Manuel Pégourié-Gonnard f2268d1c17 Reject low-order points on Curve25519 early ... We were already rejecting them at the end, due to the fact that with the usual (x, z) formulas they lead to the result (0, 0) so when we want to normalize at the end, trying to compute the modular inverse of z will give an error. If we wanted to support those points, we'd a special case in ecp_normalize_mxz(). But it's actually permitted by all sources (RFC 7748 say we MAY reject 0 as a result) and recommended by some to reject those points (either to ensure contributory behaviour, or to protect against timing attack when the underlying field arithmetic is not constant-time). Since our field arithmetic is indeed not constant-time, let's reject those points before they get mixed with sensitive data (in ecp_mul_mxz()), in order to avoid exploitable leaks caused by the special cases they would trigger. (See the "May the Fourth" paper https://eprint.iacr.org/2017/806.pdf) Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>		2021-06-25 14:06:45 +01:00
..
.gitignore
aes.c
aesni.c
arc4.c
aria.c	ARIA: add missing context init/free	2021-05-25 18:45:04 +02:00
asn1parse.c
asn1write.c
base64.c	Code style fixups	2021-03-04 14:34:50 +00:00
bignum.c	Homogenize coding patterns	2021-06-17 16:39:47 +02:00
blowfish.c
camellia.c	CAMELLIA: add missing context init/free	2021-05-25 18:45:04 +02:00
ccm.c
certs.c
chacha20.c
chachapoly.c
check_crypto_config.h	psa: config: Add CAMELLIA to the list of possible CMAC ciphers	2021-03-25 14:25:46 +01:00
cipher_wrap.c
cipher.c
cmac.c	Allow skipping 3DES in CMAC self-test when ALT implemented	2021-04-30 10:09:52 +02:00
CMakeLists.txt	Add boilerplate for dispatching MAC operations	2021-05-11 18:56:01 +02:00
common.h	Move MBEDTLS_ERR_ADD macro and functions to error.*	2021-04-13 15:21:43 +01:00
ctr_drbg.c
debug.c	Declare mbedtls_debug_print_msg as printf-like	2021-03-10 17:00:32 +00:00
des.c
dhm.c	DHM: add notes about leading zeros	2021-06-02 21:39:31 +02:00
ecdh.c
ecdsa.c	avoid "maybe-uninitialized" and "free-nonheap-object" errors/warnings with gcc11	2021-05-12 09:37:00 -04:00
ecjpake.c	ecjpake_zkp_read() now returns ...BAD_INPUT_DATA when r len == 0 and test follows that	2021-03-17 11:36:31 +01:00
ecp_curves.c	Fix low-probability arithmetic error in ECC	2021-04-04 01:10:41 +02:00
ecp_invasive.h	Move mbedtls_mpi_random to the bignum module	2021-06-02 21:31:24 +02:00
ecp.c	Reject low-order points on Curve25519 early	2021-06-25 14:06:45 +01:00
entropy_poll.c
entropy.c	Merge pull request #3616 from militant-daos/bug_3175	2021-03-30 17:33:08 +02:00
error.c	Revert "Remove deprecated things from hashing modules"	2021-04-15 12:28:15 +02:00
gcm.c
havege.c
hkdf.c
hmac_drbg.c
Makefile	Add boilerplate for dispatching MAC operations	2021-05-11 18:56:01 +02:00
md2.c	Revert "Remove deprecated things from hashing modules"	2021-04-15 12:28:15 +02:00
md4.c	Revert "Remove deprecated things from hashing modules"	2021-04-15 12:28:15 +02:00
md5.c	Revert "Remove deprecated things from hashing modules"	2021-04-15 12:28:15 +02:00
md.c	Revert "Remove deprecated things from hashing modules"	2021-04-15 12:28:15 +02:00
memory_buffer_alloc.c
mps_common.h	Capitalise MPS trace macros	2021-04-07 12:45:35 +01:00
mps_error.h	Fix Doxygen headers for MPS files	2021-03-29 14:20:18 +01:00
mps_reader.c	Capitalise MPS trace macros	2021-04-07 12:45:35 +01:00
mps_reader.h	Fix Doxygen headers for MPS files	2021-03-29 14:20:18 +01:00
mps_trace.c	Capitalise MPS trace macros	2021-04-07 12:45:35 +01:00
mps_trace.h	Capitalise MPS trace macros	2021-04-07 12:45:35 +01:00
net_sockets.c	Fix fd range for select on Windows	2021-06-20 23:17:39 +02:00
nist_kw.c	Fix null pointer arithmetic in error case	2021-06-01 11:57:18 +02:00
oid.c
padlock.c
pem.c	Apply MBEDTLS_ERROR_ADD to library	2021-04-15 11:19:47 +01:00
pk_wrap.c
pk.c
pkcs5.c	Apply MBEDTLS_ERROR_ADD to library	2021-04-15 11:19:47 +01:00
pkcs11.c
pkcs12.c	Apply MBEDTLS_ERROR_ADD to library	2021-04-15 11:19:47 +01:00
pkparse.c	Remove dead code from pk_parse_key_pkcs8_unencrypted_der	2021-04-28 14:12:07 +01:00
