yuzu-mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-mirror/mbedtls.git synced 2025-12-06 07:12:32 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity
25743 commits 89 branches 205 tags 114 MiB
Commit graph

11366 commits

Author SHA1 Message Date
Manuel Pégourié-Gonnard 8e176f747c Fix wrong return statement 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard 626aaed213 Fix unused variable warnings in some builds 
Found by depends.py MBEDTLS_SHA512_C

In principle, the case where neither SHA-256 nor SHA-384 are available
should never occur, as both TLS 1.2 and TLS 1.3 depend on one of those
being defined. However for now dependencies for TLS 1.2 are not as tight
as they should be; this will be fixed later and is tracked as #6441.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard 43cc127d3a Fix code style 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard e1a4caa934 Handle hash errors in calc_finished 
That's the last family of functions. All calls to mbedtls_sha* and
psa_hash_* in library/ssl_tls.c are now checked for errors.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard b9b564e64b Handle hash errors in calc_verify 
On top on some calls not being checked, the PSA path was missing a call
to abort() on errors.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard df94901566 Handle hash errors in update_checksum 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard b72ff498c9 Handle hash errors in reset_checksum 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard b8b07aa24a Handle errors from functions that now return int 
A few functions were changed from returning void to returning int three
commits ago. Make sure their callers check the return values.

This commits was basically a matter of declaring newly-int-returning
functions MBEDTLS_CHECK_RETURN_CRITICAL and then fixing the resulting
warnings. A few functions had to be made int in the process; they were
applied the same process as well.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard d7a7a23308 Use reset_checksum in reset_transcript_for_hrr 
This function was manually resetting just the hash that would be used;
it's simpler to just call the function that resets all hashes. This also
avoids calling low-level code from TLS 1.3.

While at it, remove the guards about SHA-256 || SHA-384 that were around
update_checksum, as they are redundant: update_checksum already has
appropriate guards (and TLS 1.3 already depends on one of those tow
hashes being present anyway).

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard 537f231fd9 Split hash start out of handshake_params_init 
This part can fail, so it shouldn't be intermixed with the part that
can't fail and is there to ensure all structures are in a clean state,
should any error happen.

Fortunately, the part that should be split out already had a function
doing it: reset_checksum. Also, handshake_params_init had only one
calling site to update.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Manuel Pégourié-Gonnard 226aa15702 Make handshake hashing functions return int 
There are three family of functions: update_checksum, calc_verify,
calc_finished, that perform hashing operations and were returning void
so far. This is not correct, as hashing functions can return errors (for
example, on hardware failure when accelerated). Change them to return
int.

This commit just changes the types: for now the functions always return
0, and their return value is not checked; this will be fixed in the
next few commits.

There is a related function in TLS 1.3,
mbedtls_ssl_reset_transcript_for_hrr, which also handles hashes, and
already returns int but does not correctly check for errors from hashing
functions so far, it will also be handled in the next few commits.

There's a special case with handshake_params_init: _init functions
should return void, so we'll need to split out the part that can return
errors, see the next commit.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-21 15:39:12 +01:00
Gilles Peskine 250a5ac4cb
Merge pull request #7095 from paul-elliott-arm/interruptible_sign_hash_codestyle 
Implement PSA interruptible sign/verify hash
 2023-02-21 15:13:34 +01:00
Ronald Cron d89360b87b Fix and improve documentation, comments and logs 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2023-02-21 14:57:25 +01:00
Przemek Stekiel 18904acc93 Adapt the code to support SAN types: uniformResourceIdentifier, dNSName and IPAddress 
According to documentation OPCUA requires: uniformResourceIdentifier, dNSName and IPAddress
https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2

Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-02-21 13:42:39 +01:00
Hannes Tschofenig 6b108606fa Added ability to include the SubjectAltName extension to a CSR 
Signed-off-by: Hannes Tschofenig <hannes.tschofenig@arm.com>
 2023-02-21 13:42:39 +01:00
Dave Rodgman e42cedf256
Merge pull request #7077 from daverodgman/pkcs7-fixes-dm-rebased 
Pkcs7 fixes
 2023-02-21 11:53:30 +00:00
Gabor Mezei aef0f2de9f
Fix limb size calculation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-21 11:35:31 +01:00
Gabor Mezei e14b5bdba7
Change the ecp_mod_p224_raw to be testable 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-21 11:35:26 +01:00
Gabor Mezei 66f88a9d22
Extract Secp224r1 from the prototype 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-21 11:32:29 +01:00
Jerry Yu ba4ec24c79 fix code style failure 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-21 15:59:18 +08:00
Jerry Yu baae4012bf merge setkey_enc* functions 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-21 15:28:03 +08:00
Jerry Yu c8bcdc8b91 fix various issues 
- Improve some function names
- Improve comments
- improve readability

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-21 15:16:20 +08:00
Dave Rodgman a1b2bfff46 Add clarifying comments 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-02-20 14:45:09 +00:00
David Horstmann 5b5a0b618c Change error codes to more appropriate codes 
The more precise error codes are borrowed from the ASN1 module.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2023-02-20 14:24:12 +00:00
Przemek Stekiel 82d250d8b0 Use const char for names and adapt style 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-02-20 15:09:50 +01:00
Przemek Stekiel 5b9e4168cf Add rfc822Name support in mbedtls_x509_info_subject_alt_name + adapt test 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-02-20 15:09:50 +01:00
Przemek Stekiel ecee12f04f Add parsing of SAN: rfc822Name 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-02-20 15:09:50 +01:00
Minos Galanakis a30afe2216 ecp_curves: Minor refactoring. 
This patch introduces the following changes:
* Documentation for `mbedtls_ecp_modulus_setup()`
  moved to `ecp_invasive.h`.
* Added invalid modulus selector `MBEDTLS_ECP_MOD_NONE`.
* Adjusted negative tests to use invalid selectors.
* Reworded documentation.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2023-02-20 13:53:06 +00:00
Minos Galanakis dd556921c9 ecp_curves: Exposed mbedtls_ecp_modulus_setup() through ecp_invasive.h 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2023-02-20 13:50:41 +00:00
Minos Galanakis d2ca802329 ecp_curves: Added mbedtls_ecp_modulus_setup(). 
This patch introduces a new static method, responsible
for automatically initialising an modulus structure,
based on the curve id and a modulus type selector.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2023-02-20 13:49:46 +00:00
Janos Follath ec718afb41
Merge pull request #7051 from gabor-mezei-arm/6376_Secp521r1_fast_reduction 
Add a raw entry point to Secp521r1 fast reduction
 2023-02-20 13:03:12 +00:00
Ronald Cron 4bb6773640 tls13: Apply same preference rules for ciphersuites as for TLS 1.2 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2023-02-20 11:42:19 +01:00
Ronald Cron 0a1c504156 tls13: Fix session resumption with 384 bits PSKs 
MBEDTLS_PSK_MAX_LEN main purpose is to determine
a miximum size for the TLS 1.2 pre-master secret.

This is not relevant to TLS 1.3 thus disable in
TLS 1.3 case the check against MBEDTLS_PSK_MAX_LEN
when setting during the handshake the PSK through
mbedtls_ssl_set_hs_psk(). This fixes the session
resumption with 384 bits PSKs when MBEDTLS_PSK_MAX_LEN
is smaller than that.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2023-02-20 11:42:19 +01:00
Ronald Cron 25e9ec61f0 tls13: server: Select preferred cipher suite 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2023-02-20 11:42:19 +01:00
Ronald Cron fc7ae87ad4 tls13: server: Check ciphersuite list length parity once 
Check ciphersuite list length parity once,
mainly to enable the possibility of getting
out of the loop of the ciphersuites whenever
we want.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2023-02-20 11:42:19 +01:00
Ronald Cron 606671e06e tls13: server: Check mbedtls_ssl_set_hs_psk returned value 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2023-02-20 11:42:19 +01:00
Manuel Pégourié-Gonnard 718eb4f190
Merge pull request #7025 from AndrzejKurek/uri_san 
Add the uniformResourceIdentifier subtype for the subjectAltName
 2023-02-20 11:29:59 +01:00
Paul Elliott f8e5b56ad8 Fix get_num_ops internal code. 
Previously calling get_num_ops more than once would have ended up with ops
getting double counted, and not calling inbetween completes would have ended up
with ops getting missed. Fix this by moving this to where the work is actually
done, and add tests for double calls to get_num_ops().

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-19 18:55:10 +00:00
Manuel Pégourié-Gonnard b9b630d628 Define "light" subset of MD 
See docs/architecture/psa-migration/md-cipher-dispatch.md

Regarding testing, the no_md component was never very useful, as that's
not something people are likely to want to do: it was mostly useful as
executable documentation of what depends on MD. It's going to be even
less useful when more and more modules auto-enable MD_LIGHT or even
MD_C. So, recycle it to test the build with only MD_LIGHT, which is
something that might happen in practice, and is necessary to ensure that
the division is consistent.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-16 22:30:06 +01:00
Gabor Mezei ac70ad6576
Fix coding style 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-16 19:31:21 +01:00
Manuel Pégourié-Gonnard ba2412fd21 Remove internal function md_process() 
It was already marked as internal use only, and no longer used
internally. Also, it won't work when we dispatch to PSA.

Remove it before the MD_LIGHT split to avoid a corner case: it's
technically a hashing function, no HMAC or extra metadata, but we still
don't want it in MD_LIGHT really.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2023-02-16 18:44:46 +01:00
Dave Rodgman fc64352253 Adjust position of empty line 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-02-16 16:23:09 +00:00
Paul Elliott ba70ad4944 Add safety for keys larger than we currently support. 
Prevent buffer overflow with keys whos grp.nbits is greater than
PSA_VENDOR_ECC_MAX_CURVE_BITS.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-16 12:15:39 +00:00
Paul Elliott 93d9ca83ea Move num_ops ECP abstraction fully into internal implementation 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-16 12:15:39 +00:00
Andrzej Kurek 81b0b89a34 Clarify comments on subjectAltName types 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2023-02-16 06:55:10 -05:00
Jerry Yu a135deeece Move clang bug workaround to the head of file 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-16 17:56:33 +08:00
Jerry Yu 383cbf42a0 Add minimum version of sha256 for clang 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-16 15:16:43 +08:00
Jerry Yu 8ae6a0193c Add comments about gcc-5 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-16 15:16:20 +08:00
Jerry Yu 2f2c04956d Add GCC options pop 
Reduce the scope of target pragma to meet
behavior of clang.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-16 14:24:46 +08:00
Jerry Yu 92fc538a22 Add attribute popup 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-16 11:17:11 +08:00
Paul Elliott 2c9843f2a4 Make mbedtls_sa_ecp_load_public_part return psa_status_t 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 7ef174b285 Correct insufficient memory return documentation. 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott a1c9409d88 Move structure init calls as early as possible 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott ebe225cf7b Move num ops update to only point where work can be done. 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 53bb312054 Wipe output buffer even when INCOMPLETE is returned. 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott c569fc268f Switch from nbits to pbits 
Correct coordinate size is grp.nbits, not grp.pbits.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 6d99f0c265 Fix errors in psa_wipe_output_buffer() doc comment. 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 0290a76fc2 Fix buffer overflow with hashes larger than key size. 
Truncate input hashes to curve private key size as that is all that is required
for the internal implementation.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 724bd25f4b Fix missing mbedtls_mpi_free() on signing. 
After moving the MPIs used to output from the operation into the complete
function, I failed to move the accompanying free as well.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 84329464d5 Replace allocated hash buffer with array 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott e6145dc47f Add documentation comment to internal abort functions 
Explain the reasoning behind not clearing some variables.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott de1114c883 Fix {sign|verify}_get_num_ops 
Move the obfuscation of the internal library only returning a delta of ops done
into the driver wrapper, thus meaning driver wrapper and API call both return
absolute values of work done. Document the differences at the internal
implementation level.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 939bd9485d Move output buffer wiping code to seperate function. 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 1243f93cca Fix build fails with non ECDSA / restartable builds 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott eefe47292c Move loading of public part of ECP into function 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott c9774411d4 Ensure that operation is put into error state if error occurs 
If an error occurs, calling any function on the same operation should return
PSA_ERROR_BAD_STATE, and we were not honouring that for all errors. Add extra
failure tests to try and ratify this.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott f9c91a7fb5 Store the hash, rather than the pointer 
For sign and verify, the pointer passed in to the hash is not guaranteed to
remain valid inbetween calls, thus we need to store the hash in the
operation. Added a test to ensure this is the case.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 813f9cdcbb Non ECDSA algorithms should return not supported 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 1bc59df92c Rename curve_bytes to coordinate_bytes 
Also remove unneeded instance from verify operation struct.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 096abc4dc0 Remove incorrect copied comment 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott e17a8fd9fd Remove unneeded warning from internal headers 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 4684525ae9 Remove unrequired mpis from sign operation struct 
These are only used at the output stage.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 6ee2408d26 Remove deterministic alg restriction on sign hash 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 068fe07740 Improve indentation of hash start functions 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 7cc4e816c1 Ensure max ops gets set regardless of having built-in implementation 
Set the psa level global anyway, regardless of having a built in
implementation, to match the set function. Also, ensure that value returned
is the same as value passed in, irregardless of internal implementation
requirements.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 59ad9457b6 Add {sign/verify}_hash_abort_internal 
Ensure that num_ops is cleared when manual abort is called, but obviously not
when an operation just completes, and test this.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 296ede99c9 Fix issues with get_{sign/verify}_num_ops 
Move to accumulate ops in context rather than attempting to read straight out
of structures due to structure ops getting reset per operation, and also
issues with _abort clearing internal data. Fix usage of size_t in structures

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 588f8ed498 Add internal implementation 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Paul Elliott 2ba002cc2f Make ECDSA restartable sign and verify functions public 
Make public the versions of ECSDA sign and verify which return raw signatures
rather than returning ASN.1 encoded signatures, in order to use them for the
internal implemention of psa_sign/verify_hash_interruptible.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 23:34:29 +00:00
Gabor Mezei 7e6fcc1fbc
Update documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:19:09 +01:00
Gabor Mezei cf228706cd
Restrict input parameter size for ecp_mod_p521_raw 
The imput mpi parameter must have twice as many limbs as the modulus.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:19:08 +01:00
Gabor Mezei d10d429380
Stack usage optimization for mod_p521 
Instead of creating an mpi on the stack, reuse the unused part of the input mpi.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:13:51 +01:00
Janos Follath fe24e91a34
mod_p521: document reduction algorithm 
Signed-off-by: Janos Follath <janos.follath@arm.com>
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:13:50 +01:00
Janos Follath 666673e83f
modp521: apply naming conventions 
Apply the usual parameter name and align the local variables and
comments. This naming diverges from the standard notation, but this is
beneficial as our variable meanings diverge as well and the difference
can help avoiding confusion.

Signed-off-by: Janos Follath <janos.follath@arm.com>
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:13:50 +01:00
Janos Follath 13c3aa13af
Revert changes to mod_p521 flow 
It is not necessary to save the middle limb upfront as overwriting it is
the desired result: in the first step we are reducing modulo
2^{512+biL}.

Arguably, the original flow is more intuitive and easier to see the idea
behind it.

Signed-off-by: Janos Follath <janos.follath@arm.com>
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:13:50 +01:00
Gabor Mezei 6bfbd36507
Fix coding style issues 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:13:49 +01:00
Gabor Mezei b62ad5d569
Rename function to follow naming convention 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:13:48 +01:00
Gabor Mezei b1c62caa1f
Add documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:13:48 +01:00
Gabor Mezei 2cb630edee
Change the ecp_mod_p521_raw to be testable 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:05:22 +01:00
Gabor Mezei 8450ab9c60
Fix Secp521r1 reduction 
The prototype calculated with wrong limb size and not taken into account
the overflow in the shared limb.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:03:03 +01:00
Gabor Mezei 42df16c84b
Extract Secp521r1 from the prototype 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-15 18:02:57 +01:00
David Horstmann f51851dc70 Change += to |= for clearer semantics 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2023-02-15 15:44:24 +00:00
Gilles Peskine e2a9f86755
Merge pull request #6971 from gabor-mezei-arm/6026_Secp192r1_fast_reduction 
Extract Secp192r1 fast reduction from the prototype
 2023-02-15 16:22:36 +01:00
David Horstmann 34b3f1b757 Make overflow checks more readable 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2023-02-15 13:46:53 +00:00
Paul Elliott 9fe12f666b PSA level initial implementation 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 12:13:17 +00:00
Paul Elliott 2d247923e5 Initial empty driver wrapper implementation 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-15 12:13:17 +00:00
David Horstmann 9c1887c4c7 Disallow overlong encoding when parsing OIDs 
OID subidentifiers are encoded as follow. For every byte:
* The top bit is 1 if there is another byte to come, 0 if this is the
last byte.
* The other 7 bits form 7 bits of the number. These groups of 7 are
concatenated together in big-endian order.

Overlong encodings are explicitly disallowed by the BER/DER/X690
specification. For example, the number 1 cannot be encoded as:

0x80 0x80 0x01

It must be encoded as:

