mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-12-23 00:35:33 +00:00
Merge remote-tracking branch 'restricted/pr/510' into development-restricted-proposed
This commit is contained in:
commit
cdd1a6c872
17
ChangeLog
17
ChangeLog
|
@ -10,6 +10,17 @@ Security
|
|||
one using PrintableString and the other UTF8String) or
|
||||
in the choice of upper and lower case. Reported by
|
||||
HenrikRosenquistAndersson in #1784.
|
||||
* Fix mbedtls_mpi_is_prime() to use more rounds of probabilistic testing. The
|
||||
previous settings for the number of rounds made it practical for an
|
||||
adversary to construct non-primes that would be erroneously accepted as
|
||||
primes with high probability. This does not have an impact on the
|
||||
security of TLS, but can matter in other contexts with potentially
|
||||
adversarially-chosen numbers that should be prime and can be validated.
|
||||
For example, the number of rounds was enough to securely generate RSA key
|
||||
pairs or Diffie-Hellman parameters, but was insufficient to validate
|
||||
Diffie-Hellman parameters properly.
|
||||
See "Prime and Prejudice" by by Martin R. Albrecht and Jake Massimo and
|
||||
Kenneth G. Paterson and Juraj Somorovsky.
|
||||
|
||||
Features
|
||||
* Add support for temporarily suspending expensive ECC computations after
|
||||
|
@ -47,6 +58,9 @@ New deprecations
|
|||
* All module specific generic hardware accelaration errors following the
|
||||
form MBEDTLS_ERR_XXX_HW_ACCEL_FAILED that are deprecated and are replaced
|
||||
by the equivalent plaform error.
|
||||
* Deprecate the function mbedtls_mpi_is_prime() in favor of
|
||||
mbedtls_mpi_is_prime_ext() which allows specifying the number of
|
||||
Miller-Rabin rounds.
|
||||
|
||||
Bugfix
|
||||
* Fix wrong order of freeing in programs/ssl/ssl_server2 example
|
||||
|
@ -99,6 +113,9 @@ Changes
|
|||
Thomas-Dee in #1641.
|
||||
* Improve documentation of mbedtls_ssl_get_verify_result().
|
||||
Fixes #517 reported by github-monoculture.
|
||||
* Add MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR flag to mbedtls_mpi_gen_prime() and
|
||||
use it to reduce error probability in RSA key generation to levels mandated
|
||||
by FIPS-186-4.
|
||||
|
||||
= mbed TLS 2.13.1 branch released 2018-09-06
|
||||
|
||||
|
|
|
@ -725,8 +725,18 @@ int mbedtls_mpi_gcd( mbedtls_mpi *G, const mbedtls_mpi *A, const mbedtls_mpi *B
|
|||
*/
|
||||
int mbedtls_mpi_inv_mod( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi *N );
|
||||
|
||||
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#if defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#define MBEDTLS_DEPRECATED __attribute__((deprecated))
|
||||
#else
|
||||
#define MBEDTLS_DEPRECATED
|
||||
#endif
|
||||
/**
|
||||
* \brief Miller-Rabin primality test
|
||||
* \brief Miller-Rabin primality test with error probability of
|
||||
* 2<sup>-80</sup>
|
||||
*
|
||||
* \deprecated Superseded by mbedtls_mpi_is_prime_ext() which allows
|
||||
* specifying the number of Miller-Rabin rounds.
|
||||
*
|
||||
* \param X MPI to check
|
||||
* \param f_rng RNG function
|
||||
|
@ -736,9 +746,48 @@ int mbedtls_mpi_inv_mod( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
|
|||
* MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed,
|
||||
* MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if X is not prime
|
||||
*/
|
||||
int mbedtls_mpi_is_prime( const mbedtls_mpi *X,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng );
|
||||
MBEDTLS_DEPRECATED int mbedtls_mpi_is_prime( const mbedtls_mpi *X,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng );
|
||||
#undef MBEDTLS_DEPRECATED
|
||||
#endif /* !MBEDTLS_DEPRECATED_REMOVED */
|
||||
|
||||
/**
|
||||
* \brief Miller-Rabin primality test.
|
||||
*
|
||||
* \warning If \p X is potentially generated by an adversary, for example
|
||||
* when validating cryptographic parameters that you didn't
|
||||
* generate yourself and that are supposed to be prime, then
|
||||
* \p rounds should be at least the half of the security
|
||||
* strength of the cryptographic algorithm. On the other hand,
|
||||
* if \p X is chosen uniformly or non-adversially (as is the
|
||||
* case when mbedtls_mpi_gen_prime calls this function), then
|
||||
* \p rounds can be much lower.
|
||||
*
|
||||
* \param X MPI to check
|
||||
* \param rounds Number of bases to perform Miller-Rabin primality test for.
|
||||
* The probability of returning 0 on a composite is at most
|
||||
* 2<sup>-2*\p rounds</sup>.
|
||||
* \param f_rng RNG function
|
||||
* \param p_rng RNG parameter
|
||||
*
|
||||
* \return 0 if successful (probably prime),
|
||||
* MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed,
|
||||
* MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if X is not prime
|
||||
*/
|
||||
int mbedtls_mpi_is_prime_ext( const mbedtls_mpi *X, int rounds,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng );
|
||||
/**
|
||||
* \brief Flags for mbedtls_mpi_gen_prime()
|
||||
*
|
||||
* Each of these flags is a constraint on the result X returned by
|
||||
* mbedtls_mpi_gen_prime().
|
||||
*/
|
||||
typedef enum {
|
||||
MBEDTLS_MPI_GEN_PRIME_FLAG_DH = 0x0001, /**< (X-1)/2 is prime too */
|
||||
MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR = 0x0002, /**< lower error rate from 2<sup>-80</sup> to 2<sup>-128</sup> */
|
||||
} mbedtls_mpi_gen_prime_flag_t;
|
||||
|
||||
/**
|
||||
* \brief Prime number generation
|
||||
|
@ -746,7 +795,7 @@ int mbedtls_mpi_is_prime( const mbedtls_mpi *X,
|
|||
* \param X Destination MPI
|
||||
* \param nbits Required size of X in bits
|
||||
* ( 3 <= nbits <= MBEDTLS_MPI_MAX_BITS )
|
||||
* \param dh_flag If 1, then (X-1)/2 will be prime too
|
||||
* \param flags Mask of flags of type #mbedtls_mpi_gen_prime_flag_t
|
||||
* \param f_rng RNG function
|
||||
* \param p_rng RNG parameter
|
||||
*
|
||||
|
@ -754,7 +803,7 @@ int mbedtls_mpi_is_prime( const mbedtls_mpi *X,
|
|||
* MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed,
|
||||
* MBEDTLS_ERR_MPI_BAD_INPUT_DATA if nbits is < 3
|
||||
*/
|
||||
int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int dh_flag,
|
||||
int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int flags,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng );
|
||||
|
||||
|
|
|
@ -2056,12 +2056,12 @@ cleanup:
|
|||
/*
|
||||
* Miller-Rabin pseudo-primality test (HAC 4.24)
|
||||
*/
|
||||
static int mpi_miller_rabin( const mbedtls_mpi *X,
|
||||
static int mpi_miller_rabin( const mbedtls_mpi *X, size_t rounds,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng )
|
||||
{
|
||||
int ret, count;
|
||||
size_t i, j, k, n, s;
|
||||
size_t i, j, k, s;
|
||||
mbedtls_mpi W, R, T, A, RR;
|
||||
|
||||
mbedtls_mpi_init( &W ); mbedtls_mpi_init( &R ); mbedtls_mpi_init( &T ); mbedtls_mpi_init( &A );
|
||||
|
@ -2077,27 +2077,12 @@ static int mpi_miller_rabin( const mbedtls_mpi *X,
|
|||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &R, s ) );
|
||||
|
||||
i = mbedtls_mpi_bitlen( X );
|
||||
/*
|
||||
* HAC, table 4.4
|
||||
*/
|
||||
n = ( ( i >= 1300 ) ? 2 : ( i >= 850 ) ? 3 :
|
||||
( i >= 650 ) ? 4 : ( i >= 350 ) ? 8 :
|
||||
( i >= 250 ) ? 12 : ( i >= 150 ) ? 18 : 27 );
|
||||
|
||||
for( i = 0; i < n; i++ )
|
||||
for( i = 0; i < rounds; i++ )
|
||||
{
|
||||
/*
|
||||
* pick a random A, 1 < A < |X| - 1
|
||||
*/
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &A, X->n * ciL, f_rng, p_rng ) );
|
||||
|
||||
if( mbedtls_mpi_cmp_mpi( &A, &W ) >= 0 )
|
||||
{
|
||||
j = mbedtls_mpi_bitlen( &A ) - mbedtls_mpi_bitlen( &W );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &A, j + 1 ) );
|
||||
}
|
||||
A.p[0] |= 3;
|
||||
|
||||
count = 0;
|
||||
do {
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &A, X->n * ciL, f_rng, p_rng ) );
|
||||
|
@ -2105,7 +2090,7 @@ static int mpi_miller_rabin( const mbedtls_mpi *X,
|
|||
j = mbedtls_mpi_bitlen( &A );
|
||||
k = mbedtls_mpi_bitlen( &W );
|
||||
if (j > k) {
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &A, j - k ) );
|
||||
A.p[A.n - 1] &= ( (mbedtls_mpi_uint) 1 << ( k - ( A.n - 1 ) * biL - 1 ) ) - 1;
|
||||
}
|
||||
|
||||
if (count++ > 30) {
|
||||
|
@ -2160,9 +2145,9 @@ cleanup:
|
|||
/*
|
||||
* Pseudo-primality test: small factors, then Miller-Rabin
|
||||
*/
|
||||
int mbedtls_mpi_is_prime( const mbedtls_mpi *X,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng )
|
||||
int mbedtls_mpi_is_prime_ext( const mbedtls_mpi *X, int rounds,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng )
|
||||
{
|
||||
int ret;
|
||||
mbedtls_mpi XX;
|
||||
|
@ -2186,17 +2171,34 @@ int mbedtls_mpi_is_prime( const mbedtls_mpi *X,
|
|||
return( ret );
|
||||
}
|
||||
|
||||
return( mpi_miller_rabin( &XX, f_rng, p_rng ) );
|
||||
return( mpi_miller_rabin( &XX, rounds, f_rng, p_rng ) );
|
||||
}
|
||||
|
||||
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
/*
|
||||
* Pseudo-primality test, error probability 2^-80
|
||||
*/
|
||||
int mbedtls_mpi_is_prime( const mbedtls_mpi *X,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng )
|
||||
{
|
||||
/*
|
||||
* In the past our key generation aimed for an error rate of at most
|
||||
* 2^-80. Since this function is deprecated, aim for the same certainty
|
||||
* here as well.
|
||||
*/
|
||||
return mbedtls_mpi_is_prime_ext( X, 40, f_rng, p_rng );
|
||||
}
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Prime number generation
|
||||
*
|
||||
* If dh_flag is 0 and nbits is at least 1024, then the procedure
|
||||
* follows the RSA probably-prime generation method of FIPS 186-4.
|
||||
* NB. FIPS 186-4 only allows the specific bit lengths of 1024 and 1536.
|
||||
* To generate an RSA key in a way recommended by FIPS 186-4, both primes must
|
||||
* be either 1024 bits or 1536 bits long, and flags must contain
|
||||
* MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR.
|
||||
*/
|
||||
int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int dh_flag,
|
||||
int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int flags,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng )
|
||||
{
|
||||
|
@ -2209,6 +2211,7 @@ int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int dh_flag,
|
|||
#endif
|
||||
int ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE;
|
||||
size_t k, n;
|
||||
int rounds;
|
||||
mbedtls_mpi_uint r;
|
||||
mbedtls_mpi Y;
|
||||
|
||||
|
@ -2219,6 +2222,27 @@ int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int dh_flag,
|
|||
|
||||
n = BITS_TO_LIMBS( nbits );
|
||||
|
||||
if( ( flags & MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR ) == 0 )
|
||||
{
|
||||
/*
|
||||
* 2^-80 error probability, number of rounds chosen per HAC, table 4.4
|
||||
*/
|
||||
rounds = ( ( nbits >= 1300 ) ? 2 : ( nbits >= 850 ) ? 3 :
|
||||
( nbits >= 650 ) ? 4 : ( nbits >= 350 ) ? 8 :
|
||||
( nbits >= 250 ) ? 12 : ( nbits >= 150 ) ? 18 : 27 );
|
||||
}
|
||||
else
|
||||
{
|
||||
/*
|
||||
* 2^-100 error probability, number of rounds computed based on HAC,
|
||||
* fact 4.48
|
||||
*/
|
||||
rounds = ( ( nbits >= 1450 ) ? 4 : ( nbits >= 1150 ) ? 5 :
|
||||
( nbits >= 1000 ) ? 6 : ( nbits >= 850 ) ? 7 :
|
||||
( nbits >= 750 ) ? 8 : ( nbits >= 500 ) ? 13 :
|
||||
( nbits >= 250 ) ? 28 : ( nbits >= 150 ) ? 40 : 51 );
|
||||
}
|
||||
|
||||
while( 1 )
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( X, n * ciL, f_rng, p_rng ) );
|
||||
|
@ -2229,9 +2253,9 @@ int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int dh_flag,
|
|||
if( k > nbits ) MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( X, k - nbits ) );
|
||||
X->p[0] |= 1;
|
||||
|
||||
if( dh_flag == 0 )
|
||||
if( ( flags & MBEDTLS_MPI_GEN_PRIME_FLAG_DH ) == 0 )
|
||||
{
|
||||
ret = mbedtls_mpi_is_prime( X, f_rng, p_rng );
|
||||
ret = mbedtls_mpi_is_prime_ext( X, rounds, f_rng, p_rng );
|
||||
|
||||
if( ret != MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
|
||||
goto cleanup;
|
||||
|
@ -2264,8 +2288,10 @@ int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int dh_flag,
|
|||
*/
|
||||
if( ( ret = mpi_check_small_factors( X ) ) == 0 &&
|
||||
( ret = mpi_check_small_factors( &Y ) ) == 0 &&
|
||||
( ret = mpi_miller_rabin( X, f_rng, p_rng ) ) == 0 &&
|
||||
( ret = mpi_miller_rabin( &Y, f_rng, p_rng ) ) == 0 )
|
||||
( ret = mpi_miller_rabin( X, rounds, f_rng, p_rng ) )
|
||||
== 0 &&
|
||||
( ret = mpi_miller_rabin( &Y, rounds, f_rng, p_rng ) )
|
||||
== 0 )
|
||||
goto cleanup;
|
||||
|
||||
if( ret != MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
|
||||
|
|
|
@ -502,6 +502,7 @@ int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
|
|||
{
|
||||
int ret;
|
||||
mbedtls_mpi H, G, L;
|
||||
int prime_quality = 0;
|
||||
|
||||
if( f_rng == NULL || nbits < 128 || exponent < 3 )
|
||||
return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
|
||||
|
@ -509,6 +510,14 @@ int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
|
|||
if( nbits % 2 )
|
||||
return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
|
||||
|
||||
/*
|
||||
* If the modulus is 1024 bit long or shorter, then the security strength of
|
||||
* the RSA algorithm is less than or equal to 80 bits and therefore an error
|
||||
* rate of 2^-80 is sufficient.
|
||||
*/
|
||||
if( nbits > 1024 )
|
||||
prime_quality = MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR;
|
||||
|
||||
mbedtls_mpi_init( &H );
|
||||
mbedtls_mpi_init( &G );
|
||||
mbedtls_mpi_init( &L );
|
||||
|
@ -523,11 +532,11 @@ int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
|
|||
|
||||
do
|
||||
{
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->P, nbits >> 1, 0,
|
||||
f_rng, p_rng ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->P, nbits >> 1,
|
||||
prime_quality, f_rng, p_rng ) );
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, nbits >> 1, 0,
|
||||
f_rng, p_rng ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, nbits >> 1,
|
||||
prime_quality, f_rng, p_rng ) );
|
||||
|
||||
/* make sure the difference between p and q is not too small (FIPS 186-4 §B.3.3 step 5.4) */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &H, &ctx->P, &ctx->Q ) );
|
||||
|
|
|
@ -351,15 +351,20 @@ int mbedtls_rsa_validate_params( const mbedtls_mpi *N, const mbedtls_mpi *P,
|
|||
*/
|
||||
|
||||
#if defined(MBEDTLS_GENPRIME)
|
||||
/*
|
||||
* When generating keys, the strongest security we support aims for an error
|
||||
* rate of at most 2^-100 and we are aiming for the same certainty here as
|
||||
* well.
|
||||
*/
|
||||
if( f_rng != NULL && P != NULL &&
|
||||
( ret = mbedtls_mpi_is_prime( P, f_rng, p_rng ) ) != 0 )
|
||||
( ret = mbedtls_mpi_is_prime_ext( P, 50, f_rng, p_rng ) ) != 0 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if( f_rng != NULL && Q != NULL &&
|
||||
( ret = mbedtls_mpi_is_prime( Q, f_rng, p_rng ) ) != 0 )
|
||||
( ret = mbedtls_mpi_is_prime_ext( Q, 50, f_rng, p_rng ) ) != 0 )
|
||||
{
|
||||
ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
||||
goto cleanup;
|
||||
|
|
|
@ -156,7 +156,7 @@ int main( int argc, char **argv )
|
|||
goto exit;
|
||||
}
|
||||
|
||||
if( ( ret = mbedtls_mpi_is_prime( &Q, mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 )
|
||||
if( ( ret = mbedtls_mpi_is_prime_ext( &Q, 50, mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 )
|
||||
{
|
||||
mbedtls_printf( " failed\n ! mbedtls_mpi_is_prime returned %d\n\n", ret );
|
||||
goto exit;
|
||||
|
|
|
@ -680,6 +680,14 @@ Test mbedtls_mpi_is_prime #20
|
|||
depends_on:MBEDTLS_GENPRIME
|
||||
mbedtls_mpi_is_prime:10:"49979687":0
|
||||
|
||||
Test mbedtls_mpi_is_prime_det (4 non-witnesses)
|
||||
depends_on:MBEDTLS_GENPRIME
|
||||
mbedtls_mpi_is_prime_det:"043BD64BA10B11DA83FBD296B04BCA9E0552FAF6E09CAC74E2D7E735ED0DB09FC47ED76145644203EE0C826013BC602F560BCDAAED557D04683859A65D659FF828A245A2C5B1AC41E01E4669A525A45E23AF":"040EA852F7935ACCECC0E87B845281F047D10DC9AAFEF990AF9D3D66770DA30B0C5B5E03EEA8C0CB79B936FE0BB8EE5389EC1D34EB16C58AA3F2E11AF084160CDF6400BE1CC179867AB074866952D9F34EE7042D27F960E715A97FCB93F3182247D0A6AE51BD21CC2F6B0651F9E572C5FB86F3137053FA85FD7A51816D69B3A53A5A438C17754836D04E98CA240B901F828332F2D72D88C497DA45F533F99A6E53EDEA6B0424EC8951B048FA9A80134B37D0A67014597934E3CFC52C5A4DD4751ADF8D66FC79E84E2A3148C4B15C17E12CB659390FD275F39A331FFC80EC699BC3F6FAB868E30E9B14575FCDAB6FAED01E00112DD28704177E09C335AD43A696FEA761E8DF3B0663277A5C3637F9060CB5E5654F72E9A6B0F369E660AD4CF7ABF4195493545B367BD55271CD4BB7D9C15D3F508FE8F7409C2126FC8E73B43A67CD4EFB21E9F15DBF040A2A8D5F5ED75CEAC12B595C0051F3EC9D5A58ACE82A9506E64F780E9836728260FFE1BFD73E8A9869E3D46A35A856D3028F7FEAB9F4F1A04449AEDC80017EE1014080D87F0B50C8EF255324CD89F7D039":82:5
|
||||
|
||||
Test mbedtls_mpi_is_prime_det (39 non-witnesses)
|
||||
depends_on:MBEDTLS_GENPRIME
|
||||
mbedtls_mpi_is_prime_det:"155102B67930FBE8858DF6C0642D77D419A7B7968E622CC7500F3E3F2C5168368C50E0083187":"119B3E2C721834D83416239B04447AA18AE0163E61DCAE97054563D79E094A6FA4485BD6A0501445BF57FE9C058926CDB862E04CC1A95D79D61D9AB3466857A53E04F8D7470C9C86649B226A13DDC534E18DFD5C22FAEA317CA4D4960F18457FD6D2FFB5F3273F74C89980DC774590D8D30D1159CA81999ED94A042D67DA68C82616AD46C2C88288A8EBD0B37AC7C152D9522CA4544642AD1210F6B642FEBF43563FA872B0DEFAFC69D0B6570E8FEA9570D0AADCFA9B06CC8BFD62CEDC221541210EEEF9762448C6D49F26AA767A4D66CB168589E0201923015314E6CD4A480E5936E7CF145F73A564C5B782635B3AFC3028E2632C5D3458224A7C9E8BA1876E8F690463C878292D3DC011E9640331E7F7621F2B5E0F6713DD8C9D6767521C4BA880DA8D11C67753C8493D2C4C4F1443147550D0B25B7FAD04EAFA9F8AA60974C1365C8A794CFEECEB4279B1150909A97E5A7A10B5D91186CA5B25A612036631FE73529C8CFAE51E76FB704A772DE5320EFC1212E7A399B1FEBF57D014AF9129DFF5D2C5DFBBEEAC55F360CF6D22FA90B8E2E9AD0C71AB6495A9452A58D653B8CC26128C66B43EFBA6E39AEC5717A1A3C2AE1449FCABAFE1180B159DA55190CD81A3D9E8D798647E11B827F0A057D6DA5AAD78AB5112EE65E10E8B8B369BA24E1B8AD2CD8548C497016C07A143DE1232F8059BE303572456FA92E76A0F23D1340629228B7D27C02D3833A72745B91A3DBEB5E081117A9F19597F00E4277B414FAEA8C8CEB895C37F956A5A22F8D7A10ADA50B22BAB312504904511AA0EFDD4D3BF20ECB17E8A684564FFB5BBD5E22C429F9A75A4FB4AE468FE7612ED53C7A11212E7EF3435CC9CA6E7DB167B8CCE2BECF35F89013F8F876223C77FA81570970858663C6E32B91080AA47F9C90177F51E6FD7747B910C9489C7B6ACB070996198AD9A40A69711274159210A9A12DBAAA4FB4632446066AB70D735DC95F7C2BCE517E88C064D728DE82B1B043DF4AEE0EFF5131120A4E5B9B4180EB6F6B8A0D1491ABDA069058A9966B1A517D8E7B4997DC52A1E698FD79E271153DF1913FE6787A5D99DE69F39C3F22D26DC731CFBB33FF5C267D85D7A3DAE8E1C87E1DB2F1236212EF1942EA756967FB3D07D629E59EA4034D9A9B5E270DD4A31C8A3DFDA99C1094B5537132C196DA2AEAF5253A019B9AF25B5DCB0D4DD75C7C9C353DA9DAABFB23959A5455312E7E1C21268C1BC14E83DCFDF50C27FD3E8B4EDC04C5F3CB5FCFFF2B57151E1B1EE1A6456DC006BC43E1158674AA4CF7D146DE4A57103BE43ED130C8007294ED2418C7A2B769A7D20EBB5A8367A77B313F81BB119B9954305FF160FF83EED7F808EE6D340A5CCC000CF81AA497D315D350CCE4E86A31456B8AA85B677491FC662933DFA55EB5BFF64B8D85430D676A85D1CAFAFF383E68C4E6C22A51063739EC03FC58C36C07C44E54828BE2152B2E9AFB0F179B157D09B64C147B524BB5424BB1914419424D9100D06EDCFC718F4DF3D562E9E16C446663F35273CA7BC5426B868A80C8D415C9A12A1619CDB7CDB5BEBC70313150BDF8C3AB26B809FE62D28E798EF1EF98C410A2DA0A9071F82154AC569078B0E647E2C085D1D907E634453442803D0492D3D0C78CACB762020C0E589C8B0981321EA2771305FD0413F3B2963FCE9A232F6641DB7E12ADC009A032063C41756E5E19E5711DE12711F07AFE7545B4D83F3EFD7BFD0435297C89DF3D4AF96EBE2CE8D64B93E36EA5D7E5A0492151D0CAEE7449A7D35E1A3C83E22C3B35162C073CC3B1CF76FBDEE84270721FC042EAAEB7325110181415E2031CFB7462F15111291CDAC0560FF9F4C7341F2FA261B97CEF348D074AA2EB4DB153FE6B1410519DA4213B611999868F3B867A2B6D758D333C4989DE80782683CA26ECDE373C71524F01B76349CE8A07A5EBECBB42259CF970DDA756EC996B189FEA045FEE45F23D476960913106ECA2510B8517AA75D56FA4152B2BDDC212014E5D07FD964D6EE532F0616DF74E104659955132331FABF2D2AD265E71C93C648A956FA0A3DB21FF103D516527F2DA0E870340B61EE8A8ED913B60605EB5A67B834D0FC90564386012585609870FEF6530B3E3C037B55506F0B5694F6B0FC":38:40
|
||||
|
||||
Test mbedtls_mpi_gen_prime (Too small)
|
||||
depends_on:MBEDTLS_GENPRIME
|
||||
mbedtls_mpi_gen_prime:2:0:MBEDTLS_ERR_MPI_BAD_INPUT_DATA
|
||||
|
@ -706,7 +714,19 @@ mbedtls_mpi_gen_prime:128:0:0
|
|||
|
||||
Test mbedtls_mpi_gen_prime (Safe)
|
||||
depends_on:MBEDTLS_GENPRIME
|
||||
mbedtls_mpi_gen_prime:128:1:0
|
||||
mbedtls_mpi_gen_prime:128:MBEDTLS_MPI_GEN_PRIME_FLAG_DH:0
|
||||
|
||||
Test mbedtls_mpi_gen_prime (Safe with lower error rate)
|
||||
depends_on:MBEDTLS_GENPRIME
|
||||
mbedtls_mpi_gen_prime:128:MBEDTLS_MPI_GEN_PRIME_FLAG_DH | MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR:0
|
||||
|
||||
Test mbedtls_mpi_gen_prime standard RSA #1 (lower error rate)
|
||||
depends_on:MBEDTLS_GENPRIME
|
||||
mbedtls_mpi_gen_prime:1024:MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR:0
|
||||
|
||||
Test mbedtls_mpi_gen_prime standard RSA #2 (lower error rate)
|
||||
depends_on:MBEDTLS_GENPRIME
|
||||
mbedtls_mpi_gen_prime:1536:MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR:0
|
||||
|
||||
Test bit getting (Value bit 25)
|
||||
mbedtls_mpi_get_bit:10:"49979687":25:1
|
||||
|
|
|
@ -1,5 +1,48 @@
|
|||
/* BEGIN_HEADER */
|
||||
#include "mbedtls/bignum.h"
|
||||
|
||||
typedef struct mbedtls_test_mpi_random
|
||||
{
|
||||
data_t *data;
|
||||
size_t pos;
|
||||
size_t chunk_len;
|
||||
} mbedtls_test_mpi_random;
|
||||
|
||||
/*
|
||||
* This function is called by the Miller-Rabin primality test each time it
|
||||
* chooses a random witness. The witnesses (or non-witnesses as provided by the
|
||||
* test) are stored in the data member of the state structure. Each number is in
|
||||
* the format that mbedtls_mpi_read_string understands and is chunk_len long.
|
||||
*/
|
||||
int mbedtls_test_mpi_miller_rabin_determinizer( void* state,
|
||||
unsigned char* buf,
|
||||
size_t len )
|
||||
{
|
||||
mbedtls_test_mpi_random *random = (mbedtls_test_mpi_random*) state;
|
||||
|
||||
if( random == NULL || random->data->x == NULL || buf == NULL )
|
||||
return( -1 );
|
||||
|
||||
if( random->pos + random->chunk_len > random->data->len
|
||||
|| random->chunk_len > len )
|
||||
{
|
||||
return( -1 );
|
||||
}
|
||||
|
||||
memset( buf, 0, len );
|
||||
|
||||
/* The witness is written to the end of the buffer, since the buffer is
|
||||
* used as big endian, unsigned binary data in mbedtls_mpi_read_binary.
|
||||
* Writing the witness to the start of the buffer would result in the
|
||||
* buffer being 'witness 000...000', which would be treated as
|
||||
* witness * 2^n for some n. */
|
||||
memcpy( buf + len - random->chunk_len, &random->data->x[random->pos],
|
||||
random->chunk_len );
|
||||
|
||||
random->pos += random->chunk_len;
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
/* END_HEADER */
|
||||
|
||||
/* BEGIN_DEPENDENCIES
|
||||
|
@ -800,7 +843,7 @@ void mbedtls_mpi_is_prime( int radix_X, char * input_X, int div_result )
|
|||
mbedtls_mpi_init( &X );
|
||||
|
||||
TEST_ASSERT( mbedtls_mpi_read_string( &X, radix_X, input_X ) == 0 );
|
||||
res = mbedtls_mpi_is_prime( &X, rnd_std_rand, NULL );
|
||||
res = mbedtls_mpi_is_prime_ext( &X, 40, rnd_std_rand, NULL );
|
||||
TEST_ASSERT( res == div_result );
|
||||
|
||||
exit:
|
||||
|
@ -809,14 +852,47 @@ exit:
|
|||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE depends_on:MBEDTLS_GENPRIME */
|
||||
void mbedtls_mpi_gen_prime( int bits, int safe, int ref_ret )
|
||||
void mbedtls_mpi_is_prime_det( data_t * input_X, data_t * witnesses,
|
||||
int chunk_len, int rounds )
|
||||
{
|
||||
mbedtls_mpi X;
|
||||
int res;
|
||||
mbedtls_test_mpi_random rand;
|
||||
|
||||
mbedtls_mpi_init( &X );
|
||||
rand.data = witnesses;
|
||||
rand.pos = 0;
|
||||
rand.chunk_len = chunk_len;
|
||||
|
||||
TEST_ASSERT( mbedtls_mpi_read_binary( &X, input_X->x, input_X->len ) == 0 );
|
||||
res = mbedtls_mpi_is_prime_ext( &X, rounds - 1,
|
||||
mbedtls_test_mpi_miller_rabin_determinizer,
|
||||
&rand );
|
||||
TEST_ASSERT( res == 0 );
|
||||
|
||||
rand.data = witnesses;
|
||||
rand.pos = 0;
|
||||
rand.chunk_len = chunk_len;
|
||||
|
||||
res = mbedtls_mpi_is_prime_ext( &X, rounds,
|
||||
mbedtls_test_mpi_miller_rabin_determinizer,
|
||||
&rand );
|
||||
TEST_ASSERT( res == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
|
||||
|
||||
exit:
|
||||
mbedtls_mpi_free( &X );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE depends_on:MBEDTLS_GENPRIME */
|
||||
void mbedtls_mpi_gen_prime( int bits, int flags, int ref_ret )
|
||||
{
|
||||
mbedtls_mpi X;
|
||||
int my_ret;
|
||||
|
||||
mbedtls_mpi_init( &X );
|
||||
|
||||
my_ret = mbedtls_mpi_gen_prime( &X, bits, safe, rnd_std_rand, NULL );
|
||||
my_ret = mbedtls_mpi_gen_prime( &X, bits, flags, rnd_std_rand, NULL );
|
||||
TEST_ASSERT( my_ret == ref_ret );
|
||||
|
||||
if( ref_ret == 0 )
|
||||
|
@ -826,12 +902,14 @@ void mbedtls_mpi_gen_prime( int bits, int safe, int ref_ret )
|
|||
TEST_ASSERT( actual_bits >= (size_t) bits );
|
||||
TEST_ASSERT( actual_bits <= (size_t) bits + 1 );
|
||||
|
||||
TEST_ASSERT( mbedtls_mpi_is_prime( &X, rnd_std_rand, NULL ) == 0 );
|
||||
if( safe )
|
||||
TEST_ASSERT( mbedtls_mpi_is_prime_ext( &X, 40, rnd_std_rand, NULL )
|
||||
== 0 );
|
||||
if( flags & MBEDTLS_MPI_GEN_PRIME_FLAG_DH )
|
||||
{
|
||||
/* X = ( X - 1 ) / 2 */
|
||||
TEST_ASSERT( mbedtls_mpi_shift_r( &X, 1 ) == 0 );
|
||||
TEST_ASSERT( mbedtls_mpi_is_prime( &X, rnd_std_rand, NULL ) == 0 );
|
||||
TEST_ASSERT( mbedtls_mpi_is_prime_ext( &X, 40, rnd_std_rand, NULL )
|
||||
== 0 );
|
||||
}
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue