[nrf_security] use vanilla mbedtls only for AES (#5596)

* removed CC310 backend for AES in nrf_security module
* removed crypto glue libraries that become unnecessary

examples/platforms/nrf528xx/nrf52840/Makefile.platform.am

@@ -39,11 +39,7 @@ LDADD_COMMON
 
 if !OPENTHREAD_ENABLE_BUILTIN_MBEDTLS
 LDADD_COMMON                                                                                              += \
-    $(top_srcdir)/third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_glue.a            \
-    $(top_srcdir)/third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_glue_cc310.a      \
-    $(top_srcdir)/third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_glue_vanilla.a    \
     $(top_srcdir)/third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_cc310_backend.a   \
-    $(top_srcdir)/third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_vanilla_backend.a \
     $(top_srcdir)/third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedtls_tls_vanilla.a        \
     $(top_srcdir)/third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedtls_x509_vanilla.a       \
     $(top_srcdir)/third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedtls_base_vanilla.a       \

examples/platforms/nrf528xx/nrf52840/README.md

@@ -135,11 +135,7 @@ mbedtls_platform_setup(NULL);
 When building an external application with OpenThread libraries and CryptoCell 310 hardware acceleration, use the following configuration:
 
 - Crypto libraries:
-  - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_glue.a`
-  - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_glue_cc310.a`
-  - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_glue_vanilla.a`
   - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_cc310_backend.a`
-  - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_vanilla_backend.a`
   - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedtls_tls_vanilla.a`
   - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedtls_x509_vanilla.a`
   - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedtls_base_vanilla.a`
@@ -207,11 +203,7 @@ mbedtls_platform_setup(NULL);
 When building an external application that uses RTOS with OpenThread libraries and the CryptoCell 310 hardware acceleration, use the following configuration:
 
 - Crypto libraries:
-  - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_glue.a`
-  - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_glue_cc310.a`
-  - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_glue_vanilla.a`
   - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_cc310_backend.a`
-  - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedcrypto_vanilla_backend.a`
   - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedtls_tls_vanilla.a`
   - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedtls_x509_vanilla.a`
   - `third_party/NordicSemiconductor/libraries/nrf_security/lib/libmbedtls_base_vanilla.a`

third_party/NordicSemiconductor/libraries/nrf_security/config/nrf-config.h

@@ -304,7 +304,7 @@
  *            digests and ciphers instead.
  *
  */
-#define MBEDTLS_AES_ALT
+/* #undef MBEDTLS_AES_ALT */
 //#define MBEDTLS_ARC4_ALT
 //#define MBEDTLS_ARIA_ALT
 //#define MBEDTLS_BLOWFISH_ALT
@@ -312,7 +312,7 @@
 #define MBEDTLS_CCM_ALT
 #define MBEDTLS_CHACHA20_ALT
 #define MBEDTLS_CHACHAPOLY_ALT
-#define MBEDTLS_CMAC_ALT
+/* #undef MBEDTLS_CMAC_ALT */
 //#define MBEDTLS_DES_ALT
 #define MBEDTLS_DHM_ALT
 //#define MBEDTLS_ECJPAKE_ALT
@@ -3136,13 +3136,9 @@ it is (2^48 - 1), our restriction is :  (int - 0xFFFF - 0xF).*/
 
 /* Target and application specific configurations */
 
-#define CONFIG_CC310_MBEDTLS_AES_C
-#define CONFIG_CC310_MBEDTLS_C
 #define CONFIG_CC310_MBEDTLS_CCM_C
 #define CONFIG_CC310_MBEDTLS_CHACHA20_C
 #define CONFIG_CC310_MBEDTLS_CHACHAPOLY_C
-#define CONFIG_CC310_MBEDTLS_CIPHER_MODE_C
-#define CONFIG_CC310_MBEDTLS_CMAC_C
 #define CONFIG_CC310_MBEDTLS_DHM_C
 #define CONFIG_CC310_MBEDTLS_ECDH_C
 #define CONFIG_CC310_MBEDTLS_ECDSA_C
@@ -3151,12 +3147,9 @@ it is (2^48 - 1), our restriction is :  (int - 0xFFFF - 0xF).*/
 #define CONFIG_CC310_MBEDTLS_POLY1305_C
 #define CONFIG_CC310_MBEDTLS_SHA1_C
 #define CONFIG_CC310_MBEDTLS_SHA256_C
-#define CONFIG_GLUE_MBEDTLS_AES_C
-#define CONFIG_GLUE_MBEDTLS_C
 #define CONFIG_GLUE_MBEDTLS_CIPHER_MODE_C
 #define CONFIG_VANILLA_MBEDTLS_AES_C
-#define CONFIG_VANILLA_MBEDTLS_C
-#define CONFIG_VANILLA_MBEDTLS_CIPHER_MODE_C
+#define CONFIG_VANILLA_MBEDTLS_CMAC_C
 
 //#define YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE "target_config.h"
 
