Commit graph

6760 commits

Author SHA1 Message Date
Valerio Setti
88ae0ef286 pk: completely remove mbedtls_pk_wrap_as_opaque
Remove instead of deprecating it.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-27 13:49:42 +01:00
Valerio Setti
4c6cea549c pk: deprecate mbedtls_pk_wrap_as_opaque()
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-27 10:51:03 +01:00
Tom Cosgrove
817772a6ca
Merge pull request #8716 from mschulz-at-hilscher/feature/gcm_largetable
Use large GCM tables
2024-02-23 16:25:38 +00:00
Gilles Peskine
0aab69d2eb
Merge pull request #8807 from gilles-peskine-arm/pk_import_into_psa-implement_import
Implement mbedtls_pk_import_into_psa
2024-02-21 15:45:17 +00:00
Gilles Peskine
dd49c739f0 Merge remote-tracking branch 'development' into pk_import_into_psa-implement_import
Conflicts:
* tests/suites/test_suite_pk.function: consecutive changes to the
  depends_on line of pk_sign_verify and its argument list.
2024-02-21 12:10:40 +01:00
Manuel Pégourié-Gonnard
0ecb5fd6f5
Merge pull request #8574 from ronald-cron-arm/ssl-tickets
Fix and align ticket age check in ssl_ticket.c for TLS 1.2 and TLS 1.3
2024-02-21 09:38:46 +00:00
Manuel Pégourié-Gonnard
fc3f980f0f
Merge pull request #8826 from valeriosetti/issue8824
RSA keys set to PSS/OAEP padding perform PKCS1v1.5 when MBEDTLS_USE_PSA_CRYPTO is enabled
2024-02-20 14:08:41 +00:00
Manuel Pégourié-Gonnard
a7f651cf16
Merge pull request #8804 from valeriosetti/issue8799
mbedtls_rsa_parse_key and mbedtls_rsa_parse_pubkey accept trailing garbage
2024-02-20 11:58:52 +00:00
Janos Follath
028a38b7cb
Merge pull request #8661 from BensonLiou/use_init_api
use mbedtls_ssl_session_init() to init session variable
2024-02-19 15:49:34 +00:00
Valerio Setti
85e568c76d pk: fix documentation for RSA sign/verify and encrypt/decrypt
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-19 15:45:00 +01:00
Manuel Pégourié-Gonnard
d93e640882
Merge pull request #8797 from adeaarm/check_config_look_for_crypto_client
Make check_config aware of MBEDTLS_PSA_CRYPTO_CLIENT
2024-02-19 08:14:34 +00:00
Valerio Setti
4cc6522a85 pem: do not parse ASN1 data after decryption (removes ASN1 dependency)
Now that we have padding verification after decryption and since
this can be used to validate the password as well there is no
need to parse ASN1 content any more, so we can simplify/remove
that dependency.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-16 15:26:12 +01:00
Valerio Setti
90ea4fd201 pk: fix documentation for sign/verify and encrypt/decrypt
Remove exception warnings about PKCS1v1.5, since now both padding
formats are treated properly no matter if USE_PSA_CRYPTO is
defined or not.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-16 15:19:19 +01:00
Gilles Peskine
4da1f01f88 Fix copypasta
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-15 17:15:29 +01:00
Yanray Wang
a8f8eb1e35 check_config: add missing dependency check for MBEDTLS_PK_WRITE_C
MBEDTLS_PK_WRITE_C requires MBEDTLS_ASN1_WRITE_C, but there is no
corresponding check in check_config.h. In addition, corresponding
documentation for `Requires` is updated in mbedtls_config.h.

Signed-off-by: Yanray Wang <yanray.wang@arm.com>
2024-02-14 16:00:35 +00:00
Yanray Wang
072a068f9f check_config: combine check for MBEDTLS_PK_PARSE_C
- check_config.h: combine separate check for MBEDTLS_PK_PARSE_C
- mbedtls_config.h: update documentation for `Requires`

Signed-off-by: Yanray Wang <yanray.wang@arm.com>
2024-02-14 16:00:28 +00:00
Yanray Wang
5b118d4aed Check MBEDTLS_PK_{PARSE,WRITE}_C requires MBEDTLS_OID_C
- check_config.h: add this dependency check
- mbedtls_config.h: update corresponding requirement documentation

Signed-off-by: Yanray Wang <yanray.wang@arm.com>
2024-02-14 15:56:02 +00:00
Yanray Wang
687bfcb54c pk: remove duplicate define of MBEDTLS_PK_HAVE_ECC_KEYS
In pk.h, MBEDTLS_PK_HAVE_ECC_KEYS is enabled if ECP_C is defined or
USE_PSA_CRYPTO && PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY are defined.
But this logic is duplicate with its definition in
config_adjust_legacy_crypto.h.

Signed-off-by: Yanray Wang <yanray.wang@arm.com>
2024-02-14 15:56:02 +00:00
Yanray Wang
b807cc6eba Add checks for PK_[PARSE/WRITE]_C when PK_HAVE_ECC_KEYS is set
When PK_HAVE_ECC_KEYS is set with PK_[PARSE/WRITE]_C, it needs OID_C
to be enabled. This commit adds proper checks in check_config.h

Signed-off-by: Yanray Wang <yanray.wang@arm.com>
2024-02-14 15:56:02 +00:00
Tom Cosgrove
1c0b1bffee
Merge pull request #8779 from gilles-peskine-arm/rsa-bitlen-fix
Fix mbedtls_pk_get_bitlen for a key size that is not a multiple of 8
2024-02-14 11:18:25 +00:00
Manuel Pégourié-Gonnard
e6c80bc6e5
Merge pull request #8755 from ronald-cron-arm/tls13-client-early-data-status
TLS 1.3: Refine and test client early data status
2024-02-13 20:36:42 +00:00
Antonio de Angelis
aa33d600cf Merge remote-tracking branch 'origin/development' into check_config_look_for_crypto_client 2024-02-13 11:43:05 +00:00
Manuel Pégourié-Gonnard
cd376dbec8
Merge pull request #8802 from mpg/adjust-vs-check
Misc. clean-ups in `check_config.h`
2024-02-13 08:45:18 +00:00
Gilles Peskine
19f1adfc69 New function mbedtls_rsa_get_bitlen()
Document, implement and test mbedtls_rsa_get_bitlen().

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-12 11:23:05 +01:00
Janos Follath
f741db3d6e
Merge pull request #8764 from Ryan-Everett-arm/threadsafe-key-wiping
Make key destruction thread safe
2024-02-12 09:37:59 +00:00
Gilles Peskine
05ee3fbdc0 mbedtls_pk_import_into_psa: documentation
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-09 19:31:04 +01:00
Matthias Schulz
a6ac0f1330 Replaced MBEDTLS_GCM_LARGETABLE by MBEDTLS_GCM_LARGE_TABLE. Removed empty comment line in doc block.
Signed-off-by: Matthias Schulz <mschulz@hilscher.com>
2024-02-09 17:11:54 +01:00
Ronald Cron
7fdee8b710 ssl_session: Reorder some fields to reduce padding
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-02-09 09:26:12 +01:00
Valerio Setti
2653e92a57 pem: fix valid data length returned by mbedtls_pem_read_buffer()
ctx->buflen now returns the amount of valid data in ctx->buf.
Unencrypted buffers were already ok, but encrypted ones were
used to return the length of the encrypted buffer, not the
unencrypted one.
This commit fix this behavior for encrypted buffers.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-09 06:42:18 +01:00
Valerio Setti
b1f6d2ad6f asn1: enable mbedtls_asn1_get_tag() when PEM_PARSE_C is defined
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-09 06:42:18 +01:00
Manuel Pégourié-Gonnard
ac60afc2d2 Remove useless overly strong dependency
ECJPAKE_C only needs MD_LIGHT and it allready auto-enables it in
config_adjust_legacy_crypto.h, so nothing to check here.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 23:46:55 +01:00
Matthias Schulz
4a9610bffe Remove comments referencing private defines.
Signed-off-by: Matthias Schulz <mschulz@hilscher.com>
2024-02-08 18:39:17 +01:00
Matthias Schulz
f3116341e2
spelling
Co-authored-by: Dave Rodgman <dave.rodgman@arm.com>
Signed-off-by: Matthias Schulz <140500342+mschulz-at-hilscher@users.noreply.github.com>
2024-02-08 18:35:36 +01:00
Ryan Everett
791fc2e24c Merge remote-tracking branch 'upstream/development' into pkcs5_aes_new
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-02-08 14:26:29 +00:00
Matthias Schulz
782667883a Fix:
- Remove unnecessary tests.
- Update description of MBEDTLS_GCM_LARGETABLE parameter.
- Move acceleration defines from gcm.h to gcm.c.
- Remove unnecessary zero setting after shift.
- Fix implementation for big-endian architectures.

Signed-off-by: Matthias Schulz <mschulz@hilscher.com>
2024-02-08 13:59:15 +01:00
Manuel Pégourié-Gonnard
a6184b2cc8 Remove redundant check
We're already making sure of that in
include/mbedtls/config_adjust_psa_superset_legacy.h - no need to
double-check here.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:55:53 +01:00
Manuel Pégourié-Gonnard
1463e49a3c Move config adjustment to config_adjust
After this change, check_config.h does not have any #defined except:
- the standard header double-inclusion guard
- short-lived helpers that are #undef-ed in the same paragraph

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:55:52 +01:00
Manuel Pégourié-Gonnard
e1f3faf5bf Remove temporary macros that are not needed
Those were only used for KEY_EXCHANGE_ECJPAKE, but had a much larger
scope than needed. We actually don't need those macros if we distinguish
between cases when expressing dependencies for this key exchange.

The remaining helper macros are all short lived.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:55:51 +01:00
Manuel Pégourié-Gonnard
61758e606e Fix wrong dependency of ECJPAKE_C
It always uses MD now. (The "fall back" to PSA Crypto was only in the
1st iteration of driver-only hash support, before we changed the
architecture to make everything go through MD.)

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:44:22 +01:00
Manuel Pégourié-Gonnard
49f64b4cac Fix dependency on low-level hash modules
None of the TLS code is calling low-level hash functions directly. So
the correct dependencies here are MD_CAN.

(I checked and this was the only occurrence.)

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:44:21 +01:00
Manuel Pégourié-Gonnard
7eb3f9a523 Simplify and fix dependency of MD_C on a hash
Simplify: let's take advantage of the MD_CAN macros instead of doing it
again ourselves.

Fix: SHA-3 was forgotten.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:44:21 +01:00
Manuel Pégourié-Gonnard
68608b2317 Remove redundant helper macros in check_config.h
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:44:19 +01:00
Antonio de Angelis
058c9a34ec build_info should look for MBEDTLS_PSA_CRYPTO_CLIENT as well
Similarly to check_config.h, also build_info.h should consider
MBEDTLS_PSA_CRYPTO_CLIENT as the define which signals that PSA
Crypto APIs feature are being required in the build (possibly
due to the client/service architecture). It is automatically
enabled if CRYPTO_C is enabled, but only at config_adjust_legacy_crypto.h
which happens after the inclusion of the config_psa.h is needed

Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com>
2024-02-08 10:40:32 +00:00
Manuel Pégourié-Gonnard
b7307630bb
Merge pull request #8703 from valeriosetti/issue7765-guards-in-asn1
Conversion function between raw and DER ECDSA signatures (guards in ASN1)
2024-02-08 08:45:30 +00:00
Manuel Pégourié-Gonnard
7bf1e98f44
Merge pull request #8740 from valeriosetti/issue8647
Move RSA basic key parsing/writing to rsa.c
2024-02-08 08:35:42 +00:00
Antonio de Angelis
3c19b237d1 Fix trailing parenthesis
Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com>
2024-02-07 17:10:14 +00:00
Valerio Setti
affba30833 psa_util: update documentation for mbedtls_ecdsa_raw_to_der()
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-07 15:03:33 +01:00
Antonio de Angelis
7889fe7917 Make check_config aware of MBEDTLS_PSA_CRYPTO_CLIENT
When check_config needs to evaluate the availability of a feature
through a PSA API, it should look for MBEDTLS_PSA_CRYPTO_CLIENT
instead of MBEDTLS_PSA_CRYPTO_C, to be able to cover the case
where the API is provided through a client/service interface.

Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com>
2024-02-07 13:01:36 +00:00
Matthias Schulz
0767fdadbf Enhance GCM throughput using larger precalculated tables. Also refactored the code for shorter tables and moved the check for available accelerators to the context initialization code.
Signed-off-by: Matthias Schulz <mschulz@hilscher.com>
2024-02-07 13:17:50 +01:00
Manuel Pégourié-Gonnard
1d7bc1ecdf
Merge pull request #8717 from valeriosetti/issue8030
PSA FFDH: feature macros for parameters
2024-02-07 10:06:03 +00:00