From 433f39c4370b52c51ddc03c958672a9d03dede23 Mon Sep 17 00:00:00 2001 From: Ron Eldor Date: Sun, 18 Jun 2017 17:57:51 +0300 Subject: [PATCH 1/4] ECDH alternative implementation support Add alternative implementation support for ECDH at the higher layer --- ChangeLog | 4 ++++ include/mbedtls/config.h | 1 + library/ecdh.c | 3 ++- library/version_features.c | 3 +++ 4 files changed, 10 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 243bd6bc0..a2a2a366b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -36,6 +36,10 @@ Changes * Clarify ECDSA documentation and improve the sample code to avoid misunderstandings and potentially dangerous use of the API. Pointed out by Jean-Philippe Aumasson. + * Add support for alternative implementation for ECDH, controlled by new + configuration flag MBEDTLS_ECDH_ALT in config.h. + Alternative Ecdh is supported for implementation of `mbedtls_ecdh_gen_public` + and `mbedtls_ecdh_compute_shared`. = mbed TLS 2.5.0 branch released 2017-05-17 diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index c4b8995c1..a29312a26 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -238,6 +238,7 @@ //#define MBEDTLS_BLOWFISH_ALT //#define MBEDTLS_CAMELLIA_ALT //#define MBEDTLS_DES_ALT +//#define MBEDTLS_ECDH_ALT //#define MBEDTLS_XTEA_ALT //#define MBEDTLS_MD2_ALT //#define MBEDTLS_MD4_ALT diff --git a/library/ecdh.c b/library/ecdh.c index c0a814731..b66cb5867 100644 --- a/library/ecdh.c +++ b/library/ecdh.c @@ -38,6 +38,7 @@ #include +#if !defined(MBEDTLS_ECDH_ALT) /* * Generate public key: simple wrapper around mbedtls_ecp_gen_keypair */ @@ -81,7 +82,7 @@ cleanup: return( ret ); } - +#endif /* MBEDTLS_ECDH_ALT */ /* * Initialize context */ diff --git a/library/version_features.c b/library/version_features.c index 9f97c7bc3..7b08f04be 100644 --- a/library/version_features.c +++ b/library/version_features.c @@ -93,6 +93,9 @@ static const char *features[] = { #if defined(MBEDTLS_DES_ALT) "MBEDTLS_DES_ALT", #endif /* MBEDTLS_DES_ALT */ +#if defined(MBEDTLS_ECDH_ALT) + "MBEDTLS_ECDH_ALT", +#endif /* MBEDTLS_ECDH_ALT */ #if defined(MBEDTLS_XTEA_ALT) "MBEDTLS_XTEA_ALT", #endif /* MBEDTLS_XTEA_ALT */ From 8b766218a845551f7006a6982750eb3723915633 Mon Sep 17 00:00:00 2001 From: Ron Eldor Date: Sun, 24 Sep 2017 15:44:56 +0300 Subject: [PATCH 2/4] Update ChangeLog Update ChangeLog according to Andres seggestion --- ChangeLog | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index a2a2a366b..23698c233 100644 --- a/ChangeLog +++ b/ChangeLog @@ -38,8 +38,9 @@ Changes by Jean-Philippe Aumasson. * Add support for alternative implementation for ECDH, controlled by new configuration flag MBEDTLS_ECDH_ALT in config.h. - Alternative Ecdh is supported for implementation of `mbedtls_ecdh_gen_public` - and `mbedtls_ecdh_compute_shared`. + The following functions from the ECDH module can be replaced + with an alternative implementation: + mbedtls_ecdh_gen_public() and mbedtls_ecdh_compute_shared(). = mbed TLS 2.5.0 branch released 2017-05-17 From a84c1cb3551fbab10c1100b5238b7f3283b2a399 Mon Sep 17 00:00:00 2001 From: Ron Eldor Date: Tue, 10 Oct 2017 19:04:27 +0300 Subject: [PATCH 3/4] Address PR cpomments reviews 1) move the change into Features from Changes, in the changLog 2) Change the feature alternative configuration MBEDTLS_ECDH_ALT definition to function alternative defintions MBEDTLS_ECDH_COMPUTE_SHARED_ALT and MBEDTLS_ECDH_GEN_PUBLIC_ALT --- ChangeLog | 5 ++++- include/mbedtls/config.h | 3 ++- library/ecdh.c | 7 +++++-- library/version_features.c | 9 ++++++--- 4 files changed, 17 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index 23698c233..76a27b666 100644 --- a/ChangeLog +++ b/ChangeLog @@ -36,8 +36,11 @@ Changes * Clarify ECDSA documentation and improve the sample code to avoid misunderstandings and potentially dangerous use of the API. Pointed out by Jean-Philippe Aumasson. + +Features * Add support for alternative implementation for ECDH, controlled by new - configuration flag MBEDTLS_ECDH_ALT in config.h. + configuration flags