[PATCH 0/4] Add a PSA Crypto API backend (CONFIG_TLS=psa)

[Chaitanya Tata]

From: Chaitanya Tata <Chaitanya.Tata at nordicsemi.no>

This series adds a new crypto/TLS backend selected with CONFIG_TLS=psa,
built on the Arm PSA Crypto API with MbedTLS 4.x / TF-PSA-Crypto 1.x as the
reference provider. It targets resource-constrained and PSA-based platforms
(Nordic nRF Connect SDK with Oberon PSA Crypto + CryptoCell, TF-M, ...),
where crypto is exposed through the standardized PSA API rather than a
specific library.

Design (PSA-first, explicit non-PSA boundary): crypto_psa.c has the portable
PSA-only primitives; crypto_psa_mbedtls.c has the bignum/EC-point/DH math the
PSA API does not expose (SAE/DPP/PASN/EAP-PWD) via MbedTLS builtin modules;
tls_psa.c does TLS/X.509 via MbedTLS.

Tested: tests/build configs build wpa_supplicant + hostapd clean (-Werror)
against MbedTLS 4.2.0 + TF-PSA-Crypto 1.2.0; MODULE_TESTS pass on both; hwsim
open/WPA2-PSK/SAE/OWE and EAP-TLS/PEAP/TTLS associations pass.

Known limitations (README-psa.md; follow-up; none affect core Personal/
Enterprise): EAP-FAST/TEAP, RSA-OAEP (DPP2/DPP3, EAP-SIM/AKA IMSI privacy),
OCSP, PKCS#12.

Relation to prior work: the 2022 library-specific mbed TLS backend [1] was
not merged; this PSA-API approach is more general (any PSA provider) and
matches the PSA-native direction of MbedTLS 4 / TF-PSA-Crypto, obsoleting it.

[1] https://patchwork.ozlabs.org/project/hostap/patch/20220424161034.1365496-1-krish271828@gmail.com/

Cc: Maochen Wang <maochen.wang at nxp.com>

Chaitanya Tata (4):
  crypto: Add PSA-based crypto and TLS backend (CONFIG_TLS=psa)
  tests: Add build configs for the PSA crypto backend
  tests: hwsim: Add PSA crypto backend option
  docs: Document the PSA crypto backend

 hostapd/Makefile                            |   83 +
 hostapd/defconfig                           |    4 +
 src/crypto/README-psa.md                    |  113 +
 src/crypto/crypto_psa.c                     | 1491 +++++++++
 src/crypto/crypto_psa_mbedtls.c             | 2357 +++++++++++++++
 src/crypto/tls_psa.c                        | 2999 +++++++++++++++++++
 tests/build/build-hostapd-psa.config        |   50 +
 tests/build/build-wpa_supplicant-psa.config |   52 +
 tests/hwsim/example-hostapd.config          |   24 +
 tests/hwsim/example-wpa_supplicant.config   |   24 +
 tests/hwsim/start.sh                        |   17 +
 wpa_supplicant/Makefile                     |   66 +
 wpa_supplicant/defconfig                    |    4 +
 13 files changed, 7284 insertions(+)
 create mode 100644 src/crypto/README-psa.md
 create mode 100644 src/crypto/crypto_psa.c
 create mode 100644 src/crypto/crypto_psa_mbedtls.c
 create mode 100644 src/crypto/tls_psa.c
 create mode 100644 tests/build/build-hostapd-psa.config
 create mode 100644 tests/build/build-wpa_supplicant-psa.config

-- 
2.43.0