pkwrite.c
platform_util.c
platform.c
poly1305.c
psa_crypto_aead.c	Update all uses of old AEAD output size macros	2021-04-15 17:32:06 +02:00
psa_crypto_aead.h	psa: aead: Move AEAD driver entry points to psa_crypto_aead.c	2021-04-07 16:03:31 +02:00
psa_crypto_cipher.c	psa: cipher: Remove cipher_generate_iv driver entry point	2021-03-26 15:58:25 +01:00
psa_crypto_cipher.h	psa: cipher: Remove cipher_generate_iv driver entry point	2021-03-26 15:58:25 +01:00
psa_crypto_client.c
psa_crypto_core.h	Merge pull request #4357 from gabor-mezei-arm/3267_Implement_psa_sign_message_and_verify	2021-05-17 10:14:46 +02:00
psa_crypto_driver_wrappers.c	Fix missing compilation guard around psa_crypto_driver_wrappers.c	2021-05-19 21:03:46 +02:00
psa_crypto_driver_wrappers.h	Merge pull request #4357 from gabor-mezei-arm/3267_Implement_psa_sign_message_and_verify	2021-05-17 10:14:46 +02:00
psa_crypto_ecp.c	Move mbedtls_md_info_from_psa into the mbedtls hash driver	2021-03-15 12:14:40 +01:00
psa_crypto_ecp.h
psa_crypto_hash.c	psa: hash: Fix is_hash_accelerated signature	2021-04-01 10:50:03 +02:00
psa_crypto_hash.h	psa: include: Merge crypto_builtin_hash.h and crypto_builtin_cipher.h	2021-04-01 16:54:30 +02:00
psa_crypto_invasive.h	Rework MAC algorithm / key type validation	2021-03-03 19:58:02 +01:00
psa_crypto_its.h
psa_crypto_mac.c	Refactor out mac_sign_setup and mac_verify_setup	2021-05-11 18:56:01 +02:00
psa_crypto_mac.h	Move is_sign and mac_size checking back to PSA core scope	2021-05-11 18:56:01 +02:00
psa_crypto_random_impl.h
psa_crypto_rsa.c	psa: Support RSA signature without MBEDTLS_GENPRIME	2021-05-21 10:21:27 +01:00
psa_crypto_rsa.h
psa_crypto_se.c
psa_crypto_se.h
psa_crypto_service_integration.h
psa_crypto_slot_management.c	Minor code flow improvements	2021-04-16 11:22:17 +02:00
psa_crypto_slot_management.h	psa: Fix error code when creating/registering a key with invalid id	2021-04-01 14:05:41 +02:00
psa_crypto_storage.c
psa_crypto_storage.h
psa_crypto.c	Fix missing state check for tls12_prf output	2021-06-14 18:08:26 +02:00
psa_its_file.c	Correct fix for potential truncation	2021-03-10 17:00:32 +00:00
ripemd160.c	Revert "Remove deprecated things from hashing modules"	2021-04-15 12:28:15 +02:00
rsa_internal.c
rsa.c	Fix misc issues with unused parameters and check-names.sh	2021-04-13 15:26:59 +01:00
sha1.c	Revert "Remove deprecated things from hashing modules"	2021-04-15 12:28:15 +02:00
sha256.c	Revert "Remove deprecated things from hashing modules"	2021-04-15 12:28:15 +02:00
sha512.c	Revert "Remove deprecated things from hashing modules"	2021-04-15 12:28:15 +02:00
ssl_cache.c	Don't check ciphersuite and compression in SSL session cache lookup	2021-05-19 05:09:56 +01:00
ssl_ciphersuites.c	Fix dependencies on SHA384 cipher suites	2021-05-19 16:58:08 +02:00
ssl_cli.c	Enforce dhm_min_bitlen exactly, not just the byte size	2021-04-01 14:20:03 +02:00
ssl_cookie.c	Improve documentation for error code checking	2021-04-22 15:28:56 +01:00
ssl_invasive.h
ssl_msg.c	Fix misuse of MD API in SSL constant-flow HMAC	2021-05-19 10:40:02 +02:00
ssl_srv.c	Don't check ciphersuite and compression in SSL session cache lookup	2021-05-19 05:09:56 +01:00
ssl_ticket.c
ssl_tls13_keys.c
ssl_tls13_keys.h
ssl_tls.c	Merge pull request #4493 from netfoundry/gcc11.fixes_2.x	2021-05-20 15:54:20 +02:00
threading.c
timing.c
version_features.c	Implement support for MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS	2021-04-15 15:04:26 +02:00
version.c
x509_create.c
x509_crl.c	Apply MBEDTLS_ERROR_ADD to library	2021-04-15 11:19:47 +01:00
x509_crt.c	Apply MBEDTLS_ERROR_ADD to library	2021-04-15 11:19:47 +01:00
x509_csr.c	Apply MBEDTLS_ERROR_ADD to library	2021-04-15 11:19:47 +01:00
x509.c	Apply MBEDTLS_ERROR_ADD to library	2021-04-15 11:19:47 +01:00
x509write_crt.c	avoid "maybe-uninitialized" and "free-nonheap-object" errors/warnings with gcc11	2021-05-12 09:37:00 -04:00
x509write_csr.c	avoid "maybe-uninitialized" and "free-nonheap-object" errors/warnings with gcc11	2021-05-12 09:37:00 -04:00
xtea.c