@@ -3193,7 +3186,7 @@ it is (2^48 - 1), our restriction is :  (int - 0xFFFF - 0xF).*/
  * Nordic added. Defines for features not supported in HW
  * on non-glued functionality.
  */
-/* #undef MBEDTLS_AES_256_CMAC_C */
+#define MBEDTLS_AES_256_CMAC_C
 
 /*
  * Nordic added. Ensure there is a definition of mbedtls_ecp_restart_ctx

third_party/NordicSemiconductor/libraries/nrf_security/include/mbedtls/aes_alt.h

@@ -1,65 +0,0 @@
-/*
- * Copyright (c) 2019 Nordic Semiconductor ASA
- *
- * SPDX-License-Identifier: LicenseRef-BSD-5-Clause-Nordic
- */
-
-/**@file
- * @addtogroup mbedtls_glue_aes
- * @{
- */
-#ifndef MBEDTLS_AES_ALT_H
-#define MBEDTLS_AES_ALT_H
-
-#if !defined(MBEDTLS_CONFIG_FILE)
-#include "../config.h"
-#else
-#include MBEDTLS_CONFIG_FILE
-#endif
-
-#define CC310_MBEDTLS_AES_CONTEXT_WORDS         (24)    //!< AES context size in words in nrf_cc310_mbedcrypto library.
-#define VANILLA_MBEDTLS_AES_CONTEXT_WORDS       (70)    //!< AES context size in words in standard mbed TLS.
-#define VANILLA_MBEDTLS_AES_XTS_CONTEXT_WORDS   (140)   //!< AES XTS context size in words in standard mbed TLS.
-
-#if defined(MBEDTLS_AES_ALT)
-
-#include <stdint.h>
-
-
-/** @brief Typedef of mbedcrypto AES glue context.
- */
-typedef struct mbedtls_aes_context
-{
-    union
-    {
-#if defined(CONFIG_CC310_MBEDTLS_AES_C)
-        uint32_t buffer_cc310[CC310_MBEDTLS_AES_CONTEXT_WORDS];                //!< Array the size of an AES context in the nrf_cc310_mbedcrypto library.
-#endif /* CONFIG_CC310_MBEDTLS_AES_C */
-#if defined(CONFIG_VANILLA_MBEDTLS_AES_C)
-        uint32_t buffer_vanilla_mbedtls[VANILLA_MBEDTLS_AES_CONTEXT_WORDS];    //!< Array the size of an AES context in vanilla mbed TLS.
-#endif /* CONFIG_VANILLA_MBEDTLS_AES_C */
-        uint32_t dummy;                                                        //!< Dummy value in case no backend is enabled.
-    } buffer;                                                                  //!< Union with size of the largest enabled backend context.
-    void* handle;   //!< Pointer to the function table in an initialized glue context.
-} mbedtls_aes_context;
-
-
-/** @brief Typedef of mbedcrypto glue AES XTS context
- */
-typedef struct mbedtls_aes_xts_context
-{
-    union
-    {
-#if defined(CONFIG_VANILLA_MBEDTLS_CIPHER_MODE_XTS)
-        uint32_t buffer_vanilla_mbedtls[VANILLA_MBEDTLS_AES_XTS_CONTEXT_WORDS];    //!< Array the size of the memory required for an AES XTS context in vanilla mbed TLS.
-#endif /* CONFIG_VANILLA_MBEDTLS_CIPHER_MODE_XTS */
-        uint32_t dummy;                                                            //!< Dummy value in case no backend is enabled.
-    } buffer;                                                                      //!< Array with length equal to the size of the largest enabled backend.
-    void* handle;   //!< Pointer to the function table in an initialized glue context.
-} mbedtls_aes_xts_context;
-
-#endif /* MBEDTLS_AES_ALT */
-
-#endif /* MBEDTLS_AES_ALT_H */
-
-/** @} */

third_party/NordicSemiconductor/libraries/nrf_security/include/mbedtls/cmac_alt.h

@@ -1,43 +0,0 @@
-/*
- * Copyright (c) 2001-2019, Arm Limited and Contributors. All rights reserved.
- *
- * SPDX-License-Identifier: BSD-3-Clause OR Arm’s non-OSI source license
- */
-
-#ifndef MBEDTLS_CMAC_ALT_H
-#define MBEDTLS_CMAC_ALT_H
-
-#if defined(MBEDTLS_CONFIG_FILE)
-#include MBEDTLS_CONFIG_FILE
-#endif
-
-
-
-#include <stddef.h>
-#include <stdint.h>
-
-#if defined(MBEDTLS_CMAC_ALT)
-
-/* hide internal implementation of the struct. Allocate enough space for it.*/
-#define MBEDTLS_CMAC_CONTEXT_SIZE_IN_WORDS          33
-
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/**
- * \brief          CMAC cipher context structure
- */
-struct mbedtls_cmac_context_t{
-    /*! Internal buffer */
-    uint32_t buf[MBEDTLS_CMAC_CONTEXT_SIZE_IN_WORDS];
-};
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif  /* MBEDTLS_CMAC_ALT */
-
-#endif /* MBEDTLS_CMAC_ALT_H */