yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #5962 from gilles-peskine-arm/storage-format-doc-202206

Browse source 
Documentation about storage format compatibility
This commit is contained in:
Manuel Pégourié-Gonnard 2022-07-01 12:21:17 +02:00 committed by GitHub
commit 790ab52ee0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
12 changed files with 269 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
BRANCHES.md
View file

@ -28,7 +28,7 @@ the API of 3.(x+1) is backward compatible with 3.x). We only break API
compatibility on major version changes (e.g. from 3.x to 4.0). We also maintain
ABI compatibility within LTS branches; see the next section for details.
## Backwards Compatibility
## Backwards Compatibility for application code
We maintain API compatibility in released versions of Mbed TLS. If you have
code that's working and secure with Mbed TLS x.y.z and does not rely on
@ -36,6 +36,14 @@ undocumented features, then you should be able to re-compile it without
modification with any later release x.y'.z' with the same major version
number, and your code will still build, be secure, and work.
Note that this guarantee only applies if you either use the default
compile-time configuration (`mbedtls/mbedtls_config.h`) or the same modified
compile-time configuration. Changing compile-time configuration options can
result in an incompatible API or ABI, although features will generally not
affect unrelated features (for example, enabling or disabling a
cryptographic algorithm does not break code that does not use that
algorithm).
Note that new releases of Mbed TLS may extend the API. Here are some
examples of changes that are common in minor releases of Mbed TLS, and are
not considered API compatibility breaks:
@ -57,6 +65,25 @@ crypto that was found to be weak) may need to be changed. In case security
comes in conflict with backwards compatibility, we will put security first,
but always attempt to provide a compatibility option.
## Backward compatibility for the key store
We maintain backward compatibility with previous versions of the
PSA Crypto persistent storage since Mbed TLS 2.25.0, provided that the
storage backend (PSA ITS implementation) is configured in a compatible way.
We intend to maintain this backward compatibility throughout a major version
of Mbed TLS (for example, all Mbed TLS 3.y versions will be able to read
keys written under any Mbed TLS 3.x with x <= y).
Mbed TLS 3.x can also read keys written by Mbed TLS 2.25.0 through 2.28.x
LTS, but future major version upgrades (for example from 2.28.x/3.x to 4.y)
may require the use of an upgrade tool.
Note that this guarantee does not currently fully extend to drivers, which
are an experimental feature. We intend to maintain compatibility with the
basic use of drivers from Mbed TLS 2.28.0 onwards, even if driver APIs
change. However, for more experimental parts of the driver interface, such
as the use of driver state, we do not yet guarantee backward compatibility.
## Long-time support branches
For the LTS branches, additionally we try very hard to also maintain ABI

5
ChangeLog.d/psa_crypto_se.txt Normal file
View file

@ -0,0 +1,5 @@
New deprecations
* Secure element drivers enabled by MBEDTLS_PSA_CRYPTO_SE_C are deprecated.
This was intended as an experimental feature, but had not been explicitly
documented as such. Use opaque drivers with the interface enabled by
MBEDTLS_PSA_CRYPTO_DRIVERS instead.

8
include/mbedtls/check_config.h
View file

@ -581,6 +581,14 @@
#error "MBEDTLS_PSA_CRYPTO_SE_C defined, but not all prerequisites"
#endif
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
#if defined(MBEDTLS_DEPRECATED_REMOVED)
#error "MBEDTLS_PSA_CRYPTO_SE_C is deprecated and will be removed in a future version of Mbed TLS"
#elif defined(MBEDTLS_DEPRECATED_WARNING)
#warning "MBEDTLS_PSA_CRYPTO_SE_C is deprecated and will be removed in a future version of Mbed TLS"
#endif
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \
! defined(MBEDTLS_PSA_CRYPTO_C)
#error "MBEDTLS_PSA_CRYPTO_STORAGE_C defined, but not all prerequisites"

