Commit graph

3959 commits

Author SHA1 Message Date
Ron Eldor 9e9096476e Fix doxygen script errors
Fix errors raised by doxygen.sh test script

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
Ron Eldor 349877e948 Fix idetifier check script error
Fix script error for identifier check

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
Ron Eldor a37326abb1 Make keyu material length in \ out
Make the key material length in mbedtls_ssl_get_dtls_srtp_key_material
to be in\out, like it is done all over the library

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
Ron Eldor 591f162bed support mki value
Add support mki value in the DTLS-SRTP

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
Ron Eldor 3adb9928f3 Add mki value and some review comments
1. Add check for prerequisites in check_config.h
2. Add mki value to use_srtp extension
3. address some review comments

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
Johan Pascal 701984d300 Comply with mbedtls naming rules
Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
Johan Pascal c28f1f600e Fix typos in documentation
Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
Johan Pascal 2d9470be76 Improve DTLS SRTP API with a dedicated function to get generated keys
Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
Johan Pascal bbc057af73 Move available dtls srtp profile list to ssl_config
Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
Johan Pascal b62bb51aff Add RFC5764 - SRTP key generation during DTLS handshake
Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2020-10-29 01:14:49 +01:00
John Durkop f87e3aea16 Update guards in PSA crypto library for ECDSA and DETERMINISTIC support
In the PSA crypto library, the code for verification of ECDSA is the same for
both MBEDTLS_PSA_BUILTIN_ALG_ECDSA and
MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA. So, the guards should allow for
either one to enable the code blocks. The original implementation only had
the check for ECDSA. In order to make this work, config_psa.h was updated
to ensure when MBEDTLS_CRYPTO_CONFIG is disabled, the setting for DETERMINISTIC
is only updated if MBEDTLS_ECDSA_C is also enabled.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-26 15:25:23 -07:00
John Durkop 36a82e5a6b Ensure MBEDTLS_ECDSA_C is set when DETERMINISTIC_ECDSA is used
Ensure that MBEDTLS_ECDSA_C is set when PSA_WANT_ALG_DETERMINISTIC_ECDSA
is requested. Also added MBEDTLS_ECDSA_C to the requirements comment in
config.h for MBEDTLS_ECDSA_DETERMINISTIC.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-26 09:39:05 -07:00
John Durkop 6dff93ff9b Ensure dependent features also included by config_psa.h
When the PSA crypto features need to be setup based on the
PSA_WANT_xxx macros, the dependent features also need to be
enabled. This change corrects that for the MBEDTLS_ECDSA_DETERMINISTIC.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-23 01:22:58 -07:00
John Durkop 0ea39e0ee4 Correct use of MBEDTLS_PSA_BUILTIN_ALG_xxx in crypto library
The psa crypto library was generically using PSA_WANT_ALG_xxx, but
should have been using the correct MBEDTLS_PSA_BUILTIN_ALG_xxx
definition since that code is the builtin version. There were also
a couple of spots that needed to ensure the code block was enabled
for either ECDSA or DETERMINISTIC_ECDSA, not just one of them.

Fixed all the new ALG_ECDSA_DETERMINISTIC names to be
ALG_DETERMINISTIC_ECDSA instead.

Fixed test to use correct definitions.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-15 07:39:02 -07:00
John Durkop 7b453130e2 Updates to fix check-names and all.sh tests after review
Need to make sure the new MBEDTLS_PSA_ACCEL_XXX defines are not checked
since they should be defined by the PSA driver. Updated the list-macros.sh
script to modify the instances of those found to match the corresponding
MBEDTLS_PSA_BUILTIN_XXX that are defined in config_psa.h

Fixed definition of MBEDTLS_PSA_BUILTIN_ALG_ECDSA_DETERMINISTIC, name was
incorrect. Also fixed a missing space in the comments of crypto_config.h

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-12 21:56:26 -07:00
John Durkop c7c03b7d17 Enhanced documentation for crypto_config.h
Provided more detailed documentation for crypto_config.h file so it
is clear to users can enable cryptographic mechanisms using
PSA_WANT_XXX. If MBEDTLS_PSA_CRYPTO_CONFIG is not set the settings in
this file are not used.

Ensure that defines used in this file are set to 1 and not simply defined
per the specification. Also removed the __cplusplus guards since they are
not needed for this file.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-12 21:42:03 -07:00
John Durkop 348188229a Correct inclusion of MBEDTLS_XXX based on PSA_WANT_XXX
Provied a more detailed description for the config_psa.h header file.
This new description makes it clear that the file should not be edited
by users or integrators. Relevant changes should be made to
psa/crypto_config.h instead.

Fixed the logic for the inclusion of MBEDTLS_PSA_BUILTIN_XXX to be set
when PSA_WANT_ALG_XXX and MBEDTLS_PSA_ACCEL_ALG_XXX is not defined,
otherwise the MBEDTLS_XXX should be set.

Ensure that MBEDTLS_PSA_BUILTIN_XXX is set to 1 and not simply defined
per specification.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-12 21:36:22 -07:00
John Durkop 185764f5f4 Enhance description for MBEDTLS_PSA_CRYPTO_CONFIG
Provided detailed description for MBEDTLS_PSA_CRYPTO_CONFIG so that it is
more clear to the user when the feature should be enabled or disabled.
It also mentions where to look for PSA crypto config settings;
include/psa/crypto_config.h. Removed some other related comments that
were not necessary.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-12 21:32:12 -07:00
John Durkop 76228acfb9 Fix typo in define in comment
This fixes error in check-names.sh test.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-09-29 22:33:49 -07:00
John Durkop 714e3a1318 Minor cleanup to fix errors with some unit tests
With the new feature MBEDTLS_PSA_CRYPTO_CONFIG, needed to
add support that when the feature is disabled, if there
are defines like MBEDTLS_ECDSA_C defined, then the PSA_WANT_
equivalent define is also enabled. This ensures the guards in
the library psa_crypto will work properly.

Also fixed an error return code in the driver wrapper for cipher
encrypt setup so it will properly pass unit tests.

Ensured config.py full works properly with the new
MBEDTLS_PSA_CRYPTO_CONFIG, it should not be set when the full
option is used.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-09-29 22:07:04 -07:00
John Durkop 2dfaf9ca23 Update how MBEDTLS_PSA_CRYPTO_CONFIG is handled
Originally, MBEDTLS_PSA_CRYPTO_CONFIG was being used to allow
inclusion of mbedlts/config_psa.h, but that needed to be updated
so that mbedtls/config_psa.h is always included and the definitions
specific to PSA configuration are now guarded by
MBEDTLS_PSA_CRYPTO_CONFIG. This will allow for the standard setup
to continue working while new PSA configuration items to also work.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-09-24 05:01:17 -07:00
John Durkop d8959390c5 Add ECDSA support to PSA crypto configuration
Initial changes to PSA crypto core to support configuration
of ECDSA algorithm using PSA crypto configuration mechanism.
Guards using MBEDTLS_ECDSA_C and MBEDTLS_ECDSA_DETERMINISTIC have
been changed to be based off PSA_WANT_ALG_ECDSA and
PSA_WANT_ALG_ECDSA_DETERMINISTIC. Added new tests to all.sh to
confirm new settings are working properly. Current code does not
pass the tests since built in signature verification is not in place.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-09-24 05:01:17 -07:00
John Durkop 7758c858ae Update requires for MBEDTLS_PSA_CRYPTO_DRIVERS
In order to test various PSA crypto settings the Requires section
needed updating to require MBEDTLS_PSA_CRYPTO_C or
MBEDTLS_PSA_CRYPTO_CONFIG.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-09-24 05:01:17 -07:00
John Durkop 6e33dbe9fd Created infrastructure for MBEDTLS_PSA_CRYPTO_CONFIG
In order to prepare for PSA cryptographic mechanism for conditional
inclusion of various modules, there needs to be some updates to
the mbedtls configuration to enable that feature to work. This initial
set of changes just lays the ground work and future changes will
implement the functional features.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-09-24 05:01:17 -07:00
Gilles Peskine 1d9c11081a
Merge pull request #3667 from Jongy/fix-docs
Fix docs to desribe written-into buffer parameter as writable
2020-09-17 00:02:08 +02:00
Janos Follath 2a25904f45
Merge pull request #3568 from hanno-arm/tls13_experimental_key_schedule_1
TLS 1.3: Add HKDF-based key derivation functionality
2020-09-16 11:40:06 +01:00
Hanno Becker 61baae7c9f Minor fixes and improvements in TLS 1.3 key schedule documentation
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-09-16 09:47:47 +01:00
Gilles Peskine dc57c25e30
Merge pull request #3527 from ronald-cron-arm/key-extended-id
PSA key identifiers rework
2020-09-15 16:06:06 +02:00
Ronald Cron 7424f0d998 psa: Move key identifier related macros and functions
Move key identifier related macros and functions from
crypto_types.h to crypto_values.h as the latter is
the intended file to put them in.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-09-15 08:50:20 +02:00
Ronald Cron 9a2511e78f Fix key owner identifier documentation
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-09-15 08:50:20 +02:00
Ronald Cron 5eba579c6c Remove unnecessary inline definition
Define inline for some compiling environment only
in crypto_platform.h.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-09-15 08:48:15 +02:00
Steven Cooreman ef8575e1bf Apply review feedback
* Reworked the cipher context once again to be more robustly defined
* Removed redundant memset
* Unified behaviour on failure between driver and software in cipher_finish
* Cipher test driver setup function now also returns early when its status
  is overridden, like the other test driver functions
* Removed redundant test cases
* Added bad-order checking to verify the driver doesn't get called where
  the spec says it won't.

Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-14 17:00:47 +02:00
Steven Cooreman a07b9970c6 Update semantics around driver context use in psa_cipher_setup
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-14 17:00:39 +02:00
Steven Cooreman fb81aa5889 Only pass the driver-relevant portion of the context struct
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-14 16:31:58 +02:00
Steven Cooreman 5240e8b519 Style and language fixes from review
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-14 16:31:58 +02:00
Steven Cooreman d3feccd3a5 Restructure cipher context object to contain driver switch
Once an operation has been 'accepted' by a driver, the remainder is bound
to the same driver, since driver-specific context structs cannot be shared.
This provides a pretty good gate mechanism for the fallback logic, too.

Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-14 16:31:52 +02:00
Steven Cooreman 37941cb5e1 Add initial pass on a multi-part test driver
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-14 16:30:14 +02:00
Gilles Peskine b1d3f2779b
Merge pull request #3480 from stevew817/feature/aes-ecb
Added support for AES-ECB to the PSA Crypto implementation
2020-09-14 14:45:14 +02:00
Yonatan Goldschmidt 6e2af094b0 Fix docs to desribe written-into buffer parameter as writable
Signed-off-by: Yonatan Goldschmidt <yon.goldschmidt@gmail.com>
2020-09-12 01:24:45 +03:00
Gilles Peskine 2a739c41bd
Merge pull request #3569 from cm6n/fix_mbedtlssslsetbio_description
Fix typo in mbedtls_ssl_set_bio description.
2020-09-11 21:17:37 +02:00
Hanno Becker 2fe043a6d1 Remove guard for TLS 1.3 specific declarations
We only guard the implementations of modules, not their declarations.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-09-09 10:58:53 +01:00
Hanno Becker 9a7a2ac2de Fix typo in ssl_internal.h
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-09-09 09:24:54 +01:00
Manuel Pégourié-Gonnard 628ed4e54f
Merge pull request #3592 from d-otte/development
adjusting size of sliding window array to correct size.
2020-09-09 10:00:26 +02:00
Hanno Becker 1588983ef0 Introduce macros for max-{IV,block,key}-size for ciphers used in TLS
See the documentation in ssl_internal.h that this commit introduces
for more information.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-09-08 11:29:11 +01:00
Hanno Becker 493ea7f4ae Remove instances of camelCase in TLS 1.3 key schedule
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-09-08 11:08:06 +01:00
Hanno Becker 3385a4d5cf Implement TLS 1.3 traffic key generation
See the documentation in library/ssl_tls13_keys.h.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-09-08 10:28:28 +01:00
Hanno Becker 27a2688fbb Introduce public macro for maximum symmetric cipher key length
This commit introduces the public macro MBEDTLS_MAX_KEY_LENGTH,
which evaluates to an upper bound for the key lengths of all enabled
ciphers, in Bytes.

This is analogous to the already existing macros MBEDTLS_MAX_IV_LENGTH
and MBEDTLS_MAX_BLOCK_LENGTH, which provide upper bounds for the IV
and block length, respectively.

For now, MBEDTLS_MAX_KEY_LENGTH is 32 Bytes by default, and 64 in case
XTS is enabled. This is a strict overapproximation for some restricted
configurations. Ideally, the upper bound should be calculated exactly
and automatically from the list of enabled ciphers. The same applies
to the existing macros MBEDTLS_MAX_IV_LENGTH and MBEDTLS_MAX_BLOCK_LENGTH,
though, and is left for future work.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-09-07 14:34:10 +01:00
Daniel Otte 608615168a adjusting comment on sliding window memory usage.
The comment now uses '**' as exponentiation operator.

Signed-off-by: Daniel Otte <d.otte@wut.de>
2020-09-07 13:07:14 +02:00
Daniel Otte 4374dc493d fixing spelling mistakes (window <-- windows)
Signed-off-by: Daniel Otte <d.otte@wut.de>
2020-09-07 13:06:40 +02:00
Steven Cooreman 15f58d2877 Move mbedtls_to_psa_error declaration to internal header
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-04 14:22:27 +02:00