Merge branch 'development-restricted' into mbedtls-2.23.0r0
This commit is contained in:
commit
4d1884916b
12 changed files with 341 additions and 5 deletions
15
ChangeLog.d/ecp-internal-rng.txt
Normal file
15
ChangeLog.d/ecp-internal-rng.txt
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
Changes
|
||||||
|
* The ECP module, enabled by `MBEDTLS_ECP_C`, now depends on
|
||||||
|
`MBEDTLS_CTR_DRBG_C` or `MBEDTLS_HMAC_DRBG_C` for some side-channel
|
||||||
|
coutermeasures. If side channels are not a concern, this dependency can
|
||||||
|
be avoided by enabling the new option `MBEDTLS_ECP_NO_INTERNAL_RNG`.
|
||||||
|
|
||||||
|
Security
|
||||||
|
* Fix side channel in mbedtls_ecp_check_pub_priv() and
|
||||||
|
mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a
|
||||||
|
private key that didn't include the uncompressed public key), as well as
|
||||||
|
mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL
|
||||||
|
f_rng argument. An attacker with access to precise enough timing and
|
||||||
|
memory access information (typically an untrusted operating system
|
||||||
|
attacking a secure enclave) could fully recover the ECC private key.
|
||||||
|
Found and reported by Alejandro Cabrera Aldaya and Billy Brumley.
|
7
ChangeLog.d/l13-hw-accel.txt
Normal file
7
ChangeLog.d/l13-hw-accel.txt
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
Security
|
||||||
|
* Fix issue in Lucky 13 counter-measure that could make it ineffective when
|
||||||
|
hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT
|
||||||
|
macros). This would cause the original Lucky 13 attack to be possible in
|
||||||
|
those configurations, allowing an active network attacker to recover
|
||||||
|
plaintext after repeated timing measurements under some conditions.
|
||||||
|
Reported and fix suggested by Luc Perneel in #3246.
|
|
@ -156,6 +156,14 @@
|
||||||
#error "MBEDTLS_ECP_C defined, but not all prerequisites"
|
#error "MBEDTLS_ECP_C defined, but not all prerequisites"
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
#if defined(MBEDTLS_ECP_C) && !( \
|
||||||
|
defined(MBEDTLS_ECP_ALT) || \
|
||||||
|
defined(MBEDTLS_CTR_DRBG_C) || \
|
||||||
|
defined(MBEDTLS_HMAC_DRBG_C) || \
|
||||||
|
defined(MBEDTLS_ECP_NO_INTERNAL_RNG))
|
||||||
|
#error "MBEDTLS_ECP_C requires a DRBG module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
|
||||||
|
#endif
|
||||||
|
|
||||||
#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)
|
#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)
|
||||||
#error "MBEDTLS_PK_PARSE_C defined, but not all prerequesites"
|
#error "MBEDTLS_PK_PARSE_C defined, but not all prerequesites"
|
||||||
#endif
|
#endif
|
||||||
|
|
|
@ -781,6 +781,28 @@
|
||||||
*/
|
*/
|
||||||
#define MBEDTLS_ECP_NIST_OPTIM
|
#define MBEDTLS_ECP_NIST_OPTIM
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||||
|
*
|
||||||
|
* When this option is disabled, mbedtls_ecp_mul() will make use of an
|
||||||
|
* internal RNG when called with a NULL \c f_rng argument, in order to protect
|
||||||
|
* against some side-channel attacks.
|
||||||
|
*
|
||||||
|
* This protection introduces a dependency of the ECP module on one of the
|
||||||
|
* DRBG modules. For very constrained implementations that don't require this
|
||||||
|
* protection (for example, because you're only doing signature verification,
|
||||||
|
* so not manipulating any secret, or because local/physical side-channel
|
||||||
|
* attacks are outside your threat model), it might be desirable to get rid of
|
||||||
|
* that dependency.
|
||||||
|
*
|
||||||
|
* \warning Enabling this option makes some uses of ECP vulnerable to some
|
||||||
|
* side-channel attacks. Only enable it if you know that's not a problem for
|
||||||
|
* your use case.