0x01

Enforce this in Mbed TLS' OID DER-to-string parser.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2023-02-15 12:02:27 +00:00
Jerry Yu 64e5d4a2cd Replace error output with target pragma if possible 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-15 11:58:48 +08:00
Jerry Yu 35f2b26fd8 move cpu modifier flags check to source file 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-15 11:58:48 +08:00
Gilles Peskine edc6ae9578
Merge pull request #7090 from paul-elliott-arm/fix_iar_warnings_dev 
Fix IAR Warnings
 2023-02-14 20:01:00 +01:00
Gilles Peskine ed73355d2e Make \retval commands non-empty 
Pacify Clang >=15 which complained:
```
include/psa/crypto.h:91:23: error: empty paragraph passed to '\retval' command [-Werror,-Wdocumentation]
 * \retval #PSA_SUCCESS
   ~~~~~~~~~~~~~~~~~~~^
```

This commit performs the following systematic replacement:
```
perl -i -0777 -p -e 's/([\\@])(retval +\S+)\n(?! *\*? *([^\n \\*\/]|\\[cp]\b))/$1$2 ${1}emptydescription\n/g' $(git ls-files '*.[hc]' '*.function' '*.jinja')
```
i.e. add an `\emptydescription` argument to `\retval` commands (or
`@retval`, which we don't normally used) that are followed by a single word,
unless the next line looks like it contains text which would be the
description.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2023-02-14 19:21:09 +01:00
David Horstmann c7f700c795 Fix incorrect printing of OIDs 
The first 2 components of an OID are combined together into the same
subidentifier via the formula:

subidentifier = (component1 * 40) + component2

The current code extracts component1 and component2 using division and
modulo as one would expect. However, there is a subtlety in the
specification[1]:

>This packing of the first two object identifier components recognizes
>that only three values are allocated from the root node, and at most
>39 subsequent values from nodes reached by X = 0 and X = 1.

If the root node (component1) is 2, the subsequent node (component2)
may be greater than 38. For example, the following are real OIDs:
* 2.40.0.25, UPU standard S25
* 2.49.0.0.826.0, Met Office
* 2.999, Allocated example OID

This has 2 implications that the current parsing code does not take
account of:
1. The second component may be > 39, so (subidentifier % 40) is not
correct in all circumstances.
2. The first subidentifier (containing the first 2 components) may be
more than one byte long. Currently we assume it is just 1 byte.

Improve parsing code to deal with these cases correctly.

[1] Rec. ITU-T X.690 (02/2021), 8.19.4

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2023-02-14 17:00:25 +00:00
Gabor Mezei 0b4b8e3c5e
Update documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-14 16:36:38 +01:00
Dave Rodgman 319a5675db
Merge pull request #7084 from daverodgman/sizemax-uintmax 
Assume SIZE_MAX >= INT_MAX, UINT_MAX
 2023-02-14 10:06:22 +00:00
Ronald Cron 70341c17b7
Merge pull request #6773 from yanrayw/6675-change-early_secrets-to-local 
TLS 1.3: Key Generation: Change tls13_early_secrets to local variable
 2023-02-14 09:03:32 +01:00
Paul Elliott 1748de160a Fix IAR Warnings 
IAR was warning that conditional execution could bypass initialisation of
variables, although those same variables were not used uninitialised.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2023-02-13 15:35:35 +00:00
Gabor Mezei a264831cff
Update documentation and add comments 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-13 16:29:05 +01:00
Andrzej Kurek 7a05fab716 Added the uniformResourceIdentifier subtype for the subjectAltName. 
Co-authored-by: Hannes Tschofenig <hannes.tschofenig@arm.com>
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2023-02-13 10:03:07 -05:00
Manuel Pégourié-Gonnard d3d8c852a0
Merge pull request #6997 from valeriosetti/issue6858 
driver-only ECDSA: get testing parity in X.509
 2023-02-13 15:30:06 +01:00
Valerio Setti 178b5bdddf pk: move MBEDTLS_PK_CAN_ECDSA_SOME macro to pk.h and fix tests 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-13 11:15:06 +01:00
Jerry Yu b2783f66b5 fix typo issue 
The error message is wrong

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-13 18:03:25 +08:00
Dave Rodgman ab1f3c153a
Merge pull request #7081 from tom-cosgrove-arm/dont-use-lstrlenW 2023-02-10 20:50:07 +00:00
Dave Rodgman 4a5c9ee7f2 Remove redundant SIZE_MAX guards 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-02-10 16:03:44 +00:00
Gilles Peskine b8531c4b0b
Merge pull request #6882 from AndrzejKurek/x509_san_parsing_testing-dev 
X.509: Fix bug in SAN parsing and enhance negative testing
 2023-02-10 15:05:32 +01:00
Dave Rodgman f691268ee9 Add missing initialisers 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-02-10 12:56:10 +00:00
Demi Marie Obenour 35598adb78 pkcs7: Check that hash algs are in digestAlgorithms 
Since only a single hash algorithm is currenlty supported, this avoids
having to perform hashing more than once.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
 2023-02-10 12:56:10 +00:00
Demi Marie Obenour 6cfc469296 pkcs7: reject signatures with internal data 
A CMS signature can have internal data, but mbedTLS does not support
verifying such signatures.  Reject them during parsing.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-02-10 12:56:10 +00:00
Demi Marie Obenour e373a254c4 pkcs7: do not store content type OIDs 
They will always be constant.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
 2023-02-10 12:56:10 +00:00
Demi Marie Obenour 55d9df25ef Simple cleanup 
No change in behavior.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
 2023-02-10 12:56:10 +00:00
Demi Marie Obenour 4ec8355795 Check for junk after SignedData 
There must not be any.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
 2023-02-10 12:56:10 +00:00
Demi Marie Obenour aaf3c0028d pkcs7: do not store content type OID 
Since only one content type (signed data) is supported, storing the
content type just wastes memory.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
 2023-02-10 12:56:10 +00:00
Demi Marie Obenour 512818b1d2 pkcs7: check that content lengths fill whole buffer 
Otherwise invalid data could be accepted.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-02-10 12:56:10 +00:00
Dave Rodgman a22749e749
Merge pull request #6816 from nick-child-ibm/pkcs7_coverage 
Pkcs7 coverage
 2023-02-10 12:55:29 +00:00
Tom Cosgrove b96c309395 Don't use lstrlenW() on Windows 
The lstrlenW() function isn't available to UWP apps, and isn't necessary, since
when given -1, WideCharToMultiByte() will process the terminating null character
itself (and the length returned by the function includes this character).

Resolves #2994

Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2023-02-10 12:52:13 +00:00
Ronald Cron 834e65d47f
Merge pull request #6499 from xkqian/tls13_write_end_of_early_data 
Tls13 write end of early data
 2023-02-10 11:08:22 +01:00
Dave Rodgman 78c6f40736
Fix code-style 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-02-09 09:21:14 +00:00
Nick Child 14f255f332 pkcs7: Remove unnecessary dependencies 
stdio, stdlib and string header files are not
used. Remove them.

Signed-off-by: Nick Child <nick.child@ibm.com>
 2023-02-08 15:38:48 +00:00
Valerio Setti ce0caa3384 oid: fix comment in #endif 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-08 13:52:31 +01:00
Valerio Setti f972ce8d69 oid: replace ECDSA_C with new macros for ECDSA capabilities 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-08 13:52:31 +01:00
Valerio Setti 80d0798ae8 pk_wrap: use new macros for ECDSA capabilities 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-08 13:49:17 +01:00
Valerio Setti 5c032b5e1b pk_wrap: fix comment in ecdsa_verify_wrap 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-08 13:39:10 +01:00
Valerio Setti b761b15f06 fix code style 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-08 13:39:10 +01:00
Valerio Setti 1337a4f334 pk_wrap: use specific lengths for EC's private key and key-pair 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-08 13:39:10 +01:00
Valerio Setti 5bc52248ef pk_wrap: fix for DETERMINISTIC_ECDSA case in ecdsa_sign_wrap() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-08 13:39:10 +01:00
Gilles Peskine 8a6022e948 Clean up header inclusions in pk_wrap.c 
To better reflect what the code relies on, limit the headers that are
included when MBEDTLS_USE_PSA_CRYPTO is disabled. Also stop including
"pkwrite.h" when it is no longer needed.

Include "mbedlts/platform_util.h" unconditionally. It was only included for
RSA ALT but was also used for MBEDTLS_USE_PSA_CRYPTO (the code worked
because other headers include "mbedtls/platform_util.h").

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2023-02-08 13:39:10 +01:00
Gilles Peskine 13caa94746 Don't use pk_write in ecdsa_sign_wrap with USE_PSA_CRYPTO 
Under MBEDTLS_USE_PSA_CRYPTO, ecdsa_sign_wrap() was calling
mbedtls_pk_write_key_der() to write a private key in SEC1 format, only to
then extract the part that represents the private value which is what
psa_import_key() actually wants. Instead, call an mpi function to directly
get the private key in the desired format.

This slightly reduces the code size and stack usage, and removes a
dependency on pk_write.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2023-02-08 13:39:10 +01:00
Gilles Peskine b4a87b07f8 Don't use pk_write in ecdsa_verify_wrap with USE_PSA_CRYPTO 
Under MBEDTLS_USE_PSA_CRYPTO, ecdsa_verify_wrap() was calling
mbedtls_pk_write_pubkey() to write a public key in the form of a
subjectPublicKey, only to then extract the part that represents the EC
point which psa_import_key() actually wants. Instead, call an ecp
function to directly get the public key in the desired format (just the
point).

This slightly reduces the code size and stack usage, and removes a
dependency on pk_write.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2023-02-08 13:39:10 +01:00
Pol Henarejos b3b220cbf8
Correct style. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-02-08 12:52:18 +01:00
Xiaokang Qian 0de0d863b6 Rebase code to restore reco-delay and fix some style issues 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 07:41:42 +00:00
Xiaokang Qian 8dc4ce76c7 Fix various coding style and comment issues 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 6b980011e5 Replace session_negotiate->ciphersuite with handshake->ciphersuite_info->id 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 53c4c27d35 Update the comment of ciphersuite check for early data 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 64bc9bc33d Add comments to describe the early data behavior-encrypt/rejected... 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian e04afdc44f Refine the condition of whether re-generate early keys 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian eb31cbc791 Share the hash check code between ticket and external psk 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 4ef8ba2938 Assign the ciphersuite in finalize_hrr{server_hello} 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian bb883244aa Remove useless comments of outbound switch 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 02f5e14073 Combine the alert check of selected_id and ciphercuite 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 934ce6f6a9 Rename the finalize_client{server}_hello() 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian ac4c625dea Add hash check of ciphersuite for ticket psk 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 6be8290aba Change to CCS after client hello only if we offer early data 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 7179f810f1 Restore the empty lines 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian b58462157e Refine the ciphersuite and select id check for early data 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 44051f6376 Refine the state change after write client hello 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 7892b6caad Refine the comment about generating early secrects in post server hello 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian bd0ab06d50 Skip CCS once we proposed early data even it is rejected 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian f6d8fd3d6b Improve the coding style of new lines 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:48 +00:00
Xiaokang Qian 79f77528f5 Move state change to finalize client hello 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian 3f616c2493 Move selected_identity zero check to post_server_hello 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian 1d8e86ce00 Get hash_alg by mbedtls_psa_translate_md 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian ea28a78384 Revert new field and check ciphersuite match when resume by exist info_id 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian 4224244883 Improve coding styles and add comments 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian 33ff868dca Fix various errors 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian 43a83f247c Move the place where call set_outbound_transform to switch handshake key 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian 907461319a Fix compile error and warnings 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian f10f474981 Check server selected cipher suite indicating a Hash associated with the PSK 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian 592021aceb Add CCS after client hello in case of early data and comp mode 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian 303f82c5b9 Skip generating early secrets in some cases 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:47 +00:00
Xiaokang Qian b46275c7ec Add TLS1_3 guard to finalize_write_client_hello() to fix compile issue 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:47:43 +00:00
Xiaokang Qian 2a674937dd Pend a illeagal allert when selected_identity isn't 0 
Handshake should abort will illeagal parameter allert when
receiving early data extentions but the selected_identity
parsed from pre-share key isn't equal to 0.

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:46:48 +00:00
Xiaokang Qian 126929f825 Move early keys generation into mbedtls_ssl_tls13_finalize_write_client_hello 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:46:45 +00:00
Xiaokang Qian 19d4416a45 Refine code to remove finalize_write_end_of_early_data() 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:44:00 +00:00
Xiaokang Qian 7094f66879 Remove useless duplicted mbedtls_ssl_tls13_ticket_get_psk 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:44:00 +00:00
Xiaokang Qian 854db28bb7 Set hs_psk,ciphercuit_info and kex mode when writing pre-share key 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:44:00 +00:00
Xiaokang Qian 57a138d5c3 Update message log for end of early data test cases 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:44:00 +00:00
Xiaokang Qian 742578ca2c Remove end_of_early_data_coordinate() to align with exist style 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:44:00 +00:00
Xiaokang Qian bc75bc0c3a Switch to MBEDTLS_SSL_END_OF_EARLY_DATA as needed 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:44:00 +00:00
Xiaokang Qian c81a15a019 Change the comment format of end_of_early_data 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:44:00 +00:00
Xiaokang Qian 7ed30e59af Fix the issue that gnutls server doesn't support packet 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:44:00 +00:00
Xiaokang Qian 8804e6d0ac Put kex_exchange_mode in the guard of TLS13 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:43:59 +00:00
Xiaokang Qian da8402dde6 Switch outbound back to handshake key after end_of_early_data 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:43:59 +00:00
Xiaokang Qian bf09376bda Remove useless prepare_write_end_of_early_data 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:43:59 +00:00
Xiaokang Qian df6f52e2b2 Generate early key and switch outbound key to it after write client hello 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:43:59 +00:00
Xiaokang Qian d05ac5dfce Add extern apis mbedtls_ticket_get_psk. 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:43:59 +00:00
Xiaokang Qian 32af4fbbdb Set ciphersuite info and kex mode in set_session in re-connection 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:43:59 +00:00
Xiaokang Qian 34aab55aa7 Add prepare function to switch transform to early keys 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:43:58 +00:00
Xiaokang Qian 125afcb060 Add end-of-early-data write 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2023-02-08 05:43:58 +00:00
Pol Henarejos a6779287e8
Style. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-02-08 00:50:04 +01:00
Nick Child 3dafc6c3b3 pkcs7: Drop support for signature in contentInfo of signed data 
The contentInfo field of PKCS7 Signed Data structures can
optionally contain the content of the signature. Per RFC 2315
it can also contain any of the PKCS7 data types. Add test and
comments making it clear that the current implementation
only supports the DATA content type and the data must be empty.

Return codes should be clear whether content was invalid or
unsupported.
Identification and fix provided by:
 - Demi Marie Obenour <demiobenour@gmail.com>
 - Dave Rodgman <dave.rodgman@arm.com>

Signed-off-by: Nick Child <nick.child@ibm.com>
 2023-02-07 20:04:52 +00:00
Pol Henarejos 4e747337ee
Merge branch 'development' into sha3 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-02-07 19:55:31 +01:00
Valerio Setti 5b16e9eabc pk_wrap: keep ECDSA_C for ECP_RESTARTABLE contexts 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-07 16:21:36 +01:00
Hanno Becker dae916b05f X.509: Add length consistency checks to x509_get_other_name() 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2023-02-07 05:24:32 -05:00
Hanno Becker 2a15a0c868 X.509: Remove red'n bounds checks and zeroiz'n in OtherName parsing 
- ASN.1 parsing functions check that length don't exceed buffer bounds,
  so checks `p + len > end` are redundant.
- If `p + len == end`, this is erroneous because we expect further fields,
  which is automatically caught by the next ASN.1 parsing call.

Hence, the two branches handling `p + len >= end` in x509_get_other_name()
can be removed.

Further, zeroization of the `other_name` structure isn't necessary
because it's not confidential (and it's also not performed on other
error conditions in this function).
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2023-02-07 05:15:27 -05:00
Hanno Becker ae8f8c435c Fix X.509 SAN parsing 
Fixes #2838. See the issue description for more information.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2023-02-07 05:10:27 -05:00
Jerry Yu 2bb3d8101f Add en(de)crypt routine 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-07 17:11:53 +08:00
Jerry Yu e096da1af6 Add inverse key function 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-07 17:11:52 +08:00
Jerry Yu 3f2fb71072 Add key expansion for encrypt 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-07 17:11:52 +08:00
Jerry Yu b95c776c43 Add linux runtime detection 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-07 17:11:52 +08:00
Jerry Yu 49231319fd Add empty aesce files 
For time being, we only support gcc and clang

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-02-07 17:11:52 +08:00
Valerio Setti 1cdddacc62 pk_wrap: use proper macros for sign and verify 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-07 08:02:23 +01:00
Valerio Setti 5c593af271 pk_wrap: fix comment on closing #endif 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-07 08:02:23 +01:00
Valerio Setti 24138d9f83 pk_wrap: re-use identical functions for eckey and ecdsa when possible 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-07 08:02:23 +01:00
Valerio Setti 7ca1318256 pk: add new symbol for generic ECDSA capability 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-07 08:02:23 +01:00
Valerio Setti 9e30dd882d removing a leftover printf from debug 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-07 08:02:23 +01:00
Valerio Setti ab363d9fe1 pk/pk_wrap: replace ECDSA_C with generic ECDSA capabilities' defines 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-02-07 08:02:23 +01:00
Gabor Mezei 63aae68b8f
Fix documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-02-06 16:24:08 +01:00
Gilles Peskine 0cfb08ddf1
Merge pull request #6922 from mprse/csr_v3 
Parsing v3 extensions from a CSR - v.2
 2023-02-03 16:41:11 +01:00
Gilles Peskine 80c552556a
Merge pull request #6791 from yanrayw/6675-change-some-key-generation-funcs-to-static 
TLS 1.3: Key Generation: change some key generation functions to static
 2023-02-03 11:56:35 +01:00
Yanray Wang f206c1493b Remove duplicate mbedtls_platform_zeroize for tls13_early_secrets 
Signed-off-by: Yanray Wang <yanray.wang@arm.com>
 2023-02-03 13:55:47 +08:00
Dave Rodgman 6dd757a8ba Fix use of sizeof without brackets 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-02-02 12:40:50 +00:00
Nick Child 282d50493a pkcs7: Remove duplicate oid condition 
MBEDTLS_OID_PKCS7_ENCRYPTED_DATA was listed twice in
the oid conditional. Remove one of them.

Signed-off-by: Nick Child <nick.child@ibm.com>
 2023-02-01 18:32:55 +00:00
Gilles Peskine 24c6f49530
Merge pull request #7005 from tom-cosgrove-arm/fix-doxygen-typos-in-new-bignum 
Fix typos in doxygen commands in new bignum modules
 2023-02-01 19:05:04 +01:00
Gilles Peskine a193986aab
Merge pull request #6942 from ucko/2023a-bignum 
mbedtls_mpi_sub_abs: Skip memcpy when redundant (#6701).
 2023-02-01 11:36:25 +01:00
Tom Cosgrove 8a1f784ece Fix typos in doxygen commands in new bignum modules 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2023-02-01 08:43:54 +00:00
Yanray Wang a12cecbe47 Modify some comments in ssl_tls13_keys.c 
Signed-off-by: Yanray Wang <yanray.wang@arm.com>
 2023-02-01 14:29:51 +08:00
Nick Child 3bd17f2f58 pkcs7: Use end_issuer_and_sn where appropriate 
There were some areas where `end_signer` were being
used when it makes more sense to use `end_issuer_and_sn`,
as pointed out by demiobenour@gmail.com.

Signed-off-by: Nick Child <nick.child@ibm.com>
 2023-01-31 20:42:26 +00:00
Gabor Mezei 2038ce976e
Rename function to follow naming convention 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-31 14:40:05 +01:00
Gabor Mezei 9b290b33e4
Add documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-31 14:40:05 +01:00
Gabor Mezei deece2bb65
Change the ecp_mod_p192_raw to be testable 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-31 14:40:05 +01:00
Gabor Mezei b5bba497fe
Extract Secp192r1 from the prototype 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-31 14:40:05 +01:00
Gilles Peskine f6b9823422
Merge pull request #6979 from daverodgman/const-time-asm-vol 
Inhibit compiler from optimising out const-time asm
 2023-01-31 11:28:45 +01:00
Gilles Peskine 470f10cfc5
Merge pull request #6941 from gabor-mezei-arm/6375_quasi-reduction_function 
Add function to fix quasi-reduction
 2023-01-31 11:25:25 +01:00
Nick Child ec81709516 pkcs7: Ensure all data in asn1 structure is accounted for 
Several PKCS7 invalid ASN1 Tests were failing due to extra
data bytes or incorrect content lengths going unnoticed. Make
the parser aware of possible malformed ASN1 data.

Signed-off-by: Nick Child <nick.child@ibm.com>
 2023-01-30 16:44:58 +00:00
Gabor Mezei db1607fa69
Remove unneeded include 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-30 16:27:48 +01:00
Manuel Pégourié-Gonnard aae61257d1
Merge pull request #6883 from valeriosetti/issue6843 
Improve X.509 cert writing serial number management
 2023-01-30 13:08:57 +01:00
Dave Rodgman 4610d4b7a6 Inhibit compiler from optimising out const-time asm 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-01-30 09:26:48 +00:00
Jerry Yu 947fd3d6ea Implement ms time with GetSystemTimeAsFile time. 
There's a potential race condition with calling time(NULL) after
GetSystemTime().

See
https://learn.microsoft.com/en-us/archive/msdn-magazine/2004/march/implementing-a-high-resolution-time-provider-for-windows

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-01-30 15:45:25 +08:00
Manuel Pégourié-Gonnard 169d9e6eb4
Merge pull request #6802 from gilles-peskine-arm/test_suite_psa_crypto_metadata-20221215 
Add metadata tests for CCM* and TLS1.2-ECJPAKE-to-PMS
 2023-01-27 10:05:00 +01:00
Przemek Stekiel 36ad5e7ab5 Fix code style 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-26 22:30:45 +01:00
Valerio Setti af4815c6a4 x509: replace/fix name of new function for setting serial 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2023-01-26 17:43:09 +01:00
Janos Follath 803638c023
Merge pull request #6939 from minosgalanakis/bignum/6027_hardcode_montgomery_moduli 
Bignum: hardcode montgomery moduli
 2023-01-25 16:51:11 +00:00
Przemek Stekiel 32e20919ac Remove redundant check and add comment to inform about processing of empty extensions 
Netscape Certificate Management System Administrator's Guide: Extension-Specific Policy Modules, Chapter 18: Extension-Specific Policy Modules, Netscape Certificate Type Extension Policy:
> The extension has no default value.

A bitstring with no flags set is still technically valid, as it will mean that the certificate has no designated purpose at the time of creation.

Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-25 16:20:25 +01:00
Gabor Mezei 9a66ab180c
Fix missing declarration 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-25 13:23:38 +01:00
Przemek Stekiel 94e21e153f Skip unsupported extensions 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-25 11:08:32 +01:00
Gilles Peskine 8296eabed6
Merge pull request #6957 from tom-cosgrove-arm/fix-spelling-of-doxygen-return 
Fix doxygen return parameter spelling
 2023-01-24 21:56:45 +01:00
Gilles Peskine 3b8623fe2c
Merge pull request #6903 from Mihir-Raj-Singh/Bignum_rename_mtoN 
Rename modulus input argument from m to N
 2023-01-24 21:48:54 +01:00
Gabor Mezei 627e5b1f91
Only enable fix_quasi_reduction when testing 
Avoid compiler error due to the fix_quasi_reduction function
is static and has not been used.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-24 18:13:24 +01:00
Przemek Stekiel a468768000 Dealocate memory for subject alt names 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-24 15:19:47 +01:00
Przemek Stekiel 86d1946164 Fix error codes returned on failures 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-24 11:20:10 +01:00
Przemek Stekiel cf6ff0fb43 Move common functions for crt/csr parsing to x509.c 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-24 10:57:19 +01:00
Przemek Stekiel db128f518c Allow empty ns_cert_type, key_usage while parsing certificates 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-24 10:57:19 +01:00
Przemek Stekiel 21c37288e5 Adapt function names 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-24 10:57:19 +01:00
Przemek Stekiel cbaf3167dd mbedtls_x509_csr_info: Add parsing code for v3 csr extensions 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-24 10:57:19 +01:00
Jens Alfke 2d9e359275 Parsing v3 extensions from a CSR 
A parsed CSR struct (`mbedtls_x509_csr`) now includes some of the
X.509v3 extensions included in the CSR -- the key usage, Netscape
cert-type, and Subject Alternative Names.

Author: Jens Alfke <jens@couchbase.com>

Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2023-01-24 10:56:55 +01:00
Gabor Mezei a24fd06451
Update documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-23 19:10:26 +01:00
Gabor Mezei 9073f7dd3b
Remove unneeded check 
The fix_quasi_reduction function changed to static so checking the
invalid arguments are not needed anymore.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-23 19:05:37 +01:00
Gabor Mezei e81a2b85c9
Change the fix_quasi_reduction function to static 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-23 18:58:20 +01:00
Gabor Mezei aaa1d2a276
Move the quasi reduction fixing function to bignum_mod_raw 
Rename the function to 'fix_quasi_reduction' to better suite its functionality.
Also changed the name prefix to suite for the new module.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-23 18:55:57 +01:00
Tom Cosgrove 37dabd540b Fix doxygen return parameter spelling 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2023-01-23 16:57:26 +00:00
Minos Galanakis 8692ec8bc0 pkarse: Added pk_group_id_from_specified() documentation. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2023-01-23 10:33:06 +00:00
Dave Rodgman 7658b63390 Remove volatile from diff; add explanatory comment 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-01-20 14:04:48 +00:00
Dave Rodgman fa96026a0e Move definition of asm out of public header 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-01-20 14:04:48 +00:00
Dave Rodgman 7f376fa6fc Improve documentation 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-01-20 14:04:48 +00:00
Dave Rodgman b9cd19bc8c Prevent perf regressions in mbedtls_xor 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-01-20 14:04:48 +00:00
Dave Rodgman 051225d07a Address potential perf regression 
Ensure platforms that don't have an assembly implementation for
mbedtls_get_unaligned_volatile_uint32() don't experience a performance
regression.

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-01-20 14:04:48 +00:00
Dave Rodgman 36dfc5a237 Improve efficiency of some constant time functions 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-01-20 14:04:48 +00:00
Dave Rodgman cb0f2c4491 Tidy-up - move asm #define into build_info.h 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-01-20 14:04:48 +00:00
Minos Galanakis c8e381ab1c pkarse: Update pk_group_id_from_specified() clean-up. 
This path updates the clean-up logic of to individually
free each of the the group's structure members
rather than invoke `mbedtls_ecp_group_free()`.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2023-01-19 16:15:11 +00:00
Minos Galanakis e9fa7a74cd ecp_curves: Update pre-processor define guards for ecp_mpi_load(). 
This patch adjusts the logic, so that the method is included,
when the following components are enabled:

* MBEDTLS_ECP_DP_CURVE448_ENABLED
* MBEDTLS_ECP_DP_CURVE25519_ENABLED
* ECP_LOAD_GROUP

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2023-01-19 16:12:07 +00:00
Minos Galanakis d61dbd4df7 ecp_curves: Update mbedtls_ecp_group_free(). 
This patch updates the method to not free the `grp->P`
and `grp->N` structure members.

The contents of `P` and `N` are stored in static memory at
`curve448_p/n` and `curve25519p/n` and no longer dynamically
allocated.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2023-01-19 16:11:55 +00:00
Minos Galanakis 146fed9849 ecp_curves: Hardcode Montgomery const for curve448. 
This patch adds two embedded constants used by `ecp_use_curve448()`.
The method has been updated to read that into an mpi instead of
calculating it on the fly.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2023-01-19 16:11:50 +00:00
Minos Galanakis bececeb0b9 ecp_curves: Hardcod Montgomery const for curve25519 
This patch adds two embedded constants used by `ecp_use_curve25519()`.
The method has been updated to read that into an mpi instead of
calculating it on the fly.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2023-01-19 11:38:19 +00:00
Gilles Peskine bb3814c7a8 Reject key agreement chained with PSA_ALG_TLS12_ECJPAKE_TO_PMS 
The key derivation algorithm PSA_ALG_TLS12_ECJPAKE_TO_PMS cannot be
used on a shared secret from a key agreement since its input must be
an ECC public key. Reject this properly.

This is tested by test_suite_psa_crypto_op_fail.generated.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2023-01-19 12:11:23 +01:00
Aaron M. Ucko af67d2c1cf mbedtls_mpi_sub_abs: Skip memcpy when redundant (#6701). 
In some contexts, the output pointer may equal the first input
pointer, in which case copying is not only superfluous but results in
"Source and destination overlap in memcpy" errors from Valgrind (as I
observed in the context of ecp_double_jac) and a diagnostic message
from TrustInSoft Analyzer (as Pascal Cuoq reported in the context of
other ECP functions called by cert-app with a suitable certificate).

Signed-off-by: Aaron M. Ucko <ucko@ncbi.nlm.nih.gov>
 2023-01-17 11:52:22 -05:00
Gabor Mezei c83f792c18
Add documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-17 13:28:06 +01:00
Gabor Mezei 9684d4dc58
Add quasi-reduction function for ecp 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2023-01-17 13:16:46 +01:00
Mihir Raj Singh 432cacf5c2 bignum_mod_raw: Renamed m -> N in mbedtls_mpi_mod_raw_neg() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-17 11:25:26 +05:30
Mihir Raj Singh b0354c5b71 bignum_mod_raw: Renamed m -> N in mbedtls_mpi_mod_raw_from_mont_rep() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:11:18 +05:30
Mihir Raj Singh 37ece7292a bignum_mod_raw: Renamed m -> N in mbedtls_mpi_mod_raw_to_mont_rep() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:10:40 +05:30
Mihir Raj Singh 01e861ff9e bignum_mod_raw: Renamed m -> N in mbedtls_mpi_mod_raw_write() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:10:00 +05:30
Mihir Raj Singh cd17ff0354 bignum_mod_raw: Renamed m -> N in mbedtls_mpi_mod_raw_read() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:09:12 +05:30
Mihir Raj Singh a43290d556 bignum_mod: Renamed m -> N in mbedtls_mpi_mod_write() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:08:17 +05:30
Mihir Raj Singh fdc314b6fe bignum_mod: Renamed m -> N in mbedtls_mpi_mod_read() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:06:16 +05:30
Mihir Raj Singh 928a07ba49 bignum_mod: Renamed m -> N in mbedtls_mpi_mod_modulus_free 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:04:37 +05:30
Mihir Raj Singh f438ad1ab9 bignum_mod: Renamed m -> N in mbedtls_mpi_mod_modulus_setup() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:03:06 +05:30
Mihir Raj Singh b6fa940fc4 bignum_mod: Renamed m -> N in mbedtls_mpi_mod_modulus_init() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:02:04 +05:30
Mihir Raj Singh b13a58938a bignum_mod: Renamed m -> N in mbedtls_mpi_mod_residue_setup() 
Signed-off-by: Mihir Raj Singh <mihirrajsingh123@gmail.com>
 2023-01-16 23:01:25 +05:30
Pengyu Lv 9b84ea75de remove ssl_tls13_has_compat_ticket_flags 
This content of the function is moved to
ssl_tls13_has_configured_ticket.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-16 14:08:23 +08:00
Pengyu Lv e2f1dbf5ae update docs of ssl_client2 and improve code format 
Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-16 12:38:12 +08:00
Pengyu Lv 4938a566bf refine ticket_flags printing helper 
Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-16 11:28:49 +08:00
Pengyu Lv acecf9c95b make ticket_flags param types consistent 
When ticket_flags used as parameter, use unsigned int,
instead of uint8_t or mbedtls_ssl_tls13_ticket_flags.Also
remove the definition of mbedtls_ssl_tls13_ticket_flags.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-16 11:23:24 +08:00
Pengyu Lv 3643fdbab9 refine the state setting in tls13_handshake_wrapup 
Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:06:02 +08:00
Pengyu Lv ee455c01ce move ticket_flags debug helpers 
The debug helpers printing ticket_flags status are
moved to ssl_tls.c and ssl_debug_helpers.h.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:06:01 +08:00
Pengyu Lv 189465306d remove MBEDTLS_ERR_SSL_TICKET_INVALID_KEX_MODE error 
Return MBEDTLS_ERR_ERROR_GENERIC_ERROR when ticket_flags
are not compatible with advertised key exchange mode.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:06:00 +08:00
Pengyu Lv 80270b2151 rename ticket_flags helper functions to generic ones 
Ticket flags is quite generic and may make sense in the
future versions of TLS or even in TLS 1.2 with new
extensions. This change remane the ticket_flags helper
functions with more generic `mbedtls_ssl_session` prefix
instead of `mbedtls_ssl_tls13_session`.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:59 +08:00
Pengyu Lv a1aa31b8b1 fix review comments 
Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:58 +08:00
Pengyu Lv 1735ba30ea fix review comments 
Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:57 +08:00
Pengyu Lv 9eacb44a5e improve code format and readability 
Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:57 +08:00
Pengyu Lv 9356678047 filter the tickets with tls13_kex_mode on client side. 
Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:56 +08:00
Pengyu Lv e6487fe3c2 guard tls13_kex_modes related function calls with macro 
Handshake parameter field, tls13_kex_mode is only valid when
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED is set.
So, any functions / calls should be guarded by this macros.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:55 +08:00
Pengyu Lv 3eb49be6a8 move kex mode check in ticket_flags to psks_check_identity_match_ticket 
Move the kex mode check in ticket_flags to
ssl_tls13_offered_psks_check_identity_match_ticket and add new error
'MBEDTLS_ERR_SSL_TICKET_INVALID_KEX_MODE' to indicate the check
failure.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:55 +08:00
Pengyu Lv c7af2c4f8c tls13: send new session ticket only when client supports psk 
Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:54 +08:00
Pengyu Lv c55eeb682d tls13: check if the session ticket is compatible with key exchange modes 
The server check if the ticket_flags is compatible with the advertised
key exchange modes in Pre-Shared Key Exchange Modes extension. The
incompatible ticket should be mark as not matched.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:53 +08:00
Pengyu Lv 9f92695c8d tls13: set key exchange mode in ticket_flags on client/server 
Set the ticket_flags when:
  - server: preparing NST (new session ticket) message
  - client: postprocessing NST message

Clear the ticket_flags when:
  - server: preparing NST message
  - client: parsing NST message

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:53 +08:00
Pengyu Lv b7d50acb37 tls13: add helpers to manipulate ticket_flags 
Add helper functions to get/set/clear ticket_flags.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:52 +08:00
Pengyu Lv 5b8dcd2097 Add debug helper to print ticket_flags status 
Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2023-01-13 11:05:52 +08:00
Valerio Setti 856cec45eb test: x509: add more tests for checking certificate serial 
- added 2 new certificates: 1 for testing a serial which is full lenght
  and another one for a serial which starts with 0x80

- added also proper Makefile and openssl configuration file to generate
  these 2 new certificates

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-12 17:01:45 +01:00
Valerio Setti 4752aac11d x509: enhancement and fixes 
- enhance mbedtls_x509write_crt_set_serial(): avoid use of useless
  temporary buffer

- fix mbedtls_x509write_crt_der(): add an extra 0x00 byte at the
  beginning of serial if the MSb of serial is 1, as required from
  ASN.1

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-12 17:01:44 +01:00
Valerio Setti 746def5ade x509: renaming of buffer variables in new serial setting function 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-12 17:01:44 +01:00
Valerio Setti acf12fb744 x509: fix endianness and input data format for x509write_crt_set_serial_new 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-12 17:01:44 +01:00
Valerio Setti 5d164c4e23 fix: add missing deprecation guards 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-12 17:01:44 +01:00
Valerio Setti da0afcc2fb x509: remove direct dependency from BIGNUM_C 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-12 17:01:44 +01:00
Jerry Yu 38257491aa Add milliseconds time function 
We provide windows and posix implementation for it.
With MBEDTLS_PLATFORM_MS_TIME_ALT, user can provide
their own implementation.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-01-12 18:01:14 +08:00
Yanray Wang ef5ec8f5ba Rename static functions in ssl_tls13_keys.c 
As some static functions are only used inside ssl_tls13_keys.c,
the prefix mbedtls_ should be removed. Furthermore, code format is
also maintained to fix code style.

Signed-off-by: Yanray Wang <yanray.wang@arm.com>
 2023-01-12 15:11:03 +08:00
Yanray Wang 0540211078 Enhancement: change some functions to static in ssl_tls13_keys.c 
Since some functions are only used in ssl_tls13_keys.c not by any
other modules, those functions are changed to static.

Signed-off-by: Yanray Wang <yanray.wang@arm.com>
 2023-01-12 14:54:26 +08:00
Yanray Wang 16c895dff3 TLS1.3: zeroize tls13_early_secrets after its lifetime 
Signed-off-by: Yanray Wang <yanray.wang@arm.com>
 2023-01-12 14:27:06 +08:00
Yanray Wang bae9e74d39 Enhancement: change tls13_early_secrets to local variable 
Since tls13_early_secrets is only temperately used in the function,
there is no need to keep it in the handshake context.

Signed-off-by: Yanray Wang <yanray.wang@arm.com>
 2023-01-12 14:27:06 +08:00
Gilles Peskine 449bd8303e Switch to the new code style 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2023-01-11 14:50:10 +01:00
Gilles Peskine 03e99cf14d Remove redundant error code definitions 
We're including psa/crypto_values.h, which defines the necessary error
codes. Remove redundant definitions, which hurt because they need to be
styled in exactly the same way (same presence/absence of spaces between
tokens).

This completes the fix of https://github.com/Mbed-TLS/mbedtls/issues/6875.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2023-01-11 11:15:18 +01:00
Ronald Cron 83c5ad4873
Merge pull request #6787 from yuhaoth/pr/workaround-gnutls_anti_replay_fail 
TLS 1.3: EarlyData: Workaround anti replay fail from GnuTLS
 2023-01-11 09:05:36 +01:00
Gilles Peskine 0770efe4e1
Merge pull request #6888 from daverodgman/iar-bignum-warning 
Fix IAR warning
 2023-01-10 22:08:37 +01:00
Manuel Pégourié-Gonnard 28d4d43416
Merge pull request #6863 from valeriosetti/issue6830 
Remove uses of mbedtls_ecp_curve_info in TLS (with USE_PSA)
 2023-01-10 10:01:17 +01:00
Jerry Yu 3e60cada5d Improve comment and changlog 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-01-10 14:58:08 +08:00
Valerio Setti a0b97bc803 fix wrong type in debug message 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-09 19:10:32 +01:00
Valerio Setti 1e868ccbac fix several typos and extra blank spaces 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-09 17:59:46 +01:00
Valerio Setti 2b5d3ded1f remove remaining occurencies of mbedtls_ecc_group_to_psa() from TLS 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-09 11:04:52 +01:00
Jerry Yu bdb936b7a5 Workaround anti replay fail of GnuTLS 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2023-01-07 20:19:55 +08:00
Glenn Strauss 14db51224e Fix IAR warning 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2023-01-06 14:20:14 +00:00
Gilles Peskine cd0a565644
Merge pull request #6703 from yuhaoth/pr/tls13-misc-from-prototype 
TLS 1.3: Upstream misc fix from prototype
 2023-01-05 14:35:54 +01:00
David Horstmann bec95320ba Don't restyle end of file 
Move the *INDENT-ON* annotation to the end of the file so that
uncrustify does not restyle the later sections (since it introduces a
risk of future problems).

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2023-01-05 09:50:47 +00:00
David Horstmann cb3b6ae580 Disable code style correction for bignum assembly 
The inline assembly defined in bn_mul.h confuses code style parsing,
causing code style correction to fail. Disable code style correction for
the whole section gated by "#if defined(MBEDTLS_HAVE_ASM)" to prevent
this.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2023-01-04 17:50:08 +00:00
Valerio Setti 67419f0e11 tls: fix + save code size when DEBUG_C is not enabled 
Some PSA curves' symbols (PSA_WANT_) were not matching the corresponding
MBEDTLS_ECP_DP_. This was fixed together with the removal of extra code
when DEBUG_C is not enabled.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-04 17:36:00 +01:00
Valerio Setti 40d9ca907b tls: remove useless legacy function 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-04 16:08:04 +01:00
Valerio Setti 18c9fed857 tls: remove dependency from mbedtls_ecp_curve functions 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2023-01-03 13:03:34 +01:00
David Horstmann e3d8f31ba1 Workaround Uncrustify parsing of "asm" 
The following code:

 #ifndef asm
 #define asm __asm
 #endif

causes Uncrustify to stop correcting the rest of the file. This may be
due to parsing the "asm" keyword in the definition.

Work around this by wrapping the idiom in an *INDENT-OFF* comment
wherever it appears.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2023-01-03 11:07:09 +00:00
Manuel Pégourié-Gonnard 7a389ddc84
Merge pull request #6784 from valeriosetti/issue6702 
Make SHA224_C/SHA384_C independent from SHA256_C/SHA512_C
 2023-01-03 09:36:58 +01:00
Janos Follath b4b0bb737d
Merge pull request #5907 from mpg/use-psa-rsa-pss 
Use PSA more often in `pk_verify_ext()`
 2022-12-30 12:33:50 +00:00
Gilles Peskine b402e4bde1
Merge pull request #6595 from mfischer/lms_heap 
lms: Move merkle tree generation to heap allocation
 2022-12-23 18:29:04 +01:00
Valerio Setti 326cf46764 test: improved readability in sha self tests 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-23 14:57:18 +01:00
Manuel Pégourié-Gonnard 676766ff77
Merge pull request #6776 from gabor-mezei-arm/6222_bignum_mod_mul 
Bignum: Implement fixed width modular multiplication
 2022-12-23 10:39:30 +01:00
Manuel Pégourié-Gonnard 2fcb4c1d06
Merge pull request #6747 from gilles-peskine-arm/bignum-mod-random 
Bignum mod random
 2022-12-23 10:36:22 +01:00
Valerio Setti 543d00ef6f sha: remove SHA1 from ssl_cookie 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-22 14:27:34 +01:00
Manuel Pégourié-Gonnard 2510dd41bf
Merge pull request #6282 from gstrauss/sw_derive_y 
mbedtls_ecp_point_read_binary from compressed fmt
 2022-12-22 10:20:31 +01:00
Manuel Pégourié-Gonnard 4dacf58d6d Take advantage of now-public macro in pk.c 
Used to be private, hence the duplication, but that's been fixed in the
meantime, I guess we just missed this occurrence.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-12-21 09:50:17 +01:00
Manuel Pégourié-Gonnard 6958355a51 Use PSA Crypto more often in pk_verify_ext() 
See https://github.com/Mbed-TLS/mbedtls/issues/5277 - strategy 1.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-12-21 09:49:57 +01:00
Gilles Peskine e1d8326e90 Fix representation of mod-random output 
mbedtls_mpi_mod_raw_random() and mbedtls_mpi_mod_random() were producing
output in the Montgomery representation, instead of obeying the
representation chosen in the modulus structure. Fix this.

Duplicate the test cases for mod-random output to have separate test cases
for each representation.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-20 20:28:02 +01:00
Gilles Peskine e655479528 Generalize representation handling in mbedtls_mpi_mod_read 
Call mbedtls_mpi_mod_raw_canonical_to_modulus_rep instead of assuming that
anything that isn't MBEDTLS_MPI_MOD_REP_MONTGOMERY is canonical.

mbedtls_mpi_mod_write should get the same treatment, but I'm holding off
until https://github.com/Mbed-TLS/mbedtls/issues/6679 is done.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-20 19:55:51 +01:00
Gilles Peskine eb2e77f617 Document modulus representation selectors 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-20 19:55:51 +01:00
Gilles Peskine 1e2a4d4089 Functions to convert raw residues to/from the modulus representation 
Test cases will be generated automatically by a subsequent commit.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-20 19:55:51 +01:00
Gabor Mezei 496cd37bac
Use equality checking for NULL value 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-12-20 17:30:20 +01:00
Gabor Mezei 2840884c35
Typo 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-12-20 17:30:19 +01:00
Gabor Mezei 6a31b7252d
Fix documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-12-20 17:30:19 +01:00
Gabor Mezei 9db81e9cca
Add mod_mul function 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-12-20 17:30:13 +01:00
Glenn Strauss efde9d58de remove duplicated consecutive preproc directives 
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 2022-12-20 04:20:12 -05:00
Manuel Pégourié-Gonnard 8b6d14be8b Extract common code for computing X^3 + AX + B 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-12-20 04:17:03 -05:00
Glenn Strauss 452416121d move mbedtls_ecp_sw_derive_y after MPI_ECP_ macros 
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 2022-12-19 21:25:27 -05:00
Glenn Strauss fcabc28cfc use MPI_ECP_* macros in mbedtls_ecp_sw_derive_y() 
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 2022-12-19 21:24:50 -05:00
Gilles Peskine e162b4725c
Merge pull request #6777 from tom-cosgrove-arm/issue-6292-mod_inv 
Bignum: Implement high level fixed width modular inversion
 2022-12-17 13:26:02 +01:00
Gilles Peskine cf86d70162
Merge pull request #6742 from gabor-mezei-arm/6022_bignum_mod_raw_mul 
Bignum: Implement fixed width raw modular multiplication
 2022-12-17 13:25:43 +01:00
Tom Cosgrove f723754f6d Fix typos 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-16 16:10:36 +00:00
Glenn Strauss cbfd5e9db7 comment 
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 2022-12-16 11:03:41 -05:00
Glenn Strauss 369bfb94c5 comments and whitespace 
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 2022-12-16 10:49:04 -05:00
Gabor Mezei 210ea63d8b
Fix documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-12-16 16:35:24 +01:00
Valerio Setti e7221a21ad test: adjust depends.py to new SHA224/SHA384 changes 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-16 14:43:48 +01:00
Tom Cosgrove 342d00bc22 Oops, use mbedtls_free() not plain free() 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-16 11:02:06 +00:00
Gilles Peskine b1eea02f74 Implement and test mbedtls_mpi_mod_random 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-16 10:13:29 +01:00
Gilles Peskine a57cf9813a Implement and test mbedtls_mpi_mod_raw_random 
In the basic/XXX=core test cases, use odd upper bounds, because the mod
version of random() only supports odd upper bounds (the upper bound is a
modulus and the mod modules only support odd moduli).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-16 10:13:29 +01:00
Manuel Pégourié-Gonnard 057b458583
Merge pull request #6766 from wernerlewis/bignum_mod_docs 
Bignum: document conventions for bignum mod and mod_raw
 2022-12-16 09:58:36 +01:00
Manuel Pégourié-Gonnard 5bf8629b2c
Merge pull request #6303 from gilles-peskine-arm/bignum-core-random 
Bignum: Implement mbedtls_mpi_core_random
 2022-12-16 09:58:07 +01:00
Gilles Peskine d1dd41f3fc
Merge pull request #6723 from mpg/restartable-vs-use-psa 
Document ECP_RESTARTABLE and make it compatible with USE_PSA
 2022-12-15 19:47:44 +01:00
Werner Lewis 6bb49ba121 Document const parameter conventions 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 17:04:43 +00:00
Tom Cosgrove b38c2ed3d9 Fix double space between words 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-15 16:56:36 +00:00
Tom Cosgrove d692ba4248 Note that (as usual) for mbedtls_mpi_mod_inv() residues must be associated with the modulus 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-15 16:56:36 +00:00
Tom Cosgrove a9e0f95903 Split mbedtls_mpi_mod_inv() into separate functions for mont/non-mont form 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-15 16:56:36 +00:00
Tom Cosgrove 4302d02fa8 Add mbedtls_mpi_mod_inv() 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-15 16:56:36 +00:00
Tom Cosgrove 786848b5c5 Add low-level Montgomery conversion functions to bignum_core 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-15 16:56:36 +00:00
Tom Cosgrove 28ff92cc3a Add an explicit mbedtls_mpi_core_montmul_working_limbs() function 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-15 16:56:36 +00:00
Tom Cosgrove 30f3b4d601 Add mbedtls_mpi_core_check_zero_ct() and tests 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-15 16:56:36 +00:00
Tom Cosgrove e9ffb6c8e9 Fix mbedtls_platform_zeroize() call in mbedtls_mpi_mod_modulus_free() 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-15 16:56:36 +00:00
Werner Lewis 756a34aadc Use lower case for p and r 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 14:53:43 +00:00
Werner Lewis 0f644f48e9 Add output initialization requirement 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 14:13:32 +00:00
Gilles Peskine 6b7ce968d2 Clarify some comments 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-15 15:04:33 +01:00
Gabor Mezei 95b754dfac
Fix documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-12-15 15:04:20 +01:00
Gabor Mezei 979d34ca7d
Add mod_raw_mul function 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-12-15 15:04:20 +01:00
Werner Lewis 214ae64349 Replace \p with \c for non-parameter code typeset 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 13:36:07 +00:00
Werner Lewis 1d89ebf548 Clarify all functions operate modulo N 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 13:35:41 +00:00
Werner Lewis a306886b3a Add modulus to parameter ordering 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 13:35:41 +00:00
Werner Lewis 2e70b9afef Reword bignum sizes section 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 13:35:41 +00:00
Werner Lewis 2bd263da1e Fix grammar and spelling 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 13:35:40 +00:00
Werner Lewis 945a165a3c Clarify output requirements 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 13:22:27 +00:00
Werner Lewis eac8be76d6 Remove unnecessary type comment 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 13:22:17 +00:00
Werner Lewis e1eb75dc99 Specify modulus constraints 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-15 12:27:56 +00:00
Manuel Pégourié-Gonnard 50faa55e4d
Merge pull request #6732 from wernerlewis/bignum_6019_mod_add 
Bignum: Implement mbedtls_mpi_mod_add()
 2022-12-15 11:39:24 +01:00
Dave Rodgman 01f6e61781
Merge pull request #986 from Mbed-TLS/merge-back-3.3.0-3 
Merge back 3.3.0 3
 2022-12-14 19:18:05 +00:00
Dave Rodgman ebef3562c3 Revert "Add generated files" 
This reverts commit c18d932705.

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-12-14 19:14:00 +00:00
Dave Rodgman e90ed7d249 Bump versions for libmbedcrypto and libmbedtls 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-12-14 17:04:00 +00:00
Manuel Pégourié-Gonnard c98624af3c
Merge pull request #6680 from valeriosetti/issue6599 
Allow isolation of EC J-PAKE password when used in TLS
 2022-12-14 11:04:33 +01:00
Valerio Setti a3f99591f6 sha: make SHA-224 independent from SHA-256 
Using proper configuration options (i.e. MBEDTLS_SHA224_C and
MBEDTLS_SHA256_C) it is now possible to build SHA224 and SHA256
independently from each other.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-14 10:56:54 +01:00
Manuel Pégourié-Gonnard 4064a82802
Merge pull request #5600 from yuhaoth/pr/refactor-cookie-members-of-handshake 
Refactor cookie members of handshake
 2022-12-14 10:55:34 +01:00
Valerio Setti 898e7a3afe test: sha: test SHA384 and SHA512 separately 
This is meant to adapt to the new library design in which
SHA384 and SHA512 can be built independently from each other.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-14 10:50:54 +01:00
Werner Lewis eed01aabd3 Clarify wording in documentation 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-14 09:44:00 +00:00
Valerio Setti 43363f5962 sha: make SHA-384 independent from SHA-512 
Using proper configuration options (i.e. MBEDTLS_SHA384_C and
MBEDTLS_SHA512_C) it is now possible to build SHA384 and SHA512
independently from each other.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-14 08:53:23 +01:00
Manuel Pégourié-Gonnard 2b70a3f831
Merge pull request #6558 from lpy4105/6416-psa_macros_name_typo 
check_names: extend typo check to PSA macro/enum names
 2022-12-13 09:56:27 +01:00
Manuel Pégourié-Gonnard 48232ed2c1
Merge pull request #6743 from minosgalanakis/bignum/implement_modular_negation 
Bignum: Implement fixed width modular negation
 2022-12-13 09:54:38 +01:00
Bence Szépkúti f7641544ea Correct the fix for the PKCS 7 memory leak 
This corrects an issue in the origina fix in
4f01121f6e.

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2022-12-12 21:59:03 +01:00
Dave Rodgman 8a05c069a5
Merge pull request #6751 from ZachFleck42/development 
Fix typo in `library/entropy.c`
 2022-12-12 16:30:54 +00:00
Werner Lewis 5e9d2e9019 Add conventions for bignum mod and mod_raw 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-12 14:00:25 +00:00
Manuel Pégourié-Gonnard a9ac61203b
Merge pull request #6666 from daverodgman/fast_unaligned 
Fast unaligned memory access macros
 2022-12-12 12:18:17 +01:00
Minos Galanakis 5e8443e6ef mbedtls_mpi_mod_raw_neg: Updated documentation. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-12-12 11:13:56 +00:00
Minos Galanakis 21fe8bdeac bignum_mod_raw: Added modular negation. 
This patch adds the `mpi_mod_raw_neg()` method.

Co-authored-by: Hanno Becker <hanno.becker@arm.com>
Co-authored-by: Minos Galanakis <minos.galanakis@arm.com>

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-12-12 11:13:56 +00:00
Valerio Setti 016f682796 tls: pake: small code refactoring for password setting functions 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-09 14:17:50 +01:00
Tom Cosgrove 5f09930017 Clarify use of temporary in mbedtls_mpi_mod_raw_inv_prime() 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-09 10:58:15 +00:00
Dave Rodgman c18d932705 Add generated files 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-12-09 09:44:10 +00:00
Manuel Pégourié-Gonnard df0c73c308 Readability improvement in pk_wrap.c 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-12-09 10:09:34 +01:00
Manuel Pégourié-Gonnard 79ae7eb4d1 Use deterministic ECDSA in PSA when we do in legacy 
This fixes the two failing cases in test_suite_pk when ECP_RESTARTABLE
and USE_PSA_CRYPTO are both enabled. The two failing cases where

    ECDSA restartable sign/verify: ECDSA, max_ops=0 (disabled)
    ECDSA restartable sign/verify: ECKEY, max_ops=0 (disabled)

associated with test function pk_sign_verify_restart(). The failure was
caused by the interaction of several things that are each reasonable on
their own:

1. The test function relies on ECDSA restartable, which is reasonable as it
allows making sure that the generated signature is correct with a simple
memcmp().
2. The implementation of pk_sign_restartable() has a shortcut to
dispatch to the sign function (as opposed to sign_restartable) when
restart is disabled (max_ops == 0).
3. When USE_PSA is enabled, the sign function dispatches to PSA, which
so far always used ECDSA (non-deterministic) even when the non-PSA
version would use deterministic ECDSA.

This could be fixed by changing any of those. I chose (3) because I
think it makes sense that when PK dispatches to PSA instead of legacy
this should not change which version of ECDSA is selected.

OTOH, I think it makes sense to keep (2), because that means more
opportunities to dispatch to PSA.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-12-09 10:07:19 +01:00
Jerry Yu 0c2a738c23 fix various issues 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-09 09:51:20 +08:00
Jerry Yu 141bbe7bee tls13: Adjust include files 
- remove duplicate and unused included
- Adjust the order to system, mbedtls global, local.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-09 09:51:20 +08:00
Jerry Yu ddda050604 tls13: Upstream various fix in prototype 
- Adjust max input_max_frag_len
- Guard transform_negotiate
- Adjust function position
- update comments
- fix wrong requirements

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-09 09:51:20 +08:00
Jerry Yu 2e19981e17 tls13: guards transform negotiate 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-09 09:51:20 +08:00
Valerio Setti eb3f788b03 tls: pake: do not destroy password key in TLS 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-08 18:42:58 +01:00
Dave Rodgman 48223bc19e Bump version to 3.3.0. No changes to .so versions. 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-12-08 14:43:19 +00:00
Dave Rodgman a5b2c52885 Merge remote-tracking branch 'restricted/development-restricted' into mbedtls-3.3.0rc0-pr 2022-12-08 14:10:59 +00:00
Zachary Fleckenstein 73defe4da0 Fix typo in library/entropy.c 
Signed-off-by: Zachary Fleckenstein <ZachFleck42@Gmail.com>
 2022-12-08 07:28:29 -05:00
Tom Cosgrove 6129268fee Bignum: Implement mbedtls_mpi_mod_raw_inv_prime() and tests 
Fixes #6023.

Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-08 09:44:10 +00:00
Tom Cosgrove a7f0d7b029 mbedtls_mpi_core_exp_mod() ouuput may alias input A 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-08 08:46:28 +00:00
Valerio Setti ae7fe7ee53 tls: pake: avoid useless psa_pake_abort in setting opaque password 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-07 17:36:59 +01:00
Valerio Setti 70d1fa538a tls: pake: fix missing return values check 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-07 16:20:27 +01:00
Valerio Setti c689ed8633 tls: pake: minor adjustments 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-07 14:40:38 +01:00
Dave Rodgman 90af1a10ab
Merge pull request #6734 from daverodgman/fix_test_dep_spelling 
Fix spelling of test dependency
 2022-12-07 09:06:29 +00:00
Ronald Cron fbba0e9d75
Merge pull request #6537 from yuhaoth/pr/tls13-refactor-early-data-configuration-interface 
TLS 1.3: Refactor early data configuration interface.
 2022-12-07 09:42:12 +01:00
Janos Follath d45924d862
Merge pull request #6733 from tom-cosgrove-arm/issue-6293-mod_exp-memory 
Have mbedtls_mpi_core_exp_mod() take a temporary instead of allocating memory
 2022-12-07 08:32:31 +00:00
Janos Follath 1d26d976e8
Merge pull request #6731 from tom-cosgrove-arm/issue-6293-mod_exp 
Require input to mbedtls_mpi_core_exp_mod() to already be in Montgomery form
 2022-12-07 08:31:49 +00:00
Dave Rodgman 556e8a3219 Fix additional mis-spelling 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-12-06 16:31:25 +00:00
Dave Rodgman 92011eef34
Merge pull request #6717 from tom-cosgrove-arm/fix-typos-2212 
Fix typos prior to release
 2022-12-06 15:00:34 +00:00
Tom Cosgrove 0a0ddedfb7 Have mbedtls_mpi_core_exp_mod() take a temporary instead of allocating memory 
Last PR needed for #6293

Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-06 14:37:18 +00:00
Werner Lewis e1b6b7c0ac Implement mbedtls_mpi_mod_add() 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-12-06 11:55:32 +00:00
Tom Cosgrove ecda186893 Require input to mbedtls_mpi_core_exp_mod() to already be in Montgomery form 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-06 10:46:30 +00:00
Jerry Yu 6ee56aa18f Add default values for conf->*early_data* 
- early_data default to disable
- max_early_data_size default to built-in value

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-06 18:00:47 +08:00
Jerry Yu 39da9857df remove limitation of max_early_data_size 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-06 16:58:36 +08:00
Jerry Yu 12c46bd14f fix various issues 
- disable reuse of max_early_data_size.
- make conf_early_data available for server.
- various comment issues

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-06 11:02:51 +08:00
Tom Cosgrove ed4f59eec3 Fix another typo where 'PSK' was 'PKS' 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-05 12:07:50 +00:00
Jerry Yu e01304f6d8 fix type conversion issue 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-05 19:58:46 +08:00
Jerry Yu ac5ca5a0ea Refactor cookie members of handshake struct 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-05 19:58:45 +08:00
Dave Rodgman acbb6dc364 Merge remote-tracking branch 'origin/development' into merge-dev 2022-12-05 10:59:23 +00:00
Tom Cosgrove 1797b05602 Fix typos prior to release 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-04 17:19:59 +00:00
Valerio Setti 757f359474 tls: pake: do not destroy key on errors while setting opaque password 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-02 11:07:11 +01:00
Gilles Peskine 70375b2028 Move mbedtls_mpi_core_random to the proper source file 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-01 23:46:26 +01:00
Gilles Peskine 78cf3bbf22 Bignum core: break mbedtls_mpi_core_random out of mbedtls_mpi_random 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-01 23:45:45 +01:00
Gilles Peskine 4a8c5cdfbf Bignum core: random: prototype 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-01 23:44:07 +01:00
Gilles Peskine 26be89b3f6 Bignum core: random: prepare to break out the core function 
Shuffle things around a bit inside mbedtls_mpi_random() in preparation for
breaking out mbedtls_mpi_core_random().

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-01 23:06:43 +01:00
Gilles Peskine 8a32a75aa2 mbedtls_mpi_random: avoid local allocation 
Rewrite the minimum bound comparison to avoid a local allocation. This costs
a bit of code size, but saves RAM. This is in preparation for moving the
bulk of the function to the bignum_core module where allocation is not
permitted.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-01 23:06:43 +01:00
Gilles Peskine 6f949ea67b New constant-flow function mbedtls_mpi_core_uint_le_mpi 
Compare a single-limb MPI with a multi-limb MPI. This is rather ad hoc, but
will be useful for mbedtls_mpi_core_random.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-12-01 23:06:43 +01:00
Jerry Yu cc4e007ff6 Add max_early_data_size to mbedtls_ssl_config 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-12-01 23:11:48 +08:00
Tom Cosgrove 62b20488f1 Implement mbedtls_mpi_mod_sub() 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-12-01 14:27:37 +00:00
Valerio Setti 0944329036 tls: pake: add check for empty passwords in mbedtls_ssl_set_hs_ecjpake_password() 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-12-01 15:06:09 +01:00
Paul Elliott 266f79c136
Merge pull request #6426 from aditya-deshpande-arm/driver-wrapper-key-agreement 
Add driver dispatch layer for raw key agreement, along with test call for transparent drivers.
 2022-12-01 11:40:52 +00:00
Dave Rodgman 2dae4b3ef6 Support armcc builtin byteswap routine 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-30 15:18:39 +00:00
Dave Rodgman 2d0f27d0fc Make use of optimised bswap from ARIA 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-30 12:16:21 +00:00
Ronald Cron 7df787c019
Merge pull request #6538 from yuhaoth/pr/tls13-add-early-data-transform-computation 2022-11-30 09:56:00 +01:00
Gilles Peskine edaa17b350
Merge pull request #6547 from yanesca/extract_mod_exp_from_prototype 
Bignum: Extract mod exp from prototype
 2022-11-29 21:40:07 +01:00
Aditya Deshpande b6bc7524f9 Minor formatting fixes to address code review comments 
Signed-off-by: Aditya Deshpande <aditya.deshpande@arm.com>
 2022-11-29 16:53:29 +00:00
Manuel Pégourié-Gonnard 0b9b560770
Merge pull request #6601 from valeriosetti/issue6502 
Avoid assumptions about implementation in EC J-PAKE tests
 2022-11-29 11:21:23 +01:00
Manuel Pégourié-Gonnard f9720cfa78
Merge pull request #6670 from gilles-peskine-arm/pkcs7-use-after-free-20221127 
PKCS7: Fix some memory management errors
 2022-11-29 11:17:27 +01:00
Manuel Pégourié-Gonnard ffc330fafa
Merge pull request #6264 from hannestschofenig/rfc9146_2 
CID update to RFC 9146
 2022-11-29 09:25:14 +01:00
Jerry Yu aec08b3f42 fix various format issues 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-29 15:19:27 +08:00
Janos Follath 97915c8685
Merge pull request #6619 from minosgalanakis/bignum/add_high_lv_IO_methods 
Bignum: Adding High level I/O methods
 2022-11-28 17:27:48 +00:00
Valerio Setti a9a97dca63 psa_pake: add support for opaque password 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-28 18:26:16 +01:00
Dave Rodgman 6d23ff60dd Make use of optimised bswap from bignum 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-28 15:41:13 +00:00
Dave Rodgman f7f1f748e3 Support built-in byteswap routines from clang, gcc, MSVC 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-28 15:41:13 +00:00
Dave Rodgman a5110b0d79 Make use of efficient unaligned access functions 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-28 15:41:13 +00:00
Dave Rodgman 6298b24127 Add byteswap routines 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-28 15:41:13 +00:00
Dave Rodgman e5c42594e5 Add byte order detection macro 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-28 15:41:13 +00:00
Dave Rodgman a360e1987a Add efficent unaligned get/put functions 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-28 15:41:04 +00:00
Dave Rodgman d98ac8b75e Merge remote-tracking branch 'dave/fast_xor' into fast_unaligned 2022-11-28 15:06:25 +00:00
Janos Follath 1f8afa22a4 Bignum Mod: improve documentation and style 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-28 14:58:08 +00:00
Aditya Deshpande 1ac41dec09 Add test function for opaque driver (simply returns PSA_ERROR_NOT_SUPPORTED), and address other review comments. 
Signed-off-by: Aditya Deshpande <aditya.deshpande@arm.com>
 2022-11-28 14:46:30 +00:00
Janos Follath 84bee4c492 mbedtls_mpi_mod_write: improve readability 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-28 10:27:14 +00:00
Jerry Yu 3d78e08ac0 erase early secrets and transcripts 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-28 17:34:06 +08:00
Jerry Yu a5db6c0ce3 fix coding style issues. 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-28 17:34:06 +08:00
Jerry Yu e31688b7fa fix comments issue 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-28 17:34:06 +08:00
Jerry Yu a8771839e8 Refactor make_traffic_keys 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-28 17:34:06 +08:00
Jerry Yu 3ce61ffca6 fix comments and function name issues 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-28 17:34:06 +08:00
Jerry Yu b094e124f2 fix various issues 
- Alignments
- comment words in doxygen paragraph

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-28 17:34:06 +08:00
Jerry Yu 91b560f38d Add compute early transform 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-28 17:34:06 +08:00
Jerry Yu 3d9b590f02 guards transform_earlydata 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-28 17:34:06 +08:00
Jerry Yu 84a6edac10 change signature of get_cipher_key_info 
- it is a static function. The name is not follow nameing ruler
- move the position.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-28 17:34:06 +08:00
Gilles Peskine 4f01121f6e Fix memory leak on error in pkcs7_get_signers_info_set 
mbedtls_x509_name allocates memory, which must be freed if there is a
subsequent error.

Credit to OSS-Fuzz (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53811).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-27 22:02:10 +01:00
Gilles Peskine e7f8c616d0 Fix dangling freed pointer in pkcs7_free_signer_info 
This may have been a use-after-free, but I haven't worked out whether it was
a problem or not. Even if it turns out to have been ok, keeping invalid
pointers around is fragile.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-27 21:55:29 +01:00
Gilles Peskine 47a732635b Simplify control flow in PKCS7 functions 
Remove useless goto in several functions.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-27 21:55:29 +01:00
Gilles Peskine 290f01b3f5 Fix dangling freed pointer on error in pkcs7_get_signers_info_set 
This fixes a use-after-free in PKCS#7 parsing when the signer data is
malformed.

Credit to OSS-Fuzz (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53798).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-27 21:55:29 +01:00
Janos Follath 6eb92c0410 Bignum Mod: improve documentation and style 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-26 17:34:37 +00:00
Janos Follath 8dfc8c41b7 mbedtls_mpi_mod_write: prevent data corruption 
The function wasn't converting back data to internal representation when
writing it out.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-26 15:39:02 +00:00
Janos Follath d7bb35257b mbedtls_mpi_mod_read/write: restrict pre-conditions 
Require equality for the number of limbs in the modulus and the residue.
This makes these functions consistent with residue_setup().

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-26 14:59:27 +00:00
Janos Follath 75b9f0fd2e mbedtls_mpi_mod_read/write: remove redundant checks 
The function isn't documented as accepting null pointer, and there's no
reason why it should be. Just let it dereference the pointer.

The null/zero checks are only marginally useful: they validate that m
and r are properly populated objects, not freshly initialized ones. For
that, it's enough to check that the pointers aren't null or that the
sizes aren't zero, we don't need to check both.

Also, use separate if statements for unrelated checks.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-26 14:28:50 +00:00
Gilles Peskine 89e31adbee Move mps modules to the correct library 
This is a private interface only, so it's an ABI change but not an API change.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-26 14:18:45 +01:00
Gilles Peskine 898db6b8e5 Move ssl_debug_helpers_generated to the correct library 
This is a private interface only, so it's an ABI change but not an API change.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-26 14:15:32 +01:00
Janos Follath ee530cc644 Bignum Mod: improve documentation 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-25 17:55:00 +00:00
Janos Follath fc6fbb4e96 Bignum Mod: improve documentation 
Signed-off-by: Janos Follath <janos.follath@arm.com>

Co-authored-by: Tom Cosgrove <tom.cosgrove@arm.com>
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-25 17:55:00 +00:00
Janos Follath 41427dee80 Bignum Mod: improve documentation 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-25 17:55:00 +00:00
Janos Follath 91295d2b8f Bignum Mod: remove endianness from modulus 
The external representation before included more than just endianness
(like reading in Mongtomery curve scalars or converting hashes to
numbers in a standard compliant way).

These are higher level concepts and are out of scope for Bignum and for
the modulus structure.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-25 17:55:00 +00:00
Janos Follath 3e3fc91c33 Bignum Mod: pass endianness as a parameter 
The external representation before included more than just endianness
(like reading in Mongtomery curve scalars or converting hashes to
numbers in a standard compliant way).

These are higher level concepts and are out of scope for Bignum and for
the modulus structure.

Passing endianness as a parameter is a step towards removing it from the
modulus structure.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-25 17:55:00 +00:00
Janos Follath d3eed33709 Bignum Mod Raw: pass endianness as a parameter 
The external representation before included more than just endianness
(like reading in Mongtomery curve scalars or converting hashes to
numbers in a standard compliant way).

These are higher level concepts and are out of scope for Bignum and for
the modulus structure.

Passing endianness as a parameter is a step towards removing it from the
modulus structure.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-25 17:55:00 +00:00
Janos Follath 50cd4b842b Bignum Mod: Restrict residue setup 
In theory we could allow residues to have more allocated limbs than the
modulus, but we might or might not need it in the end.

Go for the simpler option for now and we can extend it later if we
really need it.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-25 17:55:00 +00:00
Janos Follath b62bad442e Bidnum Mod: fix check in setup 
We want to make sure that the value has at least as many limbs allocated
as the modulus as we need this to be able to do any operations in
constant time.

An invariant of the API is that the residue values are canonical, make
sure that the residue is compared to the entire modulus.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-25 17:55:00 +00:00
Minos Galanakis 8b375451c5 bignum_mod: Refactored mbedtls_mpi_mod_read/write() 
This patch adjusts the I/O methods and the tests.
Documentation has also been updated to be more clear.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-11-25 17:55:00 +00:00
Minos Galanakis aed832ac16 bignum_mod: Adjusted input checking for mbedtls_mpi_mod_residue_setup() 
This patch adjusts the logic of the size checking of the method,
and refactors the tests. Documentation has also been updated.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-11-25 17:55:00 +00:00
Minos Galanakis a17ad48e2d bignum_mod: Fixed an issue with input checking in mpi_mod_residue_setup 
This patch is inverting the input type checking logic in the method,
in order to ensure that residue < modulus.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-11-25 17:55:00 +00:00
Minos Galanakis 81f4b11010 bignum_mod: Added mbedtls_mpi_mod_read/write() IO functions 
This patch adds input and ouput fucntions in the `bignum_mod` layer.
The data will be automatically converted between Cannonical and
Montgomery representation if required.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-11-25 17:55:00 +00:00
Janos Follath 590ae5363d
Merge pull request #6656 from tom-cosgrove-arm/bignum_pr_6225-updated 
Bignum: add mod_raw_add
 2022-11-25 17:53:31 +00:00
Dave Rodgman a616afeae4 Remove redundant inline workarounds 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-25 17:11:45 +00:00
Dave Rodgman 5a1d00f03d Merge remote-tracking branch 'origin/development' into fast_xor 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-25 17:10:25 +00:00
Dave Rodgman bf9b23abf8
Merge pull request #6648 from gilles-peskine-arm/psa-ecb-null-0 
Fix NULL+0 undefined behavior in PSA crypto ECB
 2022-11-25 17:07:46 +00:00
Bence Szépkúti 6e85673e8d
Merge pull request #3431 from naynajain/development-pkcs7 
PKCS7 Parser - RFC 2315
 2022-11-25 15:55:46 +01:00
Janos Follath 505a228b7b
Merge pull request #6606 from gabor-mezei-arm/6222_bignum_low_level_subtraction 
Bignum: Add low level subtraction
 2022-11-25 13:27:23 +00:00
Gilles Peskine 7d23778178 Explain why p + n isn't good enough 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-25 13:34:59 +01:00
Gilles Peskine 5a34b36bbd Remove more now-redundant definitions of inline 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-25 13:26:44 +01:00
Dave Rodgman f1419dbbe8
Merge pull request #6381 from tom-cosgrove-arm/pr2164 
mbedtls: fix possible false success in mbedtls_cipher_check_tag()
 2022-11-25 10:55:10 +00:00
Manuel Pégourié-Gonnard 61336848a9 Fix bug when legacy CID is enabled but not used 
When legacy CID is enabled at compile time, but not used at runtime, we
would incorrectly skip the sequence number at the beginning of the AAD.

There was already two "else" branches for writing the sequence number
but none of them was taken in that particular case.

Simplify the structure of the code: with TLS 1.2 (we're already in that
branch), we always write the sequence number, unless we're using
standard CID.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-11-25 11:48:17 +01:00
Dave Rodgman 8f6583d836 Fix for MSVC unsupported #inline keyword 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-25 09:16:41 +00:00
Bence Szépkúti ae79fb2c2e Merge branch 'development' into pr3431 2022-11-25 03:12:43 +01:00
Dave Rodgman b8c4a0d940 Minor formatting tweaks 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 21:18:55 +00:00
Dave Rodgman 7a910a8be0 Minor formatting tweaks 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 21:17:40 +00:00
Dave Rodgman 875d2383d0 Improve documentation 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 20:43:15 +00:00
Dave Rodgman aaf69fd682 Fix missing newline 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 20:40:28 +00:00
Dave Rodgman c58858865b Fix off-by-one error 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 20:35:04 +00:00
Dave Rodgman 66433444fc Fix static inline linker issues 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 20:07:39 +00:00
Dave Rodgman 4b910c1ed1 Fix whitespace 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 19:44:52 +00:00
Dave Rodgman 069e7f462a Correct mixed up comments 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 19:37:26 +00:00
Dave Rodgman 96d61d14d8 Use memcpy for unaligned accesses 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 19:33:22 +00:00
Dave Rodgman fbc23225d6 Tidy up alignment-related code into separate header 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 18:07:37 +00:00
Tom Cosgrove abddad4af8 Add note about aliasing of operands for mbedtls_mpi_mod_raw_add() 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-11-24 16:22:43 +00:00
Werner Lewis e4c0a6c3ba Change cast to correct type 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-11-24 16:18:06 +00:00
Werner Lewis 1a277d9ad6 Replace comparison with XOR 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-11-24 16:18:06 +00:00
Werner Lewis d391b8ce61 Change types and move const before type 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-11-24 16:18:06 +00:00
Werner Lewis 9fa91ebcb9 Use modulus structure in mbedtls_mpi_mod_raw_add 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-11-24 16:18:06 +00:00
Werner Lewis 0eea827cbd Rename MPI_CORE(add_mod) to mbedtls_mpi_mod_raw_add 
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
 2022-11-24 16:18:06 +00:00
Hanno Becker a45b6fee91 Extract MPI_CORE(add_mod) from the prototype 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-11-24 16:17:49 +00:00
Dave Rodgman 6921959b83 Remove unused variable 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-24 09:27:15 +00:00
Ronald Cron 4cf77e99ab
Merge pull request #6621 from ronald-cron-arm/tls13-early-data-write 
TLS 1.3: Add definition of mbedtls_ssl_{write,read}_early_data
 2022-11-24 09:58:07 +01:00
Dave Rodgman 358c7d6eb0 Fix naming inconsistency 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-23 20:29:03 +00:00
Dave Rodgman dd3103e9e7 Tidy up UNALIGNED_UINT32_T macro 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-23 19:42:13 +00:00
Dave Rodgman e7cd137606 Define UNALIGNED_UINT32_PTR for unaligned access 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-23 19:14:26 +00:00
Dave Rodgman a6778013b4 Tidy up UBSan detection 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-23 17:17:30 +00:00
Dave Rodgman 468df317bf Fix MSVC support for inline keyword 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-23 16:56:35 +00:00
Dave Rodgman 1bab27f983 Prevent unaligned access under ASan builds 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-23 16:51:59 +00:00
Dave Rodgman 3c8eb7e990 Provide external definition of mbedtls_xor 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-23 14:50:03 +00:00
Dave Rodgman 63d114305f Whitespace cleanup 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-23 14:03:30 +00:00
Dave Rodgman f9a1c37bc8 Whitespace cleanup 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-23 14:02:00 +00:00
Gabor Mezei 02d2313829
Fix documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-11-23 14:44:14 +01:00
Gabor Mezei 3411e949cd
Cas variable to proper type 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-11-23 14:44:13 +01:00
Gabor Mezei 4c7cf7d742
Add low level subtraction with modulus 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-11-23 14:44:07 +01:00
Janos Follath 531a871b88
Merge pull request #6235 from tom-cosgrove-arm/issue-6231-core-sub-int 
Bignum: extract core_sub_int from the prototype
 2022-11-23 13:32:02 +00:00
Ronald Cron 4a8c9e2cff tls13: Add definition of mbedtls_ssl_{write,read}_early_data 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-11-23 14:29:37 +01:00
Gilles Peskine 42649d9270 Fix NULL+0 undefined behavior in ECB encryption and decryption 
psa_cipher_encrypt() and psa_cipher_decrypt() sometimes add a zero offset to
a null pointer when the cipher does not use an IV. This is undefined
behavior, although it works as naively expected on most platforms. This
can cause a crash with modern Clang+ASan (depending on compiler optimizations).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-23 14:16:52 +01:00
Manuel Pégourié-Gonnard ef25a99f20
Merge pull request #6533 from valeriosetti/issue5847 
Use PSA EC-JPAKE in TLS (1.2) - Part 2
 2022-11-23 13:27:30 +01:00
Ronald Cron 1d1d53622f
Merge pull request #6490 from xkqian/tls13_parse_early_data_indication_ee 
The internal CI merge job ran successfully.
 2022-11-23 12:31:25 +01:00
Ronald Cron cb0e680779
Merge pull request #6476 from yuhaoth/pr/fix-tls13-mbedtls_ssl_is_handshake_over 
TLS 1.3: Fix tls13 mbedtls ssl is handshake over
 2022-11-23 12:12:02 +01:00
Manuel Pégourié-Gonnard 660b396e41
Merge pull request #975 from yanesca/issue-946 
Fix RSA side channel
 2022-11-23 10:30:35 +01:00
Xiaokang Qian b157e915ad Move the early data status set afeter all of the extensions parse 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-23 08:12:26 +00:00
Xiaokang Qian e861ba01d4 Remove the duplicate early_data_status check 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-23 03:21:02 +00:00
Xiaokang Qian ca09afc60a Remove useless function and parse early data in ee 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-23 02:16:49 +00:00
Moritz Fischer a6a94ad599 lms: Move merkle tree generation to heap allocation 
Larger height (e.g. H=20) trees cannot be put on the stack.
Allocate memory for them based on need using mbedtls_calloc().

Signed-off-by: Moritz Fischer <moritzf@google.com>
 2022-11-22 15:49:56 -08:00
Janos Follath 3321b5842c mpi_exp_mod: improve documentation 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine 7d89d351e6 Zeroize sensitive data 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine 0b270a5603 Explain a little more 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine 4380d7b7f3 Simplify cleanup logic 
Take advantage of the fact that there's a single point of failure.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine 3b63d09fea Make the main loop's logic clearer 
The loop ends when there are no more bits to process, with one twist: when
that happens, we need to clear the window one last time. Since the window
does not start empty (E_limbs==0 is not supported), the loop always starts
with a non-empty window and some bits to process. So it's correct to move
the window clearing logic to the end of the loop. This lets us exit the loop
when the end of the exponent is reached.

It would be clearer not to do the final window clearing inside the loop, so
we wouldn't need to repeat the loop termination condition (end of exponent
reached) inside the loop. However, this requires duplicating the code to
clear the window. Empirically, this causes a significant code size increase,
even if the window clearing code is placed into a function.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine c718a3ce94 Simplify exponent bit selection 
Use indices instead of mutating data to extract the bits of the exponent.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine d83b5cb504 Local readability improvements 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine 0de0a049f1 Move window precomputation into an auxiliary function 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine cf979b0fc1 Define variables closer to their use 
Make variables const where possible.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine 7af166b827 Change E closer to where it's used 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:54 +00:00
Gilles Peskine 07f2c69511 More consistent variable names 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-22 21:22:53 +00:00
Janos Follath 0ec6e3f394 mpi_core_mod_exp: improve style and documentation 
No intended change in behaviour.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 21:22:53 +00:00
Janos Follath a77911e5c1 core_exp_mod: improve window selection 
We are looking at the exponent at limb granularity and therefore
exponent bits can't go below 32.

The `mpi_` prefix is also removed as it is better not to have prefix at
all than to have just a partial. (Full prefix would be overly long and
would hurt readability.)

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 21:22:53 +00:00
Janos Follath 59cbd1be27 Make mbedtls_mpi_core_ct_uint_table_lookup static 
Now that we have a function that calls
mbedtls_mpi_core_ct_uint_table_lookup(), the compiler won't complain if
we make it static.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 21:22:53 +00:00
Janos Follath bad42c4d0d mpi_core_exp_mod: fix local variable type 
On platforms with size_t different from int, mismatch between size_t and
mpi_uint can cause incorrect results or complaints from the compiler.

Signed-off-by: Janos Follath <janos.follath@arm.com>

mpi_core_exp_mod: Cast local variable explicitly

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 21:22:53 +00:00
Janos Follath b6673f0f19 Add modular exponentiation to bignum core 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 21:22:53 +00:00
Dave Rodgman fdd967ebdc Detect support for unaligned memory access 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 18:55:17 +00:00
Aditya Deshpande 5e3c70e3be Merge branch 'development' into driver-wrapper-key-agreement 2022-11-22 17:58:52 +00:00
Aditya Deshpande 8cc1470c18 Merge branch 'development' into driver-wrapper-key-agreement 2022-11-22 17:55:53 +00:00
Valerio Setti 6d4e75f0c6 psa_crypto_pake: initialize psa_status_t stack variables 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-22 18:52:17 +01:00
Valerio Setti fdb77cdae3 psa_crypto_pake: internally call to psa_pake_abort() in case of errors 
In this way, in case of error, it is not possible to continue using
the same psa_pake_operation_t without reinitializing it.
This should make the PSA pake's behavior closer to what expected by
the specification

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-22 18:41:01 +01:00
Dave Rodgman c36a56e890 Use mbedtls_xor in TLS messaging layer 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:44 +00:00
Dave Rodgman 74b345f282 Use mbedtls_xor in PKCS #5 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:44 +00:00
Dave Rodgman 99a507ee55 Use mbedtls_xor in md 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:44 +00:00
Dave Rodgman d22fb73e3e Use mbedtls_xor in GCM 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:44 +00:00
Dave Rodgman 2e9db8e9bf Use mbedtls_xor in DES 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:44 +00:00
Dave Rodgman ffb5499988 Use mbedtls_xor in CTR_DRBG 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:44 +00:00
Dave Rodgman 8c0ff81ce7 Use mbedtls_xor in CMAC 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:44 +00:00
Dave Rodgman c1d9022bab Use mbedtls_xor in ChaCha20 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:43 +00:00
Dave Rodgman 0d3b55bca8 Use mbedtls_xor in ccm 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:43 +00:00
Dave Rodgman d23399eb69 Use mbedtls_xor in Camellia 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:43 +00:00
Dave Rodgman 7bb6b84b29 Use mbedtls_xor in ARIA 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:43 +00:00
Dave Rodgman a8cf607458 Use mbedtls_xor in AES 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 17:32:43 +00:00
Janos Follath 3165f063b5 mpi_exp_mod: use x_index consistently 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:11 +00:00
Janos Follath c8d66d50d0 mpi_exp_mod: reduce the table size by one 
The first half of the table is not used, let's reuse index 0 for the
result instead of appending it in the end.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:11 +00:00
Janos Follath 060009518b mpi_exp_mod: fix out of bounds access 
The table size was set before the configured window size bound was
applied which lead to out of bounds access when the configured window
