Commit Graph

7954 Commits

Author SHA1 Message Date
Gilles Peskine
ef30742a27 Clarify "as directed here" in SSL async callback documentation 2018-06-14 13:26:51 +02:00
Gilles Peskine
7457933a04 SSL async callbacks documentation: clarify resource cleanup
Clarify when resume must clean up resources and when cancel is called.
2018-06-14 13:26:51 +02:00
Gilles Peskine
3dae1cfa3a Async callback: use mbedtls_pk_check_pair to compare keys
In the current test code, the object that is used as a public key in
the certificate also contains a private key. However this is because
of the way the stest code is built and does not demonstrate the API in
a useful way. Use mbedtls_pk_check_pair, which is not what real-world
code would do (since the private key would typically be in an external
cryptoprocessor) but is a more representative placeholder.
2018-06-14 13:26:51 +02:00
Gilles Peskine
a668c60186 Rename mbedtls_ssl_async_{get,set}_data for clarity
Rename to mbedtls_ssl_get_async_operation_data and
mbedtls_ssl_set_async_operation_data so that they're about
"async operation data" and not about some not-obvious "data".
2018-06-14 13:26:51 +02:00
Gilles Peskine
02b86d0415 Fix copypasta in the async callback documentation 2018-06-14 13:26:51 +02:00
Gilles Peskine
166ce748cf SSL async callback: cert is not always from mbedtls_ssl_conf_own_cert
The certificate passed to async callbacks may not be the one set by
mbedtls_ssl_conf_own_cert. For example, when using an SNI callback,
it's whatever the callback is using. Document this, and add a test
case (and code sample) with SNI.
2018-06-14 13:26:51 +02:00
Gilles Peskine
d6fbfde994 ssl_async_set_key: detect if ctx->slots overflows 2018-06-14 13:26:51 +02:00
Gilles Peskine
07981585d3 Fix missing continuation indicator in ssl-opt.sh 2018-06-14 13:26:51 +02:00
Gilles Peskine
20e2bdf4b0 SSL async tests: tighten a few log checks in some test cases 2018-06-14 13:26:51 +02:00
Gilles Peskine
94e153af77 Improve documentation of the async callback's crypto parameters 2018-06-14 13:26:51 +02:00
Gilles Peskine
37d417561d Add test case for SSL async resume after resume
Add a test case for SSL asynchronous signature where f_async_resume is
called twice. Verify that f_async_sign_start is only called once.

This serves as a non-regression test for a bug where f_async_sign_start
was only called once, which turned out to be due to a stale build
artifacts with mismatched numerical values of
MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS.
2018-06-14 13:26:51 +02:00
Gilles Peskine
4d9ec4dcf7 Fix uninitialized variable in ssl_server2 2018-06-14 13:26:51 +02:00
Gilles Peskine
6331d78675 Don't use the printf format %zd
We target C89 libc, so don't use %zd or %zu. Just use %u, and make
slot numbers `unsigned` for simplicity.
2018-06-14 13:26:51 +02:00
Gilles Peskine
03af7f6ae7 Change boolean bitfield to unsigned
Reminder to self: 1 is not a valid value in a 1-bit bitfield. It's
undefined behavior and gcc -ansi -pedantic helpfully complains about it.
2018-06-14 13:26:51 +02:00
Jaeden Amero
ff2f493432 config: List cipher modes in alphabetical order
Keeping the cipher modes list in alphabetical order makes it easier to
find things. Move OFB and XTS to their appropriate locations in the
list.
2018-06-14 11:42:27 +01:00
Simon Butcher
4ab8acd696 Merge remote-tracking branch 'public/pr/1075' into development 2018-06-14 10:34:44 +01:00
Simon Butcher
6ac1cf6f5f Merge remote-tracking branch 'public/pr/1182' into development 2018-06-14 10:33:29 +01:00
Simon Butcher
e5cd86874e Add ChangeLog entry for PR #1555
Adds ChangeLog entry for PR #1555, 'Only redefine _WIN32_WINNT macro when <
0x0501'
2018-06-14 10:30:19 +01:00
Simon Butcher
c1bf1aaee5 Merge remote-tracking branch 'public/pr/1555' into development 2018-06-14 10:24:56 +01:00
Simon Butcher
73a4b80475 Merge remote-tracking branch 'public/pr/1672' into development 2018-06-14 10:24:02 +01:00
Simon Butcher
9a8db56959 Merge remote-tracking branch 'public/pr/1730' into development 2018-06-14 10:23:29 +01:00
Simon Butcher
2ff0e52087 Fix missing preprocessor condition in AES self-test
The AES OFB self-test made use of a variable `offset` but failed to have a
preprocessor condition around it, so unless CTR and CBC were enabled, the
variable would be undeclared.
2018-06-14 09:57:07 +01:00
Philippe Antoine
c03059db42 Simplify code in mbedtls_x509_csr_parse 2018-06-14 07:35:11 +02:00
Gilles Peskine
0a8352b4c2 Fix harmless use of uninitialized memory in ssl_parse_encrypted_pms
In ssl_parse_encrypted_pms, some operational failures from
ssl_decrypt_encrypted_pms lead to diff being set to a value that
depended on some uninitialized unsigned char and size_t values. This didn't
affect the behavior of the program (assuming an implementation with no
trap values for size_t) because all that matters is whether diff is 0,
but Valgrind rightfully complained about the use of uninitialized
memory. Behave nicely and initialize the offending memory.
2018-06-13 18:21:25 +02:00
Gilles Peskine
725f1cb6bd SSL async tests: add a few test cases for error in decrypt
The code paths in the library are different for decryption and for
signature. Improve the test coverage by doing some error path tests
for decryption in addition to signature.
2018-06-13 18:10:41 +02:00
Gilles Peskine
3f3ada8839 Fix memory leak in ssl_server2 with SNI + async callback
In ssl_server2, the private key objects are normally local variables
of the main function. However this does not hold for private keys in
the SNI configuration. When async callbacks are used, the test code
transfers the ownership of the private keys to the async callbacks.
Therefore the test code must free the SNI private keys through the
async callbacks (but it must not free the straight private keys this
way since they are not even heap-allocated).
2018-06-13 18:09:28 +02:00
Gilles Peskine
157f6d8f74 SNI + SSL async callback: make all keys async
When testing async callbacks with SNI, make all the keys async, not
just the first one. Otherwise the test is fragile with respect to
whether a key is used directly or through the async callbacks.
2018-06-13 18:06:51 +02:00
Jaeden Amero
d906b818f3 tests: cipher: Allocate enough space for XTS keys
XTS keys can be double the size, since XTS uses two keys concatenated
together as a key (one for the tweak, one for encryption).
2018-06-13 12:16:25 +01:00
Jaeden Amero
09317083b5 benchmark: Add comma at end of help message
The help message was missing a comma after "hmac_drbg". Add the missing
comma.
2018-06-13 12:16:25 +01:00
Jaeden Amero
f4474e79ef ChangeLog: Add an entry for AES-XTS 2018-06-13 12:14:41 +01:00
Jaeden Amero
ed91a79c4b config: Update documentation for XTS option
The XTS configuration option MBEDTLS_CIPHER_MODE_XTS currently only enables
XTS for AES. So, don't say it enables XTS for "symmetric ciphers", just
AES. This helps to avoid being misleading.
2018-06-13 12:13:58 +01:00
Jaeden Amero
c28012acdd tests: Remove NIST AES-XTS test vectors
The IEEE P1619 XTS test vectors should suffice. Remove the NIST test
vectors.
2018-06-13 12:13:58 +01:00
Jaeden Amero
142383e25b aes: xts: Add tests for invalid key sizes
Test that we get the error we expect when using various valid and invalid
keysizes with mbedtls_aes_xts_setkey_enc() and
mbedtls_aes_xts_setkey_dec().
2018-06-13 12:13:58 +01:00
Jaeden Amero
8cfc75f603 aes: xts: Fix style issues with gf128mul 2018-06-13 12:13:58 +01:00
Jaeden Amero
5f0b06aeda aes: xts: Fix description of gf128mul
THe function `mbedtls_gf128mul_x_ble()` doesn't multiply by x, x^4, and
x^8. Update the function description to properly describe what the function
does.
2018-06-13 12:13:58 +01:00
Jaeden Amero
f167deb6e0 aes: xts: Add a reference to the standard
It's useful to add a reference to the standard one implements. Add a
reference to the AES-XTS standard to the top of `aes.h`.
2018-06-13 12:13:58 +01:00
Jaeden Amero
c653990ed5 cipher: Add wrappers for AES-XTS
AES-XTS does not support multipart use as it can only operate on an entire
sector at a time.
2018-06-13 12:13:56 +01:00
Jaeden Amero
425382d4fb tests: Extend AES-XTS suite
Extend the existing test suite for AES-XTS with checks for error reporting
and the IEEE P1619/D16 test vectors.
2018-06-13 12:05:04 +01:00
Jaeden Amero
e5c4b07b92 tests: Make AES-XTS suite more stack friendly
Remove stack-allocated buffers from the AES-XTS test suites.
2018-06-13 12:05:04 +01:00
Jaeden Amero
21d79cf947 aes: Add self test for AES-XTS 2018-06-13 12:05:04 +01:00
Jaeden Amero
cd9fc5e541 aes: xts: Rename iv to data_unit
XTS doesn't have an IV, it has a "Data Unit". Rename iv for parity with the
XTS standard.
2018-06-13 12:05:04 +01:00
Jaeden Amero
d82cd860b2 aes: xts: Rewrite to avoid use of goto
The flow was a bit hard to follow with the `goto` everywhere. Rewrite the
XTS implementation to avoid the use of `goto`.
2018-06-13 12:05:04 +01:00
Jaeden Amero
0a8b02087a aes: xts: Enforce NIST SP 800-38E data unit size
NIST SP 800-38E requites the data unit size be limited to at most 2^20 AES
blocks in size. Enforce this restriction.
2018-06-13 12:05:04 +01:00
Jaeden Amero
5162b932a2 aes: Use length instead of bits_length in XTS
mbedtls_aes_crypt_xts() currently takes a `bits_length` parameter, unlike
the other block modes. Change the parameter to accept a bytes length
instead, as the `bits_length` parameter is not actually ever used in the
current implementation.
2018-06-13 12:05:04 +01:00
Jaeden Amero
9366feb504 aes: xts: Add new context structure
Add a new context structure for XTS. Adjust the API for XTS to use the new
context structure, including tests suites and the benchmark program. Update
Doxgen documentation accordingly.
2018-06-13 12:05:04 +01:00
Jaeden Amero
e22ba80e7b Add XTS test suites to the Makefile 2018-06-13 12:05:01 +01:00
Jaeden Amero
e9ecf00007 aes: Remove AES-XEX
AES-XEX is a building block for other cryptographic standards and not yet a
standard in and of itself. We'll just provide the standardized AES-XTS
algorithm, and not AES-XEX. The AES-XTS algorithm and interface provided
can be used to perform the AES-XEX algorithm when the length of the input
is a multiple of the AES block size.
2018-06-13 12:03:29 +01:00
Jaeden Amero
010c2cb456 gf128mul: Inline instead of making a new module 2018-06-13 12:03:29 +01:00
Jaeden Amero
97cc3b1354 gf128mul: Remove the jump table
If we're unlucky with memory placement, gf128mul_table_bbe may spread over
two cache lines and this would leak b >> 63 to a cache timing attack.
Instead, take an approach that is less likely to make different memory
loads depending on the value of b >> 63 and is also unlikely to be compiled
to a condition.
2018-06-13 12:03:29 +01:00
Aorimn
5f77801ac3 Implement AES-XTS mode
XTS mode is fully known as "xor-encrypt-xor with ciphertext-stealing".
This is the generalization of the XEX mode.
This implementation is limited to an 8-bits (1 byte) boundary, which
doesn't seem to be what was thought considering some test vectors [1].

This commit comes with tests, extracted from [1], and benchmarks.
Although, benchmarks aren't really nice here, as they work with a buffer
of a multiple of 16 bytes, which isn't a challenge for XTS compared to
XEX.

[1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/XTSTestVectors.zip
2018-06-13 12:03:27 +01:00