|
||||||
|
*
|
||||||
|
* Uncomment this macro to disable some counter-measures in ECP.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* \def MBEDTLS_ECP_RESTARTABLE
|
* \def MBEDTLS_ECP_RESTARTABLE
|
||||||
*
|
*
|
||||||
|
|
|
@ -846,6 +846,9 @@ int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group *grp,
|
||||||
* intermediate results to prevent potential timing attacks
|
* intermediate results to prevent potential timing attacks
|
||||||
* targeting these results. We recommend always providing
|
* targeting these results. We recommend always providing
|
||||||
* a non-NULL \p f_rng. The overhead is negligible.
|
* a non-NULL \p f_rng. The overhead is negligible.
|
||||||
|
* Note: unless #MBEDTLS_ECP_NO_INTERNAL_RNG is defined, when
|
||||||
|
* \p f_rng is NULL, an internal RNG (seeded from the value
|
||||||
|
* of \p m) will be used instead.
|
||||||
*
|
*
|
||||||
* \param grp The ECP group to use.
|
* \param grp The ECP group to use.
|
||||||
* This must be initialized and have group parameters
|
* This must be initialized and have group parameters
|
||||||
|
|
|
@ -104,6 +104,8 @@ typedef struct mbedtls_md_context_t
|
||||||
* \brief This function returns the list of digests supported by the
|
* \brief This function returns the list of digests supported by the
|
||||||
* generic digest module.
|
* generic digest module.
|
||||||
*
|
*
|
||||||
|
* \note The list starts with the strongest available hashes.
|
||||||
|
*
|
||||||
* \return A statically allocated array of digests. Each element
|
* \return A statically allocated array of digests. Each element
|
||||||
* in the returned list is an integer belonging to the
|
* in the returned list is an integer belonging to the
|
||||||
* message-digest enumeration #mbedtls_md_type_t.
|
* message-digest enumeration #mbedtls_md_type_t.
|
||||||
|
|
229
library/ecp.c
229
library/ecp.c
|
@ -105,6 +105,16 @@
|
||||||
|
|
||||||
#include "mbedtls/ecp_internal.h"
|
#include "mbedtls/ecp_internal.h"
|
||||||
|
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
#if defined(MBEDTLS_HMAC_DRBG_C)
|
||||||
|
#include "mbedtls/hmac_drbg.h"
|
||||||
|
#elif defined(MBEDTLS_CTR_DRBG_C)
|
||||||
|
#include "mbedtls/ctr_drbg.h"
|
||||||
|
#else
|
||||||
|
#error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
|
||||||
|
#endif
|
||||||
|
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||||
|
|
||||||
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
||||||
!defined(inline) && !defined(__cplusplus)
|
!defined(inline) && !defined(__cplusplus)
|
||||||
#define inline __inline
|
#define inline __inline
|
||||||
|
@ -118,6 +128,144 @@
|
||||||
static unsigned long add_count, dbl_count, mul_count;
|
static unsigned long add_count, dbl_count, mul_count;
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
/*
|
||||||
|
* Currently ecp_mul() takes a RNG function as an argument, used for
|
||||||
|
* side-channel protection, but it can be NULL. The initial reasoning was
|
||||||
|
* that people will pass non-NULL RNG when they care about side-channels, but
|
||||||
|
* unfortunately we have some APIs that call ecp_mul() with a NULL RNG, with
|
||||||
|
* no opportunity for the user to do anything about it.
|
||||||
|
*
|
||||||
|
* The obvious strategies for addressing that include:
|
||||||
|
* - change those APIs so that they take RNG arguments;
|
||||||
|
* - require a global RNG to be available to all crypto modules.
|
||||||
|
*
|
||||||
|
* Unfortunately those would break compatibility. So what we do instead is
|
||||||
|
* have our own internal DRBG instance, seeded from the secret scalar.