MBEDTLS_ECDH_COMPUTE_SHARED_ALT and + MBEDTLS_ECDH_GEN_PUBLIC_ALT in config.h. The following functions from the ECDH module can be replaced with an alternative implementation: mbedtls_ecdh_gen_public() and mbedtls_ecdh_compute_shared(). diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index a29312a26..a151f77cc 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -238,7 +238,6 @@ //#define MBEDTLS_BLOWFISH_ALT //#define MBEDTLS_CAMELLIA_ALT //#define MBEDTLS_DES_ALT -//#define MBEDTLS_ECDH_ALT //#define MBEDTLS_XTEA_ALT //#define MBEDTLS_MD2_ALT //#define MBEDTLS_MD4_ALT @@ -295,6 +294,8 @@ //#define MBEDTLS_AES_SETKEY_DEC_ALT //#define MBEDTLS_AES_ENCRYPT_ALT //#define MBEDTLS_AES_DECRYPT_ALT +//#define MBEDTLS_ECDH_GEN_PUBLIC_ALT +//#define MBEDTLS_ECDH_GEN_PUBLIC_ALT /** * \def MBEDTLS_ECP_INTERNAL_ALT diff --git a/library/ecdh.c b/library/ecdh.c index b66cb5867..61380b693 100644 --- a/library/ecdh.c +++ b/library/ecdh.c @@ -38,7 +38,7 @@ #include -#if !defined(MBEDTLS_ECDH_ALT) +#if !defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) /* * Generate public key: simple wrapper around mbedtls_ecp_gen_keypair */ @@ -48,7 +48,9 @@ int mbedtls_ecdh_gen_public( mbedtls_ecp_group *grp, mbedtls_mpi *d, mbedtls_ecp { return mbedtls_ecp_gen_keypair( grp, d, Q, f_rng, p_rng ); } +#endif /* MBEDTLS_ECDH_GEN_PUBLIC_ALT */ +#if !defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) /* * Compute shared secret (SEC1 3.3.1) */ @@ -82,7 +84,8 @@ cleanup: return( ret ); } -#endif /* MBEDTLS_ECDH_ALT */ +#endif /* MBEDTLS_ECDH_COMPUTE_SHARED_ALT */ + /* * Initialize context */ diff --git a/library/version_features.c b/library/version_features.c index 7b08f04be..802832ce9 100644 --- a/library/version_features.c +++ b/library/version_features.c @@ -93,9 +93,6 @@ static const char *features[] = { #if defined(MBEDTLS_DES_ALT) "MBEDTLS_DES_ALT", #endif /* MBEDTLS_DES_ALT */ -#if defined(MBEDTLS_ECDH_ALT) - "MBEDTLS_ECDH_ALT", -#endif /* MBEDTLS_ECDH_ALT */ #if defined(MBEDTLS_XTEA_ALT) "MBEDTLS_XTEA_ALT", #endif /* MBEDTLS_XTEA_ALT */ @@ -165,6 +162,12 @@ static const char *features[] = { #if defined(MBEDTLS_AES_DECRYPT_ALT) "MBEDTLS_AES_DECRYPT_ALT", #endif /* MBEDTLS_AES_DECRYPT_ALT */ +#if defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) + "MBEDTLS_ECDH_GEN_PUBLIC_ALT", +#endif /* MBEDTLS_ECDH_GEN_PUBLIC_ALT */ +#if defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) + "MBEDTLS_ECDH_GEN_PUBLIC_ALT", +#endif /* MBEDTLS_ECDH_GEN_PUBLIC_ALT */ #if defined(MBEDTLS_ECP_INTERNAL_ALT) "MBEDTLS_ECP_INTERNAL_ALT", #endif /* MBEDTLS_ECP_INTERNAL_ALT */ From 3226d36d6170c36ef966b46779bcb53ca45d5182 Mon Sep 17 00:00:00 2001 From: Ron Eldor Date: Thu, 12 Oct 2017 14:17:48 +0300 Subject: [PATCH 4/4] Fix typo in configuration Change duplicate of MBEDTLS_ECDH_GEN_PUBLIC_ALT to MBEDTLS_ECDH_COMPUTE_SHARED_ALT --- include/mbedtls/config.h | 2 +- library/version_features.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index a151f77cc..a6003b7d1 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -295,7 +295,7 @@ //#define MBEDTLS_AES_ENCRYPT_ALT //#define MBEDTLS_AES_DECRYPT_ALT //#define MBEDTLS_ECDH_GEN_PUBLIC_ALT -//#define MBEDTLS_ECDH_GEN_PUBLIC_ALT +//#define MBEDTLS_ECDH_COMPUTE_SHARED_ALT /** * \def MBEDTLS_ECP_INTERNAL_ALT diff --git a/library/version_features.c b/library/version_features.c index 802832ce9..d7acae39f 100644 --- a/library/version_features.c +++ b/library/version_features.c @@ -165,9 +165,9 @@ static const char *features[] = { #if defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) "MBEDTLS_ECDH_GEN_PUBLIC_ALT", #endif /* MBEDTLS_ECDH_GEN_PUBLIC_ALT */ -#if defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) - "MBEDTLS_ECDH_GEN_PUBLIC_ALT", -#endif /* MBEDTLS_ECDH_GEN_PUBLIC_ALT */ +#if defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) + "MBEDTLS_ECDH_COMPUTE_SHARED_ALT", +#endif /* MBEDTLS_ECDH_COMPUTE_SHARED_ALT */ #if defined(MBEDTLS_ECP_INTERNAL_ALT) "MBEDTLS_ECP_INTERNAL_ALT", #endif /* MBEDTLS_ECP_INTERNAL_ALT */