Commit graph

2847 commits

Author SHA1 Message Date
Manuel Pégourié-Gonnard 196d1338ba Fix uninitialised variable in some configs 2017-08-28 13:14:27 +02:00
Manuel Pégourié-Gonnard fd87e354f6 Improve comments on parity trick 2017-08-24 14:21:19 +02:00
Manuel Pégourié-Gonnard 95aedfea33 Remove redundant test on curve type
If rsm != NULL then the curve type has to be Short Weierstrass, as we don't
implement restartable Montgomery now. If and when we do, then it's better to
check for the subcontext only, and not for the curve type.
2017-08-24 13:47:04 +02:00
Manuel Pégourié-Gonnard 11556e2846 Clarify initialization of T in mul_comb()
Exactly one of three ways will be used, so make that clear by using an
if 1 else if 2 else 3 structure.

While at it, don't initialize variables at declaration, just to make extra
sure they're properly initialized afterwards in all code paths.
2017-08-24 13:42:34 +02:00
Manuel Pégourié-Gonnard 0b23f167ba SSL: rework restart state handling
As done by previous commits for ECC and ECDSA:
- use explicit state assignments rather than increment
- always place the state update right before the operation label

This will make it easier to add restart support for other operations later if
desired.

SSL-specific changes:
- remove useless states: when the last restartable operation on a message is
  complete, ssl->state is incremented already, so we don't need any additional
state update: ecrs_state is only meant to complement ssl->state
- rename remaining states consistently as <message>_<operation>
- move some labels closer to the actual operation when possible (no assignment
  to variables used after the label between its previous and current position)
2017-08-24 12:08:33 +02:00
Manuel Pégourié-Gonnard 6348181da9 Explicit state assignments in ecdsa too 2017-08-24 11:16:01 +02:00
Manuel Pégourié-Gonnard 4ed1dab474 ECP: move state changes closer to operations
Systematically assign state just before the next operation that may return,
rather that just after the previous one. This makes things more local. (For
example, previously precompute_comb() has to handle a state reset for
mul_comb_core(), a kind of coupling that's best avoided.)

Note that this change doesn't move the location of state updates relative
to any potential return point, which is all that matters.
2017-08-24 11:02:04 +02:00
Manuel Pégourié-Gonnard c9efa00871 ECP: Use explicit state assignments
Incrementing the state is error-prone as we can end up doing it too many times
(loops) or not enough (skipped branches), or just make programming mistakes
(eg. the state was incremented twice at the end, so it ended up with a value
not in the enum...)

This is the first step of the rework, the next one will rationalize where the
state assignments are done.
2017-08-24 10:25:06 +02:00
Manuel Pégourié-Gonnard db4a8eb992 Use ECP_RS_ENTER/LEAVE() macros, as in ECDSA 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard b948f7dc20 Don't bother to free NULL subcontexts 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard bfa1972b4f Remove redundant checks, save a few muls
ecp_mul() already checks for this, and this check is not going away, so no
need to do it twice (didn't even result in better error reporting)
2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard 28d162829b Avoid unnecessary xxx_copy() calls
The call would anyway check for pointer equality and return early, but it
doesn't hurt to save a function call, and also this follows more uniformly the
pattern that those two lines go together:

    #if defined(MBEDTLS_ECP_RESTARTBLE)
    if( rs_ctx != NULL && ...
2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard 5bd38b1144 Replace memset() calls with xxx_init() calls
And follow calloc() calls with xxx_init() too
2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard 92cceb29bd Make some names more consistent 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard ebac5d3797 Fix some whitespace & style issues 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard 7037e222ea Improve comments and doc for ECP 2017-08-23 14:30:36 +02:00
Manuel Pégourié-Gonnard daf049144e Rework state saving for verify_chain()
Child was almost redundant as it's already saved in ver_chain, except it was
multiplexed to also indicate whether an operation is in progress. This commit
removes it and introduces an explicit state variable instead.

This state can be useful later if we start returning IN_PROGRESS at other
points than find_parent() (for example when checking CRL).

Note that the state goes none -> find_parent and stays there until the context
is free(), as it's only on the first call that nothing was in progress.
2017-08-23 12:32:19 +02:00
Manuel Pégourié-Gonnard a968843429 Improve some comments in verify_chain() 2017-08-23 11:37:22 +02:00
Manuel Pégourié-Gonnard 3627a8b2f6 Clarify state handling in find_parent(_in)() 2017-08-23 11:20:48 +02:00
Manuel Pégourié-Gonnard 83e923ba2b Better initialisation of ver_chain
Use dedicated function for consistency, and initialise flags to -1 as this is
the safe value.
2017-08-23 10:55:41 +02:00
Manuel Pégourié-Gonnard d55f776cb7 Skip context allocation if restart disabled 2017-08-18 17:40:15 +02:00
Manuel Pégourié-Gonnard aaa9814879 Uniformize ifdefs to ECDSA_C+ECP_RESTARTABLE
Some parts were already implicitly using this as the two ifdefs were nested,
and some others didn't, which resulted in compile errors in some configs. This
fixes those errors and saves a bit of code+RAM that was previously wasted when
ECP_RESTARTABLE was defined but ECDSA_C wasn't
2017-08-18 17:30:37 +02:00
Manuel Pégourié-Gonnard fe6877034d Keep PK layer context in the PK layer
Previously we kept the ecdsa context created by the PK layer for ECDSA
operations on ECKEY in the ecdsa_restart_ctx structure, which was wrong, and
caused by the fact that we didn't have a proper handling of restart
sub-contexts in the PK layer.
2017-08-18 17:04:07 +02:00
Manuel Pégourié-Gonnard 0bbc66cc76 Dynamically allocate/free restart subcontext in PK 2017-08-18 16:22:06 +02:00
Manuel Pégourié-Gonnard 15d7df2ba8 Introduce mbedtls_pk_restart_ctx and use it
The fact that you needed to pass a pointer to mbedtls_ecdsa_restart_ctx (or
that you needed to know the key type of the PK context) was a breach of
abstraction.

Change the API (and callers) now, and the implementation will be changed in
the next commit.
2017-08-17 15:16:11 +02:00
Manuel Pégourié-Gonnard 98a6778d47 Better document some function arguments 2017-08-17 10:52:20 +02:00
Manuel Pégourié-Gonnard 3bf49c4552 Enable restart for certificate verify 2017-08-15 14:12:47 +02:00
Manuel Pégourié-Gonnard fed37ed039 Extract some code to separate function
Goals include:
- reducing the number of local variables in the main function (so that we
  don't have to worry about saving/restoring them)
- reducing the number exit points in the main function, making it easier to
  update ssl->state only right before we return
2017-08-15 13:35:42 +02:00
Manuel Pégourié-Gonnard 39eda87382 Make more auto variables const
That way we know we don't have to worry about saving and restoring their
value.
2017-08-15 13:00:33 +02:00
Manuel Pégourié-Gonnard 6b7301c872 Change restart context type.
No need to have both x509 and ecdsa, as the former contains the later.
2017-08-15 12:08:45 +02:00
Manuel Pégourié-Gonnard d27d1a5a82 Clean up existing SSL restartable ECC code
- more consistent naming with ecrs prefix for everything
- always check it enabled before touching the rest
- rm duplicated code in parse_server_hello()
2017-08-15 11:49:08 +02:00
Manuel Pégourié-Gonnard 8b59049407 Make verify() actually restartable 2017-08-15 10:45:09 +02:00
Manuel Pégourié-Gonnard c11e4baa63 Rework type for verify chain
- create container with length + table
- make types public (will be needed in restart context)
2017-08-15 10:44:13 +02:00
Manuel Pégourié-Gonnard 18547b5db6 Refactor find_parent() to merge two call sites 2017-08-15 10:44:13 +02:00
Manuel Pégourié-Gonnard a4a5d1dbe6 Adapt function signatures to rs_ctx + ret 2017-08-15 10:44:13 +02:00
Manuel Pégourié-Gonnard be4ff42fe4 Call crt_check_signature from one place only 2017-08-15 10:44:13 +02:00
Manuel Pégourié-Gonnard d19a41d9aa Add tests for verify_restartable()
For selection of test cases, see comments added in the commit.

It makes the most sense to test with chains using ECC only, so for the chain
of length 2 we use server10 -> int-ca3 -> int-ca2 and trust int-ca2 directly.

Note: server10.crt was created by copying server10_int3_int-ca2.crt and
manually truncating it to remove the intermediates. That base can now be used
to create derived certs (without or with a chain) in a programmatic way.
2017-08-15 10:44:08 +02:00
Manuel Pégourié-Gonnard bc3f44ae9c Introduce mbedtls_x509_crt_verify_restartable() 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 23e416261c ECDH: not restartable unless explicitly enabled
This is mainly for the benefit of SSL modules, which only supports restart in
a limited number of cases. In the other cases (ECDHE_PSK) it would currently
return ERR_ECP_IN_PROGRESS and the user would thus call ssl_handshake() again,
but the SSL code wouldn't handle state properly and things would go wrong in
possibly unexpected ways.  This is undesirable, so it should be possible for
the SSL module to choose if ECDHE should behave the old or the new way.

Not that it also brings ECDHE more in line with the other modules which
already have that choice available (by passing a NULL or valid restart
context).
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 1f1f2a1ca6 Adapt ServerKeyEchange processing to restart 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 862cde5b8e Add restart support for ECDSA client auth 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 2350b4ebdc Adapt ECDHE_ECDSA key exchange to restartable EC
For now some other key exchanges (ECDHE_PSK) will just fail to work, this will
be either fixed or properly fixed later.
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 31f0ef7b19 Fix style issues introduced earlier 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 1f596064bc Make PK EC sign/verify actually restartable 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 82cb27b3db PK: declare restartable sign/verify functions
For RSA, we could either have the function return an error code like
NOT_IMPLEMENTED or just run while disregarding ecp_max_ops. IMO the second
option makes more sense, as otherwise the caller would need to check whether
the key is EC or RSA before deciding to call either sign() or
sign_restartable(), and having to do this kind of check feels contrary to the
goal of the PK layer.
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 66ba48a3c8 Make ECDH functions actually restartable 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard af081f5460 Make ECDSA sign actually restartable 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 50b63ba2f5 Use ecp_gen_privkey() in ECDSA sign
Two different changes:

- the first one will allow us to store k in the restart context while
  restarting the following ecp_mul() operation

- the second one is an simplification, unrelated to restartability, made
  possible by the fact that ecp_gen_privkey() is now public
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 675439620d Improve sign/key_tries handling
(Unrelated to restartable work, just noticed while staring at the code.)

Checking at the end is inefficient as we might give up when we just generated
a valid signature or key.
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard b90883dc1d Prepare infra for restartable sign 2017-08-09 11:44:53 +02:00