|
||||||
|
*
|
||||||
|
* The following is a light-weight abstraction layer for doing that with
|
||||||
|
* HMAC_DRBG (first choice) or CTR_DRBG.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#if defined(MBEDTLS_HMAC_DRBG_C)
|
||||||
|
|
||||||
|
/* DRBG context type */
|
||||||
|
typedef mbedtls_hmac_drbg_context ecp_drbg_context;
|
||||||
|
|
||||||
|
/* DRBG context init */
|
||||||
|
static inline void ecp_drbg_init( ecp_drbg_context *ctx )
|
||||||
|
{
|
||||||
|
mbedtls_hmac_drbg_init( ctx );
|
||||||
|
}
|
||||||
|
|
||||||
|
/* DRBG context free */
|
||||||
|
static inline void ecp_drbg_free( ecp_drbg_context *ctx )
|
||||||
|
{
|
||||||
|
mbedtls_hmac_drbg_free( ctx );
|
||||||
|
}
|
||||||
|
|
||||||
|
/* DRBG function */
|
||||||
|
static inline int ecp_drbg_random( void *p_rng,
|
||||||
|
unsigned char *output, size_t output_len )
|
||||||
|
{
|
||||||
|
return( mbedtls_hmac_drbg_random( p_rng, output, output_len ) );
|
||||||
|
}
|
||||||
|
|
||||||
|
/* DRBG context seeding */
|
||||||
|
static int ecp_drbg_seed( ecp_drbg_context *ctx,
|
||||||
|
const mbedtls_mpi *secret, size_t secret_len )
|
||||||
|
{
|
||||||
|
int ret;
|
||||||
|
unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES];
|
||||||
|
/* The list starts with strong hashes */
|
||||||
|
const mbedtls_md_type_t md_type = mbedtls_md_list()[0];
|
||||||
|
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_type );
|
||||||
|
|
||||||
|
if( secret_len > MBEDTLS_ECP_MAX_BYTES )
|
||||||
|
{
|
||||||
|
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret,
|
||||||
|
secret_bytes, secret_len ) );
|
||||||
|
|
||||||
|
ret = mbedtls_hmac_drbg_seed_buf( ctx, md_info, secret_bytes, secret_len );
|
||||||
|
|
||||||
|
cleanup:
|
||||||
|
mbedtls_platform_zeroize( secret_bytes, secret_len );
|
||||||
|
|
||||||
|
return( ret );
|
||||||
|
}
|
||||||
|
|
||||||
|
#elif defined(MBEDTLS_CTR_DRBG_C)
|
||||||
|
|
||||||
|
/* DRBG context type */
|
||||||
|
typedef mbedtls_ctr_drbg_context ecp_drbg_context;
|
||||||
|
|
||||||
|
/* DRBG context init */
|
||||||
|
static inline void ecp_drbg_init( ecp_drbg_context *ctx )
|
||||||
|
{
|
||||||
|
mbedtls_ctr_drbg_init( ctx );
|
||||||
|
}
|
||||||
|
|
||||||
|
/* DRBG context free */
|
||||||
|
static inline void ecp_drbg_free( ecp_drbg_context *ctx )
|
||||||
|
{
|
||||||
|
mbedtls_ctr_drbg_free( ctx );
|
||||||
|
}
|
||||||
|
|
||||||
|
/* DRBG function */
|
||||||
|
static inline int ecp_drbg_random( void *p_rng,
|
||||||
|
unsigned char *output, size_t output_len )
|
||||||
|
{
|
||||||
|
return( mbedtls_ctr_drbg_random( p_rng, output, output_len ) );
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Since CTR_DRBG doesn't have a seed_buf() function the way HMAC_DRBG does,
|
||||||
|
* we need to pass an entropy function when seeding. So we use a dummy
|
||||||
|
* function for that, and pass the actual entropy as customisation string.
|
||||||
|
* (During seeding of CTR_DRBG the entropy input and customisation string are
|
||||||
|
* concatenated before being used to update the secret state.)
|
||||||
|
*/
|
||||||
|
static int ecp_ctr_drbg_null_entropy(void *ctx, unsigned char *out, size_t len)
|
||||||
|
{
|
||||||
|
(void) ctx;
|
||||||
|
memset( out, 0, len );
|
||||||
|
return( 0 );
|
||||||
|
}
|
||||||
|
|
||||||
|
/* DRBG context seeding */
|
||||||
|
static int ecp_drbg_seed( ecp_drbg_context *ctx,
|
||||||
|
const mbedtls_mpi *secret, size_t secret_len )
|
||||||
|
{
|
||||||
|
int ret;
|
||||||
|
unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES];
|
||||||
|
|
||||||
|
if( secret_len > MBEDTLS_ECP_MAX_BYTES )
|
||||||
|
{
|
||||||
|
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret,
|
||||||
|
secret_bytes, secret_len ) );
|
||||||
|
|
||||||
|
ret = mbedtls_ctr_drbg_seed( ctx, ecp_ctr_drbg_null_entropy, NULL,
|
||||||
|
secret_bytes, secret_len );
|
||||||
|
|
||||||
|
cleanup:
|
||||||
|
mbedtls_platform_zeroize( secret_bytes, secret_len );
|
||||||
|
|
||||||
|
return( ret );
|
||||||
|
}
|
||||||
|
|
||||||
|
#else
|
||||||
|
#error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
|
||||||
|
#endif /* DRBG modules */
|
||||||
|
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||||
|
|
||||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||||
/*
|
/*
|
||||||
* Maximum number of "basic operations" to be done in a row.
