Remove config option MBEDTLS_ECP_NO_INTERNAL_RNG
It was used to remove the code used when mbedtls_ecp_mul() received a NULL RNG parameter. This code is no longer relevant (as the RNG may no longer be NULL) and will be unconditionally removed in the next commit. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
parent
84dea01f36
commit
d51aaad4c9
4 changed files with 0 additions and 70 deletions
|
@ -150,14 +150,6 @@
|
|||
#error "MBEDTLS_ECP_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_C) && !( \
|
||||
defined(MBEDTLS_ECP_ALT) || \
|
||||
defined(MBEDTLS_CTR_DRBG_C) || \
|
||||
defined(MBEDTLS_HMAC_DRBG_C) || \
|
||||
defined(MBEDTLS_ECP_NO_INTERNAL_RNG))
|
||||
#error "MBEDTLS_ECP_C requires a DRBG module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)
|
||||
#error "MBEDTLS_PK_PARSE_C defined, but not all prerequesites"
|
||||
#endif
|
||||
|
|
|
@ -651,28 +651,6 @@
|
|||
*/
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
*
|
||||
* When this option is disabled, mbedtls_ecp_mul() will make use of an
|
||||
* internal RNG when called with a NULL \c f_rng argument, in order to protect
|
||||
* against some side-channel attacks.
|
||||
*
|
||||
* This protection introduces a dependency of the ECP module on one of the
|
||||
* DRBG modules. For very constrained implementations that don't require this
|
||||
* protection (for example, because you're only doing signature verification,
|
||||
* so not manipulating any secret, or because local/physical side-channel
|
||||
* attacks are outside your threat model), it might be desirable to get rid of
|
||||
* that dependency.
|
||||
*
|
||||
* \warning Enabling this option makes some uses of ECP vulnerable to some
|
||||
* side-channel attacks. Only enable it if you know that's not a problem for
|
||||
* your use case.
|
||||
*
|
||||
* Uncomment this macro to disable some counter-measures in ECP.
|
||||
*/
|
||||
//#define MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_ECP_RESTARTABLE
|
||||
*
|
||||
|
|
|
@ -181,7 +181,6 @@ EXCLUDE_FROM_FULL = frozenset([
|
|||
'MBEDTLS_DEPRECATED_WARNING', # conflicts with deprecated options
|
||||
'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED', # influences the use of ECDH in TLS
|
||||
'MBEDTLS_ECP_NO_FALLBACK', # removes internal ECP implementation
|
||||
'MBEDTLS_ECP_NO_INTERNAL_RNG', # removes a feature
|
||||
'MBEDTLS_ECP_RESTARTABLE', # incompatible with USE_PSA_CRYPTO
|
||||
'MBEDTLS_ENTROPY_FORCE_SHA256', # interacts with CTR_DRBG_128_BIT_KEY
|
||||
'MBEDTLS_HAVE_SSE2', # hardware dependency
|
||||
|
|
|
@ -1000,7 +1000,6 @@ component_test_psa_external_rng_no_drbg_classic () {
|
|||
scripts/config.py unset MBEDTLS_CTR_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_HMAC_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
|
||||
scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
# When MBEDTLS_USE_PSA_CRYPTO is disabled and there is no DRBG,
|
||||
# the SSL test programs don't have an RNG and can't work. Explicitly
|
||||
# make them use the PSA RNG with -DMBEDTLS_TEST_USE_PSA_CRYPTO_RNG.
|
||||
|
@ -1023,7 +1022,6 @@ component_test_psa_external_rng_no_drbg_use_psa () {
|
|||
scripts/config.py unset MBEDTLS_CTR_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_HMAC_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
|
||||
scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
make CFLAGS="$ASAN_CFLAGS -O2" LDFLAGS="$ASAN_CFLAGS"
|
||||
|
||||
msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, PSA crypto - main suites"
|
||||
|
@ -1048,43 +1046,6 @@ component_test_psa_external_rng_use_psa_crypto () {
|
|||
if_build_succeeded tests/ssl-opt.sh -f 'Default\|opaque'
|
||||
}
|
||||
|
||||
component_test_ecp_no_internal_rng () {
|
||||
msg "build: Default plus ECP_NO_INTERNAL_RNG minus DRBG modules"
|
||||
scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
scripts/config.py unset MBEDTLS_CTR_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_HMAC_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
|
||||
scripts/config.py unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
|
||||
scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
|
||||
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: ECP_NO_INTERNAL_RNG, no DRBG module"
|
||||
make test
|
||||
|
||||
# no SSL tests as they all depend on having a DRBG
|
||||
}
|
||||
|
||||
component_test_ecp_restartable_no_internal_rng () {
|
||||
msg "build: Default plus ECP_RESTARTABLE and ECP_NO_INTERNAL_RNG, no DRBG"
|
||||
scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
scripts/config.py set MBEDTLS_ECP_RESTARTABLE
|
||||
scripts/config.py unset MBEDTLS_CTR_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_HMAC_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
|
||||
scripts/config.py unset MBEDTLS_PSA_CRYPTO_C # requires CTR_DRBG
|
||||
scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
|
||||
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: ECP_RESTARTABLE and ECP_NO_INTERNAL_RNG, no DRBG module"
|
||||
make test
|
||||
|
||||
# no SSL tests as they all depend on having a DRBG
|
||||
}
|
||||
|
||||
component_test_everest () {
|
||||
msg "build: Everest ECDH context (ASan build)" # ~ 6 min
|
||||
scripts/config.py set MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
|
||||
|
|
Loading…
Reference in a new issue