11
include/mbedtls/mbedtls_config.h
View file

@ -1184,8 +1184,9 @@
*
* Requires: MBEDTLS_PSA_CRYPTO_C
*
* \warning This interface is experimental and may change or be removed
* without notice.
* \warning This interface is experimental. We intend to maintain backward
* compatibility with application code that relies on drivers,
* but the driver interfaces may change without notice.
*/
//#define MBEDTLS_PSA_CRYPTO_DRIVERS
@ -2690,11 +2691,11 @@
/**
* \def MBEDTLS_PSA_CRYPTO_SE_C
*
* Enable secure element support in the Platform Security Architecture
* Enable dynamic secure element support in the Platform Security Architecture
* cryptography API.
*
* \warning This feature is not yet suitable for production. It is provided
* for API evaluation and testing purposes only.
* \deprecated This feature is deprecated. Please switch to the driver
* interface enabled by #MBEDTLS_PSA_CRYPTO_DRIVERS.
*
* Module: library/psa_crypto_se.c
*

85
include/psa/crypto_types.h
View file

@ -70,10 +70,21 @@ typedef int32_t psa_status_t;
*/
/** \brief Encoding of a key type.
*
* Values of this type are generally constructed by macros called
* `PSA_KEY_TYPE_xxx`.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to existing values will require bumping the storage
* format version and providing a translation when reading the old
* format.
*/
typedef uint16_t psa_key_type_t;
/** The type of PSA elliptic curve family identifiers.
*
* Values of this type are generally constructed by macros called
* `PSA_ECC_FAMILY_xxx`.
*
* The curve identifier is required to create an ECC key using the
* PSA_KEY_TYPE_ECC_KEY_PAIR() or PSA_KEY_TYPE_ECC_PUBLIC_KEY()
@ -81,10 +92,18 @@ typedef uint16_t psa_key_type_t;
*
* Values defined by this standard will never be in the range 0x80-0xff.
* Vendors who define additional families must use an encoding in this range.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to existing values will require bumping the storage
* format version and providing a translation when reading the old
* format.
*/
typedef uint8_t psa_ecc_family_t;
/** The type of PSA Diffie-Hellman group family identifiers.
*
* Values of this type are generally constructed by macros called
* `PSA_DH_FAMILY_xxx`.
*
* The group identifier is required to create an Diffie-Hellman key using the
* PSA_KEY_TYPE_DH_KEY_PAIR() or PSA_KEY_TYPE_DH_PUBLIC_KEY()
@ -92,16 +111,29 @@ typedef uint8_t psa_ecc_family_t;
*
* Values defined by this standard will never be in the range 0x80-0xff.
* Vendors who define additional families must use an encoding in this range.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to existing values will require bumping the storage
* format version and providing a translation when reading the old
* format.
*/
typedef uint8_t psa_dh_family_t;
/** \brief Encoding of a cryptographic algorithm.
*
* Values of this type are generally constructed by macros called
* `PSA_ALG_xxx`.
*
* For algorithms that can be applied to multiple key types, this type
* does not encode the key type. For example, for symmetric ciphers
* based on a block cipher, #psa_algorithm_t encodes the block cipher
* mode and the padding mode while the block cipher itself is encoded
* via #psa_key_type_t.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to existing values will require bumping the storage
* format version and providing a translation when reading the old
* format.
*/
typedef uint32_t psa_algorithm_t;
