Provide incremental by-subsystem initialization for the crypto library

[athoelke]

See #16 for discussion of this API, which enables partial initialization of the library. This is useful in constrained contexts, for example during early boot, when not all library functionality is required to support the application use case.

Fixes #16

[gilles-peskine-arm]

This design was prototyped in Mbed-TLS/mbedtls#6636 and I consider that prototype to be sufficient validation for the API design.

The specification looks good to me except for a few places where some Mbed TLS specific history remains.

[athoelke]

Rebased and updated this PR

[gilles-peskine-arm]

I've reviewed up to 5360369. Ok so far. Still to be addressed:

• #202 (comment)
• #202 (comment)
• #202 (comment)
• #202 (comment)
• #202 (comment)

[athoelke]

I've reviewed up to 5360369. Ok so far. Still to be addressed:

I think I've covered all except the need for some discussion of accelerators, secure elements, and built-in keys within the document.

I plan to deal with that in a separate PR, unless you would prefer to keep it coupled with this one?

[athoelke]

Ah, I realise that this one still needs a change to the PR.

[gilles-peskine-arm]

Ok for a separate PR. But I don't think considerations around “drivers” and “built-in keys” should leak outside the specification of subsystem initialization for now.

[athoelke]

Ok for a separate PR. But I don't think considerations around “drivers” and “built-in keys” should leak outside the specification of subsystem initialization for now.

I think I could reword the text for the subsystem definitions to avoid talking about 'drivers' - which suggests a specific way of a portable implementation providing support for varied hardware. I just need to review the spec for a mention of 'secure element' and 'accelerator', and add/amend if necessary.

[athoelke]

I've added a couple more commits.

• In one I add some terms to the glossary for accelerators, secure elements and built-int keys - using these in appropriate places.
• I have removed 'registering drivers' from the text in the subsystem initialization
• In the other, I add a recommendation for implementation of 'all subsystem' initialization.

I think this addresses all of the outstanding comments.

[athoelke]

This is will not be in the next release of mbed TLS (4.0), and we prefer to only include new API when there is an implementation of the interface,

[athoelke]

I've rebased this for possible inclusion into v1.5