yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-25 17:55:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

Only exercise Brainpool curve keys on one algorithm

Browse Source 
There's nothing wrong with ECC keys on Brainpool curves,
but operations with them are very slow. So we only exercise them
with a single algorithm, not with all possible hashes. We do
exercise other curves with all algorithms so test coverage is
perfectly adequate like this.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2022-03-19 15:36:09 +01:00
parent cb451702b4
commit 8ddced5b1b
2 changed files with 340 additions and 331 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
tests/scripts/generate_psa_tests.py
View File

@ -517,13 +517,14 @@ class StorageFormat:
self.forward = forward #type: bool self.forward = forward #type: bool
RSA_OAEP_RE = re.compile(r'PSA_ALG_RSA_OAEP\((.*)\)\Z') RSA_OAEP_RE = re.compile(r'PSA_ALG_RSA_OAEP\((.*)\)\Z')
BRAINPOOL_RE = re.compile(r'PSA_KEY_TYPE_\w+\(PSA_ECC_FAMILY_BRAINPOOL_\w+\)\Z')
@classmethod @classmethod
def valid_key_size_for_algorithm( def exercise_key_with_algorithm(
cls, cls,
key_type: psa_storage.Expr, bits: int, key_type: psa_storage.Expr, bits: int,
alg: psa_storage.Expr alg: psa_storage.Expr
) -> bool: ) -> bool:
"""Whether the given key type and size are valid for the algorithm. """Whether to the given key with the given algorithm.
Normally only the type and algorithm matter for compatibility, and Normally only the type and algorithm matter for compatibility, and
this is handled in crypto_knowledge.KeyType.can_do(). This function this is handled in crypto_knowledge.KeyType.can_do(). This function
@ -531,7 +532,13 @@ class StorageFormat:
are not tested in OpFail and should therefore have manually written are not tested in OpFail and should therefore have manually written
test cases. test cases.
""" """
#pylint: disable=unused-argument # Some test keys have the RAW_DATA type and attributes that don't
# necessarily make sense. We do this to validate numerical
# encodings of the attributes.
# Raw data keys have no useful exercise anyway so there is no
# loss of test coverage.
if key_type.string == 'PSA_KEY_TYPE_RAW_DATA':
return False
# OAEP requires room for two hashes plus wrapping # OAEP requires room for two hashes plus wrapping
m = cls.RSA_OAEP_RE.match(alg.string) m = cls.RSA_OAEP_RE.match(alg.string)
if m: if m:
@ -540,6 +547,14 @@ class StorageFormat:
key_length = (bits + 7) // 8 key_length = (bits + 7) // 8
# Leave enough room for at least one byte of plaintext # Leave enough room for at least one byte of plaintext
return key_length > 2 * hash_length + 2 return key_length > 2 * hash_length + 2
# There's nothing wrong with ECC keys on Brainpool curves,
# but operations with them are very slow. So we only exercise them
# with a single algorithm, not with all possible hashes. We do
# exercise other curves with all algorithms so test coverage is
# perfectly adequate like this.
m = cls.BRAINPOOL_RE.match(key_type.string)
if m and alg.string != 'PSA_ALG_ECDSA_ANY':
return False
return True return True
def make_test_case(self, key: StorageTestData) -> test_case.TestCase: def make_test_case(self, key: StorageTestData) -> test_case.TestCase:
@ -565,13 +580,7 @@ class StorageFormat:
extra_arguments = [] extra_arguments = []
else: else:
flags = [] flags = []
# Some test keys have the RAW_DATA type and attributes that don't if self.exercise_key_with_algorithm(key.type, key.bits, key.alg):
# necessarily make sense. We do this to validate numerical
# encodings of the attributes.
# Raw data keys have no useful exercise anyway so there is no
# loss of test coverage.
if key.type.string != 'PSA_KEY_TYPE_RAW_DATA' and \
self.valid_key_size_for_algorithm(key.type, key.bits, key.alg):
flags.append('TEST_FLAG_EXERCISE') flags.append('TEST_FLAG_EXERCISE')
if 'READ_ONLY' in key.lifetime.string: if 'READ_ONLY' in key.lifetime.string:
flags.append('TEST_FLAG_READ_ONLY') flags.append('TEST_FLAG_READ_ONLY')

642
tests/suites/test_suite_psa_crypto_storage_format.v0.data
View File

File diff suppressed because it is too large Load Diff