mbedtls: Add missing MBEDTLS_PK_RSA_ALT_SUPPORT Kconfig option (IDFGH-17174)#18182
mbedtls: Add missing MBEDTLS_PK_RSA_ALT_SUPPORT Kconfig option (IDFGH-17174)#18182Yuerchu wants to merge 1 commit intoespressif:masterfrom
Conversation
|
|
👋 Hello Yuerchu, we appreciate your contribution to this project! 📘 Please review the project's Contributions Guide for key guidelines on code, documentation, testing, and more. 🖊️ Please also make sure you have read and signed the Contributor License Agreement for this project. Click to see more instructions ...
Review and merge process you can expect ...
|
github-actions
bot
changed the title
The ESP-TLS component's ESP_TLS_USE_DS_PERIPHERAL config option depends on MBEDTLS_PK_RSA_ALT_SUPPORT, but this symbol was never defined in the Kconfig system. It only existed as a preprocessor macro in esp_config.h. This caused the DS peripheral option to be unavailable in menuconfig, even on chips that support it (ESP32-S2, ESP32-S3, ESP32-C3, etc.), resulting in build errors when using ds_data in esp_http_client_config_t. Add the missing Kconfig option with proper dependencies on MBEDTLS_RSA_C and SOC_DIG_SIGN_SUPPORTED.
Yuerchu
force-pushed
the
fix/kconfig-mbedtls-pk-rsa-alt-support
branch
from
6193fe7 to
5402097
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
This PR is being reviewed by Cursor Bugbot
Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| When enabled, the application can use mbedtls_pk_setup_rsa_alt() to | ||
| register a custom RSA signature callback. | ||
|
|
||
| See ESP-TLS documentation for more details about using DS peripheral. |
There was a problem hiding this comment.
Kconfig option missing corresponding macro definition mapping
High Severity
The new MBEDTLS_PK_RSA_ALT_SUPPORT Kconfig option creates CONFIG_MBEDTLS_PK_RSA_ALT_SUPPORT in sdkconfig, but there's no corresponding mapping in esp_config.h to define the actual MBEDTLS_PK_RSA_ALT_SUPPORT macro for mbedTLS. Without this mapping, the mbedTLS library won't see the macro as defined, and mbedtls_pk_setup_rsa_alt() won't be compiled in, rendering the configuration option ineffective.
| config MBEDTLS_PK_RSA_ALT_SUPPORT | ||
| bool "Support external private RSA keys (eg from a HSM) in the PK layer" | ||
| default y | ||
| depends on MBEDTLS_RSA_C && SOC_DIG_SIGN_SUPPORTED |
There was a problem hiding this comment.
Missing dependency on MBEDTLS_PK_C in Kconfig
Medium Severity
The MBEDTLS_PK_RSA_ALT_SUPPORT option depends on MBEDTLS_RSA_C && SOC_DIG_SIGN_SUPPORTED but is missing a dependency on MBEDTLS_PK_C. The mbedtls_pk_setup_rsa_alt() function is part of the PK layer, so enabling this option without MBEDTLS_PK_C creates an inconsistent configuration. If MBEDTLS_MD_C is disabled (which disables MBEDTLS_PK_C), this option can still be enabled despite the PK layer not being available.
There was a problem hiding this comment.
Pull request overview
This pull request adds a missing Kconfig option MBEDTLS_PK_RSA_ALT_SUPPORT to make the Digital Signature (DS) peripheral feature properly configurable through menuconfig. The issue reported (#18181) indicated that users couldn't enable ESP_TLS_USE_DS_PERIPHERAL functionality, resulting in build errors when trying to use the ds_data field.
Changes:
- Adds MBEDTLS_PK_RSA_ALT_SUPPORT Kconfig option with dependencies on MBEDTLS_RSA_C and SOC_DIG_SIGN_SUPPORTED
- Sets default to 'y' for chips supporting digital signature peripheral
- Provides documentation about using external RSA keys and DS peripheral integration
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| When enabled, the application can use mbedtls_pk_setup_rsa_alt() to | ||
| register a custom RSA signature callback. |
There was a problem hiding this comment.
The help text mentions "mbedtls_pk_setup_rsa_alt()" function, but this function doesn't appear to exist in the current codebase. Please verify that this is the correct function name or update the help text to reflect the actual API being used. If this is a standard mbedTLS function that should be available, please confirm the implementation is present.
| When enabled, the application can use mbedtls_pk_setup_rsa_alt() to | |
| register a custom RSA signature callback. | |
| When enabled, the application can register a custom RSA signature | |
| callback in the PK layer (for example, to delegate private-key | |
| operations to an external device such as an HSM). |
| bool "Support external private RSA keys (eg from a HSM) in the PK layer" | ||
| default y | ||
| depends on MBEDTLS_RSA_C && SOC_DIG_SIGN_SUPPORTED | ||
| help | ||
| Support external private RSA keys (eg from a HSM) in the PK layer. |
There was a problem hiding this comment.