@ -143,6 +175,14 @@ typedef uint32_t psa_algorithm_t;
* #PSA_KEY_LIFETIME_PERSISTENT is supported if persistent storage is
* available. Other lifetime values may be supported depending on the
* library configuration.
*
* Values of this type are generally constructed by macros called
* `PSA_KEY_LIFETIME_xxx`.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to existing values will require bumping the storage
* format version and providing a translation when reading the old
* format.
*/
typedef uint32_t psa_key_lifetime_t;
@ -174,6 +214,11 @@ typedef uint32_t psa_key_lifetime_t;
* \note Key persistence levels are 8-bit values. Key management
* interfaces operate on lifetimes (type ::psa_key_lifetime_t) which
* encode the persistence as the lower 8 bits of a 32-bit value.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to existing values will require bumping the storage
* format version and providing a translation when reading the old
* format.
*/
typedef uint8_t psa_key_persistence_t;
@ -210,6 +255,11 @@ typedef uint8_t psa_key_persistence_t;
* \note Key location indicators are 24-bit values. Key management
* interfaces operate on lifetimes (type ::psa_key_lifetime_t) which
* encode the location as the upper 24 bits of a 32-bit value.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to existing values will require bumping the storage
* format version and providing a translation when reading the old
* format.
*/
typedef uint32_t psa_key_location_t;
@ -221,9 +271,27 @@ typedef uint32_t psa_key_location_t;
* #PSA_KEY_ID_VENDOR_MIN to #PSA_KEY_ID_VENDOR_MAX.
* - 0 is reserved as an invalid key identifier.
* - Key identifiers outside these ranges are reserved for future use.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to how values are allocated must require careful
* consideration to allow backward compatibility.
*/
typedef uint32_t psa_key_id_t;
/** Encoding of key identifiers as seen inside the PSA Crypto implementation.
*
* When PSA Crypto is built as a library inside an application, this type
* is identical to #psa_key_id_t. When PSA Crypto is built as a service
* that can store keys on behalf of multiple clients, this type
* encodes the #psa_key_id_t value seen by each client application as
* well as extra information that identifies the client that owns
* the key.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to existing values will require bumping the storage
* format version and providing a translation when reading the old
* format.
*/
#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
typedef psa_key_id_t mbedtls_svc_key_id_t;
@ -247,7 +315,16 @@ typedef struct
* @{
*/
/** \brief Encoding of permitted usage on a key. */
/** \brief Encoding of permitted usage on a key.
*
* Values of this type are generally constructed as bitwise-ors of macros
* called `PSA_KEY_USAGE_xxx`.
*
* \note Values of this type are encoded in the persistent key store.
* Any changes to existing values will require bumping the storage
* format version and providing a translation when reading the old
* format.
*/
typedef uint32_t psa_key_usage_t;
/**@}*/
@ -376,7 +453,11 @@ typedef uint64_t psa_key_slot_number_t;
* @{
*/
/** \brief Encoding of the step of a key derivation. */
/** \brief Encoding of the step of a key derivation.
*
* Values of this type are generally constructed by macros called
* `PSA_KEY_DERIVATION_INPUT_xxx`.
*/
typedef uint16_t psa_key_derivation_step_t;
/**@}*/

