Commit graph

10196 commits

Author SHA1 Message Date
Gilles Peskine 03e99cf14d Remove redundant error code definitions
We're including psa/crypto_values.h, which defines the necessary error
codes. Remove redundant definitions, which hurt because they need to be
styled in exactly the same way (same presence/absence of spaces between
tokens).

This completes the fix of https://github.com/Mbed-TLS/mbedtls/issues/6875.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-01-11 11:15:18 +01:00
Ronald Cron 83c5ad4873
Merge pull request #6787 from yuhaoth/pr/workaround-gnutls_anti_replay_fail
TLS 1.3: EarlyData: Workaround anti replay fail from GnuTLS
2023-01-11 09:05:36 +01:00
Gilles Peskine 0770efe4e1
Merge pull request #6888 from daverodgman/iar-bignum-warning
Fix IAR warning
2023-01-10 22:08:37 +01:00
Manuel Pégourié-Gonnard 28d4d43416
Merge pull request #6863 from valeriosetti/issue6830
Remove uses of mbedtls_ecp_curve_info in TLS (with USE_PSA)
2023-01-10 10:01:17 +01:00
Jerry Yu 3e60cada5d Improve comment and changlog
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2023-01-10 14:58:08 +08:00
Valerio Setti a0b97bc803 fix wrong type in debug message
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-09 19:10:32 +01:00
Valerio Setti 1e868ccbac fix several typos and extra blank spaces
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-09 17:59:46 +01:00
Valerio Setti 2b5d3ded1f remove remaining occurencies of mbedtls_ecc_group_to_psa() from TLS
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-09 11:04:52 +01:00
Jerry Yu bdb936b7a5 Workaround anti replay fail of GnuTLS
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2023-01-07 20:19:55 +08:00
Glenn Strauss 14db51224e Fix IAR warning
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-01-06 14:20:14 +00:00
Gilles Peskine cd0a565644
Merge pull request #6703 from yuhaoth/pr/tls13-misc-from-prototype
TLS 1.3: Upstream misc fix from prototype
2023-01-05 14:35:54 +01:00
David Horstmann bec95320ba Don't restyle end of file
Move the *INDENT-ON* annotation to the end of the file so that
uncrustify does not restyle the later sections (since it introduces a
risk of future problems).

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-01-05 09:50:47 +00:00
David Horstmann cb3b6ae580 Disable code style correction for bignum assembly
The inline assembly defined in bn_mul.h confuses code style parsing,
causing code style correction to fail. Disable code style correction for
the whole section gated by "#if defined(MBEDTLS_HAVE_ASM)" to prevent
this.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-01-04 17:50:08 +00:00
Valerio Setti 67419f0e11 tls: fix + save code size when DEBUG_C is not enabled
Some PSA curves' symbols (PSA_WANT_) were not matching the corresponding
MBEDTLS_ECP_DP_. This was fixed together with the removal of extra code
when DEBUG_C is not enabled.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-04 17:36:00 +01:00
Valerio Setti 40d9ca907b tls: remove useless legacy function
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-04 16:08:04 +01:00
Valerio Setti 18c9fed857 tls: remove dependency from mbedtls_ecp_curve functions
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-03 13:03:34 +01:00
David Horstmann e3d8f31ba1 Workaround Uncrustify parsing of "asm"
The following code:

 #ifndef asm
 #define asm __asm
 #endif

causes Uncrustify to stop correcting the rest of the file. This may be
due to parsing the "asm" keyword in the definition.

Work around this by wrapping the idiom in an *INDENT-OFF* comment
wherever it appears.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-01-03 11:07:09 +00:00
Manuel Pégourié-Gonnard 7a389ddc84
Merge pull request #6784 from valeriosetti/issue6702
Make SHA224_C/SHA384_C independent from SHA256_C/SHA512_C
2023-01-03 09:36:58 +01:00
Janos Follath b4b0bb737d
Merge pull request #5907 from mpg/use-psa-rsa-pss
Use PSA more often in `pk_verify_ext()`
2022-12-30 12:33:50 +00:00
Gilles Peskine b402e4bde1
Merge pull request #6595 from mfischer/lms_heap
lms: Move merkle tree generation to heap allocation
2022-12-23 18:29:04 +01:00
Valerio Setti 326cf46764 test: improved readability in sha self tests
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2022-12-23 14:57:18 +01:00
Manuel Pégourié-Gonnard 676766ff77
Merge pull request #6776 from gabor-mezei-arm/6222_bignum_mod_mul
Bignum: Implement fixed width modular multiplication
2022-12-23 10:39:30 +01:00
Manuel Pégourié-Gonnard 2fcb4c1d06
Merge pull request #6747 from gilles-peskine-arm/bignum-mod-random
Bignum mod random
2022-12-23 10:36:22 +01:00
Valerio Setti 543d00ef6f sha: remove SHA1 from ssl_cookie
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2022-12-22 14:27:34 +01:00
Manuel Pégourié-Gonnard 2510dd41bf
Merge pull request #6282 from gstrauss/sw_derive_y
mbedtls_ecp_point_read_binary from compressed fmt
2022-12-22 10:20:31 +01:00
Manuel Pégourié-Gonnard 4dacf58d6d Take advantage of now-public macro in pk.c
Used to be private, hence the duplication, but that's been fixed in the
meantime, I guess we just missed this occurrence.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2022-12-21 09:50:17 +01:00
Manuel Pégourié-Gonnard 6958355a51 Use PSA Crypto more often in pk_verify_ext()
See https://github.com/Mbed-TLS/mbedtls/issues/5277 - strategy 1.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2022-12-21 09:49:57 +01:00
Gilles Peskine e1d8326e90 Fix representation of mod-random output
mbedtls_mpi_mod_raw_random() and mbedtls_mpi_mod_random() were producing
output in the Montgomery representation, instead of obeying the
representation chosen in the modulus structure. Fix this.

