yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Implement mbedtls_mpi_core_fill_random

Browse source 
Turn mpi_fill_random_internal() into mbedtls_mpi_core_fill_random(). It
had basically the right code except for how X is passed to the function.

Write unit tests.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2022-09-09 20:55:53 +02:00
parent 909e03c52f
commit 5980f2bd36
3 changed files with 132 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
library/bignum.c
View file

@ -1934,25 +1934,26 @@ cleanup:
/* Fill X with n_bytes random bytes.
* X must already have room for those bytes.
* The ordering of the bytes returned from the RNG is suitable for
* deterministic ECDSA (see RFC 6979 §3.3 and mbedtls_mpi_random()).
* deterministic ECDSA (see RFC 6979 §3.3 and mbedtls_mpi_core_random()).
* The size and sign of X are unchanged.
* n_bytes must not be 0.
*/
static int mpi_fill_random_internal(
mbedtls_mpi *X, size_t n_bytes,
int mbedtls_mpi_core_fill_random(
mbedtls_mpi_uint *X, size_t X_limbs,
size_t n_bytes,
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
const size_t limbs = CHARS_TO_LIMBS( n_bytes );
const size_t overhead = ( limbs * ciL ) - n_bytes;
if( X->n < limbs )
if( X_limbs < limbs )
return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
memset( X->p, 0, overhead );
memset( (unsigned char *) X->p + limbs * ciL, 0, ( X->n - limbs ) * ciL );
MBEDTLS_MPI_CHK( f_rng( p_rng, (unsigned char *) X->p + overhead, n_bytes ) );
mbedtls_mpi_core_bigendian_to_host( X->p, limbs );
memset( X, 0, overhead );
memset( (unsigned char *) X + limbs * ciL, 0, ( X_limbs - limbs ) * ciL );
MBEDTLS_MPI_CHK( f_rng( p_rng, (unsigned char *) X + overhead, n_bytes ) );
mbedtls_mpi_core_bigendian_to_host( X, limbs );
cleanup:
return( ret );
@ -1980,7 +1981,7 @@ int mbedtls_mpi_fill_random( mbedtls_mpi *X, size_t size,
if( size == 0 )
return( 0 );
ret = mpi_fill_random_internal( X, size, f_rng, p_rng );
ret = mbedtls_mpi_core_fill_random( X->p, X->n, size, f_rng, p_rng );
cleanup:
return( ret );
@ -2042,7 +2043,9 @@ int mbedtls_mpi_random( mbedtls_mpi *X,
*/
do
{
MBEDTLS_MPI_CHK( mpi_fill_random_internal( X, n_bytes, f_rng, p_rng ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_core_fill_random( X->p, X->n,
n_bytes,
f_rng, p_rng ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( X, 8 * n_bytes - n_bits ) );
if( --count == 0 )

53
tests/suites/test_suite_bignum_core.function
View file

@ -992,3 +992,56 @@ exit:
mbedtls_free(dest);
}
/* END_CASE */
/* BEGIN_CASE */
void mpi_core_fill_random( int wanted_bytes_arg, int extra_rng_bytes,
int extra_limbs, int before, int expected_ret )
{
size_t wanted_bytes = wanted_bytes_arg;
mbedtls_mpi_uint *X = NULL;
size_t X_limbs = CHARS_TO_LIMBS( wanted_bytes ) + extra_limbs;
size_t rng_bytes = wanted_bytes + extra_rng_bytes;
unsigned char *rnd_data = NULL;
mbedtls_test_rnd_buf_info rnd_info = {NULL, rng_bytes, NULL, NULL};
int ret;
/* Prepare an RNG with known output, limited to rng_bytes. */
ASSERT_ALLOC( rnd_data, rng_bytes );
TEST_EQUAL( 0, mbedtls_test_rnd_std_rand( NULL, rnd_data, rng_bytes ) );
rnd_info.buf = rnd_data;
/* Allocate an MPI with room for wanted_bytes plus extra_limbs.
* extra_limbs may be negative but the total limb count must be positive.
* Fill the MPI with the byte value in before. */
TEST_LE_U( 1, X_limbs );
ASSERT_ALLOC( X, X_limbs );
memset( X, before, X_limbs * sizeof( *X ) );
ret = mbedtls_mpi_core_fill_random( X, X_limbs, wanted_bytes,
mbedtls_test_rnd_buffer_rand,
&rnd_info );
TEST_EQUAL( expected_ret, ret );
if( expected_ret == 0 )
{
/* mbedtls_mpi_core_fill_random is documented to use bytes from the
* RNG as a big-endian representation of the number. We used an RNG
* with known output, so check that the output contains the
* expected value. Bytes above wanted_bytes must be zero. */
for( size_t i = 0; i < wanted_bytes; i++ )
{
mbedtls_test_set_step( i );
TEST_EQUAL( GET_BYTE( X, i ), rnd_data[wanted_bytes - 1 - i] );
}
for( size_t i = wanted_bytes; i < X_limbs * ciL; i++ )
{
mbedtls_test_set_step( i );
TEST_EQUAL( GET_BYTE( X, i ), 0 );
}
}
exit:
mbedtls_free( rnd_data );
mbedtls_free( X );
}
/* END_CASE */

