Commit graph

13218 commits

Author SHA1 Message Date
Gilles Peskine 0e5faf6407 mbedtls_mpi_sub_abs: check the range of the result when it happens
The function mbedtls_mpi_sub_abs first checked that A >= B and then
performed the subtraction, relying on the fact that A >= B to
guarantee that the carry propagation would stop, and not taking
advantage of the fact that the carry when subtracting two numbers can
only be 0 or 1. This made the carry propagation code a little hard to
follow.

Write an ad hoc loop for the carry propagation, checking the size of
the result. This makes termination obvious.

The initial check that A >= B is no longer needed, since the function
now checks that the carry propagation terminates, which is equivalent.
This is a slight performance gain.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-08 22:50:35 +02:00
Gilles Peskine 221626f2d3 Simplify the final reduction in mpi_montmul
There was some confusion during review about when A->p[n] could be
nonzero. In fact, there is no need to set A->p[n]: only the
intermediate result d might need to extend to n+1 limbs, not the final
result A. So never access A->p[n]. Rework the explanation of the
calculation in a way that should be easier to follow.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-08 22:37:50 +02:00
Gilles Peskine c097e9ea45 Move carry propagation out of mpi_sub_hlp
The function mpi_sub_hlp had confusing semantics: although it took a
size parameter, it accessed the limb array d beyond this size, to
propagate the carry. This made the function difficult to understand
and analyze, with a potential buffer overflow if misused (not enough
room to propagate the carry).

Change the function so that it only performs the subtraction within
the specified number of limbs, and returns the carry.

Move the carry propagation out of mpi_sub_hlp and into its caller
mbedtls_mpi_sub_abs. This makes the code of subtraction very slightly
less neat, but not significantly different.

In the one other place where mpi_sub_hlp is used, namely mpi_montmul,
this is a net win because the carry is potentially sensitive data and
the function carefully arranges to not have to propagate it.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-08 22:08:21 +02:00
Gilles Peskine 37ecc61836 More logical parameter order for mpi_sub_hlp
mpi_sub_hlp performs a subtraction A - B, but took parameters in the
order (B, A). Swap the parameters so that they match the usual
mathematical syntax.

This has the additional benefit of putting the output parameter (A)
first, which is the normal convention in this module.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-08 22:05:13 +02:00
Gilles Peskine 026f555df3 Explicitly cast down from mbedtls_mpi_uint to unsigned char
Let code analyzers know that this is deliberate. For example MSVC
warns about the conversion if it's implicit.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-05 10:48:25 +02:00
Gilles Peskine d55bfe962a Add changelog entry: fix #3394
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-04 21:55:23 +02:00
Gilles Peskine 132c0976e9 Remove a secret-dependent branch in Montgomery multiplication
In mpi_montmul, an auxiliary function for modular
exponentiation (mbedtls_mpi_mod_exp) that performs Montgomery
multiplication, the last step is a conditional subtraction to force
the result into the correct range. The current implementation uses a
branch and therefore may leak information about secret data to an
adversary who can observe what branch is taken through a side channel.

Avoid this potential leak by always doing the same subtraction and
doing a contant-trace conditional assignment to set the result.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-04 21:55:23 +02:00
Gilles Peskine f04d11e8b2 Separate out low-level mpi_safe_cond_assign
Separate out a version of mpi_safe_cond_assign that works on
equal-sized limb arrays, without worrying about allocation sizes or
signs.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-04 21:55:23 +02:00
Gilles Peskine 2a82f72703 Document some internal bignum functions
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-04 21:55:23 +02:00
Gilles Peskine 4e91d473c3 Revert "Shut up a clang-analyzer warning"
This reverts commit 2cc69fffcf.

A check was added in mpi_montmul because clang-analyzer warned about a
possibly null pointer. However this was a false positive. Recent
versions of clang-analyzer no longer emit a warning (3.6 does, 6
doesn't).

Incidentally, the size check was wrong: mpi_montmul needs
T->n >= 2 * (N->n + 1), not just T->n >= N->n + 1.