Duplicate the test cases for mod-random output to have separate test cases
for each representation.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-12-20 20:28:02 +01:00
Gilles Peskine e655479528 Generalize representation handling in mbedtls_mpi_mod_read
Call mbedtls_mpi_mod_raw_canonical_to_modulus_rep instead of assuming that
anything that isn't MBEDTLS_MPI_MOD_REP_MONTGOMERY is canonical.

mbedtls_mpi_mod_write should get the same treatment, but I'm holding off
until https://github.com/Mbed-TLS/mbedtls/issues/6679 is done.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-12-20 19:55:51 +01:00
Gilles Peskine eb2e77f617 Document modulus representation selectors
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-12-20 19:55:51 +01:00
Gilles Peskine 1e2a4d4089 Functions to convert raw residues to/from the modulus representation
Test cases will be generated automatically by a subsequent commit.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-12-20 19:55:51 +01:00
Gabor Mezei 496cd37bac
Use equality checking for NULL value
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2022-12-20 17:30:20 +01:00
Gabor Mezei 2840884c35
Typo
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2022-12-20 17:30:19 +01:00
Gabor Mezei 6a31b7252d
Fix documentation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2022-12-20 17:30:19 +01:00
Gabor Mezei 9db81e9cca
Add mod_mul function
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2022-12-20 17:30:13 +01:00
Glenn Strauss efde9d58de remove duplicated consecutive preproc directives
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-12-20 04:20:12 -05:00
Manuel Pégourié-Gonnard 8b6d14be8b Extract common code for computing X^3 + AX + B
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2022-12-20 04:17:03 -05:00
Glenn Strauss 452416121d move mbedtls_ecp_sw_derive_y after MPI_ECP_ macros
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-12-19 21:25:27 -05:00
Glenn Strauss fcabc28cfc use MPI_ECP_* macros in mbedtls_ecp_sw_derive_y()
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-12-19 21:24:50 -05:00
Gilles Peskine e162b4725c
Merge pull request #6777 from tom-cosgrove-arm/issue-6292-mod_inv
Bignum: Implement high level fixed width modular inversion
2022-12-17 13:26:02 +01:00
Gilles Peskine cf86d70162
Merge pull request #6742 from gabor-mezei-arm/6022_bignum_mod_raw_mul
Bignum: Implement fixed width raw modular multiplication
2022-12-17 13:25:43 +01:00
Tom Cosgrove f723754f6d Fix typos
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-16 16:10:36 +00:00
Glenn Strauss cbfd5e9db7 comment
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-12-16 11:03:41 -05:00
Glenn Strauss 369bfb94c5 comments and whitespace
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-12-16 10:49:04 -05:00
Gabor Mezei 210ea63d8b
Fix documentation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2022-12-16 16:35:24 +01:00
Valerio Setti e7221a21ad test: adjust depends.py to new SHA224/SHA384 changes
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2022-12-16 14:43:48 +01:00
Tom Cosgrove 342d00bc22 Oops, use mbedtls_free() not plain free()
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-16 11:02:06 +00:00
Gilles Peskine b1eea02f74 Implement and test mbedtls_mpi_mod_random
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-12-16 10:13:29 +01:00
Gilles Peskine a57cf9813a Implement and test mbedtls_mpi_mod_raw_random
In the basic/XXX=core test cases, use odd upper bounds, because the mod
version of random() only supports odd upper bounds (the upper bound is a
modulus and the mod modules only support odd moduli).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-12-16 10:13:29 +01:00
Manuel Pégourié-Gonnard 057b458583
Merge pull request #6766 from wernerlewis/bignum_mod_docs
