Manuel Pégourié-Gonnard b902164cf0 Add temporary list of tasks for G1 and G2

Work in progress, some tasks have very explicit definitions and details
on how to execute, others much less so; some may need splitting.

These documents are temporary anyway, to give a rough idea of the work
remaining to reach those goals (both of which we started, but only for
some use case so far). Ultimately the result will be actionable and
estimated tasks on github.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>

2022-01-18 09:13:14 +01:00

5 KiB

Raw Blame History

This document is temporary; it lists tasks to achieve G1 as described in strategy.md while the strategy is being reviewed - once that's done, corresponding github issues will be created and this document removed.

For all of the tasks here, no specific testing is expected to be required, beyond passing the existing tests in a build with MBEDTLS_USE_PSA_ENABLED, see testing.md.

Symmetric crypto

Hashes

Use `psa_hash` in all of X.509

Conditionally on MBEDTLS_USE_PSA_CRYPTO, replace all remaining calls to mbedtls_md() or mbedtls_sha1_ret() by calls psa_hash functions, namely:

replace mbedtls_md() in x509_crt_verifycrl() in x509_crt.c
replace mbedtls_md() in mbedtls_x509write_crt_der() in x509write_crt.c
replace mbedtls_sha1_ret() in mbedtls_x509write_crt_set_subject_key_identifier()inx509write_crt.c`
replace mbedtls_sha1_ret() in mbedtls_x509write_crt_set_authority_key_identifier()inx509write_crt.c`
already done in x509_crt_check_signature() in x509_crt.c, but might want to replace multi-part with single-part.
already done in mbedtls_x509write_csr_der_internal() in x509write_csr.c, but might want to replace multi-part with single-part.

HMAC

Variable-time HMAC in TLS record protection

This is about the calls to mbedtls_md_hmac_xxx() in mbedtls_ssl_decrypt_buf() and mbedtls_ssl_encrypt_buf(), but excludes the call in mbedtls_ssl_cf_hmad() (which it its own task).
Might need to change the transform structure to hold a PSA context instead of an MD context. Note: might keep the MD context in parallel until the constant-time part is done as well.

TODO: study this better so it can be estimated.

Constant-time HMAC in TLS record protection

This is mbedtls_ssl_cf_hmac(). The PSA code might look a bit different as we'll probably need to store the HMAC key somewhere and compute the ipad/opad explicitly instead of using (the internals of) the MD layers for that.

TODO: study this better so it can be estimated.

Ciphers

Use PSA for all cipher operations in TLS

extend existing mbedtls_cipher_setup_psa() and related code to support other ciphers than AES that can be used in TLS: ARIA (depends on #4959), Camellia, ChachaPoly.
extend unit-testing in test_suite_cipher to test those new ciphers as AES-based cipher are already tested
remove the fallback mechanism in all places where cipher_setup_psa() is called from TLS code
expand use of run_test_psa() in ssl-opt.sh

Asymmetric crypto

ECDSA

Make `mbedtls_pk_sign()` use PSA for ECDSA operations

This is already done with PK_OPAQUE contexts, but this task is about doing it for regulard ECKEY/ECDSA contexts.
May share some code (transcoding) with the exist support for PK_OPAQUE contexts

RSA signature (and verification)

Make `mbedtls_pk_sign()` use PSA for RSA operations

with regular PK_RSA context
only PKCS#1 v1.5 for this task
similar to what's done for ECDSA, except no need for transcoding (I think)

Make `mbedtls_pk_verify()` use PSA for RSA operations

with regular PK_RSA context
only PKCS#1 v1.5 for this task
similar to what's done for ECDSA, except no need for transcoding (I think)

Make `mbedtls_pk_verify_ext()` use PSA for RSA operations

with regular PK_RSA context
this is for RSA-PSS
similar to what's done for ECDSA, except no need for transcoding (I think)
acceptable to enforce that all hashes are equal in the parameters (as imposed by the PSA API) and reject the signature otherwise
then need to check if all X.509 tests still pass, and if some don't, make them depend on !MBEDTLS_USE_PSA_CRYPTO

RISK: see psa-limitations.md

RSA en/decryption

Make `mbedtls_pk_encrypt()` use PSA for RSA operations

with regular PK_RSA context

Make `mbedtls_pk_decrypt()` use PSA for RSA operations

with regular PK_RSA context

ECDH

Write remaining utilities for ECDH parsing/writing

PSA only provides an API for the operation, need to parse and write parameters and public keys to/from grp ID + string of bytes
need to complete what was done in 4a.1
testing: positive: extract known-good inputs/outputs from actual handshakes?
testing: negative: manipulate known-good input to make it invalid

Note: future task in this section depend on this one, but not on each other.

Use PSA for ECDHE in ECDHE-ECDSA and ECDHE-RSA server-side

may need to separate branches from other ECDHE-based key exchanges
only server-side (client-side is already done, can be used for inspiration)

Use PSA for ECDH in ECDHE-PSK (all sides and versions)

only with non-opaque PSK (support for opaque PSK here is part of G2)

Use PSA for ECDH in static-ECDH key exchanges

may require additional utility functions to load from cert to PSA

FFDH

This may be hard, see psa-limitations.md

EC J-PAKE

Use PSA for all EC J-PAKE operations in TLS (both sides). (TODO: consider how this could be split.)

5 KiB Raw Blame History