Commit graph

11563 commits

Author SHA1 Message Date
Dave Rodgman 84eaefa43e Use designated initializers for mbedtls_mpi
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-07-11 16:02:46 +01:00
Valerio Setti 7e6aaa1ea5 psa: fix missed LEGACY symbols caused by the rebase
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-11 16:59:21 +02:00
Paul Elliott 88f34e3348
Merge pull request #7703 from gabor-mezei-arm/7598_clone_the_eco_module
[Bignum] Clone the ECP module
2023-07-11 15:00:01 +01:00
Tom Cosgrove f2b5a13d02 Fix MBEDTLS_BSWAP32 on armcc 5
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2023-07-11 14:06:37 +01:00
Valerio Setti 76df8c1900 psa: remove redundant GENPRIME when RSA_KEY_PAIR_GENERATE is defined
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-11 14:11:28 +02:00
Valerio Setti b2bcedbf9a library: replace MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-11 14:06:00 +02:00
Valerio Setti f6d4dfb745 library: replace PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_LEGACY symbols with proper ones
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-11 14:06:00 +02:00
Dave Rodgman 4999f15d98
Merge pull request #7878 from beni-sandu/development
aesce: use correct target attribute when building with clang
2023-07-11 10:54:14 +01:00
Yanray Wang ffc3c48e4e Remove getter functions of PAKE if no PAKE algorithms are required
Signed-off-by: Yanray Wang <yanray.wang@arm.com>
2023-07-11 17:33:22 +08:00
Valerio Setti 41b0818bcb ecp: rearrange code in ecp_read_key()
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-11 11:28:22 +02:00
Valerio Setti 21d42417f9 pkparse: always check all private keys on import
This allows to remove explicit calls to mbedtls_ecp_check_privkey()
in pkparse.c.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-11 11:28:22 +02:00
Valerio Setti 6b062eeed0 pkparse: parse also Weierstrass private keys using ecp_read_key()
This is to hanlde more uniformly Weierstrass and Montgomery curves.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-11 11:28:22 +02:00
Valerio Setti 805e4a0378 pkparse: use ecp_read_key() for parsing private key of Montgomery curves
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-11 11:28:22 +02:00
Gilles Peskine 6aca2c9613
Merge pull request #7716 from mpg/psa-util-internal
Split psa_util.h between internal and public
2023-07-10 18:33:23 +02:00
Manuel Pégourié-Gonnard 5c41ae867b
Merge pull request #7887 from ronald-cron-arm/fix-hrr-in-psk-kem
tls13: server: Fix spurious HRR
2023-07-10 09:58:13 +02:00
Valerio Setti 54e23792c8 tls: replace numeric values with proper TLS IANA symbols
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-10 09:13:57 +02:00
Valerio Setti 6f0441d11e tls: replace occurencies of ECP_LIGHT with PK_HAVE_ECC_KEYS
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-10 09:13:57 +02:00
Valerio Setti acd32c005f programs: add helper functions for supported EC curves
- get full list, or
- get TLS ID from name

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-10 09:13:57 +02:00
Valerio Setti 49e6907b5b tls: replace ECP_LIGHT occurrencies with PK_HAVE_ECC_KEYS
Up to this point "make test" runs successfully. "ssl-opt" has
not been tested yet.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-10 09:10:20 +02:00
Paul Elliott 2dfe7993af
Merge pull request #6914 from davidhorstmann-arm/cmake-pass-through-config-defines
Pass `MBEDTLS_CONFIG_FILE` defines through cmake
2023-07-07 17:01:57 +01:00
Tom Cosgrove c5f41bfeb8
Merge pull request #7212 from sergio-nsk/patch-4
Fix error: comparison of integers of different signs: 'SOCKET' and 'int'
2023-07-07 16:45:55 +01:00
Dave Rodgman 602a0919f3
Merge pull request #7464 from yuhaoth/pr/Change-clock-source-to-bootime-for-ms-time
Replace CLOCK_MONOTONIC with CLOCK_BOOTTIME for `mbedtls_ms_time` on linux
2023-07-07 15:42:17 +01:00
Manuel Pégourié-Gonnard 461d59b2f8
Merge pull request #7858 from mprse/ffdh_tls13_v2_f
Make use of FFDH keys in TLS 1.3 - follow-up
2023-07-07 16:19:35 +02:00
Ronald Cron 8a74f07c2a tls13: server: Fix spurious HRR
If the server during a TLS 1.3 handshake selects
the PSK key exchange mode, it does not matter
if it did not find in the key share extension
a key share for a group it supports. Such a
key share is used and necessary only in the
case of the ephemeral or PSK ephemeral key
exchange mode. This is a possible scenario in
the case of a server that supports only the PSK
key exchange mode and a client that also
supports a key exchange mode with ephemeral keys.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2023-07-07 15:53:12 +02:00
Gabor Mezei f05ca737da
Update comment
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-07-07 12:59:22 +02:00
Manuel Pégourié-Gonnard 9967f11066
Merge pull request #7810 from valeriosetti/issue7771
Define PSA_WANT_xxx_KEY_PAIR_yyy step 2/ECC
2023-07-07 10:22:47 +02:00
Przemek Stekiel 46b2d2b643 Fix code style
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-07-07 09:34:17 +02:00
Manuel Pégourié-Gonnard d55d66f5ec Fix missing includes
Some files relied on psa_util.h to provide the includes they need.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-07-06 12:47:28 +02:00
Manuel Pégourié-Gonnard abfe640864 Rationalize includes in psa_util
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-07-06 12:47:27 +02:00
Manuel Pégourié-Gonnard b7e8939198 Move error functions to internal header
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-07-06 12:47:26 +02:00
Manuel Pégourié-Gonnard a5a8f29d7e Move ECC and FFDH macros to internal header
ECC macros used in the following files:

library/pk.c
library/pk_wrap.c
library/pkparse.c
library/pkwrite.c
library/ssl_misc.h
library/ssl_tls12_client.c

FFDH macro use only in library/ssl_misc.h so could possibly be moved
there, but it seems cleaner to keep it close to the ECC macros are they
are very similar in nature.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-07-06 12:45:54 +02:00
Manuel Pégourié-Gonnard 5c731b0afb Use consistent guards for deprecated feature
Fixes an "unused static function" warning in builds with
DEPRECATED_REMOVED.

While at it, remove an include that's now useless.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-07-06 12:42:33 +02:00
Manuel Pégourié-Gonnard 57fa72fdf8 Remove unused function in cipher.c
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-07-06 12:42:33 +02:00
Manuel Pégourié-Gonnard efcc1f21c8 Make cipher functions static in cipher.c
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-07-06 12:42:33 +02:00
Manuel Pégourié-Gonnard 2be8c63af7 Create psa_util_internal.h
Most functions in psa_util.h are going to end up there (except those
that can be static in one file), but I wanted to have separate commits
for file creation and moving code around, so for now the new file's
pretty empty but that will change in the next few commits.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-07-06 12:42:33 +02:00
Przemek Stekiel 408569f91a Adapt function name: mbedtls_ssl_tls13_generate_and_write_dh_key_exchange
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-07-06 12:16:44 +02:00
Przemek Stekiel 615cbcdbdf Provide additional comments for claryfication
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-07-06 12:16:39 +02:00
Yanray Wang 5adfdbdaed AES: fix mismatch comment in #endif
Signed-off-by: Yanray Wang <yanray.wang@arm.com>
2023-07-06 17:10:44 +08:00
Gabor Mezei c97a407dba
Remove value assignment for enum entries
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-07-06 10:54:41 +02:00
Gabor Mezei 2a7bcaf8af
Use only MBEDTLS_ECP_WITH_MPI_UINT to switch between the ecp variants
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-07-06 10:37:51 +02:00
Tom Cosgrove 836aed7cf8
Merge pull request #6003 from gstrauss/x509_time
mbedtls_x509_time performance and reduce memory use
2023-07-06 09:28:14 +01:00
Dave Rodgman 3d0c8255aa
Merge pull request #7825 from daverodgman/cipher_wrap_size
Cipher wrap size improvement
2023-07-05 15:45:48 +01:00
Gabor Mezei 1a729dcece
Fix comment
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-07-05 16:13:46 +02:00
Gabor Mezei d6789f1e2e
Used preferred macro definition check
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-07-05 16:13:45 +02:00
David Horstmann 0f1dd57214 Use emptiness-checks rather than DEFINED checks
For the MBEDTLS_CONFIG_FILE and MBEDTLS_USER_CONFIG_FILE variables,
check that they are non-empty and defined. This means they can be
unconditionally created in the cache, simplifying the CMakeLists.txt

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-07-05 14:12:13 +01:00
David Horstmann ae33ab85a5 Pass config file options to mbedtls_test(_helpers)
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-07-05 14:11:51 +01:00
David Horstmann 82f11ff6ac Pass MBEDTLS_CONFIG_FILE defines through cmake
When -DMBEDTLS_CONFIG_FILE or -DMBEDTLS_USER_CONFIG_FILE are passed to
cmake, pass them through as compile definitions. This allows different
mbedtls configs to be passed at configure time without modifying any
cmake files.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-07-05 14:09:58 +01:00
David Horstmann 3ae1c4c0f7 Fix formatting of explanatory commented code
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-07-05 11:15:08 +01:00
David Horstmann b1d27bcd69 Improve comment formatting
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-07-05 10:00:31 +01:00
David Horstmann cdf5283dad Rename variables to more descriptive names
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-07-05 09:58:03 +01:00
Przemek Stekiel e80bbf4dbf Fix function name after rebase
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-07-05 10:34:40 +02:00
Manuel Pégourié-Gonnard db084d16ea
Merge pull request #7862 from ronald-cron-arm/improve-write-supported-group-ext
Improve write supported group ext
2023-07-05 09:55:33 +02:00
Przemek Stekiel 7ac93bea8c Adapt names: dh -> xxdh
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-07-05 09:26:26 +02:00
Przemek Stekiel d5f79e7297 Adapt functions names for ffdh
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-07-05 09:26:26 +02:00
Przemek Stekiel 6f199859b6 Adapt handshake fields to ffdh
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-07-05 09:25:00 +02:00
Przemek Stekiel e03ddbb497 Use valid size of peerkey buffer (EC vs FF)
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-07-05 09:25:00 +02:00
Beniamin Sandu aa4f621901 aesce: use correct target attribute when building with clang
Seems clang has its own issues when it comes to crypto extensions,
and right now the best way to avoid them is to accurately enable
the needed instructions instead of the broad crypto feature.

E.g.: https://github.com/llvm/llvm-project/issues/61645

Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com>
2023-07-04 21:15:52 +03:00
Dave Rodgman c8d81ad54d
Merge pull request #7784 from daverodgman/aesce-unroll 2023-07-04 18:41:13 +01:00
Tom Cosgrove e939464eb7
Merge pull request #7829 from mpg/deduplicate-tls-hashing
De-duplicate TLS hashing functions
2023-07-04 16:06:00 +01:00
Tom Cosgrove b7af7eac05
Merge pull request #7834 from beni-sandu/development
aesce: do not specify an arch version when enabling crypto instructions
2023-07-04 13:32:04 +01:00
Ronald Cron 1ffa450882 tls: client: Improve writing of supported_groups ext
Align the TLS 1.3 specific and TLS 1.2 specific
tests done before to call
ssl_write_supported_groups_ext() and inside
thsi function.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2023-07-04 12:16:25 +02:00
Manuel Pégourié-Gonnard aaad2b6bfc Rename some local variables
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-07-04 11:35:16 +02:00
Manuel Pégourié-Gonnard 443589ac53
Merge pull request #7870 from valeriosetti/fix-tls13-guards
tls13: fix guards for PSA error translating function
2023-07-04 11:21:14 +02:00
Tom Cosgrove 9b20c6fcc1
Merge pull request #7840 from yanrayw/7381_aes_gen_table
AES: use uint8_t for array of pow and log to save RAM usage
2023-07-04 08:34:12 +01:00
Valerio Setti dbd01cb677 tls13: fix guards for PSA error translating function
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-04 09:18:52 +02:00
Dave Rodgman 9cf17dad9d
Merge pull request #7851 from daverodgman/fix-unused-aes
Fix AES dependencies - build TF-M config cleanly
2023-07-03 16:49:00 +01:00
Manuel Pégourié-Gonnard 56b159a12a
Merge pull request #7627 from mprse/ffdh_tls13_v2
Make use of FFDH keys in TLS 1.3 v.2
2023-07-03 10:12:33 +02:00
Manuel Pégourié-Gonnard 45e009aa97
Merge pull request #7814 from valeriosetti/issue7746
PK: refactor wrappers in the USE_PSA case
2023-07-03 09:32:31 +02:00
Valerio Setti f7cd419ade pk: ignore opaque EC keys in pk_setup when they are not supported
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 18:11:29 +02:00
Valerio Setti 35d1dacd82 pk_wrap: fix: always clear buffer holding private key in eckey_check_pair_psa
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 18:04:16 +02:00
Gabor Mezei f4aab6f666
Add comments and remove unneeded defines
For `check_names.py` it is enough to appear a macro definition in
a comment to validate it.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-06-30 16:54:55 +02:00
Valerio Setti 38913c16b0 pk_wrap: do not support opaque EC keys when !PK_HAVE_ECC_KEYS
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 16:18:33 +02:00
Tom Cosgrove c4a760c538
Merge pull request #7849 from davidhorstmann-arm/fix-string-to-names-retcode
Fix false success return code in `mbedtls_x509_string_to_names()`
2023-06-30 14:28:29 +01:00
Dave Rodgman a2c1a387e4
Merge pull request #7630 from daverodgman/prefer-intrinsics
Prefer intrinsics over asm for AES-NI
2023-06-30 11:39:38 +01:00
Gabor Mezei c810707980
Add check for the ecp module variants
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-06-30 11:39:21 +02:00
Gabor Mezei 1df4c6435f
Enable build of the new ecp_new.c file
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-06-30 11:39:20 +02:00
Gabor Mezei a306d20766
Clone the ecp.c file as ecp_new.c
Add macro guard for each file defaults to enable the ecp.c file content.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-06-30 11:38:55 +02:00
Valerio Setti 27c501a10c lib/test: replace BASIC_IMPORT_EXPORT internal symbol with BASIC,IMPORT,EXPORT
Also the python script for automatic test generation is fixed accordingly

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 10:16:22 +02:00
Valerio Setti 86587abde4 psa: fix guards for EC key derivation
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 10:16:22 +02:00
Valerio Setti dd24f29105 psa: fix wrong naming for ECC derive symbols in code
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 10:16:22 +02:00
Valerio Setti 4c0174de2e psa: replace remaining ECC_KEY_PAIR_LEGACY symbols with proper ones
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 10:16:22 +02:00
Valerio Setti 5dad7051b4 psa_crypto_ecp: fix wrong comment in #endif
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 10:16:22 +02:00
Valerio Setti 2a63460248 psa: fix guards for EC key derivation
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 10:16:21 +02:00
Valerio Setti 6a9d0ee373 library/test: replace LEGACY symbol with BASIC_IMPORT_EXPORT
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 10:16:21 +02:00
Valerio Setti bfeaf5b4f6 library: replace ECC_KEY_PAIR_LEGACY with GENERATE
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 10:16:21 +02:00
Valerio Setti 8ffdb5df7d library: replace ECC_KEY_PAIR_LEGACY with DERIVE
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-30 10:12:19 +02:00
Gilles Peskine 053022fe24 Reduce the size of mbedtls_mpi
Reduce the size of mbedtls_mpi from 3 words to 2 on most architectures.

This also reduces the code size significantly in bignum.o and ecp_curves.o,
with negligible variations in other modules.

This removes the ability to set MBEDTLS_MPI_MAX_LIMBS to a value >=65536,
but we don't support customizing this value anyway (it's always 10000).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-06-29 19:33:44 +02:00
Valerio Setti 88a3aeed9f pk_wrap: use PK_HAVE_ECC_KEYS as guard for ecdsa_opaque_check_pair_wrap
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 15:01:10 +02:00
Valerio Setti d9d74c285b pk_wrap: guard all ECDSA function with MBEDTLS_PK_HAVE_ECC_KEYS
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 15:00:02 +02:00
Valerio Setti 4d1daf8f8d pk_wrap: minor fixes for guards
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:27 +02:00
Valerio Setti 97976e3e4c pk_wrap: always fill all the fields of the pk_info structures
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:27 +02:00
Valerio Setti 76d0f9637c pk: uniform naming of functions and structures in pk/pk_wrap
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:27 +02:00
Valerio Setti 884c1ec1f5 pk_wrap: share code for selecting the psa_alg in ECDSA sign
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:27 +02:00
Valerio Setti 574a00b576 pk_wrap: minor reorganization for opaque keys
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:26 +02:00
Valerio Setti 5c26b30d9e pk_wrap: add missing labels to #else and #endif
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:26 +02:00
Valerio Setti bb7603a28f pk_wrap: optimize eckey_check_pair()
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:26 +02:00
Valerio Setti f69514a7d8 pk_wrap: name all the fields of the pk_info structs
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:26 +02:00
Valerio Setti e77307738d pk_wrap: add support for ECDSA verify for opaque keys
This commit also add tests to verify the functionality

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:26 +02:00
Valerio Setti ed7d6af670 pk_wrap: optimize code for ECDSA verify
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:26 +02:00
Valerio Setti 4657f10bdb pk_wrap: optimize code for ECDSA sign
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-06-29 14:33:26 +02:00