Bignum: document conventions for bignum mod and mod_raw
2022-12-16 09:58:36 +01:00
Manuel Pégourié-Gonnard 5bf8629b2c
Merge pull request #6303 from gilles-peskine-arm/bignum-core-random
Bignum: Implement mbedtls_mpi_core_random
2022-12-16 09:58:07 +01:00
Gilles Peskine d1dd41f3fc
Merge pull request #6723 from mpg/restartable-vs-use-psa
Document ECP_RESTARTABLE and make it compatible with USE_PSA
2022-12-15 19:47:44 +01:00
Werner Lewis 6bb49ba121 Document const parameter conventions
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 17:04:43 +00:00
Tom Cosgrove b38c2ed3d9 Fix double space between words
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-15 16:56:36 +00:00
Tom Cosgrove d692ba4248 Note that (as usual) for mbedtls_mpi_mod_inv() residues must be associated with the modulus
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-15 16:56:36 +00:00
Tom Cosgrove a9e0f95903 Split mbedtls_mpi_mod_inv() into separate functions for mont/non-mont form
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-15 16:56:36 +00:00
Tom Cosgrove 4302d02fa8 Add mbedtls_mpi_mod_inv()
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-15 16:56:36 +00:00
Tom Cosgrove 786848b5c5 Add low-level Montgomery conversion functions to bignum_core
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-15 16:56:36 +00:00
Tom Cosgrove 28ff92cc3a Add an explicit mbedtls_mpi_core_montmul_working_limbs() function
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-15 16:56:36 +00:00
Tom Cosgrove 30f3b4d601 Add mbedtls_mpi_core_check_zero_ct() and tests
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-15 16:56:36 +00:00
Tom Cosgrove e9ffb6c8e9 Fix mbedtls_platform_zeroize() call in mbedtls_mpi_mod_modulus_free()
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-15 16:56:36 +00:00
Werner Lewis 756a34aadc Use lower case for p and r
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 14:53:43 +00:00
Werner Lewis 0f644f48e9 Add output initialization requirement
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 14:13:32 +00:00
Gilles Peskine 6b7ce968d2 Clarify some comments
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-12-15 15:04:33 +01:00
Gabor Mezei 95b754dfac
Fix documentation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2022-12-15 15:04:20 +01:00
Gabor Mezei 979d34ca7d
Add mod_raw_mul function
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2022-12-15 15:04:20 +01:00
Werner Lewis 214ae64349 Replace \p with \c for non-parameter code typeset
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 13:36:07 +00:00
Werner Lewis 1d89ebf548 Clarify all functions operate modulo N
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 13:35:41 +00:00
Werner Lewis a306886b3a Add modulus to parameter ordering
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 13:35:41 +00:00
Werner Lewis 2e70b9afef Reword bignum sizes section
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 13:35:41 +00:00
Werner Lewis 2bd263da1e Fix grammar and spelling
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 13:35:40 +00:00
Werner Lewis 945a165a3c Clarify output requirements
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 13:22:27 +00:00
Werner Lewis eac8be76d6 Remove unnecessary type comment
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 13:22:17 +00:00
Werner Lewis e1eb75dc99 Specify modulus constraints
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-15 12:27:56 +00:00
Manuel Pégourié-Gonnard 50faa55e4d
Merge pull request #6732 from wernerlewis/bignum_6019_mod_add
Bignum: Implement mbedtls_mpi_mod_add()
2022-12-15 11:39:24 +01:00
Dave Rodgman 01f6e61781
Merge pull request #986 from Mbed-TLS/merge-back-3.3.0-3
Merge back 3.3.0 3
2022-12-14 19:18:05 +00:00
Dave Rodgman ebef3562c3 Revert "Add generated files"
This reverts commit c18d932705.

