Add hw-rsa feature for hardware RSA offload

Cargo.toml

@@ -32,7 +32,7 @@ embedded-io-adapters = { version = "0.7", optional = true }
 generic-array = { version = "0.14", default-features = false }
 webpki = { package = "rustls-webpki", version = "0.101.7", default-features = false, optional = true }
 const-oid = { version = "0.10.1", optional = true }
-der = { version = "0.8.0-rc.2", features = ["derive", "oid", "time"], optional = true }
+der = { version = "0.8.0-rc.2", features = ["derive", "oid", "time", "heapless"], optional = true }
 signature = { version = "2.2", default-features = false }
 ecdsa = { version = "0.16.9", default-features = false }
 
@@ -41,6 +41,7 @@ log = { version = "0.4", optional = true }
 defmt = { version = "1.0.1", optional = true }
 
 [dev-dependencies]
+rsa = { version = "0.9.9", features = ["sha2"] }
 env_logger = "0.11"
 tokio = { version = "1", features = ["full"] }
 mio = { version = "0.8.3", features = ["os-poll", "net"] }
@@ -61,5 +62,7 @@ alloc = []
 webpki = ["dep:webpki"]
 rustpki = ["dep:der","dep:const-oid"]
 rsa = ["dep:rsa", "rustpki", "alloc"]
+hw-rsa = ["rustpki"]
+system-clock = []
 ed25519 = ["dep:ed25519-dalek", "rustpki"]
 p384 = ["dep:p384", "rustpki"]

src/config.rs

@@ -138,6 +138,15 @@ pub struct NoClock;
 
 impl TlsClock for NoClock {
     fn now() -> Option<u64> {
+        #[cfg(feature = "system-clock")]
+        {
+            unsafe extern "Rust" {
+                fn embedded_tls_system_clock_now() -> u64;
+            }
+            let secs = unsafe { embedded_tls_system_clock_now() };
+            return if secs == 0 { None } else { Some(secs) };
+        }
+        #[cfg(not(feature = "system-clock"))]
         None
     }
 }
@@ -267,7 +276,7 @@ impl<'a> TlsConfig<'a> {
             priv_key: &[],
         };
 
-        if cfg!(feature = "alloc") {
+        if cfg!(any(feature = "alloc", feature = "hw-rsa")) {
             config = config.enable_rsa_signatures();
         }
 
@@ -277,12 +286,14 @@ impl<'a> TlsConfig<'a> {
                 .push(SignatureScheme::EcdsaSecp256r1Sha256)
                 .ok()
         );
+        #[cfg(feature = "p384")]
         unwrap!(
             config
                 .signature_schemes
                 .push(SignatureScheme::EcdsaSecp384r1Sha384)
                 .ok()
         );
+        #[cfg(feature = "ed25519")]
         unwrap!(config.signature_schemes.push(SignatureScheme::Ed25519).ok());
 
         unwrap!(config.named_groups.push(NamedGroup::Secp256r1));

src/der_certificate.rs

@@ -31,17 +31,22 @@ pub const ED25519: AlgorithmIdentifier = AlgorithmIdentifier {
     oid: ObjectIdentifier::new_unwrap("1.3.101.112"),
     parameters: None,
 };
-#[cfg(feature = "rsa")]
+#[cfg(any(feature = "rsa", feature = "hw-rsa"))]
+pub const RSA_PKCS1_SHA1: AlgorithmIdentifier = AlgorithmIdentifier {
+    oid: ObjectIdentifier::new_unwrap("1.2.840.113549.1.1.5"),
+    parameters: Some(AnyRef::NULL),
+};
+#[cfg(any(feature = "rsa", feature = "hw-rsa"))]
 pub const RSA_PKCS1_SHA256: AlgorithmIdentifier = AlgorithmIdentifier {
     oid: ObjectIdentifier::new_unwrap("1.2.840.113549.1.1.11"),
     parameters: Some(AnyRef::NULL),
 };
-#[cfg(feature = "rsa")]
+#[cfg(any(feature = "rsa", feature = "hw-rsa"))]
 pub const RSA_PKCS1_SHA384: AlgorithmIdentifier = AlgorithmIdentifier {
     oid: ObjectIdentifier::new_unwrap("1.2.840.113549.1.1.12"),
     parameters: Some(AnyRef::NULL),
 };
-#[cfg(feature = "rsa")]
+#[cfg(any(feature = "rsa", feature = "hw-rsa"))]
 pub const RSA_PKCS1_SHA512: AlgorithmIdentifier = AlgorithmIdentifier {
     oid: ObjectIdentifier::new_unwrap("1.2.840.113549.1.1.13"),
     parameters: Some(AnyRef::NULL),

src/lib.rs

@@ -47,6 +47,9 @@ async fn main() {
 ```
 */
 
+#[cfg(all(feature = "rsa", feature = "hw-rsa"))]
+compile_error!("Features `rsa` and `hw-rsa` are mutually exclusive. Use `rsa` for software RSA or `hw-rsa` for hardware-accelerated RSA, not both.");
+
 // This mod MUST go first, so that the others see its macros.
 pub(crate) mod fmt;