Remove SHA-1 as a fallback option

- it's 2020, there shouldn't be too many systems out there where SHA-1 is the
  only available hash option, so its usefulness is limited
- OTOH testing configurations without SHA-2 reveal bugs that are not easy to
  fix in a fully compatible way

So overall, the benefit/cost ratio is not good enough to justify keeping SHA-1
as a fallback option here.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>

ChangeLog.d/ecp-internal-rng.txt

@@ -1,9 +1,9 @@
 Changes
    * The ECP module, enabled by `MBEDTLS_ECP_C`, now depends on
-     `MBEDTLS_CTR_DRBG_C`, `MBEDTLS_HMAC_DRBG_C`, `MBEDTLS_SHA512_C`,
-     `MBEDTLS_SHA256_C` or `MBEDTLS_SHA1_C` for some side-channel
-     coutermeasures. If side channels are not a concern, this dependency can
-     be avoided by enabling the new option `MBEDTLS_ECP_NO_INTERNAL_RNG`.
+     `MBEDTLS_CTR_DRBG_C`, `MBEDTLS_HMAC_DRBG_C`, `MBEDTLS_SHA512_C` or
+     `MBEDTLS_SHA256_C` for some side-channel coutermeasures. If side channels
+     are not a concern, this dependency can be avoided by enabling the new
+     option `MBEDTLS_ECP_NO_INTERNAL_RNG`.
 
 Security
    * Fix side channel in mbedtls_ecp_check_pub_priv() and

include/mbedtls/check_config.h

@@ -146,9 +146,8 @@
     defined(MBEDTLS_HMAC_DRBG_C) ||         \
     defined(MBEDTLS_SHA512_C) ||            \
     defined(MBEDTLS_SHA256_C) ||            \
-    defined(MBEDTLS_SHA1_C) ||              \
     defined(MBEDTLS_ECP_NO_INTERNAL_RNG))
-#error "MBEDTLS_ECP_C requires a DRBG or SHA module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
+#error "MBEDTLS_ECP_C requires a DRBG or SHA-2 module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
 #endif
 
 #if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)

include/mbedtls/config.h

@@ -788,12 +788,11 @@
  * against some side-channel attacks.
  *
  * This protection introduces a dependency of the ECP module on one of the
- * DRBG or SHA modules (HMAC-DRBG, CTR-DRBG, SHA-512, SHA-256 or SHA-1).
- * For very constrained applications that don't require this protection
- * (for example, because you're only doing signature verification, so not
- * manipulating any secret, or because local/physical side-channel attacks are
- * outside your threat model), it might be desirable to get rid of that
- * dependency.
+ * DRBG or SHA modules (HMAC-DRBG, CTR-DRBG, SHA-512 or SHA-256.) For very
+ * constrained applications that don't require this protection (for example,
+ * because you're only doing signature verification, so not manipulating any
+ * secret, or because local/physical side-channel attacks are outside your
+ * threat model), it might be desirable to get rid of that dependency.
  *
  * \warning Enabling this option makes some uses of ECP vulnerable to some
  * side-channel attacks. Only enable it if you know that's not a problem for

library/ecp.c

@@ -113,8 +113,6 @@
 #include "mbedtls/sha512.h"
 #elif defined(MBEDTLS_SHA256_C)
 #include "mbedtls/sha256.h"
-#elif defined(MBEDTLS_SHA1_C)
-#include "mbedtls/sha1.h"
 #else
 #error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
 #endif
@@ -254,9 +252,7 @@ cleanup:
     return( ret );
 }
 
-#elif defined(MBEDTLS_SHA512_C) || \
-      defined(MBEDTLS_SHA256_C) || \
-      defined(MBEDTLS_SHA1_C)
+#elif defined(MBEDTLS_SHA512_C) || defined(MBEDTLS_SHA256_C)
 
 /* This will be used in the self-test function */
 #define ECP_ONE_STEP_KDF
@@ -268,7 +264,7 @@ cleanup:
  * function) and empty FixedInfo. (Though we'll make it fit the DRBG API for
  * convenience, this is not a full-fledged DRBG, but we don't need one here.)
  *
- * We need a basic hash abstraction layer to use whatever SHA is available.
+ * We need a basic hash abstraction layer to use whatever SHA-2 is available.
  */
 #if defined(MBEDTLS_SHA512_C)
 
@@ -280,12 +276,7 @@ cleanup:
 #define HASH_FUNC( in, ilen, out )  mbedtls_sha256_ret( in, ilen, out, 0 );
 #define HASH_BLOCK_BYTES            ( 256 / 8 )
 