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-12-14 19:14:00 +00:00
Dave Rodgman e90ed7d249 Bump versions for libmbedcrypto and libmbedtls
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-12-14 17:04:00 +00:00
Manuel Pégourié-Gonnard c98624af3c
Merge pull request #6680 from valeriosetti/issue6599
Allow isolation of EC J-PAKE password when used in TLS
2022-12-14 11:04:33 +01:00
Valerio Setti a3f99591f6 sha: make SHA-224 independent from SHA-256
Using proper configuration options (i.e. MBEDTLS_SHA224_C and
MBEDTLS_SHA256_C) it is now possible to build SHA224 and SHA256
independently from each other.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2022-12-14 10:56:54 +01:00
Manuel Pégourié-Gonnard 4064a82802
Merge pull request #5600 from yuhaoth/pr/refactor-cookie-members-of-handshake
Refactor cookie members of handshake
2022-12-14 10:55:34 +01:00
Valerio Setti 898e7a3afe test: sha: test SHA384 and SHA512 separately
This is meant to adapt to the new library design in which
SHA384 and SHA512 can be built independently from each other.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2022-12-14 10:50:54 +01:00
Werner Lewis eed01aabd3 Clarify wording in documentation
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-14 09:44:00 +00:00
Valerio Setti 43363f5962 sha: make SHA-384 independent from SHA-512
Using proper configuration options (i.e. MBEDTLS_SHA384_C and
MBEDTLS_SHA512_C) it is now possible to build SHA384 and SHA512
independently from each other.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2022-12-14 08:53:23 +01:00
Manuel Pégourié-Gonnard 2b70a3f831
Merge pull request #6558 from lpy4105/6416-psa_macros_name_typo
check_names: extend typo check to PSA macro/enum names
2022-12-13 09:56:27 +01:00
Manuel Pégourié-Gonnard 48232ed2c1
Merge pull request #6743 from minosgalanakis/bignum/implement_modular_negation
Bignum: Implement fixed width modular negation
2022-12-13 09:54:38 +01:00
Bence Szépkúti f7641544ea Correct the fix for the PKCS 7 memory leak
This corrects an issue in the origina fix in
4f01121f6e.

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2022-12-12 21:59:03 +01:00
Dave Rodgman 8a05c069a5
Merge pull request #6751 from ZachFleck42/development
Fix typo in `library/entropy.c`
2022-12-12 16:30:54 +00:00
Werner Lewis 5e9d2e9019 Add conventions for bignum mod and mod_raw
Signed-off-by: Werner Lewis <werner.lewis@arm.com>
2022-12-12 14:00:25 +00:00
Manuel Pégourié-Gonnard a9ac61203b
Merge pull request #6666 from daverodgman/fast_unaligned
Fast unaligned memory access macros
2022-12-12 12:18:17 +01:00
Minos Galanakis 5e8443e6ef mbedtls_mpi_mod_raw_neg: Updated documentation.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2022-12-12 11:13:56 +00:00
Minos Galanakis 21fe8bdeac bignum_mod_raw: Added modular negation.
This patch adds the `mpi_mod_raw_neg()` method.

Co-authored-by: Hanno Becker <hanno.becker@arm.com>
Co-authored-by: Minos Galanakis <minos.galanakis@arm.com>

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2022-12-12 11:13:56 +00:00
Valerio Setti 016f682796 tls: pake: small code refactoring for password setting functions
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2022-12-09 14:17:50 +01:00
Tom Cosgrove 5f09930017 Clarify use of temporary in mbedtls_mpi_mod_raw_inv_prime()
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-09 10:58:15 +00:00
Dave Rodgman c18d932705 Add generated files
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-12-09 09:44:10 +00:00
Manuel Pégourié-Gonnard df0c73c308 Readability improvement in pk_wrap.c
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2022-12-09 10:09:34 +01:00
Manuel Pégourié-Gonnard 79ae7eb4d1 Use deterministic ECDSA in PSA when we do in legacy
This fixes the two failing cases in test_suite_pk when ECP_RESTARTABLE
and USE_PSA_CRYPTO are both enabled. The two failing cases where

    ECDSA restartable sign/verify: ECDSA, max_ops=0 (disabled)
    ECDSA restartable sign/verify: ECKEY, max_ops=0 (disabled)

associated with test function pk_sign_verify_restart(). The failure was
caused by the interaction of several things that are each reasonable on
their own:

1. The test function relies on ECDSA restartable, which is reasonable as it
allows making sure that the generated signature is correct with a simple
memcmp().
2. The implementation of pk_sign_restartable() has a shortcut to
dispatch to the sign function (as opposed to sign_restartable) when
restart is disabled (max_ops == 0).
3. When USE_PSA is enabled, the sign function dispatches to PSA, which
so far always used ECDSA (non-deterministic) even when the non-PSA
version would use deterministic ECDSA.

This could be fixed by changing any of those. I chose (3) because I
think it makes sense that when PK dispatches to PSA instead of legacy
this should not change which version of ECDSA is selected.

OTOH, I think it makes sense to keep (2), because that means more
opportunities to dispatch to PSA.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2022-12-09 10:07:19 +01:00
Jerry Yu 0c2a738c23 fix various issues
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2022-12-09 09:51:20 +08:00
Jerry Yu 141bbe7bee tls13: Adjust include files
- remove duplicate and unused included
- Adjust the order to system, mbedtls global, local.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2022-12-09 09:51:20 +08:00
Jerry Yu ddda050604 tls13: Upstream various fix in prototype
- Adjust max input_max_frag_len
- Guard transform_negotiate
- Adjust function position
- update comments
- fix wrong requirements

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2022-12-09 09:51:20 +08:00