|
* Maximum number of "basic operations" to be done in a row.
|
||||||
|
@ -165,6 +313,10 @@ struct mbedtls_ecp_restart_mul
|
||||||
ecp_rsm_comb_core, /* ecp_mul_comb_core() */
|
ecp_rsm_comb_core, /* ecp_mul_comb_core() */
|
||||||
ecp_rsm_final_norm, /* do the final normalization */
|
ecp_rsm_final_norm, /* do the final normalization */
|
||||||
} state;
|
} state;
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
ecp_drbg_context drbg_ctx;
|
||||||
|
unsigned char drbg_seeded;
|
||||||
|
#endif
|
||||||
};
|
};
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -177,6 +329,10 @@ static void ecp_restart_rsm_init( mbedtls_ecp_restart_mul_ctx *ctx )
|
||||||
ctx->T = NULL;
|
ctx->T = NULL;
|
||||||
ctx->T_size = 0;
|
ctx->T_size = 0;
|
||||||
ctx->state = ecp_rsm_init;
|
ctx->state = ecp_rsm_init;
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
ecp_drbg_init( &ctx->drbg_ctx );
|
||||||
|
ctx->drbg_seeded = 0;
|
||||||
|
#endif
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -198,6 +354,10 @@ static void ecp_restart_rsm_free( mbedtls_ecp_restart_mul_ctx *ctx )
|
||||||
mbedtls_free( ctx->T );
|
mbedtls_free( ctx->T );
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
ecp_drbg_free( &ctx->drbg_ctx );
|
||||||
|
#endif
|
||||||
|
|
||||||
ecp_restart_rsm_init( ctx );
|
ecp_restart_rsm_init( ctx );
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1897,7 +2057,9 @@ static int ecp_mul_comb_core( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R
|
||||||
i = d;
|
i = d;
|
||||||
MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, T_size, x[i] ) );
|
MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, T_size, x[i] ) );
|
||||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 1 ) );
|
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 1 ) );
|
||||||
|
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
if( f_rng != 0 )
|
if( f_rng != 0 )
|
||||||
|
#endif
|
||||||
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
|
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -2018,6 +2180,7 @@ static int ecp_mul_comb_after_precomp( const mbedtls_ecp_group *grp,
|
||||||
rs_ctx->rsm->state = ecp_rsm_final_norm;
|
rs_ctx->rsm->state = ecp_rsm_final_norm;
|
||||||
|
|
||||||
final_norm:
|
final_norm:
|
||||||
|
MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
|
||||||
#endif
|
#endif
|
||||||
/*
|
/*
|
||||||
* Knowledge of the jacobian coordinates may leak the last few bits of the
|
* Knowledge of the jacobian coordinates may leak the last few bits of the
|
||||||
|
@ -2030,10 +2193,11 @@ final_norm:
|
||||||
*
|
*
|
||||||
* Avoid the leak by randomizing coordinates before we normalize them.
|
* Avoid the leak by randomizing coordinates before we normalize them.