46
include/psa/crypto_values.h
View file

@ -12,6 +12,11 @@
* designations of cryptographic algorithms, and error codes returned by
* the library.
*
* Note that many of the constants defined in this file are embedded in
* the persistent key store, as part of key metadata (including usage
* policies). As a consequence, they must not be changed (unless the storage
* format version changes).
*
* This header file only defines preprocessor macros.
*/
/*
@ -41,6 +46,18 @@
/* PSA error codes */
/* Error codes are standardized across PSA domains (framework, crypto, storage,
* etc.). Do not change the values in this section or even the expansions
* of each macro: it must be possible to `#include` both this header
* and some other PSA component's headers in the same C source,
* which will lead to duplicate definitions of the `PSA_SUCCESS` and
* `PSA_ERROR_xxx` macros, which is ok if and only if the macros expand
* to the same sequence of tokens.
*
* If you must add a new
* value, check with the Arm PSA framework group to pick one that other
* domains aren't already using. */
/** The action was completed successfully. */
#define PSA_SUCCESS ((psa_status_t)0)
@ -317,6 +334,12 @@
* @{
*/
/* Note that key type values, including ECC family and DH group values, are
* embedded in the persistent key store, as part of key metadata. As a
* consequence, they must not be changed (unless the storage format version
* changes).
*/
/** An invalid key type value.
*
* Zero is not the encoding of any key type.
@ -719,6 +742,11 @@
1u << PSA_GET_KEY_TYPE_BLOCK_SIZE_EXPONENT(type) : \
0u)
/* Note that algorithm values are embedded in the persistent key store,
* as part of key metadata. As a consequence, they must not be changed
* (unless the storage format version changes).
*/
/** Vendor-defined algorithm flag.
*
* Algorithms defined by this standard will never have the #PSA_ALG_VENDOR_FLAG
@ -2207,6 +2235,11 @@
* @{
*/
/* Note that location and persistence level values are embedded in the
* persistent key store, as part of key metadata. As a consequence, they
* must not be changed (unless the storage format version changes).
*/
/** The default lifetime for volatile keys.
*
* A volatile key only exists as long as the identifier to it is not destroyed.
@ -2322,6 +2355,11 @@
#define PSA_KEY_LOCATION_VENDOR_FLAG ((psa_key_location_t)0x800000)
/* Note that key identifier values are embedded in the
* persistent key store, as part of key metadata. As a consequence, they
* must not be changed (unless the storage format version changes).
*/
/** The null key identifier.
*/
#define PSA_KEY_ID_NULL ((psa_key_id_t)0)
@ -2433,6 +2471,11 @@ static inline int mbedtls_svc_key_id_is_null( mbedtls_svc_key_id_t key )
* @{
*/
/* Note that key usage flags are embedded in the
* persistent key store, as part of key metadata. As a consequence, they
* must not be changed (unless the storage format version changes).
*/
/** Whether the key may be exported.
*
* A public key or the public part of a key pair may always be exported
@ -2559,6 +2602,9 @@ static inline int mbedtls_svc_key_id_is_null( mbedtls_svc_key_id_t key )
* @{
*/
/* Key input steps are not embedded in the persistent storage, so you can
* change them if needed: it's only an ABI change. */
/** A secret input for key derivation.
*
* This should be a key of type #PSA_KEY_TYPE_DERIVE

66
scripts/abi_check.py
View file

@ -1,9 +1,10 @@
#!/usr/bin/env python3
"""
This script compares the interfaces of two versions of Mbed TLS, looking
"""This script compares the interfaces of two versions of Mbed TLS, looking
for backward incompatibilities between two different Git revisions within
an Mbed TLS repository. It must be run from the root of a Git working tree.
### How the script works ###
For the source (API) and runtime (ABI) interface compatibility, this script
is a small wrapper around the abi-compliance-checker and abi-dumper tools,
applying them to compare the header and library files.
@ -20,7 +21,66 @@ at a configurable location, or are given as a brief list of problems.
Returns 0 on success, 1 on non-compliance, and 2 if there is an error
while running the script.
You must run this test from an Mbed TLS root.
### How to interpret non-compliance ###
This script has relatively common false positives. In many scenarios, it only
reports a pass if there is a strict textual match between the old version and
the new version, and it reports problems where there is a sufficient semantic
match but not a textual match. This section lists some common false positives.
This is not an exhaustive list: in the end what matters is whether we are
breaking a backward compatibility goal.
**API**: the goal is that if an application works with the old version of the
library, it can be recompiled against the new version and will still work.
This is normally validated by comparing the declarations in `include/*/*.h`.
A failure is a declaration that has disappeared or that now has a different
type.
* It's ok to change or remove macros and functions that are documented as
for internal use only or as experimental.
* It's ok to rename function or macro parameters as long as the semantics
has not changed.
* It's ok to change or remove structure fields that are documented as
private.
* It's ok to add fields to a structure that already had private fields
or was documented as extensible.
**ABI**: the goal is that if an application was built against the old version
of the library, the same binary will work when linked against the new version.
This is normally validated by comparing the symbols exported by `libmbed*.so`.
A failure is a symbol that is no longer exported by the same library or that
now has a different type.
* All ABI changes are acceptable if the library version is bumped
(see `scripts/bump_version.sh`).
* ABI changes that concern functions which are declared only inside the
library directory, and not in `include/*/*.h`, are acceptable only if
the function was only ever used inside the same library (libmbedcrypto,
libmbedx509, libmbedtls). As a counter example, if the old version
of libmbedtls calls mbedtls_foo() from libmbedcrypto, and the new version
of libmbedcrypto no longer has a compatible mbedtls_foo(), this does
require a version bump for libmbedcrypto.
**Storage format**: the goal is to check that persistent keys stored by the
old version can be read by the new version. This is normally validated by
comparing the `*read*` test cases in `test_suite*storage_format*.data`.
A failure is a storage read test case that is no longer present with the same
function name and parameter list.
* It's ok if the same test data is present, but its presentation has changed,
for example if a test function is renamed or has different parameters.
* It's ok if redundant tests are removed.
**Generated test coverage**: the goal is to check that automatically
generated tests have as much coverage as before. This is normally validated
by comparing the test cases that are automatically generated by a script.
A failure is a generated test case that is no longer present with the same
function name and parameter list.
* It's ok if the same test data is present, but its presentation has changed,
for example if a test function is renamed or has different parameters.
* It's ok if redundant tests are removed.
"""
# Copyright The Mbed TLS Contributors