Minor typo: "eg" should be "e.g." (with periods) for proper abbreviation of "exempli gratia" (for example).
| bool "Support external private RSA keys (eg from a HSM) in the PK layer" | |
| default y | |
| depends on MBEDTLS_RSA_C && SOC_DIG_SIGN_SUPPORTED | |
| help | |
| Support external private RSA keys (eg from a HSM) in the PK layer. | |
| bool "Support external private RSA keys (e.g. from a HSM) in the PK layer" | |
| default y | |
| depends on MBEDTLS_RSA_C && SOC_DIG_SIGN_SUPPORTED | |
| help | |
| Support external private RSA keys (e.g. from a HSM) in the PK layer. |
| bool "Support external private RSA keys (eg from a HSM) in the PK layer" | ||
| default y | ||
| depends on MBEDTLS_RSA_C && SOC_DIG_SIGN_SUPPORTED | ||
| help | ||
| Support external private RSA keys (eg from a HSM) in the PK layer. |
There was a problem hiding this comment.
Minor typo: "eg" should be "e.g." (with periods) for proper abbreviation of "exempli gratia" (for example).
| bool "Support external private RSA keys (eg from a HSM) in the PK layer" | |
| default y | |
| depends on MBEDTLS_RSA_C && SOC_DIG_SIGN_SUPPORTED | |
| help | |
| Support external private RSA keys (eg from a HSM) in the PK layer. | |
| bool "Support external private RSA keys (e.g. from a HSM) in the PK layer" | |
| default y | |
| depends on MBEDTLS_RSA_C && SOC_DIG_SIGN_SUPPORTED | |
| help | |
| Support external private RSA keys (e.g. from a HSM) in the PK layer. |
| config MBEDTLS_PK_RSA_ALT_SUPPORT | ||
| bool "Support external private RSA keys (eg from a HSM) in the PK layer" | ||
| default y | ||
| depends on MBEDTLS_RSA_C && SOC_DIG_SIGN_SUPPORTED | ||
| help | ||
| Support external private RSA keys (eg from a HSM) in the PK layer. | ||
|
|
||
| When enabled, the application can use mbedtls_pk_setup_rsa_alt() to | ||
| register a custom RSA signature callback. | ||
|
|
||
| See ESP-TLS documentation for more details about using DS peripheral. | ||
|
|
There was a problem hiding this comment.
The CONFIG_MBEDTLS_PK_RSA_ALT_SUPPORT option is being added but there's no corresponding code that checks for this config option or defines the MBEDTLS_PK_RSA_ALT_SUPPORT preprocessor macro.
Typically, Kconfig options like CONFIG_MBEDTLS_PK_RSA_ALT_SUPPORT need to be converted to MBEDTLS_PK_RSA_ALT_SUPPORT macros in components/mbedtls/port/include/mbedtls/esp_config.h following the established pattern (similar to how CONFIG_MBEDTLS_RSA_C is converted to MBEDTLS_RSA_C).
Additionally, if ESP_TLS_USE_DS_PERIPHERAL truly depends on this option, then components/esp-tls/Kconfig should be updated to add "depends on MBEDTLS_PK_RSA_ALT_SUPPORT" or "select MBEDTLS_PK_RSA_ALT_SUPPORT" to the ESP_TLS_USE_DS_PERIPHERAL config option.
|
It seems I submitted to the wrong branch. This fix is intended to address the issue that occurred in v5.5.x. The problem has already been resolved for the master branch through PSA migration and no modification is needed. I will close this submission and create a new pull request to the release/v5.5 branch. |
espressif-bot
added
Status: Done
This pull request may fix #18181 .
The ESP-TLS component's ESP_TLS_USE_DS_PERIPHERAL config option depends on MBEDTLS_PK_RSA_ALT_SUPPORT, but this symbol was never defined in the Kconfig system. It only existed as a preprocessor macro in esp_config.h.
This caused the DS peripheral option to be unavailable in menuconfig, even on chips that support it (ESP32-S2, ESP32-S3, ESP32-C3, etc.), resulting in build errors when using ds_data in esp_http_client_config_t.
Add the missing Kconfig option with proper dependencies on MBEDTLS_RSA_C and SOC_DIG_SIGN_SUPPORTED.
Description
Related
Testing
Checklist
Before submitting a Pull Request, please ensure the following:
Note
Low Risk
Low risk: this only adds a missing Kconfig symbol with conservative dependencies, affecting menuconfig visibility/build config rather than runtime crypto behavior.
Overview
Adds the previously-missing
MBEDTLS_PK_RSA_ALT_SUPPORTKconfig option to the mbedTLSAsymmetric Ciphersmenu.The new option defaults to enabled and is gated by
MBEDTLS_RSA_CandSOC_DIG_SIGN_SUPPORTED, allowing features (e.g., DS-peripheral-backed RSA signing viambedtls_pk_setup_rsa_alt()) to be selected via menuconfig instead of relying on an undefined symbol.Written by Cursor Bugbot for commit 5402097. This will update automatically on new commits. Configure here.