Merge pull request #715 from ARMmbed/merge-2.7.16-release-to-mbedtls-2.7

Merge 2.7.16 release to mbedtls 2.7
This commit is contained in:
Janos Follath 2020-07-01 14:44:34 +01:00 committed by GitHub
commit 4a4aad8983
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
22 changed files with 536 additions and 55 deletions

View file

@ -1,5 +1,57 @@
mbed TLS ChangeLog (Sorted per branch, date)
= mbed TLS 2.7.16 branch released 2020-07-01
Security
* Fix a side channel vulnerability in modular exponentiation that could
reveal an RSA private key used in a secure enclave. Noticed by Sangho Lee,
Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute
of Technology); and Marcus Peinado (Microsoft Research). Reported by Raoul
Strackx (Fortanix) in #3394.
* Fix side channel in mbedtls_ecp_check_pub_priv() and
mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a
private key that didn't include the uncompressed public key), as well as
mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL
f_rng argument. An attacker with access to precise enough timing and
memory access information (typically an untrusted operating system
attacking a secure enclave) could fully recover the ECC private key.
Found and reported by Alejandro Cabrera Aldaya and Billy Brumley.
* Fix issue in Lucky 13 counter-measure that could make it ineffective when
hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT
macros). This would cause the original Lucky 13 attack to be possible in
those configurations, allowing an active network attacker to recover
plaintext after repeated timing measurements under some conditions.
Reported and fix suggested by Luc Perneel in #3246.
Bugfix
* Fix the Visual Studio Release x64 build configuration for mbedtls itself.
Completes a previous fix in Mbed TLS 2.7.12 that only fixed the build for
the example programs. Reported in #1430 and fix contributed by irwir.
* Fix undefined behavior in X.509 certificate parsing if the
pathLenConstraint basic constraint value is equal to INT_MAX.
The actual effect with almost every compiler is the intended
behavior, so this is unlikely to be exploitable anywhere. #3196
* Include asn1.h in error.c. Fixes #3328 reported by David Hu.
* Fix potential memory leaks in ecp_randomize_jac() and ecp_randomize_mxz()
when PRNG function fails. Contributed by Jonas Lejeune in #3318.
* Add additional bounds checks in ssl_write_client_hello() preventing
output buffer overflow if the configuration declared a buffer that was
too small.
Changes
* Unify the example programs termination to call mbedtls_exit() instead of
using a return command. This has been done to enable customization of the
behavior in bare metal environments.
* Abort the ClientHello writing function as soon as some extension doesn't
fit into the record buffer. Previously, such extensions were silently
dropped. As a consequence, the TLS handshake now fails when the output
buffer is not large enough to hold the ClientHello.
* The ECP module, enabled by `MBEDTLS_ECP_C`, now depends on
`MBEDTLS_CTR_DRBG_C`, `MBEDTLS_HMAC_DRBG_C`, `MBEDTLS_SHA512_C` or
`MBEDTLS_SHA256_C` for some side-channel coutermeasures. If side channels
are not a concern, this dependency can be avoided by enabling the new
option `MBEDTLS_ECP_NO_INTERNAL_RNG`.
= mbed TLS 2.7.15 branch released 2020-04-14
Security

View file

@ -1,4 +0,0 @@
Bugfix
* Fix the Visual Studio Release x64 build configuration for mbedtls itself.
Completes a previous fix in Mbed TLS 2.7.12 that only fixed the build for
the example programs. Reported in #1430 and fix contributed by irwir.

View file

@ -1,2 +0,0 @@
Bugfix
* Include asn1.h in error.c. Fixes #3328 reported by David Hu.

View file

@ -1,3 +0,0 @@
Bugfix
* Fix potential memory leaks in ecp_randomize_jac() and ecp_randomize_mxz()
when PRNG function fails. Contributed by Jonas Lejeune in #3318.

View file

@ -1,5 +0,0 @@
Bugfix
* Fix undefined behavior in X.509 certificate parsing if the
pathLenConstraint basic constraint value is equal to INT_MAX.
The actual effect with almost every compiler is the intended
behavior, so this is unlikely to be exploitable anywhere. #3196

View file

@ -1,6 +0,0 @@
Security
* Fix a side channel vulnerability in modular exponentiation that could
reveal an RSA private key used in a secure enclave. Noticed by Sangho Lee,
Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute
of Technology); and Marcus Peinado (Microsoft Research). Reported by Raoul
Strackx (Fortanix) in #3394.