66
tests/suites/test_suite_bignum_core.misc.data
View file

@ -364,3 +364,69 @@ mpi_core_get_mont_r2_unsafe:"8335616aed761f1f7f44e6bd49e807b82e3bf2bf11bfa63":"5
mbedtls_mpi_core_get_mont_r2_unsafe #11
mpi_core_get_mont_r2_unsafe:"d1cece570f2f991013f26dd5b03c4c5b65f97be5905f36cb4664f2c78ff80aa8135a4aaf57ccb8a0aca2f394909a74cef1ef6758a64d11e2c149c393659d124bfc94196f0ce88f7d7d567efa5a649e2deefaa6e10fdc3deac60d606bf63fc540ac95294347031aefd73d6a9ee10188aaeb7a90d920894553cb196881691cadc51808715a07e8b24fcb1a63df047c7cdf084dd177ba368c806f3d51ddb5d3898c863e687ecaf7d649a57a46264a582f94d3c8f2edaf59f77a7f6bdaf83c991e8f06abe220ec8507386fce8c3da84c6c3903ab8f3ad4630a204196a7dbcbd9bcca4e40ec5cc5c09938d49f5e1e6181db8896f33bb12e6ef73f12ec5c5ea7a8a337":"12d7243d92ebc8338221f6dcec8ad8a2ec64c10a98339c8721beb1cb79e629253a7aa35e25d5421e6c2b43ddc4310cf4443875c070a7a5a5cc2c4c3eefa8a133af2e477fb7bb5b5058c6120946a7f9f08f2fab51e2f243b9ba206d2bfd62e4ef647dda49100d7004794f28172be2d715905fbd2e9ab8588c774523c0e096b49b6855a10e5ce0d8498370949a29d71d293788bf10a71e2447d4b2f11959a72f7290e2950772d14c83f15532468745fa58a83fca8883b0b6169a27ec0cf922c4f39d283bb20fca5ff1de01d9c66b8a710108b951af634d56c843d9505bf2edd5a7b8f0b72a5c95672151e60075a78084e83fbe284617a90c74c8335cce38bb012e":"12d7243d92ebc8338221f6dcec8ad8a2ec64c10a98339c8721beb1cb79e629253a7aa35e25d5421e6c2b43ddc4310cf4443875c070a7a5a5cc2c4c3eefa8a133af2e477fb7bb5b5058c6120946a7f9f08f2fab51e2f243b9ba206d2bfd62e4ef647dda49100d7004794f28172be2d715905fbd2e9ab8588c774523c0e096b49b6855a10e5ce0d8498370949a29d71d293788bf10a71e2447d4b2f11959a72f7290e2950772d14c83f15532468745fa58a83fca8883b0b6169a27ec0cf922c4f39d283bb20fca5ff1de01d9c66b8a710108b951af634d56c843d9505bf2edd5a7b8f0b72a5c95672151e60075a78084e83fbe284617a90c74c8335cce38bb012e"
Fill random core: 0 bytes
mpi_core_fill_random:0:0:1:0:0
Fill random core: 1 byte, RNG stops at 0
mpi_core_fill_random:1:-1:0:0:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED
Fill random core: 1 byte, RNG just sufficient
mpi_core_fill_random:1:0:0:0:0
Fill random core: 1 byte, RNG not exhausted
mpi_core_fill_random:1:1:0:0:0
Fill random core: 1 byte, prior content nonzero
mpi_core_fill_random:1:0:0:0xba:0
Fill random core: 1 byte, 1 extra limb
mpi_core_fill_random:1:0:1:0:0
Fill random core: 1 byte, 1 extra limb, prior content nonzero
mpi_core_fill_random:1:0:1:0xba:0
Fill random core: 8 bytes, RNG stops before
mpi_core_fill_random:8:-1:0:0:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED
Fill random core: 8 bytes, RNG just sufficient
mpi_core_fill_random:8:0:0:0:0
Fill random core: 8 bytes, RNG not exhausted
mpi_core_fill_random:8:1:0:0:0
Fill random core: 8 bytes, prior content nonzero
mpi_core_fill_random:8:0:0:0xba:0
Fill random core: 8 bytes, 1 extra limb
mpi_core_fill_random:8:0:1:0:0
Fill random core: 8 bytes, 1 extra limb, prior content nonzero
mpi_core_fill_random:8:0:1:0xba:0
Fill random core: 9 bytes, 1 missing limb
mpi_core_fill_random:9:0:-1:0:MBEDTLS_ERR_MPI_BAD_INPUT_DATA
Fill random core: 42 bytes, RNG stops before
mpi_core_fill_random:42:-1:0:0:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED
Fill random core: 42 bytes, RNG just sufficient
mpi_core_fill_random:42:0:0:0:0
Fill random core: 42 bytes, RNG not exhausted
mpi_core_fill_random:42:1:0:0:0
Fill random core: 42 bytes, prior content nonzero
mpi_core_fill_random:42:0:0:0xba:0
Fill random core: 42 bytes, 1 extra limb
mpi_core_fill_random:42:0:1:0:0
Fill random core: 42 bytes, 1 extra limb, prior content nonzero
mpi_core_fill_random:42:0:1:0xba:0
Fill random core: 42 bytes, 1 missing limb
mpi_core_fill_random:42:0:-1:0:MBEDTLS_ERR_MPI_BAD_INPUT_DATA
Fill random core: 42 bytes, 5 missing limbs
mpi_core_fill_random:42:0:-5:0:MBEDTLS_ERR_MPI_BAD_INPUT_DATA