|
||||||
*/
|
*/
|
||||||
|
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
if( f_rng != 0 )
|
if( f_rng != 0 )
|
||||||
|
#endif
|
||||||
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, RR, f_rng, p_rng ) );
|
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, RR, f_rng, p_rng ) );
|
||||||
|
|
||||||
MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
|
|
||||||
MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, RR ) );
|
MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, RR ) );
|
||||||
|
|
||||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||||
|
@ -2104,11 +2268,44 @@ static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||||
unsigned char w, p_eq_g, i;
|
unsigned char w, p_eq_g, i;
|
||||||
size_t d;
|
size_t d;
|
||||||
unsigned char T_size, T_ok;
|
unsigned char T_size = 0, T_ok = 0;
|
||||||
mbedtls_ecp_point *T;
|
mbedtls_ecp_point *T = NULL;
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
ecp_drbg_context drbg_ctx;
|
||||||
|
|
||||||
|
ecp_drbg_init( &drbg_ctx );
|
||||||
|
#endif
|
||||||
|
|
||||||
ECP_RS_ENTER( rsm );
|
ECP_RS_ENTER( rsm );
|
||||||
|
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
if( f_rng == NULL )
|
||||||
|
{
|
||||||
|
/* Adjust pointers */
|
||||||
|
f_rng = &ecp_drbg_random;
|
||||||
|
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||||
|
if( rs_ctx != NULL && rs_ctx->rsm != NULL )
|
||||||
|
p_rng = &rs_ctx->rsm->drbg_ctx;
|
||||||
|
else
|
||||||
|
#endif
|
||||||
|
p_rng = &drbg_ctx;
|
||||||
|
|
||||||
|
/* Initialize internal DRBG if necessary */
|
||||||
|
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||||
|
if( rs_ctx == NULL || rs_ctx->rsm == NULL ||
|
||||||
|
rs_ctx->rsm->drbg_seeded == 0 )
|
||||||
|
#endif
|
||||||
|
{
|
||||||
|
const size_t m_len = ( grp->nbits + 7 ) / 8;
|
||||||
|
MBEDTLS_MPI_CHK( ecp_drbg_seed( p_rng, m, m_len ) );
|
||||||
|
}
|
||||||
|
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||||
|
if( rs_ctx != NULL && rs_ctx->rsm != NULL )
|
||||||
|
rs_ctx->rsm->drbg_seeded = 1;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
#endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||||
|
|
||||||
/* Is P the base point ? */
|
/* Is P the base point ? */
|
||||||
#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
|
#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
|
||||||
p_eq_g = ( mbedtls_mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 &&
|
p_eq_g = ( mbedtls_mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 &&
|
||||||
|
@ -2180,6 +2377,10 @@ static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||||
|
|
||||||
cleanup:
|
cleanup:
|
||||||
|
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
ecp_drbg_free( &drbg_ctx );
|
||||||
|
#endif
|
||||||
|
|
||||||
/* does T belong to the group? */
|
/* does T belong to the group? */
|
||||||
if( T == grp->T )
|
if( T == grp->T )
|
||||||
T = NULL;
|
T = NULL;
|
||||||
|
@ -2370,9 +2571,23 @@ static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||||
unsigned char b;
|
unsigned char b;
|
||||||
mbedtls_ecp_point RP;
|
mbedtls_ecp_point RP;
|
||||||
mbedtls_mpi PX;
|
mbedtls_mpi PX;
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
ecp_drbg_context drbg_ctx;
|
||||||
|
|
||||||
|
ecp_drbg_init( &drbg_ctx );
|
||||||
|
#endif
|
||||||
mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX );
|
mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX );
|
||||||
|
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
if( f_rng == NULL )
|
||||||
|
{
|
||||||
|
const size_t m_len = ( grp->nbits + 7 ) / 8;
|
||||||
|
MBEDTLS_MPI_CHK( ecp_drbg_seed( &drbg_ctx, m, m_len ) );
|
||||||
|
f_rng = &ecp_drbg_random;
|
||||||
|
p_rng = &drbg_ctx;
|
||||||
|
}
|
||||||
|
#endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||||
|
|
||||||
/* Save PX and read from P before writing to R, in case P == R */
|
/* Save PX and read from P before writing to R, in case P == R */
|
||||||
MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &PX, &P->X ) );
|
MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &PX, &P->X ) );
|
||||||
MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &RP, P ) );
|
MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &RP, P ) );
|
||||||
|
@ -2386,7 +2601,9 @@ static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||||
MOD_ADD( RP.X );
|
MOD_ADD( RP.X );
|
||||||
|
|
||||||
/* Randomize coordinates of the starting point */
|
/* Randomize coordinates of the starting point */
|
||||||
|
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
if( f_rng != NULL )
|
if( f_rng != NULL )
|
||||||
|
#endif
|
||||||
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
|
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
|
||||||
|
|
||||||
/* Loop invariant: R = result so far, RP = R + P */
|
/* Loop invariant: R = result so far, RP = R + P */
|
||||||
|
@ -2419,12 +2636,18 @@ static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||||
*
|
*
|
||||||
* Avoid the leak by randomizing coordinates before we normalize them.
