yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-26 10:05:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3390 from piotr-now/rndelay_comment

Browse Source 
Add comment for mbedtls_platform_random_delay() and returning an FAULT_DETECTED error on potential FI attack detection
This commit is contained in:
Piotr Nowicki 2020-06-10 09:13:10 +02:00 committed by GitHub
commit c520b90507
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 37 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
library/pk.c
View File

@ -46,10 +46,9 @@
#endif /* MBEDTLS_USE_TINYCRYPT */ #endif /* MBEDTLS_USE_TINYCRYPT */
#include "mbedtls/platform_util.h" #include "mbedtls/platform_util.h"
#if defined(MBEDTLS_PLATFORM_C)
#include "mbedtls/platform.h" #include "mbedtls/platform.h"
#else
#if !defined(MBEDTLS_PLATFORM_C)
#include <stdlib.h> #include <stdlib.h>
#define mbedtls_calloc calloc #define mbedtls_calloc calloc
#define mbedtls_free free #define mbedtls_free free
@ -1561,7 +1560,7 @@ int mbedtls_pk_verify_restartable( mbedtls_pk_context *ctx,
} }
else else
{ {
verify_ret = MBEDTLS_ERR_PK_HW_ACCEL_FAILED; verify_ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
} }
} }

3
library/platform_util.c
View File

@ -190,6 +190,9 @@ void mbedtls_platform_random_delay( void )
do do
{ {
i++; i++;
/* Dummy calculations to increase the time between iterations and
* make side channel attack more difficult by reducing predictability
* of its behaviour */
shift = rn_2 & 0x07; shift = rn_2 & 0x07;
if ( i % 2 ) if ( i % 2 )
rn_2 = (uint32_t)( rn_2 >> shift | rn_2 << ( 32 - shift ) ); rn_2 = (uint32_t)( rn_2 >> shift | rn_2 << ( 32 - shift ) );

20
library/ssl_cli.c
View File

@ -27,9 +27,9 @@
#if defined(MBEDTLS_SSL_CLI_C) #if defined(MBEDTLS_SSL_CLI_C)
#if defined(MBEDTLS_PLATFORM_C)
#include "mbedtls/platform.h" #include "mbedtls/platform.h"
#else
#if !defined(MBEDTLS_PLATFORM_C)
#include <stdlib.h> #include <stdlib.h>
#define mbedtls_calloc calloc #define mbedtls_calloc calloc
#define mbedtls_free free #define mbedtls_free free
@ -724,6 +724,10 @@ static int ssl_generate_random( mbedtls_ssl_context *ssl )
ssl->handshake->hello_random_set = MBEDTLS_SSL_FI_FLAG_SET; ssl->handshake->hello_random_set = MBEDTLS_SSL_FI_FLAG_SET;
return( 0 ); return( 0 );
} }
else
{
ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
}
} }
return( ret ); return( ret );
@ -2388,6 +2392,10 @@ static int ssl_rsa_generate_partial_pms( mbedtls_ssl_context *ssl,
ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET; ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
return( 0 ); return( 0 );
} }
else
{
ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
}
} }
MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret ); MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
@ -2460,6 +2468,12 @@ static int ssl_rsa_encrypt_partial_pms( mbedtls_ssl_context *ssl,
{ {
ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET; ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
} }
else
{
ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
goto cleanup;
}
} }
else else
{ {
@ -3101,7 +3115,7 @@ static int ssl_in_server_key_exchange_parse( mbedtls_ssl_context *ssl,
} }
else else
{ {
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
} }
} }
#if defined(MBEDTLS_SSL__ECP_RESTARTABLE) #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)

8
library/ssl_srv.c
View File

@ -27,9 +27,9 @@
#if defined(MBEDTLS_SSL_SRV_C) #if defined(MBEDTLS_SSL_SRV_C)
#if defined(MBEDTLS_PLATFORM_C)
#include "mbedtls/platform.h" #include "mbedtls/platform.h"
#else
#if !defined(MBEDTLS_PLATFORM_C)
#include <stdlib.h> #include <stdlib.h>
#define mbedtls_calloc calloc #define mbedtls_calloc calloc
#define mbedtls_free free #define mbedtls_free free
@ -4659,6 +4659,10 @@ static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
goto exit; goto exit;
} }
else
{
ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
}
} }

5
library/ssl_tls.c
View File

@ -2027,8 +2027,9 @@ int mbedtls_ssl_build_pms( mbedtls_ssl_context *ssl )
} }
else else
{ {
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret ); MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret",
return( ret ); MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
} }
} }
else else

6
library/x509_crt.c
View File

@ -2936,7 +2936,7 @@ static int x509_crt_check_parent( const mbedtls_x509_crt_sig_info *sig_info,
* *
* Return value: * Return value:
* - 0 on success * - 0 on success
* - MBEDTLS_ERR_ECP_IN_PROGRESS otherwise * - MBEDTLS_ERR_ECP_IN_PROGRESS or MBEDTLS_ERR_PLATFORM_FAULT_DETECTED otherwise
*/ */
static int x509_crt_find_parent_in( static int x509_crt_find_parent_in(
mbedtls_x509_crt_sig_info const *child_sig, mbedtls_x509_crt_sig_info const *child_sig,
@ -3051,6 +3051,8 @@ check_signature:
mbedtls_platform_random_delay(); mbedtls_platform_random_delay();
if( ret_fi == 0 ) if( ret_fi == 0 )
signature_is_good = X509_SIGNATURE_IS_GOOD; signature_is_good = X509_SIGNATURE_IS_GOOD;
else
return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
} }
if( top && ! signature_is_good ) if( top && ! signature_is_good )
@ -3869,6 +3871,8 @@ exit:
mbedtls_platform_random_delay(); mbedtls_platform_random_delay();
if( flags_fi == 0 ) if( flags_fi == 0 )
return( 0 ); return( 0 );
else
return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
} }
/* Preserve the API by removing internal extra bits - from now on the /* Preserve the API by removing internal extra bits - from now on the