5
scripts/config.py
View file

@ -324,6 +324,9 @@ def crypto_adapter(adapter):
return adapter(name, active, section)
return continuation
DEPRECATED = frozenset([
'MBEDTLS_PSA_CRYPTO_SE_C',
])
def no_deprecated_adapter(adapter):
"""Modify an adapter to disable deprecated symbols.
@ -334,6 +337,8 @@ def no_deprecated_adapter(adapter):
def continuation(name, active, section):
if name == 'MBEDTLS_DEPRECATED_REMOVED':
return True
if name in DEPRECATED:
return False
if adapter is None:
return active
return adapter(name, active, section)

10
scripts/mbedtls_dev/psa_storage.py
View file

@ -1,4 +1,9 @@
"""Knowledge about the PSA key store as implemented in Mbed TLS.
Note that if you need to make a change that affects how keys are
stored, this may indicate that the key store is changing in a
backward-incompatible way! Think carefully about backward compatibility
before changing how test data is constructed or validated.
"""
# Copyright The Mbed TLS Contributors
@ -146,6 +151,11 @@ class Key:
This is the content of the PSA storage file. When PSA storage is
implemented over stdio files, this does not include any wrapping made
by the PSA-storage-over-stdio-file implementation.
Note that if you need to make a change in this function,
this may indicate that the key store is changing in a
backward-incompatible way! Think carefully about backward
compatibility before making any change here.
"""
header = self.MAGIC + self.pack('L', self.version)
if self.version == 0:

5
tests/suites/test_suite_psa_crypto_persistent_key.data
View file

@ -1,3 +1,8 @@
# Note that if you need to make a change that affects how keys are
# stored, this may indicate that the key store is changing in a
# backward-incompatible way! Think carefully about backward compatibility
# before changing how test data is constructed or validated.
Format for storage: RSA private key
format_storage_data_check:"3082025e02010002818100af057d396ee84fb75fdbb5c2b13c7fe5a654aa8aa2470b541ee1feb0b12d25c79711531249e1129628042dbbb6c120d1443524ef4c0e6e1d8956eeb2077af12349ddeee54483bc06c2c61948cd02b202e796aebd94d3a7cbf859c2c1819c324cb82b9cd34ede263a2abffe4733f077869e8660f7d6834da53d690ef7985f6bc3020301000102818100874bf0ffc2f2a71d14671ddd0171c954d7fdbf50281e4f6d99ea0e1ebcf82faa58e7b595ffb293d1abe17f110b37c48cc0f36c37e84d876621d327f64bbe08457d3ec4098ba2fa0a319fba411c2841ed7be83196a8cdf9daa5d00694bc335fc4c32217fe0488bce9cb7202e59468b1ead119000477db2ca797fac19eda3f58c1024100e2ab760841bb9d30a81d222de1eb7381d82214407f1b975cbbfe4e1a9467fd98adbd78f607836ca5be1928b9d160d97fd45c12d6b52e2c9871a174c66b488113024100c5ab27602159ae7d6f20c3c2ee851e46dc112e689e28d5fcbbf990a99ef8a90b8bb44fd36467e7fc1789ceb663abda338652c3c73f111774902e840565927091024100b6cdbd354f7df579a63b48b3643e353b84898777b48b15f94e0bfc0567a6ae5911d57ad6409cf7647bf96264e9bd87eb95e263b7110b9a1f9f94acced0fafa4d024071195eec37e8d257decfc672b07ae639f10cbb9b0c739d0c809968d644a94e3fd6ed9287077a14583f379058f76a8aecd43c62dc8c0f41766650d725275ac4a1024100bb32d133edc2e048d463388b7be9cb4be29f4b6250be603e70e3647501c97ddde20a4e71be95fd5e71784e25aca4baf25be5738aae59bbfe1c997781447a2b24":"505341004b455900000000000100000001700004010000000000000700000006620200003082025e02010002818100af057d396ee84fb75fdbb5c2b13c7fe5a654aa8aa2470b541ee1feb0b12d25c79711531249e1129628042dbbb6c120d1443524ef4c0e6e1d8956eeb2077af12349ddeee54483bc06c2c61948cd02b202e796aebd94d3a7cbf859c2c1819c324cb82b9cd34ede263a2abffe4733f077869e8660f7d6834da53d690ef7985f6bc3020301000102818100874bf0ffc2f2a71d14671ddd0171c954d7fdbf50281e4f6d99ea0e1ebcf82faa58e7b595ffb293d1abe17f110b37c48cc0f36c37e84d876621d327f64bbe08457d3ec4098ba2fa0a319fba411c2841ed7be83196a8cdf9daa5d00694bc335fc4c32217fe0488bce9cb7202e59468b1ead119000477db2ca797fac19eda3f58c1024100e2ab760841bb9d30a81d222de1eb7381d82214407f1b975cbbfe4e1a9467fd98adbd78f607836ca5be1928b9d160d97fd45c12d6b52e2c9871a174c66b488113024100c5ab27602159ae7d6f20c3c2ee851e46dc112e689e28d5fcbbf990a99ef8a90b8bb44fd36467e7fc1789ceb663abda338652c3c73f111774902e840565927091024100b6cdbd354f7df579a63b48b3643e353b84898777b48b15f94e0bfc0567a6ae5911d57ad6409cf7647bf96264e9bd87eb95e263b7110b9a1f9f94acced0fafa4d024071195eec37e8d257decfc672b07ae639f10cbb9b0c739d0c809968d644a94e3fd6ed9287077a14583f379058f76a8aecd43c62dc8c0f41766650d725275ac4a1024100bb32d133edc2e048d463388b7be9cb4be29f4b6250be603e70e3647501c97ddde20a4e71be95fd5e71784e25aca4baf25be5738aae59bbfe1c997781447a2b24":PSA_KEY_LIFETIME_PERSISTENT:PSA_KEY_TYPE_RSA_KEY_PAIR:1024:PSA_KEY_USAGE_EXPORT:PSA_ALG_CATEGORY_ASYMMETRIC_ENCRYPTION:PSA_ALG_CATEGORY_SIGN

5
tests/suites/test_suite_psa_crypto_persistent_key.function
View file

@ -5,6 +5,11 @@
* on the the storage format. On the other hand, these tests treat the storage
* subsystem as a black box, and in particular have no reliance on the
* internals of the ITS implementation.
*
* Note that if you need to make a change that affects how files are
* stored, this may indicate that the key store is changing in a
* backward-incompatible way! Think carefully about backward compatibility
* before changing how test data is constructed or validated.
*/
#include <stdint.h>

5
tests/suites/test_suite_psa_its.function
View file

@ -3,6 +3,11 @@
/* This test file is specific to the ITS implementation in PSA Crypto
* on top of stdio. It expects to know what the stdio name of a file is
* based on its keystore name.
*
* Note that if you need to make a change that affects how files are
* stored, this may indicate that the key store is changing in a
* backward-incompatible way! Think carefully about backward compatibility
* before changing how test data is constructed or validated.
*/
#include "../library/psa_crypto_its.h"