Hi Philippe, On Thu, Feb 19, 2026 at 8:26 AM Philippe Reynes <[email protected]> wrote: > > Enables the support of ecc in mbedtls. > > Signed-off-by: Philippe Reynes <[email protected]> > --- > v2: > - move ecdsa to MBEDTLS_LIB_X509 > - enhance depencendies > > configs/amd_versal2_virt_defconfig | 1 + > configs/qemu_arm64_lwip_defconfig | 1 + > configs/starfive_visionfive2_defconfig | 1 + > configs/xilinx_versal_net_virt_defconfig | 1 + > configs/xilinx_versal_virt_defconfig | 1 + > configs/xilinx_zynqmp_kria_defconfig | 1 + > configs/xilinx_zynqmp_virt_defconfig | 1 + > lib/mbedtls/Kconfig | 16 ++++++++++++++++ > lib/mbedtls/Makefile | 16 +++++++++------- > lib/mbedtls/mbedtls_def_config.h | 18 ++++++++++++++++++ > 10 files changed, 50 insertions(+), 7 deletions(-) > > diff --git a/configs/amd_versal2_virt_defconfig > b/configs/amd_versal2_virt_defconfig > index 0344089030c..702bf28405d 100644 > --- a/configs/amd_versal2_virt_defconfig > +++ b/configs/amd_versal2_virt_defconfig > @@ -164,6 +164,7 @@ CONFIG_VIRTIO_MMIO=y > CONFIG_VIRTIO_NET=y > CONFIG_VIRTIO_BLK=y > CONFIG_MBEDTLS_LIB=y > +CONFIG_ECDSA=y > CONFIG_TPM=y > # CONFIG_OPTEE_LIB is not set > CONFIG_TOOLS_MKFWUMDATA=y > diff --git a/configs/qemu_arm64_lwip_defconfig > b/configs/qemu_arm64_lwip_defconfig > index a974970c3d3..ab6302b67eb 100644 > --- a/configs/qemu_arm64_lwip_defconfig > +++ b/configs/qemu_arm64_lwip_defconfig > @@ -11,3 +11,4 @@ CONFIG_CMD_WGET=y > CONFIG_EFI_HTTP_BOOT=y > CONFIG_WGET_HTTPS=y > CONFIG_WGET_CACERT=y > +CONFIG_ECDSA=y > diff --git a/configs/starfive_visionfive2_defconfig > b/configs/starfive_visionfive2_defconfig > index a754134a313..508bd465704 100644 > --- a/configs/starfive_visionfive2_defconfig > +++ b/configs/starfive_visionfive2_defconfig > @@ -156,3 +156,4 @@ CONFIG_USB_GADGET=y > CONFIG_WDT=y > CONFIG_WDT_STARFIVE=y > CONFIG_MBEDTLS_LIB=y > +CONFIG_ECDSA=y > diff --git a/configs/xilinx_versal_net_virt_defconfig > b/configs/xilinx_versal_net_virt_defconfig > index 323b5606566..8b760beab03 100644 > --- a/configs/xilinx_versal_net_virt_defconfig > +++ b/configs/xilinx_versal_net_virt_defconfig > @@ -154,4 +154,5 @@ CONFIG_VIRTIO_MMIO=y > CONFIG_VIRTIO_NET=y > CONFIG_VIRTIO_BLK=y > CONFIG_MBEDTLS_LIB=y > +CONFIG_ECDSA=y > CONFIG_TPM=y > diff --git a/configs/xilinx_versal_virt_defconfig > b/configs/xilinx_versal_virt_defconfig > index 652121e27a0..6dd8620cf51 100644 > --- a/configs/xilinx_versal_virt_defconfig > +++ b/configs/xilinx_versal_virt_defconfig > @@ -168,5 +168,6 @@ CONFIG_VIRTIO_MMIO=y > CONFIG_VIRTIO_NET=y > CONFIG_VIRTIO_BLK=y > CONFIG_MBEDTLS_LIB=y > +CONFIG_ECDSA=y > CONFIG_TPM=y > CONFIG_TOOLS_MKFWUMDATA=y > diff --git a/configs/xilinx_zynqmp_kria_defconfig > b/configs/xilinx_zynqmp_kria_defconfig > index 8ad05e37189..d23452e96d0 100644 > --- a/configs/xilinx_zynqmp_kria_defconfig > +++ b/configs/xilinx_zynqmp_kria_defconfig > @@ -219,6 +219,7 @@ CONFIG_VIRTIO_BLK=y > CONFIG_BINMAN_DTB="./arch/arm/dts/zynqmp-binman-som.dtb" > CONFIG_PANIC_HANG=y > CONFIG_MBEDTLS_LIB=y > +CONFIG_ECDSA=y > CONFIG_TPM=y > CONFIG_SPL_GZIP=y > CONFIG_TOOLS_MKFWUMDATA=y > diff --git a/configs/xilinx_zynqmp_virt_defconfig > b/configs/xilinx_zynqmp_virt_defconfig > index bb79ddf989e..01370a215d4 100644 > --- a/configs/xilinx_zynqmp_virt_defconfig > +++ b/configs/xilinx_zynqmp_virt_defconfig > @@ -237,6 +237,7 @@ CONFIG_VIRTIO_BLK=y > CONFIG_BINMAN_DTB="./arch/arm/dts/zynqmp-binman.dtb" > CONFIG_PANIC_HANG=y > CONFIG_MBEDTLS_LIB=y > +CONFIG_ECDSA=y > CONFIG_TPM=y > CONFIG_SPL_GZIP=y > CONFIG_TOOLS_MKFWUMDATA=y > diff --git a/lib/mbedtls/Kconfig b/lib/mbedtls/Kconfig > index 789721ee6cd..8bf8809198f 100644 > --- a/lib/mbedtls/Kconfig > +++ b/lib/mbedtls/Kconfig > @@ -242,11 +242,16 @@ config MBEDTLS_LIB_X509 > select X509_CERTIFICATE_PARSER_MBEDTLS if X509_CERTIFICATE_PARSER > select PKCS7_MESSAGE_PARSER_MBEDTLS if PKCS7_MESSAGE_PARSER > select MSCODE_PARSER_MBEDTLS if MSCODE_PARSER > + select ECDSA_MBEDTLS if ECDSA > help > Enable MbedTLS certificate libraries. > > if MBEDTLS_LIB_X509 > > +config BIGNUM_MBEDTLS > + bool > + default n > + > config ASN1_DECODER_MBEDTLS > bool "ASN1 decoder with MbedTLS certificate library" > depends on MBEDTLS_LIB_X509 && ASN1_DECODER > @@ -264,6 +269,7 @@ config RSA_PUBLIC_KEY_PARSER_MBEDTLS > bool "RSA public key parser with MbedTLS certificate library" > depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS > select ASN1_DECODER_MBEDTLS > + select BIGNUM_MBEDTLS > help > This option chooses MbedTLS certificate library for RSA public key > parser. > @@ -292,6 +298,15 @@ config MSCODE_PARSER_MBEDTLS > This option chooses MbedTLS certificate library for MS authenticode > parser. > > +config ECDSA_MBEDTLS > + bool "Enable ECDSA support with MbedTLS certificate library" > + depends on MBEDTLS_LIB_X509 > + select ASN1_DECODER
This should be ASN1_DECODER_MBEDTLS. > + select BIGNUM_MBEDTLS > + help > + This option enables support of ECDSA with the MbedTLS certificate > + library. > + > endif # MBEDTLS_LIB_X509 > > config MBEDTLS_LIB_TLS > @@ -301,6 +316,7 @@ config MBEDTLS_LIB_TLS > depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS > depends on ASN1_DECODER_MBEDTLS > depends on MBEDTLS_LIB > + depends on ECDSA_MBEDTLS > help > Enable MbedTLS TLS library. Required for HTTPs support > in wget > diff --git a/lib/mbedtls/Makefile b/lib/mbedtls/Makefile > index c5b445bd85c..5433e17cc64 100644 > --- a/lib/mbedtls/Makefile > +++ b/lib/mbedtls/Makefile > @@ -39,13 +39,14 @@ mbedtls_lib_crypto-$(CONFIG_$(PHASE_)HKDF_MBEDTLS) += \ > # MbedTLS X509 library > obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_X509) += mbedtls_lib_x509.o > mbedtls_lib_x509-y := $(MBEDTLS_LIB_DIR)/x509.o > +mbedtls_lib_x509-$(CONFIG_$(PHASE_)BIGNUM_MBEDTLS) += \ > + $(MBEDTLS_LIB_DIR)/bignum.o \ > + $(MBEDTLS_LIB_DIR)/bignum_core.o > mbedtls_lib_x509-$(CONFIG_$(PHASE_)ASN1_DECODER_MBEDTLS) += \ > $(MBEDTLS_LIB_DIR)/asn1parse.o \ > $(MBEDTLS_LIB_DIR)/asn1write.o \ > $(MBEDTLS_LIB_DIR)/oid.o > mbedtls_lib_x509-$(CONFIG_$(PHASE_)RSA_PUBLIC_KEY_PARSER_MBEDTLS) += \ > - $(MBEDTLS_LIB_DIR)/bignum.o \ > - $(MBEDTLS_LIB_DIR)/bignum_core.o \ > $(MBEDTLS_LIB_DIR)/rsa.o \ > $(MBEDTLS_LIB_DIR)/rsa_alt_helpers.o > mbedtls_lib_x509-$(CONFIG_$(PHASE_)ASYMMETRIC_PUBLIC_KEY_MBEDTLS) += \ > @@ -57,6 +58,12 @@ > mbedtls_lib_x509-$(CONFIG_$(PHASE_)X509_CERTIFICATE_PARSER_MBEDTLS) += \ > $(MBEDTLS_LIB_DIR)/x509_crt.o > mbedtls_lib_x509-$(CONFIG_$(PHASE_)PKCS7_MESSAGE_PARSER_MBEDTLS) += \ > $(MBEDTLS_LIB_DIR)/pkcs7.o > +mbedtls_lib_x509-$(CONFIG_$(PHASE_)ECDSA_MBEDTLS) += \ > + $(MBEDTLS_LIB_DIR)/ecdsa.o \ > + $(MBEDTLS_LIB_DIR)/ecp.o \ > + $(MBEDTLS_LIB_DIR)/ecp_curves.o \ > + $(MBEDTLS_LIB_DIR)/ecp_curves_new.o \ > + $(MBEDTLS_LIB_DIR)/pk_ecc.o > > #mbedTLS TLS support > obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_TLS) += mbedtls_lib_tls.o > @@ -64,7 +71,6 @@ mbedtls_lib_tls-y := \ > $(MBEDTLS_LIB_DIR)/mps_reader.o \ > $(MBEDTLS_LIB_DIR)/mps_trace.o \ > $(MBEDTLS_LIB_DIR)/net_sockets.o \ > - $(MBEDTLS_LIB_DIR)/pk_ecc.o \ > $(MBEDTLS_LIB_DIR)/ssl_cache.o \ > $(MBEDTLS_LIB_DIR)/ssl_ciphersuites.o \ > $(MBEDTLS_LIB_DIR)/ssl_client.o \ > @@ -82,8 +88,4 @@ mbedtls_lib_tls-y := \ > $(MBEDTLS_LIB_DIR)/cipher.o \ > $(MBEDTLS_LIB_DIR)/cipher_wrap.o \ > $(MBEDTLS_LIB_DIR)/ecdh.o \ > - $(MBEDTLS_LIB_DIR)/ecdsa.o \ > - $(MBEDTLS_LIB_DIR)/ecp.o \ > - $(MBEDTLS_LIB_DIR)/ecp_curves.o \ > - $(MBEDTLS_LIB_DIR)/ecp_curves_new.o \ > $(MBEDTLS_LIB_DIR)/gcm.o \ > diff --git a/lib/mbedtls/mbedtls_def_config.h > b/lib/mbedtls/mbedtls_def_config.h > index dda3f4dd6e4..7d60bcc52aa 100644 > --- a/lib/mbedtls/mbedtls_def_config.h > +++ b/lib/mbedtls/mbedtls_def_config.h > @@ -89,6 +89,24 @@ > #define MBEDTLS_ASN1_WRITE_C > #endif > > +#if CONFIG_IS_ENABLED(ECDSA_MBEDTLS) In the 'mbedtls_def_config.h' file, we use the kconfigs without the '_MBEDTLS' postfix. Regards, Raymond > +#define MBEDTLS_ECDSA_C > +#define MBEDTLS_ECP_C > +#define MBEDTLS_BIGNUM_C > +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED > +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED > +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED > +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED > +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED > +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED > +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED > +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED > +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED > +#define MBEDTLS_ECP_DP_BP256R1_ENABLED > +#define MBEDTLS_ECP_DP_BP384R1_ENABLED > +#define MBEDTLS_ECP_DP_BP512R1_ENABLED > +#endif > + > #endif /* #if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */ > > #if CONFIG_IS_ENABLED(MBEDTLS_LIB_TLS) > -- > 2.43.0 >
