Refactor t_cose_crypto_is_algorithm_supported in PSA

[gaborgvarga]

Replacing static allowlist with runtime checks.

Previously, the PSA crypto adapter layer used a hard-coded allowlist, which could report algorithms as supported even when the crypto backend did not enable them. This refactor changes
t_cose_crypto_is_algorithm_supported to query the PSA crypto backend at runtime, ensuring capability checks reflect actual algorithm support.

Change-Id: I51a11b1018f50a5f874d8fbd4412a8b9ac1a16e6

[gaborgvarga]

Hi @laurencelundblade,

When you get a chance, would you mind reviewing this PR?

Thank you,
Gabor

[laurencelundblade]

Hi Gabor, I'm finally getting back to some t_cose work.

Can you tell me the reason for this change? What problems is it trying to solve. I think I know, but I want to be sure.

Thx

[gaborgvarga]

Hi @laurencelundblade,

Sure, the goal is to avoid false positives from the PSA crypto adapter.

Previously, t_cose_crypto_is_algorithm_supported() in the PSA layer relied on a static allowlist, but in practice algorithm availability is backend config dependent. In those cases the allowlist could report “supported”, and then the actual operation can later fail with PSA_ERROR_NOT_SUPPORTED. That makes capability reporting unreliable and pushes the failure further down the flow.

Best,
Gabor

[laurencelundblade]

Thanks, Gabor,

I agree that this is a really good thing to do.

I have some trouble with this PR because it is kind of big and complicated. In particular, it takes is_algorithm_supported from a tiny function, to very large. Large both in the object code for the function itself and large because it pulls in a huge amount of MbedTLS. It breaks the general decoupling between different classes and types of algorithms. Most people won't use it, but one call to is_algorithm_supported and your code size might more than double.

The question I have is whether there are better ways to accomplish this. It is a perfectly good and reasonably things to do. PSA/MbedTLS shouldn't make it this complicated. I also worry about the complexity to support this.

I think MbedTLS does have a better way, but then we'd be outside the PSA API.

Thoughts?