|
* Avoid the leak by randomizing coordinates before we normalize them.
|
||||||
*/
|
*/
|
||||||
|
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
if( f_rng != NULL )
|
if( f_rng != NULL )
|
||||||
|
#endif
|
||||||
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, R, f_rng, p_rng ) );
|
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, R, f_rng, p_rng ) );
|
||||||
|
|
||||||
MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) );
|
MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) );
|
||||||
|
|
||||||
cleanup:
|
cleanup:
|
||||||
|
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
ecp_drbg_free( &drbg_ctx );
|
||||||
|
#endif
|
||||||
|
|
||||||
mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX );
|
mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX );
|
||||||
|
|
||||||
return( ret );
|
return( ret );
|
||||||
|
|
|
@ -1578,6 +1578,8 @@ int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
|
||||||
* linking an extra division function in some builds).
|
* linking an extra division function in some builds).
|
||||||
*/
|
*/
|
||||||
size_t j, extra_run = 0;
|
size_t j, extra_run = 0;
|
||||||
|
/* This size is enough to server either as input to
|
||||||
|
* md_process() or as output to md_finish() */
|
||||||
unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
|
unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -1633,10 +1635,15 @@ int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
|
||||||
ssl_read_memory( data + rec->data_len, padlen );
|
ssl_read_memory( data + rec->data_len, padlen );
|
||||||
mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
|
mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
|
||||||
|
|
||||||
/* Call mbedtls_md_process at least once due to cache attacks
|
/* Dummy calls to compression function.
|
||||||
* that observe whether md_process() was called of not */
|
* Call mbedtls_md_process at least once due to cache attacks
|
||||||
|
* that observe whether md_process() was called of not.
|
||||||
|
* Respect the usual start-(process|update)-finish sequence for
|
||||||
|
* the sake of hardware accelerators that might require it. */
|
||||||
|
mbedtls_md_starts( &transform->md_ctx_dec );
|
||||||
for( j = 0; j < extra_run + 1; j++ )
|
for( j = 0; j < extra_run + 1; j++ )
|
||||||
mbedtls_md_process( &transform->md_ctx_dec, tmp );
|
mbedtls_md_process( &transform->md_ctx_dec, tmp );
|
||||||
|
mbedtls_md_finish( &transform->md_ctx_dec, tmp );
|
||||||
|
|
||||||
mbedtls_md_hmac_reset( &transform->md_ctx_dec );
|
mbedtls_md_hmac_reset( &transform->md_ctx_dec );
|
||||||
|
|
||||||
|
|
|
@ -354,6 +354,9 @@ static const char * const features[] = {
|
||||||
#if defined(MBEDTLS_ECP_NIST_OPTIM)
|
#if defined(MBEDTLS_ECP_NIST_OPTIM)
|
||||||
"MBEDTLS_ECP_NIST_OPTIM",
|
"MBEDTLS_ECP_NIST_OPTIM",
|
||||||
#endif /* MBEDTLS_ECP_NIST_OPTIM */
|
#endif /* MBEDTLS_ECP_NIST_OPTIM */
|
||||||
|
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
"MBEDTLS_ECP_NO_INTERNAL_RNG",
|
||||||
|
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||||
"MBEDTLS_ECP_RESTARTABLE",
|
"MBEDTLS_ECP_RESTARTABLE",
|
||||||
#endif /* MBEDTLS_ECP_RESTARTABLE */
|
#endif /* MBEDTLS_ECP_RESTARTABLE */
|
||||||
|
|
|
@ -986,6 +986,14 @@ int query_config( const char *config )
|
||||||
}
|
}
|
||||||
#endif /* MBEDTLS_ECP_NIST_OPTIM */
|
#endif /* MBEDTLS_ECP_NIST_OPTIM */
|
||||||
|
|
||||||
|
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||||
|
if( strcmp( "MBEDTLS_ECP_NO_INTERNAL_RNG", config ) == 0 )
|
||||||
|
{
|
||||||
|
MACRO_EXPANSION_TO_STR( MBEDTLS_ECP_NO_INTERNAL_RNG );
