netutils/dropbear: back chacha20-poly1305 with NuttX /dev/crypto

[FelipeMdeO]

Summary

This PR replaces Dropbear's bundled libtomcrypt chacha20-poly1305 implementation with an adapter that drives the NuttX crypto device (/dev/crypto), so the chacha20-poly1305@openssh.com cipher runs on the kernel crypto framework (which may be hardware accelerated) and the bundled implementation is dropped from the build.

The NuttX crypto backend is a hard requirement of the port:
NETUTILS_DROPBEAR now selects CRYPTO_CRYPTODEV,
CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO and CRYPTO_SW_AES (and depends on
ALLOW_BSD_COMPONENTS, since the kernel crypto framework is BSD licensed).
The bundled src/chachapoly.c is unconditionally removed from the build and
a small patch (0005) switches the cipher state to plain key storage. The
kernel crypto backend also exports ecc_make_key, which collides with
libtomcrypt's unused plain wrapper at link time; the wrapper is renamed via
a compile definition.

Uses CRYPTO_CHACHA20_DJB introduced by apache/nuttx#19403 (already merged).

Impact

• Users: enabling NETUTILS_DROPBEAR now requires the kernel crypto
  device (selected automatically); the cipher implementation moves to the
  kernel, reducing application code size. On-wire behavior is unchanged.
• Build: Kconfig selects for the crypto backend, Make/CMake source list
  adjustments and a new source patch; no changes to other Dropbear
  functionality.

Testing

Host: Ubuntu 24.04 (aarch64), GCC 13.3.0
Target: NuttX simulator, sim:dropbear configuration (apache/nuttx#19405),
built against current nuttx and nuttx-apps masters (which already include
apache/nuttx#19403 and #3631).

$ ./nuttx
dropbear [6:100]
NuttShell (NSH) NuttX-12.6.0-RC1
nsh> [6] Jun 01 00:00:00 using NuttX passwd auth at /tmp/passwd
dropbear: listening on port 2222
nsh> useradd admin nuttx2026
nsh> [6] Jun 01 00:00:15 connection from 172.17.0.2:58064
[6] Jun 01 00:00:15 Password auth succeeded for 'admin' from 172.17.0.2:58064
[6] Jun 01 00:00:15 NSH exec started: uname -a; ps
[6] Jun 01 00:00:15 NSH session wait failed: Unknown error 10
[6] Jun 01 00:00:15 Exit (admin) from <172.17.0.2:58064>: Disconnect received

(The session wait failed line is pre-existing port behavior on this sim
configuration — waitpid() returns ECHILD without SCHED_CHILD_STATUS —
and is unrelated to this change; the remote command output is delivered
normally.)

Host side, with a real OpenSSH client forcing the cipher:

$ ssh -v -p 2222 -c chacha20-poly1305@openssh.com admin@10.0.1.2 'uname -a; ps'
...
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
...
NuttX  12.6.0-RC1 f388c2c086 Jul 12 2026 20:38:22 sim sim
  TID   PID  PPID PRI POLICY   TYPE    NPX STATE    EVENT     SIGMASK            STACK COMMAND
    0     0     0   0 FIFO     Kthread   - Ready              0000000000000000 0069584 Idle_Task
    ...
    6     6     5 100 FIFO     Task      - Ready              0000000000000000 0130984 dropbear
    7     7     6 100 FIFO     Task      - Running            0000000000000000 0073616 dropbear_exec -c uname

[FelipeMdeO]

Hello all,

I need help to solve this issue, the pipeline issue is related esp32 build issue:

multiple definition of aes_encrypt' multiple definition of aes_decrypt'

I already opened PR in the esp32 3rd party to solve this issue. Now I am Waiting for them.

Please, take a look in PR below:
espressif/esp-hal-3rdparty#13

[FelipeMdeO]

Hello, I am changing the approach to solve aes functions collisions: apache/nuttx#19428