Document another limitation of driver-only hashes

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>

ChangeLog.d/driver-only-hashes.txt

@@ -8,12 +8,16 @@ Features
      are only provided by PSA drivers. In these configurations, you need to
      call `psa_crypto_init()` before you call any function from those
      modules; this is not required in configurations where the built-in
-     implementation is still available. Note that some crypto modules and
+     implementation is still available. Note that for modules that use MD
-     features still depend on the built-in implementation of hashes:
+     (RSA, PKCS5, PKCS12, EC J-PAKE) in builds that have MBEDTLS_MD_C enabled,
-     MBEDTLS_HKDF_C (but the PSA HKDF function do not depend on it),
+     all hashes used with those modules need to be built-in, as drivers are only
-     MBEDTLS_ENTROPY_C, MBEDTLS_HMAC_DRBG_C and MBEDTLS_ECDSA_DETERMINISTIC.
+     used when MBEDTLS_MD_C is disabled; configurations where some hashes are
-     In particular, for now, compiling without built-in hashes requires use
+     available as built-ins, and some only from drivers, are currently not
-     of MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
+     supported. Also note that some crypto modules and features still depend on
+     the built-in implementation of hashes: MBEDTLS_HKDF_C (but the PSA HKDF
+     functions do not depend on it), MBEDTLS_ENTROPY_C, MBEDTLS_HMAC_DRBG_C and
+     MBEDTLS_ECDSA_DETERMINISTIC. In particular, for now, compiling without
+     built-in hashes requires use of MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
    * When MBEDTLS_USE_PSA_CRYPTO is enabled, X.509, TLS 1.2 and TLS 1.3 no
      longer depend on MD. This means it is now possible to use them in
      configurations where the built-in implementations of hashes are excluded

include/mbedtls/mbedtls_config.h

@@ -1146,6 +1146,11 @@
  * \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init()
  * before doing any PKCS#1 v2.1 operation.
  *
+ * \warning When building with MBEDTLS_MD_C, all hashes used with this
+ * need to be available a built-ins (that is, for SHA-256, MBEDTLS_SHA256_C,
+ * etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by
+ * this module in builds where MBEDTLS_MD_C is disabled.
+ *
  * This enables support for RSAES-OAEP and RSASSA-PSS operations.
  */
 #define MBEDTLS_PKCS1_V21
@@ -2433,6 +2438,11 @@
  *
  * \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init()
  * before doing any EC J-PAKE operations.
+ *
+ * \warning When building with MBEDTLS_MD_C, all hashes used with this
+ * need to be available a built-ins (that is, for SHA-256, MBEDTLS_SHA256_C,
+ * etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by
+ * this module in builds where MBEDTLS_MD_C is disabled.
  */
 #define MBEDTLS_ECJPAKE_C
 
@@ -2777,6 +2787,11 @@
  * \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init()
  * before doing any PKCS5 operation.
  *
+ * \warning When building with MBEDTLS_MD_C, all hashes used with this
+ * need to be available a built-ins (that is, for SHA-256, MBEDTLS_SHA256_C,
+ * etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by
+ * this module in builds where MBEDTLS_MD_C is disabled.
+ *
  * This module adds support for the PKCS#5 functions.
  */
 #define MBEDTLS_PKCS5_C
@@ -2796,6 +2811,11 @@
  * \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init()
  * before doing any PKCS12 operation.
  *
+ * \warning When building with MBEDTLS_MD_C, all hashes used with this
+ * need to be available a built-ins (that is, for SHA-256, MBEDTLS_SHA256_C,
+ * etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by
+ * this module in builds where MBEDTLS_MD_C is disabled.
+ *
  * This module enables PKCS#12 functions.
  */
 #define MBEDTLS_PKCS12_C