|
||||||
|
return( 0 );
|
||||||
|
}
|
||||||
|
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||||
|
|
||||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||||
if( strcmp( "MBEDTLS_ECP_RESTARTABLE", config ) == 0 )
|
if( strcmp( "MBEDTLS_ECP_RESTARTABLE", config ) == 0 )
|
||||||
{
|
{
|
||||||
|
|
|
@ -173,6 +173,7 @@ EXCLUDE_FROM_FULL = frozenset([
|
||||||
'MBEDTLS_DEPRECATED_REMOVED', # conflicts with deprecated options
|
'MBEDTLS_DEPRECATED_REMOVED', # conflicts with deprecated options
|
||||||
'MBEDTLS_DEPRECATED_WARNING', # conflicts with deprecated options
|
'MBEDTLS_DEPRECATED_WARNING', # conflicts with deprecated options
|
||||||
'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED', # influences the use of ECDH in TLS
|
'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED', # influences the use of ECDH in TLS
|
||||||
|
'MBEDTLS_ECP_NO_INTERNAL_RNG', # removes a feature
|
||||||
'MBEDTLS_ECP_RESTARTABLE', # incompatible with USE_PSA_CRYPTO
|
'MBEDTLS_ECP_RESTARTABLE', # incompatible with USE_PSA_CRYPTO
|
||||||
'MBEDTLS_ENTROPY_FORCE_SHA256', # interacts with CTR_DRBG_128_BIT_KEY
|
'MBEDTLS_ENTROPY_FORCE_SHA256', # interacts with CTR_DRBG_128_BIT_KEY
|
||||||
'MBEDTLS_HAVE_SSE2', # hardware dependency
|
'MBEDTLS_HAVE_SSE2', # hardware dependency
|
||||||
|
|
|
@ -929,6 +929,43 @@ component_test_no_hmac_drbg () {
|
||||||
# so there's little value in running those lengthy tests here.
|
# so there's little value in running those lengthy tests here.
|
||||||
}
|
}
|
||||||
|
|
||||||
|
component_test_ecp_no_internal_rng () {
|
||||||
|
msg "build: Default plus ECP_NO_INTERNAL_RNG minus DRBG modules"
|
||||||
|
scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||||
|
scripts/config.py unset MBEDTLS_CTR_DRBG_C
|
||||||
|
scripts/config.py unset MBEDTLS_HMAC_DRBG_C
|
||||||
|
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
|
||||||
|
scripts/config.py unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
|
||||||
|
scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
|
||||||
|
|
||||||
|
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||||
|
make
|
||||||
|
|
||||||
|
msg "test: ECP_NO_INTERNAL_RNG, no DRBG module"
|
||||||
|
make test
|
||||||
|
|
||||||
|
# no SSL tests as they all depend on having a DRBG
|
||||||
|
}
|
||||||
|
|
||||||
|
component_test_ecp_restartable_no_internal_rng () {
|
||||||
|
msg "build: Default plus ECP_RESTARTABLE and ECP_NO_INTERNAL_RNG, no DRBG"
|
||||||
|
scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||||
|
scripts/config.py set MBEDTLS_ECP_RESTARTABLE
|
||||||
|
scripts/config.py unset MBEDTLS_CTR_DRBG_C
|
||||||
|
scripts/config.py unset MBEDTLS_HMAC_DRBG_C
|
||||||
|
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
|
||||||
|
scripts/config.py unset MBEDTLS_PSA_CRYPTO_C # requires CTR_DRBG
|
||||||
|
scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
|
||||||
|
|
||||||
|
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||||
|
make
|
||||||
|
|
||||||
|
msg "test: ECP_RESTARTABLE and ECP_NO_INTERNAL_RNG, no DRBG module"
|
||||||
|
make test
|
||||||
|
|
||||||
|
# no SSL tests as they all depend on having a DRBG
|
||||||
|
}
|
||||||
|
|
||||||
component_test_new_ecdh_context () {
|
component_test_new_ecdh_context () {
|
||||||
msg "build: new ECDH context (ASan build)" # ~ 6 min
|
msg "build: new ECDH context (ASan build)" # ~ 6 min
|
||||||
scripts/config.py unset MBEDTLS_ECDH_LEGACY_CONTEXT
|
scripts/config.py unset MBEDTLS_ECDH_LEGACY_CONTEXT
|
||||||
|
|
Loading…
Reference in a new issue