78// The core never tests these. board_drivers/ does, to decide which backend TU compiles. Each is a
79// deliberate statement by the vendor, not a default: choosing software crypto is legitimate (on some
80// parts it is the only option) but it must be chosen. There is no weak symbol behind any of these -
81// linking no backend is an undefined reference, linking two is a duplicate definition, and both fail
82// the build rather than silently selecting one.
83
84// AES-GCM. 1 = the vendor supplies an accelerated AEAD (board_drivers/hal/<vendor>); 0 = the portable
85// software backend, which is software AES plus a table GHASH.
86//
87// Not a small difference and not a preference: measured sealing 1 KiB on an ESP32-S3 at 240 MHz, the
88// vendor AEAD is 81,085 cycles and the software path 616,567 - 7.6x. Hand it to the vendor whenever
89// there is one; choosing software is legitimate where there is not, but it has to be chosen.
90#ifndef PC_HAS_HW_AESGCM
91#if PC_VENDOR_ESP
92#define PC_HAS_HW_AESGCM 1
93#elif PC_VENDOR_HOST
94#define PC_HAS_HW_AESGCM 0 // a unit-test build has no silicon by definition
95#else
96#error \
97 "ProtoCore: this vendor must state PC_HAS_HW_AESGCM (1 = accelerated AEAD in board_drivers/hal/<vendor>, 0 = portable software AES + table GHASH, ~7.6x slower where measured). Choosing software is fine; defaulting into it is not."
98#endif
99#endif
100
101// DH-2048 / RSA modexp. 1 = the vendor supplies an accelerated backend; 0 = the portable software
102// Montgomery backend (board_drivers/hal/portable), which is data-dependent and NOT constant time -
103// see SECURITY.md, timing.
104#ifndef PC_HAS_HW_BIGNUM
105#if PC_VENDOR_ESP
106#define PC_HAS_HW_BIGNUM 1
107#elif PC_VENDOR_HOST
108#define PC_HAS_HW_BIGNUM 0 // a unit-test build has no silicon by definition
109#else
110#error \
111 "ProtoCore: this vendor must state PC_HAS_HW_BIGNUM (1 = accelerated backend in board_drivers/hal/<vendor>, 0 = portable software Montgomery, which is not constant time). Choosing software crypto is fine; defaulting into it is not."