random: remove TinyCrypt usage

Following the deprecation of TinyCrypt (zephyrproject-rtos#79566) we remove TinyCrypt usage in random generators. This basically only affects the CTR-DRBG random generator which from now only will only make use of Mbed TLS. Signed-off-by: Valerio Setti <[email protected]>
valeriosetti · Oct 30, 2024 · 6b09d44 · 6b09d44
1 parent 21a67bb
commit 6b09d44
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 78 deletions.
diff --git a/doc/releases/migration-guide-4.0.rst b/doc/releases/migration-guide-4.0.rst
@@ -534,6 +534,14 @@ MCUmgr
 Modem
 =====
 
+Random
+======
+
+* Following the deprecation of the TinyCrypt library (:github:`79566`), usage
+  of TinyCrypt in the CTR-DRBG random number generator was removed. From now on
+  Mbed TLS is required to enable :kconfig:option:`CONFIG_CTR_DRBG_CSPRNG_GENERATOR`.
+  (:github:`79653`)
+
 Shell
 =====
 

diff --git a/subsys/random/Kconfig b/subsys/random/Kconfig
@@ -106,11 +106,9 @@ config HARDWARE_DEVICE_CS_GENERATOR
 
 config CTR_DRBG_CSPRNG_GENERATOR
 	bool "Use CTR-DRBG CSPRNG"
-	depends on MBEDTLS || TINYCRYPT
+	depends on MBEDTLS
 	depends on ENTROPY_HAS_DRIVER
-	select MBEDTLS_CIPHER_AES_ENABLED if MBEDTLS
-	select TINYCRYPT_CTR_PRNG if TINYCRYPT
-	select TINYCRYPT_AES if TINYCRYPT
+	select MBEDTLS_CIPHER_AES_ENABLED
 	help
 	  Enables the CTR-DRBG pseudo-random number generator. This CSPRNG
 	  shall use the entropy API for an initialization seed. The CTR-DRBG

diff --git a/subsys/random/random_ctr_drbg.c b/subsys/random/random_ctr_drbg.c
@@ -10,22 +10,13 @@
 #include <zephyr/kernel.h>
 #include <string.h>
 
-#if defined(CONFIG_MBEDTLS)
 #if !defined(CONFIG_MBEDTLS_CFG_FILE)
 #include "mbedtls/config.h"
 #else
 #include CONFIG_MBEDTLS_CFG_FILE
 #endif /* CONFIG_MBEDTLS_CFG_FILE */
 #include <mbedtls/ctr_drbg.h>
 
-#elif defined(CONFIG_TINYCRYPT)
-
-#include <tinycrypt/ctr_prng.h>
-#include <tinycrypt/aes.h>
-#include <tinycrypt/constants.h>
-
-#endif /* CONFIG_MBEDTLS */
-
 /*
  * entropy_dev is initialized at runtime to allow first time initialization
  * of the ctr_drbg engine.
@@ -35,22 +26,13 @@ static const unsigned char drbg_seed[] = CONFIG_CS_CTR_DRBG_PERSONALIZATION;
 static bool ctr_initialised;
 static struct k_mutex ctr_lock;
 
-#if defined(CONFIG_MBEDTLS)
-
 static mbedtls_ctr_drbg_context ctr_ctx;
 
 static int ctr_drbg_entropy_func(void *ctx, unsigned char *buf, size_t len)
 {
 	return entropy_get_entropy(entropy_dev, (void *)buf, len);
 }
 
-#elif defined(CONFIG_TINYCRYPT)
-
-static TCCtrPrng_t ctr_ctx;
-
-#endif /* CONFIG_MBEDTLS */
-
-
 static int ctr_drbg_initialize(void)
 {
 	int ret;
@@ -62,8 +44,6 @@ static int ctr_drbg_initialize(void)
 		return -ENODEV;
 	}
 
-#if defined(CONFIG_MBEDTLS)
-
 	mbedtls_ctr_drbg_init(&ctr_ctx);
 
 	ret = mbedtls_ctr_drbg_seed(&ctr_ctx,
@@ -77,27 +57,6 @@ static int ctr_drbg_initialize(void)
 		return -EIO;
 	}
 
-#elif defined(CONFIG_TINYCRYPT)
-
-	uint8_t entropy[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
-
-	ret = entropy_get_entropy(entropy_dev, (void *)&entropy,
-				  sizeof(entropy));
-	if (ret != 0) {
-		return -EIO;
-	}
-
-	ret = tc_ctr_prng_init(&ctr_ctx,
-			       (uint8_t *)&entropy,
-			       sizeof(entropy),
-			       (uint8_t *)drbg_seed,
-			       sizeof(drbg_seed));
-
-	if (ret == TC_CRYPTO_FAIL) {
-		return -EIO;
-	}
-
-#endif
 	ctr_initialised = true;
 	return 0;
 }
@@ -117,41 +76,8 @@ int z_impl_sys_csrand_get(void *dst, uint32_t outlen)
 		}
 	}
 
-#if defined(CONFIG_MBEDTLS)
-
 	ret = mbedtls_ctr_drbg_random(&ctr_ctx, (unsigned char *)dst, outlen);
 
-#elif defined(CONFIG_TINYCRYPT)
-
-	uint8_t entropy[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
-
-	ret = tc_ctr_prng_generate(&ctr_ctx, 0, 0, (uint8_t *)dst, outlen);
-
-	if (ret == TC_CRYPTO_SUCCESS) {
-		ret = 0;
-	} else if (ret == TC_CTR_PRNG_RESEED_REQ) {
-
-		ret = entropy_get_entropy(entropy_dev,
-				    (void *)&entropy, sizeof(entropy));
-		if (ret != 0) {
-			ret = -EIO;
-			goto end;
-		}
-
-		ret = tc_ctr_prng_reseed(&ctr_ctx,
-					entropy,
-					sizeof(entropy),
-					drbg_seed,
-					sizeof(drbg_seed));
-
-		ret = tc_ctr_prng_generate(&ctr_ctx, 0, 0,
-					   (uint8_t *)dst, outlen);
-
-		ret = (ret == TC_CRYPTO_SUCCESS) ? 0 : -EIO;
-	} else {
-		ret = -EIO;
-	}
-#endif
 end:
 	k_mutex_unlock(&ctr_lock);