-#else // from a previous #if we know that SHA-1 is available if SHA-2 isn't
-
-#define HASH_FUNC                   mbedtls_sha1_ret
-#define HASH_BLOCK_BYTES            ( 160 / 8 )
-
-#endif /* SHA512/SHA256/SHA1 abstraction */
+#endif /* SHA512/SHA256 abstraction */
 
 /*
  * State consists of a 32-bit counter plus the secret value.
@@ -333,8 +324,8 @@ static int ecp_drbg_random( void *p_rng, unsigned char *output, size_t output_le
          * bytes from this function, and retrying up to 10 times if unlucky.
          *
          * So for the largest curve, each scalar multiplication draws at most
-         * 2 * 66 bytes. The minimum block size is 20 bytes (with SHA-1), so
-         * that means at most 66 blocks.
+         * 20 * 66 bytes. The minimum block size is 32 (SHA-256), so with
+         * rounding that means a most 20 * 3 blocks.
          *
          * Since we don't need to draw more that 255 blocks, don't bother
          * with carry propagation and just return an error instead. We can
@@ -3231,8 +3222,8 @@ cleanup:
  * https://github.com/patrickfav/singlestep-kdf/wiki/NIST-SP-800-56C-Rev1:-Non-Official-Test-Vectors
  *
  * We only use the ones with empty fixedInfo, and for brevity's sake, only
- * 32-bytes output (with SHA-1 that's more than one block, with SHA-256
- * exactly one block, and with SHA-512 less than one block).
+ * 32-bytes output (with SHA-256 that's exactly one block, and with SHA-512
+ * less than one block).
  */
 #if defined(MBEDTLS_SHA512_C)
 
@@ -3260,21 +3251,6 @@ static const uint8_t test_kdf_out[32] = {
     0x34, 0x3f, 0x6d, 0x82, 0x16, 0x22, 0xb4, 0x45,
 };
 
-#elif defined(MBEDTLS_SHA1_C)
-
-static const uint8_t test_kdf_z[16] = {
-    0x4e, 0x1e, 0x70, 0xc9, 0x88, 0x68, 0x19, 0xa3,
-    0x1b, 0xc2, 0x9a, 0x53, 0x79, 0x11, 0xad, 0xd9,
-};
-static const uint8_t test_kdf_out[32] = {
-    0xdd, 0xbf, 0xc4, 0x40, 0x44, 0x9a, 0xab, 0x41,
-    0x31, 0xc6, 0xd8, 0xae, 0xc0, 0x8c, 0xe1, 0x49,
-    0x6f, 0x27, 0x02, 0x24, 0x1d, 0x0e, 0x27, 0xcc,
-    0x15, 0x5c, 0x5c, 0x7c, 0x3c, 0xda, 0x75, 0xb5,
-};
-
-#else
-#error "Need at least one of SHA-512, SHA-256 or SHA-1"
 #endif
 
 static int ecp_kdf_self_test( void )

tests/scripts/all.sh

@@ -854,32 +854,6 @@ component_test_no_drbg_no_sha512 () {
     # no SSL tests as they all depend on having a DRBG
 }
 
-component_test_no_drbg_no_sha2 () {
-    # this tests the internal ECP DRBG using a KDF based on SHA-1
-    msg "build: Default minus DRBGs minus SHA-2"
-    scripts/config.pl unset MBEDTLS_CTR_DRBG_C
-    scripts/config.pl unset MBEDTLS_HMAC_DRBG_C
-    scripts/config.pl unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
-    scripts/config.pl unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
-    scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
-    scripts/config.pl unset MBEDTLS_SHA512_C
-    scripts/config.pl unset MBEDTLS_SHA256_C
-    scripts/config.pl unset MBEDTLS_ENTROPY_C # requires SHA-2
-    scripts/config.pl unset MBEDTLS_PSA_CRYPTO_C # requires Entropy
-    scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
-    scripts/config.pl unset MBEDTLS_PSA_CRYPTO_SE_C # requires PSA Crypto
-    scripts/config.pl unset MBEDTLS_USE_PSA_CRYPTO # requires PSA Crypto
-    scripts/config.pl unset MBEDTLS_SSL_PROTO_TLS1_2 # requires SHA-2
-
-    CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
-    make
-
-    msg "test: Default minus DRBGs minus SHA-2"
-    make test
-
-    # no SSL tests as they all depend on having a DRBG
-}
-
 component_test_ecp_no_internal_rng () {
     msg "build: Default plus ECP_NO_INTERNAL_RNG minus DRBG modules"
     scripts/config.pl set MBEDTLS_ECP_NO_INTERNAL_RNG