size bound is less.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:11 +00:00
Janos Follath 9c09326572 mpi_mod_exp: be pedantic about right shift 
The window size starts giving diminishing returns around 6 on most
platforms and highly unlikely to be more than 31 in practical use cases.
Still, compilers and static analysers might complain about this and
better to be pedantic.

Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:11 +00:00
Janos Follath be54ca77e2 mpi_exp_mod: improve documentation 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:10 +00:00
Janos Follath 74601209fa mpi_exp_mod: remove the 'one' variable 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:10 +00:00
Janos Follath b2c2fca974 mpi_exp_mod: simplify freeing loop 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:10 +00:00
Janos Follath 3646ff02ad mpi_exp_mod: move X next to the precomputed values 
With small exponents (for example, when doing RSA-1024 with CRT, each
prime is 512 bits and we'll use wsize = 5 which may be smaller that the
maximum - or even worse when doing public RSA operations which typically
have a 16-bit exponent so we'll use wsize = 1) the usage of W will have
pre-computed values, then empty space, then the accumulator at the very
end.

Move X next to the precomputed values to make accesses more efficient
and intuitive.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:10 +00:00
Janos Follath 7fa11b88f3 mpi_exp_mod: rename local variables 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:10 +00:00
Janos Follath 844614814e mpi_exp_mod: remove memory ownership confusion 
Elements of W didn't all have the same owner: all were owned by this
function, except W[x_index]. It is more robust if we make a proper copy
of X.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:10 +00:00
Janos Follath f08b40eaab mpi_exp_mod: improve documentation 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:10 +00:00
Janos Follath b764ee1603 mpi_exp_mod: protect out of window zeroes 
Out of window zeroes were doing squaring on the output variable
directly. This leaks the position of windows and the out of window
zeroes.

Loading the output variable from the table in constant time removes this
leakage.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:10 +00:00
Janos Follath 8e7d6a0386 mpi_exp_mod: load the output variable to the table 
This is done in preparation for constant time loading that will be added
in a later commit.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-22 15:04:10 +00:00
Valerio Setti 99d88c1ab4 tls: psa_pake: fix missing casting in mbedtls_psa_ecjpake_write_round 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-22 16:03:43 +01:00
Dave Rodgman c3d8041fe7 Introduce mbedtls_xor 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-22 15:01:39 +00:00
Tom Cosgrove 452c99c173 Use mbedtls_mpi_core_sub_int() in mbedtls_mpi_sub_abs() 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-11-22 14:58:15 +00:00
Tom Cosgrove f7ff4c9a11 Tidy up, remove MPI_CORE(), and apply the naming convention 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-11-22 14:58:15 +00:00
Hanno Becker d9b2348d8f Extract MPI_CORE(sub_int) from the prototype 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-11-22 14:58:15 +00:00
Bence Szépkúti a17d038ee1 Merge branch 'development' into pr3431 2022-11-22 15:54:52 +01:00
Gilles Peskine 4f19d86e3f
Merge pull request #6608 from mprse/ecjpake_password_fix 
Make a copy of the password key in operation object while setting j-pake password
 2022-11-22 14:52:12 +01:00
Aditya Deshpande 2f7fd76d91 Replace PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE with PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE in psa_key_agreement_internal(). 
Signed-off-by: Aditya Deshpande <aditya.deshpande@arm.com>
 2022-11-22 11:10:34 +00:00
Valerio Setti d4a9b1ab8d tls: psa_pake: remove useless defines and fix a comment 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-22 11:11:10 +01:00
Xiaokang Qian 8bee89994d Add parse function for early data in encrypted extentions 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-22 09:40:07 +00:00
Przemek Stekiel 0bdec19c93 Further optimizations of pake set_password implementation 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-11-22 09:10:35 +01:00
Jerry Yu fdd24b8c49 Revert change in flight transmit 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-22 14:08:03 +08:00
Gilles Peskine 339406daf9
Merge pull request #6609 from gilles-peskine-arm/mpi_sint-min-ub 
Fix undefined behavior in bignum: NULL+0 and -most-negative-sint
 2022-11-21 19:51:58 +01:00
Przemek Stekiel ad0f357178 Optimize pake code that sets/use password key 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-11-21 15:04:37 +01:00
Przemek Stekiel e2d6b5f45b psa_key_slot_get_slot_number: Move documentation to header file 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-11-21 15:03:52 +01:00
Valerio Setti 5151bdf46e tls: psa_pake: add missing braces 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-21 14:30:02 +01:00
Valerio Setti 79f6b6bb1b tls: psa_pake: fixing mbedtls_psa_ecjpake_write_round() 
It might happen that the psa_pake_output() function returns
elements which are not exactly 32 or 65 bytes as expected, but
1 bytes less.
As a consequence, insted of hardcoding the expected value for
the length in the output buffer, we write the correct one as
obtained from psa_pake_output()

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-21 14:17:03 +01:00
Dave Rodgman 9e1836cc16
Merge pull request #6593 from Mbed-TLS/fix_tls12_sent_sigalgs 
Fix TLS1.2 signature algorithms list entry getting overwritten by length.
 2022-11-21 10:09:57 +00:00
Jerry Yu 9b421456b0 Revert change in dtls1.2 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-19 20:12:35 +08:00
Jerry Yu 668070d5f4 Remove unnecessary replace 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-19 20:12:35 +08:00
Jerry Yu a8d3c5048f Rename new session ticket name for TLS 1.3 
NewSessionTicket is different with TLS 1.2.
It should not share same state.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-19 20:12:35 +08:00
Jerry Yu cfda4bbeac Replace handshake over in flight transmit 
Fix deadloop in DTLS resumption test.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-19 20:12:35 +08:00
Jerry Yu 1fb3299ad7 Replace internal usage of is_handshake_over. 
NEW_SESSION_TICKETS* are processed in handshake_step.
Change the stop condition from `mbedtls_ssl_is_handshake_over`
to directly check.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-19 20:12:34 +08:00
Jerry Yu 5ed73ff6de Add NEW_SESSION_TICKET* into handshake over states 
All state list after HANDSHAKE_OVER as is_handshakeover

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-19 20:12:34 +08:00
Jerry Yu 6848a61922 Revert "Replace internal usage of mbedtls_ssl_is_handshake_over" 
This reverts commit 1d3ed2975e7ef0d84050a3aece02eec1f890dec3.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-19 20:12:34 +08:00
Jerry Yu e219c11b4e Replace internal usage of mbedtls_ssl_is_handshake_over 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-19 20:12:34 +08:00
Valerio Setti 61ea17d30a tls: psa_pake: fix return values in parse functions 
Ensure they all belong to the MBEDTLS_ERR_SSL_* group

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-18 12:11:00 +01:00
Valerio Setti aca21b717c tls: psa_pake: enforce not empty passwords 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-17 18:20:50 +01:00
Valerio Setti 819de86895 tls: removed extra white spaces and other minor fix 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-17 18:05:19 +01:00
Valerio Setti 6b3dab03b5 tls: psa_pake: use a single function for round one and two in key exchange read/write 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-17 17:14:54 +01:00
Valerio Setti 9bed8ec5d8 tls: psa_pake: make round two reading function symmatric to the writing one 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-17 16:36:19 +01:00
Valerio Setti 30ebe11f86 tls: psa_pake: add a check on read size on both rounds 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-17 16:35:02 +01:00
Valerio Setti a988364767 tls: psa_pake: fix missing new round one parsing function on tls12 server 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-17 16:35:02 +01:00
Valerio Setti a08b1a40a0 tls: psa_pake: move move key exchange read/write functions to ssl_tls.c 
Inlined functions might cause the compiled code to have different sizes
depending on the usage and this not acceptable in some cases.
Therefore read/write functions used in the initial key exchange are
moved to a standard C file.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-17 16:34:59 +01:00
Andrzej Kurek ec71b0937f Introduce a test for single signature algorithm correctness 
The value of the first sent signature algorithm is overwritten.
This test forces only a single algorithm to be sent and then
validates that the client received such algorithm.
04 03 is the expected value for SECP256R1_SHA256.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-11-17 14:58:14 +00:00
Paul Elliott 96a0fd951f Fix signature algorithms list entry getting overwritten by length. 
Fix bug whereby the supported signature algorithm list sent by the
server in the certificate request would not leave enough space for the
length to be written, and thus the first element would get overwritten,
leaving two random bytes in the last entry.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2022-11-17 14:58:14 +00:00
Przemek Stekiel 369ae0afc3 Zeroize pake password buffer before free 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-11-17 14:14:31 +01:00
Przemek Stekiel 152ae07682 Change password ec j-pake operation fields to more suitable 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-11-17 13:24:36 +01:00
Ronald Cron d12922a69a
Merge pull request #6486 from xkqian/tls13_add_early_data_indication 
The merge job of the internal CI ran successfully. This is good to go.
 2022-11-17 12:48:50 +01:00
Przemyslaw Stekiel 1def5becc2 Add psa_get_and_lock_key_slot_with_policy to header file 
Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
 2022-11-16 16:28:04 +01:00
Valerio Setti 6f1b5741ae tls12: psa_pake: simplify EC info parsing in server's 2nd round 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-16 14:50:13 +01:00
Valerio Setti 4a9caaa0c9 tls12: psa_pake: check elliptic curve's TLS ID on handshake 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-16 14:50:10 +01:00
Valerio Setti fbbc1f3812 tls12: psa_pake: use proper defines for the output size of each step in ECJPAKE 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-16 14:49:52 +01:00
Valerio Setti 02c25b5f83 tls12: psa_pake: use common code for parsing/writing round one and round two data 
Share a common parsing code for both server and client for parsing
round one and two.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-16 13:56:12 +01:00
Ronald Cron e9f92c4fbc tls: Fix in_cid buffer size in transform structure 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-11-16 10:23:05 +01:00
Xiaokang Qian 0cc4320e16 Add EARLY_DATA guard to the early data extension in session ticket 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-16 08:43:50 +00:00
Gilles Peskine ef7f4e47b1 Express abs(z) in a way that satisfies GCC and MSVC 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-15 23:25:27 +01:00
Gilles Peskine af601f9751 Fix undefined behavior with the most negative mbedtls_mpi_sint 
When x is the most negative value of a two's complement type,
`(unsigned_type)(-x)` has undefined behavior, whereas `-(unsigned_type)x`
has well-defined behavior and does what was intended.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-15 23:02:14 +01:00
Gilles Peskine db14a9d180 Fix NULL+0 in addition 0 + 0 
Fix undefined behavior (typically harmless in practice) of
mbedtls_mpi_add_mpi(), mbedtls_mpi_add_abs() and mbedtls_mpi_add_int() when
both operands are 0 and the left operand is represented with 0 limbs.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-15 23:00:21 +01:00
Przemek Stekiel 348410f709 Make a copy of the key in operation while setting pake password 
Additionally use psa_get_and_lock_key_slot_with_policy() to obtain key.
This requires making this function public. This will have to be solved while adding driver dipatch for EC-JPAKE.

Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-11-15 22:22:07 +01:00
Gilles Peskine 4a768dd17d Fix negative zero created by (-A) + (+A) or (-A) - (-A) 
In mbedtls_mpi_add_mpi() and mbedtls_mpi_sub_mpi(), and by extention
mbedtls_mpi_add_int() and mbedtls_mpi_sub_int(), when the resulting value
was zero, the sign bit of the result was incorrectly set to -1 when the
left-hand operand was negative. This is not a valid mbedtls_mpi
representation. Fix this: always set the sign to +1 when the result is 0.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-15 20:36:18 +01:00
Gilles Peskine 72ee1e3f3c Unify mbedtls_mpi_add_mpi and mbedtls_mpi_sub_mpi 
mbedtls_mpi_add_mpi() and mbedtls_mpi_sub_mpi() have the same logic, just
with one bit to flip in the sign calculation. Move the shared logic to a new
auxiliary function. This slightly reduces the code size (if the compiler
doesn't inline) and reduces the maintenance burden.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-15 20:30:09 +01:00
Xiaokang Qian 2cd5ce0c6b Fix various issues cause rebase to latest code 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-15 10:33:53 +00:00
Dave Rodgman d384b64dd2
Merge branch 'development' into rfc9146_2 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-14 17:43:15 +00:00
Janos Follath 4d0ea7f4cc
Merge pull request #6550 from minosgalanakis/minos/6017_add_montgomery_conversion 
Bignum: Add Montgomery conversion from/to cannonical form
 2022-11-14 11:12:13 +00:00
Xiaokang Qian fe3483f9a1 Update early data doument and config dependencies 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:16:22 +00:00
Xiaokang Qian ae07cd995a Change ticket_flag base on review 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:16:22 +00:00
Xiaokang Qian 2d87a9eeb5 Pend one alert in case wrong EXT_EARLY_DATA length 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:16:22 +00:00
Xiaokang Qian a042b8406d Address some format issues 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:16:19 +00:00
Xiaokang Qian f447e8a8d3 Address comments base on reviews 
Improve early data indication check
Update test case to gnutls server

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:15:36 +00:00
Xiaokang Qian a341225fd0 Change function name ssl_tls13_early_data_has_valid_ticket 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:15:05 +00:00
Xiaokang Qian 01323a46c6 Add session ticket related check when send early data 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:15:05 +00:00
Xiaokang Qian ecc2948f21 Fix format issues 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:15:05 +00:00
Xiaokang Qian 76332816c7 Define the EARLY_DATA_STATUS 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:15:05 +00:00
Xiaokang Qian 338f727683 Move EARLY_DATA_OFF/ON guard to ssl_misc.h 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:15:03 +00:00
Xiaokang Qian b781a2323c Move ssl_tls13_has_configured_ticket() back to tls13 client 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:13:51 +00:00
Xiaokang Qian 893ad81966 Remove useless early_secrets field 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:13:51 +00:00
Xiaokang Qian 911c0cc4f0 Fix format issues in comments 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:13:50 +00:00
Xiaokang Qian 0e97d4d16d Add early data indication to client side 
Add fields to mbedtls_ssl_context
Add write early data indication function
Add check whether write early data indication
Add early data option to ssl_client2
Add test cases for early data

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-11-14 03:13:50 +00:00
Paul Elliott aeb8bf2ab0
Merge pull request #6170 from yuhaoth/pr/tls13-cleanup-extensions-parser 
TLS 1.3: Add extension check for message parsers
 2022-11-11 19:00:46 +00:00
Minos Galanakis d9299c388e bignum_mod_raw: Refactored Montgomery conversion functions 
This patch updates the `mbedtls_mpi_mod_raw_conv_xx()` methods
as follows:

* Renamed for simplicity: conv_fwd -> from_mont_rep, conv_inv -> to_mont_rep.
* Uncoupled the dependency on the legaly bignum interface.
* `mbedtls_mpi` is no longer used for temporary buffer allocation.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-11-11 10:54:58 +00:00
Hanno Becker 5ad4a93596 bignum_mod_raw: Added conversion methods for internal/public data representation 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-11-11 10:54:58 +00:00
Dave Rodgman f58172fe43 Merge remote-tracking branch 'origin/development' into pr3431 2022-11-10 09:54:49 +00:00
Gilles Peskine ed4b34aa7c
Merge pull request #6570 from gilles-peskine-arm/bignum-mbedtls_test_read_mpi_core-nonempty 
Forbid empty mpi_core in test data
 2022-11-09 19:02:24 +01:00
Jerry Yu 97be6a913e fix various issues 
- typo error
- replace `ssl->hanshake` with handshake

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-09 22:43:31 +08:00
Gilles Peskine 95b5addcd6 Don't test mbedtls_mpi_core_lt_ct with 0 limbs 
A core MPI must have at least 1 limb. We can no longer test with 0 limbs,
and we don't need to anyway, so don't try.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-09 11:18:38 +01:00
Gilles Peskine d4bd38ba5d
Merge pull request #6544 from KloolK/development 
Fix outdated reference in debug message
 2022-11-08 17:12:20 +01:00
Gilles Peskine 4a480ac5a1
Merge pull request #6265 from Kabbah/x509-info-hwmodulename-hex 
`x509_info_subject_alt_name`: Render HardwareModuleName as hex
 2022-11-08 17:11:07 +01:00
Jerry Yu 7de2ff0310 Refactor extension list print 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-08 23:51:39 +08:00
Jerry Yu 79aa721ade Rename ext print function and macro 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-08 23:51:39 +08:00
Jerry Yu b95dd3683b Add missing mask set and tls13 unrecognized extension 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-08 23:51:38 +08:00
Aditya Deshpande c4646c08cd Merge branch 'development' into driver-wrapper-key-agreement 2022-11-08 14:25:20 +00:00
Jerry Yu c437ee3bac fix wrong return value 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-08 21:04:15 +08:00
Jerry Yu ea52ed91cf fix typo and spell issues 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-08 21:01:17 +08:00
Gilles Peskine 42d75f2daf
Merge pull request #6013 from gstrauss/asn1-type-free 
Shared code to free x509 structs like mbedtls_x509_named_data
 2022-11-08 12:20:20 +01:00
Dave Rodgman ae2635df6f
Merge pull request #6306 from tom-cosgrove-arm/issue-6305-fix 
Return an error from mbedtls_ssl_handshake_step() if neither client nor server
 2022-11-08 10:54:17 +00:00
Pengyu Lv c1ecb25d8a fix PSA_XXX typos detected by check_names.py 
Fix the PSA_XXX typos detected by check_names.py.
PSA_WANT is actually not typo, but would cause a false negative
result. So PSA_WANT is reworded to PSA_WANT_xxx.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
 2022-11-08 18:22:53 +08:00
Neil Armstrong ca7d506556 Use PSA PAKE API when MBEDTLS_USE_PSA_CRYPTO is selected 
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2022-11-08 10:58:45 +01:00
Jerry Yu e5991328ff fix tls13 psk only test fail 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-08 16:16:29 +08:00
Glenn Strauss 82ba274c01 Deprecate mbedtls_asn1_free_named_data() 
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 2022-11-07 15:42:44 -05:00
Aditya Deshpande d1b72a7b83 Merge branch 'development' into driver-wrapper-key-agreement 2022-11-07 17:36:23 +00:00
Gilles Peskine faefe62013
Merge pull request #6390 from mpg/fix-ecjpake-psa-format 
Fix ecjpake PSA format
 2022-11-07 17:35:44 +01:00
Gilles Peskine bf249accc7
Merge pull request #6498 from yuhaoth/pr/fix-session-resumption-fail-when-hostname-is-not-localhost 
BUG: Fix session resumption fail when hostname is not localhost
 2022-11-07 17:33:38 +01:00
Jan Bruckner f869bfdfef Fix outdated reference in debug message 
Signed-off-by: Jan Bruckner <jan@janbruckner.de>
 2022-11-07 15:28:49 +01:00
Aditya Deshpande 5567c660cd Fix formatting and code comments 
Signed-off-by: Aditya Deshpande <aditya.deshpande@arm.com>
 2022-11-07 10:43:29 +00:00
Aditya Deshpande 3f1606a1f6 Refactor call hierarchy for ECDH so that it goes through the driver wrapper in a similar fashion to ECDSA. 
Add component_test_psa_config_accel_ecdh to all.sh to test key agreement driver wrapper with libtestdriver1.

Signed-off-by: Aditya Deshpande <aditya.deshpande@arm.com>
 2022-11-07 09:22:52 +00:00
Jerry Yu 50e00e3ac6 Refactor server hello 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-06 11:54:22 +08:00
Jerry Yu edab637b51 Refactor new session ticket 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-06 11:54:22 +08:00
Jerry Yu 0d5cfb7703 Refactor Certificate 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-06 11:54:22 +08:00
Jerry Yu 6d0e78ba22 Refactor certificate request 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-06 11:54:22 +08:00
Jerry Yu 9eba750916 Refactor encrypted extensions 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-06 11:54:22 +08:00
Jerry Yu 63a459cde5 Refactor client_hello parser and writer 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-06 11:54:21 +08:00
Jerry Yu 4b8f2f7266 Refactor sent extension message output 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-06 11:54:21 +08:00
Jerry Yu d25cab0327 Refactor debug helpers for exts and hs message 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-06 11:54:21 +08:00
Janos Follath 5933f691a2 Add merge slots to Bignum files 
Legacy Bignum is excluded as it doesn't get regular extensions like new
ones.

Each slot uses comments of their respective filetype. Since .data files
don't have a syntax for comments, dummy test cases are used. (These test
cases will never be executed and no noise will be added to tests.)

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-02 17:27:25 +00:00
Janos Follath 2a8bcf8c6f Add bignum merge scaffolding 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-11-02 17:25:48 +00:00
Gilles Peskine 22cdd0ccd3 Update some internal comments 
The refactoring of fill_random had left some obsolete bits in comments.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-02 16:00:01 +01:00
Gilles Peskine 009d195a56 Move mbedtls_mpi_core_fill_random to the proper .c file 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-02 16:00:01 +01:00
Gilles Peskine 5980f2bd36 Implement mbedtls_mpi_core_fill_random 
Turn mpi_fill_random_internal() into mbedtls_mpi_core_fill_random(). It
had basically the right code except for how X is passed to the function.

Write unit tests.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-02 15:59:36 +01:00
Gilles Peskine 909e03c52f Bignum core: fill_random: prototype 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-11-02 15:59:16 +01:00
Janos Follath f1ed5815ba
Merge pull request #6512 from yanesca/extract_uint_table_lookup_core 
Implement mbedtls_mpi_core_ct_uint_table_lookup()
 2022-11-02 13:58:19 +00:00
Jerry Yu df0ad658a3 tls13: Add allowed extesions constants. 
- And refactor check_received_extension

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-11-02 21:35:27 +08:00
Dave Rodgman 90c6836271
Merge pull request #6524 from daverodgman/fix-duplicate-header 
Remove duplicate function prototype
 2022-11-02 13:06:08 +00:00
Dave Rodgman 0877dc8f55 Improve documentation for psa_crypto_cipher.h 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-02 09:29:50 +00:00
Dave Rodgman 1630447eed Move declaration of mbedtls_cipher_info_from_psa into psa_crypto_cipher.h 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-02 09:25:38 +00:00
Dave Rodgman ba864848e7 Remove duplicate function prototype 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-01 16:41:09 +00:00
Dave Rodgman 29b9b2b699 Fix zeroization at NULL pointer 
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-11-01 16:08:14 +00:00
Janos Follath 8904a2db29 mpi_core_ct_uint_table_lookup: style and docs 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-10-31 16:51:56 +00:00
Nick Child 3951a4f3ad pkcs7: Use better error codes 
Remove an unnecessary debug print (whoops).
Use new error code for when the x509 is expired.
When there are no signers return invalid certificate.

Signed-off-by: Nick Child <nick.child@ibm.com>

Co-authored-by: Dave Rodgman <dave.rodgman@arm.com>
Signed-off-by: Nick Child <nick.child@ibm.com>
 2022-10-31 09:38:42 -05:00
Dave Rodgman e8734d8a55
Apply suggestions from code review 
Two spelling fixes (changelog & a comment)

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
 2022-10-31 14:30:24 +00:00
Dave Rodgman 55fd0b9fc1
Merge pull request #6121 from daverodgman/pr277 
cert_write - add a way to set extended key usages - rebase
 2022-10-31 13:27:49 +00:00
Janos Follath e50f2f1a8e Add mbedtls_mpi_core_ct_uint_table_lookup 
This will be needed for extracting modular exponentiation from the
prototype. The function signature is kept aligned to the prototype, but
the implementation is new. (The implementation of this function in the
prototype has further optimisations which are out of scope for now.)

The function is not reused in the bignum counterpart as it will become
redundant soon.

This function is meant to be static, but doesn't have the qualifier as
it is not used yet and would cause compiler warnings. The
MBEDTLS_STATIC_TESTABLE macro will be added in a later commit.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2022-10-31 11:32:55 +00:00
Janos Follath 2dc2757cca
Merge pull request #6457 from minosgalanakis/minos/6017_update_modulus_lifecycle 
Bignum: Updated the modulus lifecyle
 2022-10-31 11:28:37 +00:00
Dave Rodgman 1a22bef116
Merge pull request #6190 from daverodgman/invalid-ecdsa-pubkey 
Improve ECDSA verify validation
 2022-10-31 09:37:26 +00:00
Jerry Yu 7a485c1fdf Add ext id and utilities 
- Remove `MBEDTLS_SSL_EXT_*`
- Add macros and functions for translating iana identifer.
- Add internal identity for extension

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu c4bf5d658e fix various issues 
- Signature of
  - mbedtls_tls13_set_hs_sent_ext_mask
  - check_received_extension and issues
- Also fix comment issue.
- improve readablity.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu 03112ae022 change input extension_type 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu 0c354a211b introduce sent/recv extensions field 
And remove `extensions_present`

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu ffa1582793 move get_extension mask 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu 9872eb2d69 change return type for unexpected extension 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu 43ff252688 Remove unnecessary checks. 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu d15992d3ce fix wrong setting of unrecognized ext 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu 6ba9f1c959 Add extension check for NewSessionTicket 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu 2c5363e58b Add extension check for ServerHello and HRR 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu 2eaa76044b Add extension check for Certificate 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu c55a6af9eb Add extensions check for CertificateRequest 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu cbd082f396 Add extension check for EncryptedExtensions 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu e18dc7eb9a Add forbidden extensions check for ClientHello 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu 471dee5a12 Add debug helpers to track extensions 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-31 16:41:42 +08:00
Jerry Yu def7ae4404 Add auth mode check 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-30 17:57:06 +08:00
Nick Child 5f39767495 pkcs7: Fix imports 
Respond to feedback about duplicate imports[1] and new import style [2].

[1] https://github.com/Mbed-TLS/mbedtls/pull/3431#discussion_r991355485
[2] https://github.com/Mbed-TLS/mbedtls/pull/3431#pullrequestreview-1138745361
Signed-off-by: Nick Child <nick.child@ibm.com>
 2022-10-28 12:38:41 -05:00
Nick Child bb82ab764f pkcs7: Respond to feeback on parsing logic 
After recieving review on the pkcs7 parsing functions, attempt
to use better API's, increase consisitency and use better
documentation. The changes are in response to the following
comments:
 - use mbedtls_x509_crt_parse_der instead of mbedtls_x509_crt_parse [1]
 - make lack of support for authenticatedAttributes more clear [2]
 - increment pointer in pkcs7_get_content_info_type rather than after [3]
 - rename `start` to `p` for consistency in mbedtls_pkcs7_parse_der [4]

[1] https://github.com/Mbed-TLS/mbedtls/pull/3431#discussion_r992509630
[2] https://github.com/Mbed-TLS/mbedtls/pull/3431#discussion_r992562450
[3] https://github.com/Mbed-TLS/mbedtls/pull/3431#discussion_r992741877
[4] https://github.com/Mbed-TLS/mbedtls/pull/3431#discussion_r992754103

Signed-off-by: Nick Child <nick.child@ibm.com>
 2022-10-28 12:28:54 -05:00
Glenn Strauss 7db3124c00 Skip asn1 zeroize if freeing shallow pointers 
This skips zeroizing additional pointers to data.
(Note: actual sensitive data should still be zeroized when freed.)

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 2022-10-28 12:51:35 -04:00
Glenn Strauss a4b4041219 Shared code to free x509 structs 
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 2022-10-28 12:51:35 -04:00
Nick Child 73621ef0f0 pkcs7: Improve verify logic and rebuild test data 
Various responses to feedback regarding the
pkcs7_verify_signed_data/hash functions. Mainly, merge these two
functions into one to reduce redudant logic [1]. As a result, an
identified bug about skipping over a signer is patched [2].

Additionally, add a conditional in the verify logic that checks if
the given x509 validity period is expired [3]. During testing of this
conditional, it turned out that all of the testing data was expired.
So, rebuild all of the pkcs7 testing data to refresh timestamps.

[1] https://github.com/Mbed-TLS/mbedtls/pull/3431#discussion_r999652525
[2] https://github.com/Mbed-TLS/mbedtls/pull/3431#discussion_r997090215
[3] https://github.com/Mbed-TLS/mbedtls/pull/3431#discussion_r967238206
Signed-off-by: Nick Child <nick.child@ibm.com>
 2022-10-28 11:24:25 -05:00
Ronald Cron 04e2133f45
Merge pull request #6482 from ronald-cron-arm/tls13-misc 
TLS 1.3: Update documentation for the coming release and misc
 2022-10-28 11:09:03 +02:00
Gilles Peskine 75c4eaf1f8
Merge pull request #5841 from aurel32/ecp_mul_mxz-timing-leak 
Fix a timing leak in ecp_mul_mxz()
 2022-10-27 19:46:48 +02:00
Minos Galanakis 4d4c98b1b9 bignum_mod: mbedtls_mpi_mod_modulus_setup() refactoring. 
This patch addresses more review comments, and fixes
a circular depedency in the `mbedtls_mpi_mod_modulus_setup()`.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-27 17:47:26 +01:00
Minos Galanakis 771c47055f bignum_mod: Style changes 
This patch addresses review comments with regards to style of
`mbedtls_mpi_mod_modulus_setup/free()`.

It also removes a test check which was triggering a use-after-free.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-27 12:36:24 +01:00
Minos Galanakis 8b33363315 bignum_mod: Updated modulus lifecycle with mm and rr. 
This patch updates the `mbedtls_mpi_mod_modulus_setup/free()`
methods to precalculate mm and rr(Montgomery const squared) during
setup and zeroize it during free.

A static `set_mont_const_square()` is added to manage the memory allocation
and parameter checking before invoking the
`mbedtls_mpi_core_get_mont_r2_unsafe()`

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-27 11:43:54 +01:00
Minos Galanakis 760f5d6b6b bignum_mod: Updated mbedtls_mpi_mod_modulus_setup/free with new fields 
At the current state, those fields are initialised to 0, NULL.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-27 11:43:54 +01:00
Hanno Becker cd860dfe02 bignum_mod: Added Montgomery constants 
This patch adds the Montgomery constants to the `mbedtls_mpi_mont_struct`.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-27 11:43:54 +01:00
Gilles Peskine 9603daddaa
Merge pull request #6230 from tom-cosgrove-arm/issue-6223-core-add 
Bignum: extract core_add from the prototype
 2022-10-27 11:25:27 +02:00
Ronald Cron 77e15e8a2c
Merge pull request #6460 from xkqian/tls13_add_early_data_preparatory 
Internal and Open CI merge job ran successfully. Good to go.
 2022-10-27 10:40:56 +02:00
Gilles Peskine 88f5fd9099
Merge pull request #6479 from AndrzejKurek/depends-py-no-psa 
Enable running depends.py in a configuration without MBEDTLS_USE_PSA_CRYPTO and remove perl dependency scripts
 2022-10-26 20:02:57 +02:00
Gilles Peskine d4d080b41b
Merge pull request #6407 from minosgalanakis/minos/6017_add_montgomery_constant_squared 
Bignum: Added pre-calculation of Montgomery constants
 2022-10-26 14:28:16 +02:00
Ronald Cron 4f7feca0dc
Merge pull request #6391 from davidhorstmann-arm/fix-x509-get-name-cleanup 
The Open CI ran successfully thus I think we can ignore the internal CI.
 2022-10-26 14:27:54 +02:00
Xiaokang Qian 72dbfef6e4 Improve coding styles 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-26 06:33:57 +00:00
Ronald Cron eac00ad2a6 tls13: server: Note down client not being authenticated in SSL context 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-25 20:02:03 +02:00
Gilles Peskine 744fd37d23
Merge pull request #6467 from davidhorstmann-arm/fix-unusual-macros-0 
Fix unusual macros
 2022-10-25 19:55:29 +02:00
Ronald Cron a709a0f2c6 tls13: Declare PSK ephemeral key exchange mode first 
In the PSK exchange modes extension declare first
PSK ephemeral if we support both PSK ephemeral
and PSK. This is aligned with our implementation
giving precedence to PSK ephemeral over pure PSK
and improve compatibility with GnuTLS.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-25 19:05:26 +02:00
Tom Cosgrove 6469fdfb0a Fix whitespace issue spotted in review 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-10-25 16:29:58 +01:00
Tom Cosgrove 82f131063a Update documentation following review comment 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-10-25 16:29:58 +01:00
Tom Cosgrove af7d44b4d2 Tidy up, remove MPI_CORE(), apply the naming convention, and use the new mbedtls_mpi_core_add() 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-10-25 16:29:58 +01:00
Hanno Becker c98871339d Extract MPI_CORE(add) from the prototype 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2022-10-25 16:29:58 +01:00
Minos Galanakis a081c51cd3 Renamed mpi_core_get_mont_R2_unsafe_neg -> mpi_core_get_mont_r2_unsafe_neg 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-25 15:12:38 +01:00
Minos Galanakis 51d638baf6 bignum_core: Style update 
'mbedtls_mpi_core_get_mont_R2_unsafe' aligns const
keyword to match the style of the rest of the module.

Documentation is also updated to remove
`MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED`.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-25 15:12:38 +01:00
Minos Galanakis ae4fb671b4 mbedtls_mpi_core_get_mont_R2_unsafe: Removed NULL input checking 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-25 15:12:38 +01:00
Minos Galanakis b85506e250 bignum_core.h: Comment update for mbedtls_mpi_core_get_mont_R2_unsafe 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-25 15:12:23 +01:00
Minos Galanakis 4f43f61c6a Renamed mbedtls_mpi_get_montgomery_constant_unsafe to mpi_core_get_mont_R2_unsafe 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-25 15:12:23 +01:00
Hanno Becker ec440f2397 bignum_mod_raw: Ported mbedtls_mpi_get_montgomery_constant_unsafe from prototype 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2022-10-25 15:08:08 +01:00
David Horstmann 3a334c2edc Minor improvements to ssl_tls12_server.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-25 10:53:44 +01:00
David Horstmann 7aee0ec0ba Minor improvements in ssl_client.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-25 10:38:25 +01:00
David Horstmann 6e11687ba5 Minor improvements to ecp.c changes 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-25 10:32:08 +01:00
David Horstmann 9b0eb90131 Rename ARIA_SELF_TEST_IF_FAIL 
Change to ARIA_SELF_TEST_ASSERT

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-25 10:23:34 +01:00
David Horstmann 059848ff23 Minor changes to asn1write.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-25 10:16:45 +01:00
Gilles Peskine e5a715e8c0
Merge pull request #6449 from gilles-peskine-arm/bignum-core-shift_r 
Bignum core: shift_r
 2022-10-25 10:40:39 +02:00
Xiaokang Qian 72de95dcf5 Move function mbedtls_ssl_tls13_conf_early_data to ssl_tls.c 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-25 05:34:25 +00:00
Xiaokang Qian 600804b0e7 Remove useless early data related macros for the time being 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-25 03:00:18 +00:00
Xiaokang Qian 54413b10c2 Add early data support preparatory work 
Add MBEDTLS_SSL_EARLY_DATA configuration option
Define early_data_enabled field in mbedtls_ssl_config
Add function mbedtls_ssl_conf_early_data

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-25 03:00:18 +00:00
Andrzej Kurek 409248a73a mbedtls_ssl_get_handshake_transcript is unusable without hashes 
Mark unused variables when compiling without
SHA256 and SHA384. In future a proper dependency
will be added to TLS 1.2 to enforce either of these hashes
to be on.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-24 15:56:10 -04:00
Andrzej Kurek 57d1063db9 Fix tls_prf generic dependencies 
One version was already surrounded by the USE_PSA define,
so the VIA_XX_OR_XX macros were removed;
Second version is when USE_PSA is undefined, so MBEDTLS_
macros can be used. 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-24 15:56:10 -04:00
Andrzej Kurek 468c50656e Fix key exchange dependencies for ssl_parse_server_ecdh_params 
Resulting from particular configs in which this code is used.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-24 15:55:18 -04:00
Ronald Cron 083da8eb53 tls13: client: Improve coding style 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-22 14:42:04 +02:00
Ronald Cron a2900bcd1e tls13: keys: Simplify code guard 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-22 14:42:04 +02:00
Ronald Cron 766c0cdb1f tls13: Add missing kex guards 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-22 14:42:04 +02:00
Ronald Cron 82be0d4b4d tls13: Do not use MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-22 14:42:04 +02:00
Ronald Cron de08cf3543 tls13: Do not use MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED 
Use MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
instead.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-22 14:42:04 +02:00
Ronald Cron 73fe8df922 Introduce and use MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED 
Introduce and use
MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED to
guard TLS code (both 1.2 and 1.3) specific
to handshakes involving PSKs.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-22 14:42:04 +02:00
Ronald Cron e68ab4f55e Introduce and use MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED 
Introduce and use
MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED to
guard TLS code (both TLS 1.2 and 1.3) specific
to handshakes involving certificates.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-22 14:42:04 +02:00
Ronald Cron 41a443a68d tls13: Use MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK.*ENABLED 
Use MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED
instead of MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED to guard
code specific to one of the TLS 1.3 key exchange mode with
PSK.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-22 14:42:04 +02:00
Ronald Cron 928cbd34e7 tls13: Use MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED 
Use MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
instead of MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED to guard
code specific to the TLS 1.3 ephemeral key exchange mode.

Use it also for the dependencies of TLS 1.3 only tests
relying on ephemeral key exchange mode, but for
tests in tls13-kex-modes.sh where the change is done
later using all
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_.*ENABLED macros.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-22 14:42:04 +02:00
Gilles Peskine abc6fbb8d7 Fix brief description 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-10-21 18:36:31 +02:00
Ronald Cron d29e13eb1b tls: Use the same function in TLS 1.2 and 1.3 to check PSK conf 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-21 14:34:20 +02:00
Ronald Cron 2a87e9bf83 tls: Align set and usage check for PSK 
Check that the identity length is not
zero in ssl_conf_set_psk_identity()
as it is done in
mbedtls_ssl_conf_has_static_psk().

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-21 14:34:20 +02:00
Ronald Cron fa1e04a7c4 tls13: keys: Fix PSK build only case 
When deriving the handshake stage master
secret, in the case of a PSK only build,
the only possible key exchange mode is PSK
and there is no ephemeral key exchange
shared secret in that case. Thus do not
error out in that case in the first
phae of the derivation dedicated to the
shared secret.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-21 14:34:20 +02:00
Ronald Cron 9a6a49c7cb tls13: keys: Fail if the group type is not ECDHE or DHE 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-21 14:34:20 +02:00
Ronald Cron b15d4d8966 tls13: keys: Fix error code 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-21 14:34:20 +02:00
Ronald Cron 3b056202d3 tls13: keys: Do not use handshake->premaster 
`handshake->premaster` was used to store the
(EC)DHE shared secret but in TLS 1.3 there is
no need to store it in a context.

Futhermore, `handshake->premaster` and more
specifically its sizing is TLS 1.2 specific
thus better to not use it in TLS 1.3.

Allocate a buffer to store the shared secret
instead. Allocation instead of a stack buffer
as the maintenance of the size of such buffer
is harder (new elliptic curve for ECDHE,
support for FFDHE ... ).

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-21 14:34:20 +02:00
Ronald Cron 4c7edb2b9b tls13: keys: Fix indentation 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-21 14:34:20 +02:00
Ronald Cron 831fee68c3 tls13: keys: Avoid input buffer copy 
In mbedtls_ssl_tls13_evolve_secret() avoid
to copy the input buffer into a local buffer
as the copy is avoidable.

This also fixes a potential overflow as the
size of the local buffer was not checked when
copying into it.

With the current calls to mbedtls_ssl_tls13_evolve_secret()
no buffer overflow was expected to happen though.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2022-10-21 14:34:20 +02:00
Manuel Pégourié-Gonnard 45c6792faf
Merge pull request #6385 from AndrzejKurek/depends-py-reloaded 
Unified tests/scripts/depends.py - reloaded
 2022-10-21 10:17:58 +02:00
Gilles Peskine c279b2fa4a Move mbedtls_mpi_core_shift_r to the proper source file 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-10-20 11:40:15 +02:00
Gilles Peskine 6641420951 Bignum core: Break shift_r function out of the classic shift_r 
This commit contains the function prototype for mbedtls_mpi_core_shift_r,
and the implementation minimally modified from mbedtls_mpi_shift_r.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-10-20 11:40:15 +02:00
Gilles Peskine 4281ae0bd2
Merge pull request #6373 from gilles-peskine-arm/bignum-core-conventions 
Spell out bignum core conventions
 2022-10-19 15:53:33 +02:00
Gilles Peskine db2996357c
Merge pull request #6289 from gabor-mezei-arm/6237_Add_conditional_assign_and_swap_for_bignum 
Bignum: Add safe conditional assign and swap for the new MPI types
 2022-10-19 15:51:19 +02:00
Andrzej Kurek 9387b7b34e Add a temporary solution to create a seedfile 
This caused problems if a config with SHA512 was
compiled after a config without it and the seedfile
did not contain enough data.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:09 -04:00
Andrzej Kurek c610e7402e Formatting & unnecessary (void) fixes 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:09 -04:00
Andrzej Kurek ecb630925f Fix constant name in ssl_tls13_keys 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:09 -04:00
Andrzej Kurek e5a5cc1944 Remove the dependency of tls1_3 key evolution tests on curve25519 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:09 -04:00
Andrzej Kurek eabeb30c65 Fix SHA512 vs SHA384 dependencies 
When building SHA512 without SHA384,
there are some code paths that resulted
in unused variables or usage of undefined code.
This commit fixes that.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:09 -04:00
Andrzej Kurek c19fb08dd3 Add missing ECDH dependency in tls 1.3 client 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:08 -04:00
Andrzej Kurek 68327748d3 Add missing dependencies 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:08 -04:00
Andrzej Kurek 46a987367c Formatting fix 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:08 -04:00
Andrzej Kurek 084334c8f2 Compile constant time masking and hmac if there are suites using MAC 
This is used in TLS 1.2 authentication with NULL cipher,
when there are no TLS_CBC suites.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:08 -04:00
Andrzej Kurek 2d59dbc032 Use TLS prf only if TLS 1.2 is compiled in 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:08 -04:00
Andrzej Kurek 894edde991 Add tls prf handling when there's no SHA256 or SHA384 
Return a null prf function pointer and check for it when populating transform.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:08 -04:00
Andrzej Kurek 252283f2aa Fix missing cipher mode dependencies 
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
 2022-10-19 08:35:08 -04:00
David Horstmann 078250eb56 Fix incorrect return style 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-18 18:11:13 +01:00
David Horstmann 178ec96c89 Remove unnecessary NULL assignments 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-18 18:09:30 +01:00
David Horstmann 11307a1933 Clarify wording on allocation 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-17 18:10:23 +01:00
Aditya Deshpande cfb441d5ee Fix spacing and formatting 
Signed-off-by: Aditya Deshpande <aditya.deshpande@arm.com>
 2022-10-17 15:17:30 +01:00
Gilles Peskine 8874cd570e
Merge pull request #4826 from RcColes/development 
Add LMS implementation
 2022-10-14 18:33:01 +02:00
Aditya Deshpande 40c05cc8e4 Newlines at end of file + trim trailing whitespace 
Signed-off-by: Aditya Deshpande <aditya.deshpande@arm.com>
 2022-10-14 16:46:51 +01:00
Aditya Deshpande 17845b8f71 Add driver wrapper function for raw key agreement, along with test call for transparent drivers. 
Signed-off-by: Aditya Deshpande <aditya.deshpande@arm.com>
 2022-10-14 16:46:00 +01:00
Gilles Peskine dcd1717f5f Forbid aliasing outputs 
Aliasing between two outputs is hardly ever useful.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-10-14 17:15:21 +02:00
Gabor Mezei 4086de667d
Fix documentation 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-10-14 16:29:42 +02:00
Manuel Pégourié-Gonnard b3c30907d6
Merge pull request #6383 from mprse/aead_driver_test 
Enable testing of AEAD drivers with libtestdriver1
 2022-10-14 11:11:01 +02:00
Raef Coles 1951259a10
Update how lms.c imports platform.h 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 16:47:13 +01:00
Ronald Cron 49e4184812
Merge pull request #6299 from xkqian/tls13_add_servername_check 
Add server name check when proposing pre-share key
 2022-10-13 16:00:59 +02:00
Raef Coles cbd02adc6e
Simplify LMS context freeing 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:30:32 +01:00
Raef Coles 45c4ff93c9
Fix windows requiring explicit cast in LMS calloc 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:30:14 +01:00
Raef Coles 142e577c34
Add extra zeroization to LMS and LMOTS 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:30:03 +01:00
Raef Coles 9fc303a99a
Add extra LMOTS import negative tests 
And fix failures that are related to the new tests

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:30:01 +01:00
Raef Coles 4829459c90
Validate LMOTS sig length before parsing type 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:47 +01:00
Raef Coles 285d44b180
Capitalize "Merkle" in LMS and LMOTS code 
As it is a proper noun

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:43 +01:00
Raef Coles faf59babe8
Make LMS verification return VERIFY_FAILED more 
To align with PSA error code rules on when VERIFY_FAILED is returned vs
INVALID_ARGUMENT

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:42 +01:00
Raef Coles fbd60ec775
Change LMS and LMOTS init functions to use memset 
Instead of zeroize

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:40 +01:00
Raef Coles 9b0daf60fb
Improve LMS private function warning 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:38 +01:00
Raef Coles f6cb5a4826
Fix LMS return statements having incorrect style 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:35 +01:00
Raef Coles 75b4c7790e
Fix LMS internal function documentation 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:34 +01:00
Raef Coles d48f7e90bb
Allocate LMS C_RANDOM_VALUE as hash size 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:32 +01:00
Raef Coles 1fb2f32ef5
Check LMS offsets are sane at runtime 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:31 +01:00
Raef Coles e34e3c0e59
Remove unneeded cast in LMS calloc 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:30 +01:00
Raef Coles 370cc43630
Make LMS public key export part of public key api 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:28 +01:00
Raef Coles e89488debf
Fix bug in LMS public key loading 
To avoid using the type before it is parsed from the signature

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:27 +01:00
Raef Coles 3f6cdd7aab
Fix LMS not checking RNG function return value 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:24 +01:00
Raef Coles 02cf8234b4
Fix ots sig length check in LMS validate function 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:22 +01:00
Raef Coles f36874a535
Fix error type of lms_import_public_key 
Was returning an incorrect error when bad public key sizes were input

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:21 +01:00
Raef Coles dc8fb79e09
Simplify LMS private key generation error handling 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:20 +01:00
Raef Coles be3bdd8240
Rename LMS and LMOTS init/free functions 
To match convention

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:18 +01:00
Raef Coles 29117d2e4e
Update LMS PSA error conversion 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:17 +01:00
Raef Coles be0c2f9183
Update LMS local variable allocation 
To use a default failure value, and to avoid a call to
psa_hash_operation_init()

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:15 +01:00
Raef Coles 2ac352a322
Make LMS functions args const where required 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:14 +01:00
Raef Coles 5127e859d7
Update LMS and LMOTS dependency macros 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:11 +01:00
Raef Coles 56fe20a473
Move MBEDTLS_PRIVATE required defines into lms.h 
From lmots.h, as it is a private header

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:10 +01:00
Raef Coles ab300f15e8
Move public header content from lmots.h to lms.h 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:08 +01:00
Raef Coles 0b7da1b787
Fix overflow in LMS context init 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:03 +01:00
Raef Coles 57d5328ad5
Remove MBEDTLS_LM(OT)S prefix from internal macros 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:29:00 +01:00
Raef Coles ad05425ab7
Update naming of internal LMS functions 
To comply with the mbedtls_ requirement

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:59 +01:00
Raef Coles 40158e11fc
Add LMOTS test hook to header 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:58 +01:00
Raef Coles 3982040232
Fix LMS zeroization using wrong sizeof type 
Causing a buffer write out of bounds

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:55 +01:00
Raef Coles 98d6e22050
Remove doxygen markup from internal LMS functions 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:54 +01:00
Raef Coles 40f184c83e
Cast LMS allocation sizes to size_t 
To prevent implict casting errors on 64-bit platforms

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:52 +01:00
Raef Coles 1310ecb389
Update LMOTS function documentation 
To avoid CI failure

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:51 +01:00
Raef Coles 9c9027b1a4
Add extra LMS and LMOTS tests 
NULL-message and LMOTS signature leak tests

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:50 +01:00
Raef Coles fa24f9d6ea
Minor fixes to LMS and LMOTS macros 
Update some names, use the correct macro in certain places.

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:48 +01:00
Raef Coles 0a967ccf9a
Document LMS and LMOTS internal functions 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:47 +01:00
Raef Coles 8738a49d0c
Fix iterator types in LMOTS 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:45 +01:00
Raef Coles e0a17610d1
Fix LMS/LMOTS if-statement style 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:41 +01:00
Raef Coles 9b88ee5d5d
Fix LMS and LMOTS coding style violations 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:40 +01:00
Raef Coles 366d67d9af
Shorted LMS and LMOTS line-lengths 
To attempt to comply with the 80-char suggestion

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:38 +01:00
Raef Coles e9479a0264
Update LMS API to support multiple parameter sets 
Parameterise macros to allow variation of sizes

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:36 +01:00
Raef Coles ab4f87413a
Add MBEDTLS_LMS_PRIVATE define 
To enable private key operations

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:35 +01:00
Raef Coles ebd35b5b80
Rename LMS internal tree-manipulation functions 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:31 +01:00
Raef Coles 891c613f31
Update LMOTS signature use of temporary variables 
Document them properly, and move random value to a temporary variable

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:29 +01:00
Raef Coles 0c88d4e447
Remove superfluous casts in LMS and LMOTS 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:28 +01:00
Raef Coles f5632d3efc
Remove MBEDTLS_PRIVATE usage from LMS and LMOTS 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:27 +01:00
Raef Coles 01c71a17b3
Update LMS and LMOTS api 
Fix function names and parameters. Move macros to be more private.
Update implementation.

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:25 +01:00
Raef Coles c8f9604d7b
Use PSA hashing for LMS and LMOTS 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:23 +01:00
Raef Coles 7dce69a27a
Make LMOTS a private api 
Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:22 +01:00
Raef Coles 8ff6df538c
Add LMS implementation 
Also an LM-OTS implementation as one is required for LMS.

Signed-off-by: Raef Coles <raef.coles@arm.com>
 2022-10-13 14:28:15 +01:00
Manuel Pégourié-Gonnard 02f82bbfa9 Fix MSVC warning 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-10-13 13:32:02 +02:00
Manuel Pégourié-Gonnard f155ab9a91 Abort on errors when we should 
We're not strictly required to abort, but at least to leave the context
is an invalid state. For "late" functions like input() and output(),
calling abort() is the easiest way to do that. Do it systematically for
input() and output() by using a wrapper. psa_pake_get_implicit_key() was
already doing it. For "early" function, we can just leave the operation
in its current state which is already invalid.

Restore previous tests about that. Not adding systematic tests, though,
just test the two functions that are the most important, and more likely
to return errors.

Since we now abort in more cases, we need to make sure we don't
invalidate the operation that's going to be re-used later in the test.
For that reason, use a copy of the operation for calls to input() and
output() that are expected to return errors.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-10-13 13:20:31 +02:00
Gilles Peskine 0fe6631486
Merge pull request #6291 from gilles-peskine-arm/platform.h-unconditional-3.2 
Include platform.h unconditionally
 2022-10-13 10:19:22 +02:00
Xiaokang Qian 28af501cae Fix the ticket_lifetime equal to 0 issue 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-13 08:18:19 +00:00
Pol Henarejos 39fb1d52d1
Update library/sha3.c 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Pol Henarejos <55573252+polhenarejos@users.noreply.github.com>
 2022-10-13 08:29:47 +02:00
Pol Henarejos c9754c3ec1
Merge branch 'Mbed-TLS:development' into sha3 2022-10-13 08:28:13 +02:00
Xiaokang Qian 126bf8e4d7 Address some comments 
Delete reference immediately after shallow copy
Fix format issues

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-13 02:57:15 +00:00
Xiaokang Qian 997669aeeb Fix heap use-after-free corruption issue 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 14:30:27 +00:00
Xiaokang Qian 307a7303fd Rebase and replace session_negotiate 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:14:32 +00:00
Xiaokang Qian baa4764d77 Fix typo issues 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:06:51 +00:00
Xiaokang Qian 8730644da1 Move ticket and hostname set code just after shallow-copy 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:06:51 +00:00
Xiaokang Qian ed3afcd6c3 Fix various typo and macro guards issues 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:06:51 +00:00
Xiaokang Qian ed0620cb13 Refine code base on comments 
Move code to proper macro guards protection
Fix typo issues

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:06:51 +00:00
Xiaokang Qian 03409290d2 Add MBEDTLS_SSL_SESSION_TICKETS guard to server name check 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:06:51 +00:00
Xiaokang Qian d7adc374d3 Refine the server name compare logic 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:06:51 +00:00
Xiaokang Qian a3b451f950 Adress kinds of comments base on review 
Rename function name to mbedtls_ssl_session_set_hostname
Add two extra check cases for server name
Fix some coding styles

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:06:51 +00:00
Xiaokang Qian 2f9efd3038 Address comments base on review 
Change function name to ssl_session_set_hostname()
Remove hostname_len
Change hostname to c_string
Update test cases to multi session tickets

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:06:49 +00:00
Xiaokang Qian bc663a0461 Refine code based on commnets 
Change code layout
Change hostname_len type to size_t
Fix various issues

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:06:01 +00:00
Xiaokang Qian adf84a4a8c Remove public api mbedtls_ssl_reset_hostname() 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:05:11 +00:00
Xiaokang Qian be98f96de2 Remove useless hostname check in server side 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:03:44 +00:00
Xiaokang Qian 6af2a6da74 Fix session save-load overflow issue 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:03:44 +00:00
Xiaokang Qian ecd7528c7f Address some comments 
Hostname_len has at least one byte
Change structure serialized_session_tls13
Fix various issues

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:03:44 +00:00
Xiaokang Qian 281fd1bdd8 Add server name check when proposeing pre-share key 
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
 2022-10-12 11:03:41 +00:00
Gilles Peskine 8fd3254cfc
Merge pull request #6374 from mprse/enc_types 
Test TLS 1.2 builds with each encryption type
 2022-10-12 12:45:50 +02:00
Jerry Yu c79742303d Remove unnecessary empty line and fix format issue 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-11 21:22:33 +08:00
Jerry Yu 22c18c1432 Add NULL check in prepare hello 
`session_negotiate` is used directly in `ssl_prepare_client_hello`
without NULL check. Add the check in the beggining to avoid segment
fault.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-11 18:07:19 +08:00
Jerry Yu c2bfaf00d9 fix wrong typo 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-11 18:07:19 +08:00
Jerry Yu 4f77ecf409 disable session resumption when ticket expired 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-10 22:10:08 +08:00
Jerry Yu 03aa174d7c Improve test message and title 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-10 21:48:37 +08:00
Jerry Yu 6916e70521 fix various issues 
- adjust guards. Remove duplicate guards and adjust format.
- Return success at function end. Not `ret`
- change input len

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-10 21:33:51 +08:00
Jerry Yu 21092062f3 Restrict cipher suite validation to TLS1.3 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-10 21:21:31 +08:00
Gabor Mezei d7edb1d225
Initialize variable 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-10-10 14:32:09 +02:00
Gabor Mezei e9c013c222
Handle if parameters are alised 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2022-10-10 14:26:57 +02:00
Przemek Stekiel 88ade84735 psa_aead_setup: remove redundant tag length check 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-10-08 17:56:18 +02:00
Przemek Stekiel 6ab50762e0 psa_aead_setup: validate tag length before calling driver setup 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-10-08 17:54:30 +02:00
Jerry Yu a99cbfa2d3 fix various issues 
- rename function and variable
- change signature of `ssl_tls13_has_configured_psk`
- remove unnecessary statements
- remove unnecessary local variables
- wrong variable initial value
- improve output message

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-08 14:35:47 +08:00
Jerry Yu 40afab61a8 Add ciphersuite check in set_session 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-08 14:35:43 +08:00
Jerry Yu 21f9095fa8 Revert "move ciphersuite validation to set_session" 
This reverts commit 19ae6f62c7.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-08 14:35:34 +08:00
Jerry Yu 379b91a393 add ticket age check 
Remove ticket if it is expired.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-08 10:21:15 +08:00
David Horstmann 91e20a0580 Refactor macro-spanning ifs in ecdh.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-07 14:08:42 +01:00
David Horstmann fc735dffd6 Refactor macro-spanning ifs in ecp.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-07 14:08:42 +01:00
David Horstmann 8a7629fd0f Refactor macro-spanning if in asn1write.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-07 14:08:42 +01:00
David Horstmann 2788f6b668 Refactor macro-spanning if in sha512.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-07 14:08:42 +01:00
David Horstmann 687262ca7d Refactor macro-spanning if in sha256.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-07 14:08:42 +01:00
David Horstmann 21b89761f8 Refactor macro-spanning if in ssl_tls13_server.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-07 14:08:42 +01:00
David Horstmann 10be134d8e Refactor macro-spanning if in ssl_msg.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-07 14:08:42 +01:00
David Horstmann 4a28563e84 Refactor macro-spanning ifs in ssl_client.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-07 14:08:42 +01:00
David Horstmann e0af39a2ef Refactor macro-spanning ifs in ssl_tls12_server.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-07 14:08:36 +01:00
Przemek Stekiel 86679c7bd8 psa_validate_tag_length(): use PSA_WANT_ALG_xxx instead MBEDTLS_PSA_BUILTIN_ALG_xxx guards 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-10-07 08:24:19 +02:00
Jerry Yu 4a698341c9 Re-org selected_identity parser 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu 6183cc7470 Re-org binders writer 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu f75364bee1 Re-organize identities writer 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu 8b41e893a2 fix various issues 
- Re-order code and comments
  - move comment above `write_identities`
  - move `write_binder` above `write_identities`.
- Add has_{psk,identity} into {ticket,psk}_get_{psk,identity}
- rename `*_session_tickets_*` to `_ticket_`

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu 19ae6f62c7 move ciphersuite validation to set_session 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu 25ab654781 Add dummy ticket support 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu b300e3c5be add selected_identity parser 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu 1a0a0f4416 Add binders writer 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu f7c125917c Add identites writer 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu 0c6105bc9e empty pre_shared_key functions 
To easy review

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
Jerry Yu 8897c07075 Add server only guards for psk callback 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
 2022-10-07 10:11:05 +08:00
David Horstmann b21bbef061 Refactor macro-spanning if in ssl_tls12_client.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-06 18:00:51 +01:00
David Horstmann 3b2276a439 Refactor macro-spanning ifs in ssl_tls.c 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-06 17:59:57 +01:00
Przemek Stekiel 8a05a646f4 Remove psa_driver_get_tag_len() and use PSA_ALG_AEAD_GET_TAG_LENGTH macro instead 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-10-06 17:01:58 +02:00
Przemek Stekiel ff1efc9a84 psa_aead_check_nonce_length: Fix unused variable warining 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
 2022-10-06 16:53:47 +02:00
David Horstmann 0763ccf04f Refactor ARIA_SELF_TEST_IF_FAIL macro 
Change the ARIA_SELF_TEST_IF_FAIL macro to be more code-style friendly.
Currently it expands to the body of an if statement, which causes
problems for automatic brace-addition for if statements.

Convert the macro to a function-like macro that takes the condition as
an argument and expands to a full if statement inside a do {} while (0)
idiom.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-06 14:32:30 +01:00
Manuel Pégourié-Gonnard 0771d41584 Fix missing length check 
There was a check against the remaining size of the buffer, which used
to be correct, but was broken two commits ago when we started not just
copying the input but also adding to it.

Replace it with a check that the input length is not greater that what's
expected for this step. This guarantees we won't overflow the internal
buffer.

While at it, add an explicit cast to uint8_t when writing the length to
the buffer, so silence an MSVC warning. This cast is safe because we
checked that the length is no larger than 65 or 32 (depending on the
step), so in any case is fits in one byte.

This was found because some lengths had not been adjusted in the test
suite, and instead of failing cleanly, library code performed buffer
overflows. I'll fix the tests in the next commit.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-10-06 09:30:34 +02:00
Manuel Pégourié-Gonnard 79617d99ae Fix namespacing issue 
This macro is specific to the Mbed TLS implementation and not part of
the public API, so it shouldn't used the PSA_ namespace.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-10-05 12:55:50 +02:00
Manuel Pégourié-Gonnard ec7012dbc7 Fix I/O format of PSA EC J-PAKE for compliance 
The format used by the mbedtls_ecjpake_xxx() APIs and that defined by
the PSA Crypto PAKE extension are quite different; the former is
tailored to the needs of TLS while the later is quite generic and plain.
Previously we only addressed some part of this impedance mismatch: the
different number of I/O rounds, but failed to address the part where the
legacy API adds some extras (length bytes, ECParameters) that shouldn't
be present in the PSA Crypto version. See comments in the code.

Add some length testing as well; would have caught the issue.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2022-10-05 12:52:48 +02:00
David Horstmann ed79483aca Free structs in mbedtls_x509_get_name() on error 
mbedtls_x509_get_name() allocates a linked list of mbedtls_x509_name
structs but does not free these when there is an error, leaving the
caller to free them itself. Change this to cleanup these objects within
the function in case of an error.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2022-10-05 11:51:16 +01:00
Gilles Peskine 01af3ddc82 Fixed confusion between number size and limb size; define limb 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2022-10-04 16:23:29 +02:00