[nrf noup] mbedtls: Disable configurations in Kconfig.tls-generic

-This commit prevents legacy mbed TLS configurations from being in
 conflict with PSA Configurations while using nrf_security
-Removing use of unsupported TLS protocols (TLS 1.0, 1.1)
-Required configurations are duplicated inside nrf_security Kconfig
-Ensured that mbedtls_platform_zeroize is not duplicated when
 CONFIG_NRF_CC3XX_PLATFORM is set

ref: NCSDK-13503

Signed-off-by: Frank Audun Kvamtrø <[email protected]>

Author: frkv

modules/mbedtls/Kconfig.tls-generic

@@ -9,6 +9,8 @@ menu "TLS configuration"
 
 menu "Supported TLS version"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_TLS_VERSION_1_0
 	bool "Enable support for TLS 1.0"
 	select MBEDTLS_CIPHER
@@ -33,6 +35,8 @@ config MBEDTLS_DTLS
 	bool "Enable support for DTLS"
 	depends on MBEDTLS_TLS_VERSION_1_1 || MBEDTLS_TLS_VERSION_1_2
 
+endif
+
 config MBEDTLS_SSL_EXPORT_KEYS
 	bool "Enable support for exporting SSL key block and master secret"
 	depends on MBEDTLS_TLS_VERSION_1_0 || MBEDTLS_TLS_VERSION_1_1 || MBEDTLS_TLS_VERSION_1_2
@@ -47,6 +51,8 @@ menu "Ciphersuite configuration"
 
 comment "Supported key exchange modes"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
 	bool "Enable all available ciphersuite modes"
 	select MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
@@ -80,13 +86,17 @@ config MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED
 		MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED || \
 		MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
 
+endif
+
 config MBEDTLS_PSK_MAX_LEN
 	int "Max size of TLS pre-shared keys"
 	default 32
 	depends on MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED
 	help
 	  Max size of TLS pre-shared keys, in bytes.
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
 	bool "Enable the RSA-only based ciphersuite modes"
 	default y if !NET_L2_OPENTHREAD
@@ -119,8 +129,12 @@ if MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED || \
 	MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || \
 	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
 
+endif
+
 comment "Supported elliptic curves"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_ECP_ALL_ENABLED
 	bool "Enable all available elliptic curves"
 	select MBEDTLS_ECP_DP_SECP192R1_ENABLED
@@ -182,9 +196,12 @@ config MBEDTLS_ECP_NIST_OPTIM
 	bool "Enable NSIT curves optimization"
 
 endif
+endif
 
 comment "Supported cipher modes"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_CIPHER_ALL_ENABLED
 	bool "Enable all available ciphers"
 	select MBEDTLS_CIPHER_AES_ENABLED
@@ -248,8 +265,12 @@ config MBEDTLS_CHACHAPOLY_AEAD_ENABLED
 	bool "Enable the ChaCha20-Poly1305 AEAD algorithm"
 	depends on MBEDTLS_CIPHER_CHACHA20_ENABLED || MBEDTLS_MAC_POLY1305_ENABLED
 
+endif
+
 comment "Supported message authentication methods"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_MAC_ALL_ENABLED
 	bool "Enable all available MAC methods"
 	select MBEDTLS_MAC_MD4_ENABLED
@@ -293,10 +314,14 @@ config MBEDTLS_MAC_CMAC_ENABLED
 	bool "Enable the CMAC (Cipher-based Message Authentication Code) mode for block ciphers."
 	depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_DES_ENABLED
 
+endif
+
 endmenu
 
 comment "Random number generators"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_CTR_DRBG_ENABLED
 	bool "Enable the CTR_DRBG AES-256-based random generator"
 	depends on MBEDTLS_CIPHER_AES_ENABLED
@@ -306,14 +331,20 @@ config MBEDTLS_HMAC_DRBG_ENABLED
 	bool "Enable the HMAC_DRBG random generator"
 	select MBEDTLS_MD
 
+endif
+
 comment "Other configurations"
 
 config MBEDTLS_CIPHER
 	bool "Enable the generic cipher layer."
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_MD
 	bool "Enable the generic message digest layer."
 
+endif
+
 config MBEDTLS_GENPRIME_ENABLED
 	bool "Enable the prime-number generation code."
 
@@ -331,10 +362,14 @@ config MBEDTLS_HAVE_ASM
 	  of asymmetric cryptography, however this might have an impact on the
 	  code size.
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_ENTROPY_ENABLED
 	bool "Enable mbedTLS generic entropy pool"
 	depends on MBEDTLS_MAC_SHA256_ENABLED || MBEDTLS_MAC_SHA512_ENABLED
 
+endif
+
 config MBEDTLS_OPENTHREAD_OPTIMIZATIONS_ENABLED
 	bool "Enable mbedTLS optimizations for OpenThread"
 	depends on NET_L2_OPENTHREAD

modules/mbedtls/configs/config-tls-generic.h

@@ -438,6 +438,10 @@
 #include CONFIG_MBEDTLS_USER_CONFIG_FILE
 #endif
 
+#if defined(CONFIG_NRF_CC3XX_PLATFORM)
+#define MBEDTLS_PLATFORM_ZEROIZE_ALT
+#endif
+
 #include "mbedtls/check_config.h"
 
 #endif /* MBEDTLS_CONFIG_H */