Given that this is an internal function which is only used from one
public function and in a tightly controlled way, remove both the null
check (which is of low value to begin with) and the size check (which
would be slightly more valuable, but was wrong anyway). This allows
the function not to need to return an error, which makes the source
code a little easier to read and makes the object code a little
smaller.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-04 21:55:17 +02:00
Gilles Peskine 742f1a4528 Add a const annotation to the non-changing argument of mpi_sub_mul
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-04 20:53:57 +02:00
Manuel Pégourié-Gonnard 6abc20e0e3
Merge pull request #3378 from mpg/fix-ctr-drbg-deps
Fix undeclared dependencies on CTR_DRBG (and add test)
2020-06-03 10:55:52 +02:00
Gilles Peskine d6916d74c5
Merge pull request #3121 from gilles-peskine-arm/invasive_testing_strategy-crypto
Invasive testing strategy

Create a new header `common.h`.

Introduce a configuration option `MBEDTLS_TEST_HOOKS` for test-specific code, to be used in accordance with the invasive testing strategy.
2020-06-02 16:55:48 +02:00
Gilles Peskine 73b394290a
Merge pull request #3367 from hug-dev/psa-constants-in-build-dir
Generate PSA constant names in CMake build dir
2020-06-02 12:29:46 +02:00
Manuel Pégourié-Gonnard bd004e862d
Merge pull request #3320 from gilles-peskine-arm/check-files-changelog-development
Check changelog entries on CI
2020-06-02 09:38:37 +02:00
Manuel Pégourié-Gonnard 817e368dfd Add test for building without CTR_DRBG
People who prefer to rely on HMAC_DRBG (for example because they use it for
deterministic ECDSA and don't want a second DRBG for code size reasons) should
be able to build and run the tests suites without CTR_DRBG.

Ideally we should make sure the level of testing (SSL) is the same regardless
of which DRBG modules is enabled, but that's a more significant piece of work.
For now, just ensure everything builds and `make test` passes.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-05-29 11:50:53 +02:00
Hugues de Valon 600cf9d142 Add usage info of generate_psa_constants script
Signed-off-by: Hugues de Valon <hugues.devalon@arm.com>
2020-05-29 10:29:49 +01:00
Manuel Pégourié-Gonnard a89040c7f5 Fix undeclared deps on CTR_DRBG in programs/fuzz
While at it, fix a few other obvious ones such as ENTROPY and TIMING_C when
applicable.

A non-regression test for CTR_DRBG will be added in a follow-up commit.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-05-29 11:27:08 +02:00
Manuel Pégourié-Gonnard d12402ffc0 Fix undeclared deps on MBEDTLS_CTR_DRBG in tests
While at it, declare deps on ENTROPY as well.

A non-regression test will be added in a follow-up commit.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-05-29 11:27:07 +02:00
Janos Follath 0af1560919
Merge pull request #3305 from gilles-peskine-arm/psa-asymmetric-adjectives
PSA: Fix copypasta and align terminology about asymmetric encryption
2020-05-29 08:15:11 +01:00
Gilles Peskine eca95db763 Finish the documentation of normalize_path
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-28 18:19:20 +02:00
Hugues de Valon 235c72d3cb Generate PSA constant names in CMake build dir
This commit modifies the generate_psa_constants.py script to take as
input argument the location of where to write the
psa_constant_names_generated.c file.
For make-based build system, this commit does not change anything.
For CMake build system, this commit modifies the generation location of
that file to be inside the build directory and include it from there in
psa_constant_names.c

Fix #3365

Signed-off-by: Hugues de Valon <hugues.devalon@arm.com>
2020-05-28 16:51:21 +01:00
Gilles Peskine 6147e86e5d
Merge pull request #3350 from gilles-peskine-arm/error-include-asn1-development
Include asn1.h in error.c
2020-05-28 15:09:20 +02:00
Gilles Peskine 30e0bb4a24 Run assemble_changelog.py in all.sh
Avoid nasty surprises where it would fail when we want to make a release.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:55:10 +02:00
Gilles Peskine ba968a723b Wrap line to 79 columns
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:55:10 +02:00
Gilles Peskine 344da1cbd3 Some .pem files are openssl output and have tabs and that's ok
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:55:10 +02:00
Gilles Peskine d2df86f005 .dsw files are Visual Studio stuff
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:55:09 +02:00
Gilles Peskine 12b180a0b9 Permit empty files
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:55:09 +02:00
Gilles Peskine ee40e76943 Normalize line endings
Convert all text files to Unix line endings unless they're Windows
stuff.

Make sure that all text files have a trailing newline.

Remove whitespace at the end of lines.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:55:08 +02:00
Gilles Peskine 3e2ee3cedc Check only files checked into Git
We're only interested in files that are committed and pushed to be
included in Mbed TLS, not in any other files that may be lying around.
So ask git for the list of file names.

This script is primarily intended to run on the CI, and there it runs
on a fresh Git checkout plus potentially some other checkouts or
leftovers from a previous part of the CI job. It should also run
reasonably well on developer machines, where there may be various
additional files. In both cases, git is available.

Ad hoc directory exclusions are no longer needed.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:53:32 +02:00
Gilles Peskine d4a853dbd7 Exclude binary files from text checks
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:53:32 +02:00
Gilles Peskine 0598db84c3 Regex mechanism for check-specific exemptions
Suffixes are convenient but not always sufficient.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:53:32 +02:00
Gilles Peskine c1d1b669db Check all files by default
Have an explicit list of exemptions for specific checks rather than
whitelisting files to check. Some checks, such as permissions, should
apply to all files.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:53:32 +02:00
Gilles Peskine 05a51a8a72 More accurate variable name
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:53:32 +02:00
Gilles Peskine 4eb05a4edd Fix article in documentation
Co-authored-by: Andrew Thoelke <andrew.thoelke@arm.com>
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:51:00 +02:00
danh-arm 14b8b3cd51
Merge pull request #3351 from ronald-cron-arm/make_cmake_versions
Add output of make, cmake and python3 versions
2020-05-27 17:37:19 +01:00
Janos Follath eee1f3b0c1
Merge pull request #3341 from paul-elliott-arm/fix-contributing
Fix contributing link to changelog howto
2020-05-27 07:44:25 +01:00
Gilles Peskine b1ccff8725
Merge pull request #2855 from irwir/fix_x509_crt.c
Remove non-working check from x509_get_subject_alt_name
2020-05-26 18:32:16 +02:00
Gilles Peskine deacf60f79
Merge pull request #3326 from kohnakagawa/fix/utf-8_encoding_bug
fix mbedtls_x509_dn_gets to show non-ASCII string properly
2020-05-25 14:18:48 +02:00
Ronald Cron 87e658d5a4 Add output of python3 version
Add output of python3 version to output_env.sh.
Added in addition to the version of `python` as some
project's scripts try both executable names.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-05-25 13:55:21 +02:00
Ronald Cron 2c1a1f0a2d Add output of make and cmake versions
Add output of make and cmake versions to output_env.sh.
That way we can see their versions in the CI.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-05-25 13:22:18 +02:00
Gilles Peskine 7c3468efbc Fix #3328
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-25 12:26:04 +02:00
Gilles Peskine 583cd7f442 Re-generate error.c
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-25 12:23:55 +02:00
Gilles Peskine efdce2df0d Do include asn1.h in error.c
When generate_errors.pl was first written, there was no asn1.h. But
now there is one and it does not need any special treatment.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-25 12:23:11 +02:00
Gilles Peskine 5241f85bbd Check that all necessary headers are included in error.c
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-25 12:21:22 +02:00
Manuel Pégourié-Gonnard 4bfa1171ae
Merge pull request #3335 from Redfoxymoon/development
midipix platform support
2020-05-22 13:04:15 +02:00
Paul Elliott 8c4fd40bf6 Change Changelog link to point at Changelog readme
Make the contributing document link to how to create a changelog rather
than just linking to the Changelog itself.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-05-21 16:25:56 +01:00
Ørjan Malde 479d8de31d Add support for midipix, a POSIX layer for Microsoft Windows
Signed-off-by: Ørjan Malde <orjan.malde@foxi.me>
2020-05-20 18:14:45 +00:00
Koh M. Nakagawa 46b8782a72 fix mbedtls_x509_dn_gets to escape non-ASCII characters
Signed-off-by: Koh M. Nakagawa <tsunekou1019@gmail.com>
2020-05-21 01:56:55 +09:00
irwir d742a2416d Add changelog entry
Signed-off-by: irwir <irwir@users.noreply.github.com>
2020-05-20 18:24:12 +03:00