cause PSA Crypto
to not be able to compile out these algorithm implementations in software,
which again causes pretty hefty dependencies on mbedTLS

* [EFR32] Now that we have HMAC through PSA, we don't need PKCS5 anymore

This saves quite some codespace by allowing to strip dead code dangling
from OpenThread's use of mbedtls_pk_parse_key (which, when PKCS5 is
enabled, will always include code for parsing password-protected PEM
files, but no such files are ever used in the context of Matter)

* [EFR32] Add implementation of opaque keys and opaque operational key store

* [EFR32] Implement persistence for operational keys and cleanup

* Implemented persistence of operational key map and runtime resizing
  on key map should the setting change and be OTA'ed over.
* Changed namespacing to put EFR32 classes under the internal layer
* Added 'ConfigValueExists' overload to the config manager which returns
  the size of an object if it exists.

* [EFR32] Set correct SHA context size on devices with HW acceleration

* [EFR32] fix incorrect usage of VerifyOrExit

* Add empty definition of TestAddEntropySources for platform

* [EFR32] Fix circular dependency

* [EFR32] Fix dependencies for Wifi build

* Fix default crypto build

Moving the override of chip_crypto in case it isn't set into crypto's
BUILD.gn instead of crypto.gni means that the toplevel BUILD.gn no longer
can see which crypto instance it ends up building with. This was only used
to determine whether or not to build chip-cert tool by default.

This commit clarifies that by duplicating the exact logic that was backing
this into the tools.gni file under a more descriptive variable name. The
actual logic probably needs cleaning up, but that would be outside the scope
of this PR.

* Pull apart the crypto library into headers, intermediate and backend

Instead of viewing crypto as a monolithic library, encode it more
granular to better allow platform crypto implementations. It now consists
of its public headers (which the crypto backends depend on), a static
library containing the abstractly-implemented functions, and a set
of source sets for each of the crypto backends provided by the main tree.

* [EFR32] Fix dependency encoding of crypto backend

The EFR32 crypto backend (brought in by setting chip_crypto to platform)
now correctly advertises a dependency on the matter crypto PAL. It only
needs the intermediate layer of the crypto PAL, not a backend, which is
taken care of due to chip_crypto being set to platform.

* [EFR32] Address readability according to review comments

* [EFR32] Use Matter CSR generation instead of mbedTLS

Use GenerateCertificateSigningRequest instead of replicating the mbedTLS
implementation of CSR generation. Since there were no other parts of the
app depending on mbedTLS CSR writing functionality, this saved 3.5kB of
code space for the light sample app on EFR32 BRD4161A.

* MbedTLS backend depends on Crypto PAL headers regardless of where it lives

* Restyled by gn

* Fix typo

* [EFR32] Allow building EFR32 examples with in-tree crypto backends

* [EFR32] Remove dead TinyCrypt code from EFR32 crypto backend

* [EFR32] Ensure mbedTLS gets rebuilt when config header is modified

* [EFR32] Dynamically size the keymap object for the operational keystore

* [EFR32] Some parts need mbedTLS's entropy API still

* rebase and restyle

Co-authored-by: Restyled.io <[email protected]>
Co-authored-by: Junior Martinez <[email protected]>
mkardous-silabs pushed a commit to mkardous-silabs/connectedhomeip that referenced this pull request Dec 19, 2022
The silabs_1.0 commit rebased into: fdf1048

Details of these changes can be seen in the initial commits on the feature/matter-slc-integration branch:
        commit e06dbd63a25bf6c0670481cfa056b545f5312585 (HEAD -> feature/matter-slc-integration, origin/feature/matter-slc-integration)
                update code owners for gsdk integration
        commit 14b33a1eb6c09485ee955c20104a594f90df8079
                script updates
        commit 34e65edce927356361a6518aaf04adb5bd9db8b1
                 Add a script for copying Matter extension files to a give directory
        commit 4e0b6ea46301de7bf4c3bb0b8fb29a1c3e61658e
               Fix gsdk_matter.patch, exlcude INCLUDE_xTimerPendFunctionCall
               This define comes from Matter, exclude the contribution from the FreeRTOS component
        commit aec69e1a5be0910657388b4edf0c068dea03cfa7
              Set OPENTHREAD_CONFIG_LOG_OUTPUT_APP in the lock project file
        commit b037d18e1752c2496783c5a1129d850c3e1e809e
              Reenable patching of GSDK now that the patch file is updated
        commit 66d7d48055a5199b089c8f846765aa1a3738abb3
             Update the patch file for the GSDK repo
             Update the patch file to account for the OpenThread code refactor. The crypto change show no longer be needed because of https://stash.silabs.com/projects/EMBSW/repos/platform_crypto/pull-requests/875/overview
        commit 8994c0de263d31e2ae51088dd51f82a41f8cac12
               Misc fixes to pass compilation
        commit f596e9d46d5183bb7ea27e6d1a13d578c280fe1f
              Add SDK extension meta files
        commit a169862cd14717a2c03bfa7889782ba5d99b1656
             Update slc-based lock-app sources to match the example
        commit 44eaa72b178461c2622f7f4142f3403cc7879fda
           Misc temporary changes to pass compilation
        commit 7e13939d82ceb3cfcac5c216c42db173926626e5
           Fix rebase error
        commit d688016aff0d7cb20d2a48426f82dc8b532981ab
           Add a line lost during rebase
        commit 1665b4ba3a5a6444cb98c9741677f2c5f4bcaa0b
           Fix merge errors
           Picked up changes from project-chip#21415 lost during rebase
        commit 1518b635ea9d739893ac24598d2700192848cdb6
           Temporary fix to get SLC integration to compile.
        commit 94dd419ca4ac60eed21b5f556211b1b17f9011e1
           Update SLCC files after running gen_components.py on the latest code
        commit 4084163b8dd49f08f9d47552df1e112b0e813651
           Add gatt component that is now required by ot_platform_abstraction component (NOT APPLICABLE)
        commit 34f8a5e831feffeef26ced4a06dbed571f927c97
            Update lock example and QR code components to accommodate lcd.c name change
        commit c5c6d1e959cf059968c7154687de4b4bca1172f6
            Initial commit for Matter SLC integration changes from Aksel Mellbeye
            Changes originaly went into the experimental/slc-integration branch
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants