Commit Graph

13046 Commits

Author SHA1 Message Date
Jaeden Amero
aeb5a4af46 Merge remote-tracking branch 'origin/pr/2623' into development
* origin/pr/2623:
  Adapt ChangeLog
  Fix mpi_bigendian_to_host() on bigendian systems
2019-09-05 14:43:14 +01:00
Unknown
f094b53e8e all.sh: disable MEMORY_BUFFER_ALLOC in cmake asan build
Enabling MBEDTLS_MEMORY_BUFFER_ALLOC_C bypasses ASan leak checks
because system calloc() and free() aren't used.
2019-09-05 09:34:57 -04:00
Unknown
10d42b686a Unify gcc and clang cmake flags to test with UBsan
Previously, not all flags were supported by the gcc version that was used
(pre-4.9). Now, since the minimum version gcc version tested is 5.4, 
the flags can be unified.
2019-09-05 09:34:47 -04:00
Andrzej Kurek
dc22d8d022 Add an input check in psa_its_set 2019-09-05 09:34:34 -04:00
Jaeden Amero
4714fd8998 Merge remote-tracking branch 'origin/pr/2815' into development
* origin/pr/2815:
  ssl-opt.sh: wait for proxy to start before running the script further
2019-09-05 14:24:07 +01:00
Jaeden Amero
ba7f4d1484 Merge remote-tracking branch 'origin/pr/2771' into development
* origin/pr/2771:
  Fix copypasta in msg
  When not using PSA crypto, disable it
  Disable MEMORY_BUFFER_ALLOC with ASan
  Remove config.pl calls with no effect
2019-09-05 14:23:55 +01:00
Darryl Green
5e843fa133 Use safer deterministic function in psa_ecdsa_sign 2019-09-05 14:06:34 +01:00
Jaeden Amero
3cadc626b2
Merge pull request #242 from ArmMbedCloud/getting-started-technical-author-review
Technical author review of getting_started.md
2019-09-05 13:57:41 +01:00
Janos Follath
75f2c20f9c ECDSA: Explain limitations of constant blinding 2019-09-05 11:18:58 +01:00
Janos Follath
896a294211 Correct deterministic ECDSA behavior
We were still reusing the internal HMAC-DRBG of the deterministic ECDSA
for blinding. This meant that with cryptographically low likelyhood the
result was not the same signature as the one the deterministic ECDSA
algorithm has to produce (however it is still a valid ECDSA signature).

To correct this we seed a second HMAC-DRBG with the same seed to restore
correct behavior. We also apply a label to avoid reusing the bits of the
ephemeral key for a different purpose and reduce the chance that they
leak.

This workaround can't be implemented in the restartable case without
penalising the case where external RNG is available or completely
defeating the purpose of the restartable feature, therefore in this case
the small chance of incorrect behavior remains.
2019-09-05 11:18:58 +01:00
Janos Follath
1231d210e1 Add warning for alternative ECDSA implementations
Alternative implementations are often hardware accelerators and might
not need an RNG for blinding. But if they do, then we make them misuse
the RNG in the deterministic case.

There are several way around this:
- Exposing a lower level function for replacement. This would be the
optimal solution, but litters the API and is not backward compatible.
- Introducing a new compile time option for replacing the deterministic
function. This would mostly cover the same code as
MBEDTLS_ECDSA_DETERMINISTIC and would be yet another compile time flag.
- Reusing the existing MBEDTLS_ECDSA_DETERMINISTIC macro. This changes
the algorithm used by the PK layer from deterministic to randomised if
the alternative implementation is present.

This commit implements the third option. This is a temporary solution
and should be fixed at the next device driver API change.
2019-09-05 11:18:58 +01:00
Janos Follath
e65e0597a8 Deprecate the old deterministic ECDSA function
The current interface does not allow passing an RNG, which is needed for
blinding. Using the scheme's internal HMAC-DRBG results the same
blinding values for the same key and message, diminishing the
effectiveness of the countermeasure. A new function
`mbedtls_ecdsa_det_ext` is available to address this problem.
2019-09-05 11:18:58 +01:00
Janos Follath
651eac8c5e Make tests use the new deterministic ECDSA function
In preparation of deprecating the old and less secure deterministic
ECDSA signature function we need to remove it from the test. At the
same time, the new function needs to be tested. Modifying the tests
to use the new function achieves both of these goals.
2019-09-05 11:18:58 +01:00
Janos Follath
dca667ac80 Add a safer deterministic ECDSA function
`mbedtls_ecdsa_sign_det` reuses the internal HMAC-DRBG instance to
implement blinding. The advantage of this is that the algorithm is
deterministic too, not just the resulting signature. The drawback is
that the blinding is always the same for the same key and message.
This diminishes the efficiency of blinding and leaks information about
the private key.

A function that takes external randomness fixes this weakness.
2019-09-05 11:18:58 +01:00
Jaeden Amero
c04305f036 Merge remote-tracking branch 'crypto/development' into development-restricted
* crypto/development: (863 commits)
  crypto_platform: Fix typo
  des: Reduce number of self-test iterations
  Fix -O0 build for Aarch64 bignum multiplication.
  Make GNUC-compatible compilers use the right mbedtls_t_udbl again on Aarch64 builds.
  Add optimized bignum multiplication for Aarch64.
  Enable 64-bit limbs for all Aarch64 builds.
  HMAC DRBG: Split entropy-gathering requests to reduce request sizes
  psa: Use application key ID where necessary
  psa: Adapt set_key_id() for when owner is included
  psa: Add PSA_KEY_ID_INIT
  psa: Don't duplicate policy initializer
  crypto_extra: Use const seed for entropy injection
  getting_started: Update for PSA Crypto API 1.0b3
  Editorial fixes.
  Cross reference 'key handles' from INVALID_HANDLE
  Update documentation for psa_destroy_key
  Update documentation for psa_close_key
  Update psa_open_key documentation
  Remove duplicated information in psa_open_key
  Initialize key bits to max size + 1 in psa_import_key
  ...
2019-09-05 11:11:38 +01:00
Adrian L. Shaw
8619f8cd07 Remove storage errors from psa_generate_random 2019-09-05 10:37:22 +01:00
Guy Wild
2900811b01
Update getting_started.md 2019-09-05 11:38:14 +03:00
Andrew Thoelke
de183416f8 Update the behavior of key handles
* open output distinct key handles
* each handle must be closed
* destroying a key does not invalidate other handles
* closing a key can/might fail an active operation (but not required)
2019-09-05 09:38:06 +01:00
Guy Wild
ce56077f97
Update based on Jaeden's comments. 2019-09-05 11:35:16 +03:00
Guy Wild
5b1347a59e Update getting_started.md 2019-09-05 09:46:31 +03:00
Adrian L. Shaw
3b5975641e Fix return code warnings
- Remove STORAGE_FAILURE from hash and abort functions
- Remove BUFFER_TOO_SMALL from psa_mac_verify
2019-09-04 19:20:32 +01:00
Gilles Peskine
545c28bf70 Fix URL of ATECC driver 2019-09-04 19:41:16 +02:00
Gilles Peskine
92bcfdbb66 Write secure element driver interface test strategy 2019-09-04 19:26:50 +02:00
Gilles Peskine
b26c8d8bb4 Create a driver interface test strategy document
Just the structure for now, no actual content.
2019-09-04 19:26:17 +02:00
Jaeden Amero
8096969905
Merge pull request #139 from Patater/des-faster-and-typo-fix
Make DES self-test faster, and fix a typo
2019-09-04 12:18:39 +01:00
Guy Wild
2a9e9f7d52 Update getting_started.md 2019-09-04 13:45:54 +03:00
Adrian L. Shaw
fa2cefa001 Fix warnings 2019-09-04 11:36:15 +01:00
Adrian L. Shaw
f483973c37 Add PSA_ERROR_STORAGE_FAILURE to psa_cipher_generate_iv 2019-09-04 11:35:32 +01:00
Adrian L. Shaw
599c712668 Remove errorneous insert 2019-09-04 11:35:32 +01:00
Adrian L. Shaw
1505b2108a Add STORAGE_FAILURE everywhere + add missing codes 2019-09-04 11:35:32 +01:00
Adrian L. Shaw
1f1e1a5253 Add storage failure to psa_mac_verify_finish 2019-09-04 11:35:32 +01:00
Adrian L. Shaw
56b32b126c Add storage failure to psa_mac_sign_finish 2019-09-04 11:35:32 +01:00
Adrian L. Shaw
22bc8fff0c Add PSA_ERROR_STORAGE_FAILURE to psa_aead_*_setup functions 2019-09-04 11:35:06 +01:00
Adrian L. Shaw
8f7cd1ee55 Added PSA_ERROR_BAD_STATE to functions with operations
In the case that the operation object has not been initialized
appropriately.
2019-09-04 11:34:22 +01:00
Adrian L. Shaw
97d3bc3674 Added extra bad state case to psa_hash_setup 2019-09-04 11:34:22 +01:00
Adrian L. Shaw
2364924619 Add missing return codes to psa_generate_key 2019-09-04 11:34:22 +01:00
Adrian L. Shaw
1f42a84a13 Add PSA_ERROR_BUFFER_TOO_SMALL to psa_mac_compute 2019-09-04 11:33:32 +01:00
Vikas Katariya
52fa174a5a Check for zero length and NULL buffer pointer.
In reference to issue https://github.com/ARMmbed/mbed-crypto/issues/49
2019-09-04 11:31:35 +01:00
Adrian L. Shaw
650229ba38 Added PSA_ERROR_STORAGE_FAILURE to psa_mac_compute
In case the key could not be retrieved from
storage.
2019-09-04 11:31:14 +01:00
Adrian L. Shaw
2a889781c5 Add PSA_ERROR_STORAGE_FAILURE to psa_export_public_key
The same reason that it is included in psa_export_key
2019-09-04 11:31:14 +01:00
Adrian L. Shaw
11638b99a0 Added PSA_ERROR_INSUFFICIENT_MEMORY to psa_export_public_key
For the same reasons that psa_export_key can fail with this error
2019-09-04 11:31:14 +01:00
Adrian L. Shaw
7f1863c905 Add PSA_ERROR_INSUFFICIENT_MEMORY to psa_export_key
It may be possible that the implementation runs out of
memory when exporting a key from storage or a secure
element. For example, it may not be possible to directly
move the data from storage to the caller, so the implementation
will have to buffer the material temporarily (an issue if dynamic
memory allocation scheme is used). For a large key
this is more likely to return.
2019-09-04 11:31:14 +01:00
Adrian L. Shaw
15731c1422 Added PSA_ERROR_STORAGE_FAILURE to psa_export_key
It may be possible that an implementation does not
fetch key material until a command like
this is called and such an error may occur if an
off-chip secure storage dependency may have been wiped.
2019-09-04 11:31:14 +01:00
Adrian L. Shaw
23c006f45e Added missing return codes to get_key_attributes
Note that PSA_ERROR_NOT_PERMITTED is not included
because I can't think of a scenario where you have
a valid key handle but aren't allowed to read the
attributes
2019-09-04 11:31:14 +01:00
Adrian L. Shaw
39797aa34c Fix erroneous cut and paste 2019-09-04 11:30:18 +01:00
Adrian L. Shaw
fbf7f121f9 Separate return codes for unsupported and invalid algorithms 2019-09-04 11:30:18 +01:00
Adrian L. Shaw
66200c4e98 Add PSA_ERROR_STORAGE_FAILURE to psa_cipher_generate_iv 2019-09-04 11:30:18 +01:00
Adrian L. Shaw
f97c8523ee Add CORRUPTION_DETECTED to psa_close_key 2019-09-04 11:30:18 +01:00
Adrian L. Shaw
6725757cec Remove errorneous insert 2019-09-04 11:30:18 +01:00
Adrian L. Shaw
484ba88a0f Add STORAGE_FAILURE everywhere + add missing codes 2019-09-04 11:30:18 +01:00