View file

@ -1,4 +0,0 @@
Changes
* Unify the example programs termination to call mbedtls_exit() instead of
using a return command. This has been done to enable customization of the
behavior in bare metal environments.

View file

@ -1,9 +0,0 @@
Bugfix
* Add additional bounds checks in ssl_write_client_hello() preventing
output buffer overflow if the configuration declared a buffer that was
too small.
Changes
* Abort the ClientHello writing function as soon as some extension doesn't
fit into the record buffer. Previously, such extensions were silently
dropped. As a consequence, the TLS handshake now fails when the output
buffer is not large enough to hold the ClientHello.

View file

@ -51,7 +51,7 @@
*/
/**
* @mainpage mbed TLS v2.7.15 source code documentation
* @mainpage mbed TLS v2.7.16 source code documentation
*
* This documentation describes the internal structure of mbed TLS. It was
* automatically generated from specially formatted comment blocks in

View file

@ -28,7 +28,7 @@ DOXYFILE_ENCODING = UTF-8
# identify the project. Note that if you do not use Doxywizard you need
# to put quotes around the project name if it contains spaces.
PROJECT_NAME = "mbed TLS v2.7.15"
PROJECT_NAME = "mbed TLS v2.7.16"
# The PROJECT_NUMBER tag can be used to enter a project or revision number.
# This could be handy for archiving the generated documentation or

View file

@ -150,6 +150,16 @@
#error "MBEDTLS_ECP_C defined, but not all prerequisites"
#endif
#if defined(MBEDTLS_ECP_C) && !( \
defined(MBEDTLS_ECP_ALT) || \
defined(MBEDTLS_CTR_DRBG_C) || \
defined(MBEDTLS_HMAC_DRBG_C) || \
defined(MBEDTLS_SHA512_C) || \
defined(MBEDTLS_SHA256_C) || \
defined(MBEDTLS_ECP_NO_INTERNAL_RNG))
#error "MBEDTLS_ECP_C requires a DRBG or SHA-2 module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
#endif
#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)
#error "MBEDTLS_PK_PARSE_C defined, but not all prerequesites"
#endif

View file

@ -645,6 +645,28 @@
*/
#define MBEDTLS_ECP_NIST_OPTIM
/**
* \def MBEDTLS_ECP_NO_INTERNAL_RNG
*
* When this option is disabled, mbedtls_ecp_mul() will make use of an
* internal RNG when called with a NULL \c f_rng argument, in order to protect
* against some side-channel attacks.
*
* This protection introduces a dependency of the ECP module on one of the
* DRBG or SHA modules (HMAC-DRBG, CTR-DRBG, SHA-512 or SHA-256.) For very
* constrained applications that don't require this protection (for example,
* because you're only doing signature verification, so not manipulating any
* secret, or because local/physical side-channel attacks are outside your
* threat model), it might be desirable to get rid of that dependency.
*
* \warning Enabling this option makes some uses of ECP vulnerable to some
* side-channel attacks. Only enable it if you know that's not a problem for
* your use case.
*
* Uncomment this macro to disable some counter-measures in ECP.
*/
//#define MBEDTLS_ECP_NO_INTERNAL_RNG
/**
* \def MBEDTLS_ECDSA_DETERMINISTIC
*

View file

@ -545,10 +545,13 @@ int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group *grp, size_t *olen,
* operations for any valid m. It avoids any if-branch or
* array index depending on the value of m.
*
* \note If f_rng is not NULL, it is used to randomize intermediate
* results in order to prevent potential timing attacks
* targeting these results. It is recommended to always
* provide a non-NULL f_rng (the overhead is negligible).
* \note If \p f_rng is not NULL, it is used to randomize
* intermediate results to prevent potential timing attacks
* targeting these results. We recommend always providing
* a non-NULL \p f_rng. The overhead is negligible.
* Note: unless #MBEDTLS_ECP_NO_INTERNAL_RNG is defined, when
* \p f_rng is NULL, an internal RNG (seeded from the value
* of \p m) will be used instead.
*
* \param grp ECP group
* \param R Destination point

View file

@ -122,6 +122,8 @@ typedef struct {
* \brief This function returns the list of digests supported by the
* generic digest module.
*
* \note The list starts with the strongest available hashes.
*
* \return A statically allocated array of digests. Each element
* in the returned list is an integer belonging to the
* message-digest enumeration #mbedtls_md_type_t.

View file

@ -67,16 +67,16 @@
*/
#define MBEDTLS_VERSION_MAJOR 2
#define MBEDTLS_VERSION_MINOR 7
#define MBEDTLS_VERSION_PATCH 15
#define MBEDTLS_VERSION_PATCH 16
/**
* The single version number has the following structure:
* MMNNPP00
* Major version | Minor version | Patch version
*/
#define MBEDTLS_VERSION_NUMBER 0x02070F00
#define MBEDTLS_VERSION_STRING "2.7.15"
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.7.15"
#define MBEDTLS_VERSION_NUMBER 0x02071000
#define MBEDTLS_VERSION_STRING "2.7.16"
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.7.16"
#if defined(MBEDTLS_VERSION_C)

View file

@ -147,15 +147,15 @@ endif(USE_STATIC_MBEDTLS_LIBRARY)
if(USE_SHARED_MBEDTLS_LIBRARY)
add_library(mbedcrypto SHARED ${src_crypto})
set_target_properties(mbedcrypto PROPERTIES VERSION 2.7.15 SOVERSION 2)
set_target_properties(mbedcrypto PROPERTIES VERSION 2.7.16 SOVERSION 2)
target_link_libraries(mbedcrypto ${libs})
add_library(mbedx509 SHARED ${src_x509})
set_target_properties(mbedx509 PROPERTIES VERSION 2.7.15 SOVERSION 0)
set_target_properties(mbedx509 PROPERTIES VERSION 2.7.16 SOVERSION 0)
target_link_libraries(mbedx509 ${libs} mbedcrypto)
add_library(mbedtls SHARED ${src_tls})
set_target_properties(mbedtls PROPERTIES VERSION 2.7.15 SOVERSION 10)
set_target_properties(mbedtls PROPERTIES VERSION 2.7.16 SOVERSION 10)
target_link_libraries(mbedtls ${libs} mbedx509)
install(TARGETS mbedtls mbedx509 mbedcrypto

View file

@ -94,6 +94,20 @@
#include "mbedtls/ecp_internal.h"
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
#if defined(MBEDTLS_HMAC_DRBG_C)
#include "mbedtls/hmac_drbg.h"
#elif defined(MBEDTLS_CTR_DRBG_C)
#include "mbedtls/ctr_drbg.h"
#elif defined(MBEDTLS_SHA512_C)
#include "mbedtls/sha512.h"
#elif defined(MBEDTLS_SHA256_C)
#include "mbedtls/sha256.h"
#else
#error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
#endif
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
!defined(inline) && !defined(__cplusplus)
#define inline __inline
@ -112,6 +126,233 @@ static void mbedtls_zeroize( void *v, size_t n ) {
static unsigned long add_count, dbl_count, mul_count;
#endif
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
/*
* Currently ecp_mul() takes a RNG function as an argument, used for
* side-channel protection, but it can be NULL. The initial reasoning was
* that people will pass non-NULL RNG when they care about side-channels, but
* unfortunately we have some APIs that call ecp_mul() with a NULL RNG, with
* no opportunity for the user to do anything about it.
*
* The obvious strategies for addressing that include:
* - change those APIs so that they take RNG arguments;
* - require a global RNG to be available to all crypto modules.
*
* Unfortunately those would break compatibility. So what we do instead is
* have our own internal DRBG instance, seeded from the secret scalar.
*
* The following is a light-weight abstraction layer for doing that with
* HMAC_DRBG (first choice) or CTR_DRBG.
*/
#if defined(MBEDTLS_HMAC_DRBG_C)
/* DRBG context type */
typedef mbedtls_hmac_drbg_context ecp_drbg_context;
/* DRBG context init */
static inline void ecp_drbg_init( ecp_drbg_context *ctx )
{
mbedtls_hmac_drbg_init( ctx );
}
/* DRBG context free */
static inline void ecp_drbg_free( ecp_drbg_context *ctx )
{
mbedtls_hmac_drbg_free( ctx );
}
/* DRBG function */
static inline int ecp_drbg_random( void *p_rng,
unsigned char *output, size_t output_len )
{
return( mbedtls_hmac_drbg_random( p_rng, output, output_len ) );
}
/* DRBG context seeding */
static int ecp_drbg_seed( ecp_drbg_context *ctx,
const mbedtls_mpi *secret, size_t secret_len )
{
int ret;
unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES];
/* The list starts with strong hashes */
const mbedtls_md_type_t md_type = mbedtls_md_list()[0];
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_type );
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret,
secret_bytes, secret_len ) );
ret = mbedtls_hmac_drbg_seed_buf( ctx, md_info, secret_bytes, secret_len );
cleanup:
mbedtls_zeroize( secret_bytes, secret_len );
return( ret );
}
#elif defined(MBEDTLS_CTR_DRBG_C)
/* DRBG context type */
typedef mbedtls_ctr_drbg_context ecp_drbg_context;
/* DRBG context init */
static inline void ecp_drbg_init( ecp_drbg_context *ctx )
{
mbedtls_ctr_drbg_init( ctx );
}
/* DRBG context free */
static inline void ecp_drbg_free( ecp_drbg_context *ctx )
{
mbedtls_ctr_drbg_free( ctx );
}
/* DRBG function */
static inline int ecp_drbg_random( void *p_rng,
unsigned char *output, size_t output_len )
{
return( mbedtls_ctr_drbg_random( p_rng, output, output_len ) );
}
/*
* Since CTR_DRBG doesn't have a seed_buf() function the way HMAC_DRBG does,
* we need to pass an entropy function when seeding. So we use a dummy
* function for that, and pass the actual entropy as customisation string.
* (During seeding of CTR_DRBG the entropy input and customisation string are
* concatenated before being used to update the secret state.)
*/
static int ecp_ctr_drbg_null_entropy(void *ctx, unsigned char *out, size_t len)
{
(void) ctx;
memset( out, 0, len );
return( 0 );
}
/* DRBG context seeding */
static int ecp_drbg_seed( ecp_drbg_context *ctx,
const mbedtls_mpi *secret, size_t secret_len )
{
int ret;
unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES];
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret,
secret_bytes, secret_len ) );
ret = mbedtls_ctr_drbg_seed( ctx, ecp_ctr_drbg_null_entropy, NULL,
secret_bytes, secret_len );
cleanup:
mbedtls_zeroize( secret_bytes, secret_len );
return( ret );
}
#elif defined(MBEDTLS_SHA512_C) || defined(MBEDTLS_SHA256_C)
/* This will be used in the self-test function */
#define ECP_ONE_STEP_KDF
/*
* We need to expand secret data (the scalar) into a longer stream of bytes.
*
* We'll use the One-Step KDF from NIST SP 800-56C, with option 1 (H is a hash
* function) and empty FixedInfo. (Though we'll make it fit the DRBG API for
* convenience, this is not a full-fledged DRBG, but we don't need one here.)
*
* We need a basic hash abstraction layer to use whatever SHA-2 is available.
*/
#if defined(MBEDTLS_SHA512_C)
#define HASH_FUNC( in, ilen, out ) mbedtls_sha512_ret( in, ilen, out, 0 );
#define HASH_BLOCK_BYTES ( 512 / 8 )
#elif defined(MBEDTLS_SHA256_C)
#define HASH_FUNC( in, ilen, out ) mbedtls_sha256_ret( in, ilen, out, 0 );
#define HASH_BLOCK_BYTES ( 256 / 8 )
#endif /* SHA512/SHA256 abstraction */
/*
* State consists of a 32-bit counter plus the secret value.
*
* We stored them concatenated in a single buffer as that's what will get
* passed to the hash function.
*/
typedef struct {
size_t total_len;
uint8_t buf[4 + MBEDTLS_ECP_MAX_BYTES];
} ecp_drbg_context;
static void ecp_drbg_init( ecp_drbg_context *ctx )
{
memset( ctx, 0, sizeof( ecp_drbg_context ) );
}
static void ecp_drbg_free( ecp_drbg_context *ctx )
{
mbedtls_zeroize( ctx, sizeof( ecp_drbg_context ) );
}
static int ecp_drbg_seed( ecp_drbg_context *ctx,
const mbedtls_mpi *secret, size_t secret_len )
{
ctx->total_len = 4 + secret_len;
memset( ctx->buf, 0, 4);
return( mbedtls_mpi_write_binary( secret, ctx->buf + 4, secret_len ) );
}
static int ecp_drbg_random( void *p_rng, unsigned char *output, size_t output_len )
{
ecp_drbg_context *ctx = p_rng;
int ret;
size_t len_done = 0;
uint8_t tmp[HASH_BLOCK_BYTES];
while( len_done < output_len )
{
uint8_t use_len;
/* This function is only called for coordinate randomisation, which
* happens only twice in a scalar multiplication. Each time needs a
* random value in the range [2, p-1], and gets it by drawing len(p)
* bytes from this function, and retrying up to 10 times if unlucky.
*
* So for the largest curve, each scalar multiplication draws at most
* 20 * 66 bytes. The minimum block size is 32 (SHA-256), so with
* rounding that means a most 20 * 3 blocks.
*
* Since we don't need to draw more that 255 blocks, don't bother
* with carry propagation and just return an error instead. We can
* change that it we even need to draw more blinding values.
*/
ctx->buf[3] += 1;
if( ctx->buf[3] == 0 )
return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
ret = HASH_FUNC( ctx->buf, ctx->total_len, tmp );
if( ret != 0 )
return( ret );
if( output_len - len_done > HASH_BLOCK_BYTES )
use_len = HASH_BLOCK_BYTES;
else
use_len = output_len - len_done;
memcpy( output + len_done, tmp, use_len );
len_done += use_len;
}
mbedtls_zeroize( tmp, sizeof( tmp ) );
return( 0 );
}
#else /* DRBG/SHA modules */
#error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
#endif /* DRBG/SHA modules */
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
@ -1357,7 +1598,9 @@ static int ecp_mul_comb_core( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R
i = d;
MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, t_len, x[i] ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 1 ) );
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
if( f_rng != 0 )
#endif
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
while( i-- != 0 )
@ -1486,7 +1729,9 @@ static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
*
* Avoid the leak by randomizing coordinates before we normalize them.
*/
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
if( f_rng != 0 )
#endif
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, R ) );
@ -1689,7 +1934,9 @@ static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
MOD_ADD( RP.X );
/* Randomize coordinates of the starting point */
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
if( f_rng != NULL )
#endif
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
/* Loop invariant: R = result so far, RP = R + P */
@ -1722,7 +1969,9 @@ static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
*
* Avoid the leak by randomizing coordinates before we normalize them.
*/
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
if( f_rng != NULL )
#endif
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, R, f_rng, p_rng ) );
MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) );
@ -1746,6 +1995,11 @@ int mbedtls_ecp_mul( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
#if defined(MBEDTLS_ECP_INTERNAL_ALT)
char is_grp_capable = 0;
#endif
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
ecp_drbg_context drbg_ctx;
ecp_drbg_init( &drbg_ctx );
#endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */
/* Common sanity checks */
if( mbedtls_mpi_cmp_int( &P->Z, 1 ) != 0 )
@ -1755,32 +2009,46 @@ int mbedtls_ecp_mul( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
( ret = mbedtls_ecp_check_pubkey( grp, P ) ) != 0 )
return( ret );
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
if( f_rng == NULL )
{
const size_t m_len = ( grp->nbits + 7 ) / 8;
MBEDTLS_MPI_CHK( ecp_drbg_seed( &drbg_ctx, m, m_len ) );
f_rng = &ecp_drbg_random;
p_rng = &drbg_ctx;
}
#endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */
#if defined(MBEDTLS_ECP_INTERNAL_ALT)
if ( is_grp_capable = mbedtls_internal_ecp_grp_capable( grp ) )
{
MBEDTLS_MPI_CHK( mbedtls_internal_ecp_init( grp ) );
}
#endif /* MBEDTLS_ECP_INTERNAL_ALT */
#if defined(ECP_MONTGOMERY)
if( ecp_get_type( grp ) == ECP_TYPE_MONTGOMERY )
ret = ecp_mul_mxz( grp, R, m, P, f_rng, p_rng );
#endif
#if defined(ECP_SHORTWEIERSTRASS)
if( ecp_get_type( grp ) == ECP_TYPE_SHORT_WEIERSTRASS )
ret = ecp_mul_comb( grp, R, m, P, f_rng, p_rng );
#endif
#if defined(MBEDTLS_ECP_INTERNAL_ALT) || !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
cleanup:
#endif
#if defined(MBEDTLS_ECP_INTERNAL_ALT)
cleanup:
if ( is_grp_capable )
{
mbedtls_internal_ecp_free( grp );
}
#endif /* MBEDTLS_ECP_INTERNAL_ALT */
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
ecp_drbg_free( &drbg_ctx );
#endif
return( ret );
}
@ -2145,6 +2413,76 @@ cleanup:
#if defined(MBEDTLS_SELF_TEST)
#if defined(ECP_ONE_STEP_KDF)
/*
* There are no test vectors from NIST for the One-Step KDF in SP 800-56C,
* but unofficial ones can be found at:
* https://github.com/patrickfav/singlestep-kdf/wiki/NIST-SP-800-56C-Rev1:-Non-Official-Test-Vectors
*
* We only use the ones with empty fixedInfo, and for brevity's sake, only
* 40-bytes output (with SHA-256 that's more than one block, and with SHA-512
* less than one block).
*/
#if defined(MBEDTLS_SHA512_C)
static const uint8_t test_kdf_z[16] = {
0x3b, 0xa9, 0x79, 0xe9, 0xbc, 0x5e, 0x3e, 0xc7,
0x61, 0x30, 0x36, 0xb6, 0xf5, 0x1c, 0xd5, 0xaa,
};
static const uint8_t test_kdf_out[40] = {
0x3e, 0xf6, 0xda, 0xf9, 0x51, 0x60, 0x70, 0x5f,
0xdf, 0x21, 0xcd, 0xab, 0xac, 0x25, 0x7b, 0x05,
0xfe, 0xc1, 0xab, 0x7c, 0xc9, 0x68, 0x43, 0x25,
0x8a, 0xfc, 0x40, 0x6e, 0x5b, 0xf7, 0x98, 0x27,
0x10, 0xfa, 0x7b, 0x93, 0x52, 0xd4, 0x16, 0xaa,
};
#elif defined(MBEDTLS_SHA256_C)
static const uint8_t test_kdf_z[16] = {
0xc8, 0x3e, 0x35, 0x8e, 0x99, 0xa6, 0x89, 0xc6,
0x7d, 0xb4, 0xfe, 0x39, 0xcf, 0x8f, 0x26, 0xe1,
};
static const uint8_t test_kdf_out[40] = {
0x7d, 0xf6, 0x41, 0xf8, 0x3c, 0x47, 0xdc, 0x28,
0x5f, 0x7f, 0xaa, 0xde, 0x05, 0x64, 0xd6, 0x25,
0x00, 0x6a, 0x47, 0xd9, 0x1e, 0xa4, 0xa0, 0x8c,
0xd7, 0xf7, 0x0c, 0x99, 0xaa, 0xa0, 0x72, 0x66,
0x69, 0x0e, 0x25, 0xaa, 0xa1, 0x63, 0x14, 0x79,
};
#endif
static int ecp_kdf_self_test( void )
{
int ret;
ecp_drbg_context kdf_ctx;
mbedtls_mpi scalar;
uint8_t out[sizeof( test_kdf_out )];
ecp_drbg_init( &kdf_ctx );
mbedtls_mpi_init( &scalar );
memset( out, 0, sizeof( out ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &scalar,
test_kdf_z, sizeof( test_kdf_z ) ) );
MBEDTLS_MPI_CHK( ecp_drbg_seed( &kdf_ctx,
&scalar, sizeof( test_kdf_z ) ) );
MBEDTLS_MPI_CHK( ecp_drbg_random( &kdf_ctx, out, sizeof( out ) ) );
if( memcmp( out, test_kdf_out, sizeof( out ) ) != 0 )
ret = -1;
cleanup:
ecp_drbg_free( &kdf_ctx );
mbedtls_mpi_free( &scalar );
return( ret );
}
#endif /* ECP_ONE_STEP_KDF */
/*
* Checkup routine
*/
@ -2256,6 +2594,24 @@ int mbedtls_ecp_self_test( int verbose )
if( verbose != 0 )
mbedtls_printf( "passed\n" );
#if defined(ECP_ONE_STEP_KDF)
if( verbose != 0 )
mbedtls_printf( " ECP test #3 (internal KDF): " );
ret = ecp_kdf_self_test();
if( ret != 0 )
{
if( verbose != 0 )
mbedtls_printf( "failed\n" );
ret = 1;
goto cleanup;
}
if( verbose != 0 )
mbedtls_printf( "passed\n" );
#endif /* ECP_ONE_STEP_KDF */
cleanup:
if( ret < 0 && verbose != 0 )

View file

@ -2119,10 +2119,20 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
ssl_read_memory( ssl->in_msg + ssl->in_msglen, padlen );
mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mac_expect );
/* Call mbedtls_md_process at least once due to cache attacks
* that observe whether md_process() was called of not */
/* Dummy calls to compression function.
* Call mbedtls_md_process at least once due to cache attacks
* that observe whether md_process() was called of not.
* Respect the usual start-(process|update)-finish sequence for
* the sake of hardware accelerators that might require it. */
mbedtls_md_starts( &ssl->transform_in->md_ctx_dec );
for( j = 0; j < extra_run + 1; j++ )
mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg );
{
/* The switch statement above already checks that we're using
* one of MD-5, SHA-1, SHA-256 or SHA-384. */
unsigned char tmp[384 / 8];
mbedtls_md_finish( &ssl->transform_in->md_ctx_dec, tmp );
}
mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );

View file

@ -339,6 +339,9 @@ static const char *features[] = {
#if defined(MBEDTLS_ECP_NIST_OPTIM)
"MBEDTLS_ECP_NIST_OPTIM",
#endif /* MBEDTLS_ECP_NIST_OPTIM */
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
"MBEDTLS_ECP_NO_INTERNAL_RNG",
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
"MBEDTLS_ECDSA_DETERMINISTIC",
#endif /* MBEDTLS_ECDSA_DETERMINISTIC */

View file

@ -112,6 +112,7 @@ EOU
my @excluded = qw(
MBEDTLS_DEPRECATED_REMOVED
MBEDTLS_DEPRECATED_WARNING
MBEDTLS_ECP_NO_INTERNAL_RNG
MBEDTLS_HAVE_SSE2
MBEDTLS_MEMORY_BACKTRACE
MBEDTLS_MEMORY_BUFFER_ALLOC_C

View file

@ -892,6 +892,61 @@ component_test_no_hmac_drbg () {
# so there's little value in running those lengthy tests here.
}
component_test_no_drbg_all_hashes () {
# this tests the internal ECP DRBG using a KDF based on SHA-512
msg "build: Default minus DRBGs"
scripts/config.pl unset MBEDTLS_CTR_DRBG_C
scripts/config.pl unset MBEDTLS_HMAC_DRBG_C
scripts/config.pl unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
make
msg "test: Default minus DRBGs"
make test
# no SSL tests as they all depend on having a DRBG
}
component_test_no_drbg_no_sha512 () {
# this tests the internal ECP DRBG using a KDF based on SHA-256
msg "build: Default minus DRBGs minus SHA-512"
scripts/config.pl unset MBEDTLS_CTR_DRBG_C
scripts/config.pl unset MBEDTLS_HMAC_DRBG_C
scripts/config.pl unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
scripts/config.pl unset MBEDTLS_SHA512_C
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
make
msg "test: Default minus DRBGs minus SHA-512"
make test
# no SSL tests as they all depend on having a DRBG
}
component_test_ecp_no_internal_rng () {
msg "build: Default plus ECP_NO_INTERNAL_RNG minus DRBG modules"
scripts/config.pl set MBEDTLS_ECP_NO_INTERNAL_RNG
scripts/config.pl unset MBEDTLS_CTR_DRBG_C
scripts/config.pl unset MBEDTLS_HMAC_DRBG_C
scripts/config.pl unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
make
msg "test: ECP_NO_INTERNAL_RNG, no DRBG module"
make test
# no SSL tests as they all depend on having a DRBG
}
component_test_full_cmake_clang () {
msg "build: cmake, full config, clang" # ~ 50s
scripts/config.pl full

View file

@ -1,8 +1,8 @@
Check compiletime library version
check_compiletime_version:"2.7.15"
check_compiletime_version:"2.7.16"
Check runtime library version
check_runtime_version:"2.7.15"
check_runtime_version:"2.7.16"
Check for MBEDTLS_VERSION_C
check_feature:"MBEDTLS_VERSION_C":0