fix(nimble): Fix PSA related compilation issue for mesh example

nimble/host/mesh/src/crypto.c

@@ -15,7 +15,11 @@
 #include <stdbool.h>
 #include <errno.h>
 
+#if CONFIG_MBEDTLS_VER_4_X_SUPPORT
+#include <psa/crypto.h>
+#else
 #include <mbedtls/cmac.h>
+#endif
 
 #include "crypto.h"
 
@@ -23,6 +27,52 @@
 #define APP_MIC_LEN(aszmic) ((aszmic) ? 8 : 4)
 
 
+#if CONFIG_MBEDTLS_VER_4_X_SUPPORT
+int bt_mesh_aes_cmac(const uint8_t key[16], struct bt_mesh_sg *sg,
+		     size_t sg_len, uint8_t mac[16])
+{
+	psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
+	psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
+	psa_key_id_t key_id = 0;
+	size_t mac_len = 0;
+	int err = -EIO;
+
+	psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
+	psa_set_key_algorithm(&key_attributes, PSA_ALG_CMAC);
+	psa_set_key_type(&key_attributes, PSA_KEY_TYPE_AES);
+	psa_set_key_bits(&key_attributes, 128);
+
+	if (psa_import_key(&key_attributes, key, 16, &key_id) != PSA_SUCCESS) {
+		psa_reset_key_attributes(&key_attributes);
+		return -EIO;
+	}
+	psa_reset_key_attributes(&key_attributes);
+
+	if (psa_mac_sign_setup(&operation, key_id, PSA_ALG_CMAC) != PSA_SUCCESS) {
+		goto done;
+	}
+
+	for (; sg_len; sg_len--, sg++) {
+		if (psa_mac_update(&operation, sg->data, sg->len) != PSA_SUCCESS) {
+			goto done;
+		}
+	}
+
+	if (psa_mac_sign_finish(&operation, mac, 16, &mac_len) != PSA_SUCCESS ||
+	    mac_len != 16) {
+		goto done;
+	}
+
+	err = 0;
+
+done:
+	if (err) {
+		psa_mac_abort(&operation);
+	}
+	psa_destroy_key(key_id);
+	return err;
+}
+#else
 int bt_mesh_aes_cmac(const uint8_t key[16], struct bt_mesh_sg *sg,
 		     size_t sg_len, uint8_t mac[16])
 {
@@ -56,6 +106,7 @@ done:
 	mbedtls_cipher_free(&ctx);
 	return err;
 }
+#endif /* CONFIG_MBEDTLS_VER_4_X_SUPPORT */
 
 int bt_mesh_k1(const uint8_t *ikm, size_t ikm_len, const uint8_t salt[16],
 	       const char *info, uint8_t okm[16])

nimble/host/mesh/src/glue.c

@@ -33,7 +33,11 @@
 #include "base64/base64.h"
 #endif
 
+#if CONFIG_MBEDTLS_VER_4_X_SUPPORT
+#include <psa/crypto.h>
+#else
 #include <mbedtls/aes.h>
+#endif
 
 extern uint8_t g_mesh_addr_type;
 
@@ -137,6 +141,37 @@ void net_buf_simple_clone(const struct os_mbuf *original,
 }
 
 
+#if CONFIG_MBEDTLS_VER_4_X_SUPPORT
+int
+bt_encrypt_be(const uint8_t *key, const uint8_t *plaintext, uint8_t *enc_data)
+{
+	psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
+	psa_key_id_t key_id = 0;
+	size_t output_len = 0;
+	psa_status_t status;
+
+	psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_ENCRYPT);
+	psa_set_key_algorithm(&key_attributes, PSA_ALG_ECB_NO_PADDING);
+	psa_set_key_type(&key_attributes, PSA_KEY_TYPE_AES);
+	psa_set_key_bits(&key_attributes, 128);
+
+	status = psa_import_key(&key_attributes, key, 16, &key_id);
+	psa_reset_key_attributes(&key_attributes);
+	if (status != PSA_SUCCESS) {
+		return BLE_HS_EUNKNOWN;
+	}
+
+	status = psa_cipher_encrypt(key_id, PSA_ALG_ECB_NO_PADDING, plaintext, 16,
+				    enc_data, 16, &output_len);
+	psa_destroy_key(key_id);
+
+	if (status != PSA_SUCCESS || output_len != 16) {
+		return BLE_HS_EUNKNOWN;
+	}
+
+	return 0;
+}
+#else
 int
 bt_encrypt_be(const uint8_t *key, const uint8_t *plaintext, uint8_t *enc_data)
 {
@@ -156,6 +191,7 @@ bt_encrypt_be(const uint8_t *key, const uint8_t *plaintext, uint8_t *enc_data)
 
 	return 0;
 }
+#endif /* CONFIG_MBEDTLS_VER_4_X_SUPPORT */
 
 uint16_t
 net_buf_simple_pull_le16(struct os_mbuf *om)

nimble/host/mesh/src/prov_device.c

@@ -24,7 +24,11 @@
 #include "settings.h"
 #include "pb_gatt_srv.h"
 
+#if CONFIG_MBEDTLS_VER_4_X_SUPPORT
+#include "psa/crypto.h"
+#else
 #include "mbedtls/ecdh.h"
+#endif
 
 static void send_pub_key(void);
 static void pub_key_ready(const uint8_t *pkey);
@@ -297,6 +301,43 @@ static void prov_dh_key_cb(const uint8_t dhkey[BT_DH_KEY_LEN])
 	dh_key_gen_complete();
 }
 
+#if CONFIG_MBEDTLS_VER_4_X_SUPPORT
+int bt_mesh_dhkey_gen(const uint8_t *remote_pk, const uint8_t *private_key_be,
+		      uint8_t *dhkey)
+{
+	psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
+	psa_key_id_t key_id = 0;
+	uint8_t uncompressed_pk[65];
+	size_t output_len = 0;
+	psa_status_t status;
+
+	uncompressed_pk[0] = 0x04;
+	memcpy(&uncompressed_pk[1], remote_pk, 64);
+
+	psa_set_key_type(&key_attributes,
+			 PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1));
+	psa_set_key_bits(&key_attributes, 256);
+	psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
+	psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
+
+	status = psa_import_key(&key_attributes, private_key_be, 32, &key_id);
+	psa_reset_key_attributes(&key_attributes);
+	if (status != PSA_SUCCESS) {
+		return -EIO;
+	}
+
+	status = psa_raw_key_agreement(PSA_ALG_ECDH, key_id, uncompressed_pk,
+				       sizeof(uncompressed_pk), dhkey, 32,
+				       &output_len);
+	psa_destroy_key(key_id);
+
+	if (status != PSA_SUCCESS || output_len != 32) {
+		return -EIO;
+	}
+
+	return 0;
+}
+#else
 static int
 mbedtls_rand(void *arg, unsigned char *buf, size_t size)
 {
@@ -352,6 +393,7 @@ done:
 
 	return ret;
 }
+#endif /* CONFIG_MBEDTLS_VER_4_X_SUPPORT */
 
 static void prov_dh_key_gen(void)
 {