Commit graph

301 commits

Author SHA1 Message Date
Hanno Becker b7a04a7851 Fix mbedtls_ecp_curve_info_from_name() for NULL input 2018-12-19 08:52:05 +00:00
Hanno Becker 80f71689ee Add parameter validation to mbedtls_ecp_restart_init() 2018-12-19 08:51:52 +00:00
Hanno Becker 4f8e8e5805 Implement parameter validation for ECP module 2018-12-18 13:00:48 +00:00
Jaeden Amero 01b34fb316 Merge remote-tracking branch 'upstream-public/pr/2267' into development 2018-12-07 16:17:12 +00:00
Janos Follath 683c582530 Clarify alternative ECP calling conventions
Function calls to alternative implementations have to follow certain
rules in order to preserve correct functionality. To avoid accidentally
breaking these rules we state them explicitly in the ECP module for
ourselves and every contributor to see.
2018-12-07 13:13:30 +00:00
Janos Follath af6f2694a4 Fix ECC hardware double initialization
We initialized the ECC hardware before calling
mbedtls_ecp_mul_shortcuts(). This in turn calls
mbedtls_ecp_mul_restartable(), which initializes and frees the hardware
too. This issue has been introduced by recent changes and caused some
accelerators to hang.

We move the initialization after the mbedtle_ecp_mul_shortcuts() calls
to avoid double initialization.
2018-12-07 11:03:47 +00:00
Jaeden Amero a04617ec18 Merge remote-tracking branch 'upstream-public/pr/2125' into development 2018-12-06 16:02:31 +00:00
Janos Follath 89ac8c9266 ECP: Add mbedtls_ecp_tls_read_group_id()
`mbedtls_ecp_tls_read_group()` both parses the group ID and loads the
group into the structure provided. We want to support alternative
implementations of ECDH in the future and for that we need to parse the
group ID without populating an `mbedtls_ecp_group` structure (because
alternative implementations might not use that).

This commit moves the part that parses the group ID to a new function.
There is no need to test the new function directly, because the tests
for `mbedtls_ecp_tls_read_group()` are already implicitly testing it.

There is no intended change in behaviour in this commit.
2018-11-30 14:09:57 +00:00
Hanno Becker b10c66073f Detect unsigned integer overflow in mbedtls_ecp_check_budget()
This commit modifies a bounds check in `mbedtls_ecp_check_budget()` to
be correct even if the requested number of ECC operations would overflow
the operation counter.
2018-10-26 15:09:35 +01:00
Manuel Pégourié-Gonnard a966fdea72 Fix some documentation typos and improve a comment 2018-10-23 10:41:11 +02:00
Brian J Murray f343de12dc typo fix 2018-10-22 16:41:35 -07:00
Manuel Pégourié-Gonnard b25cb603bb Add a comment to clarify code flow 2018-10-16 11:48:09 +02:00
Manuel Pégourié-Gonnard 90f31b71a8 Improve readability by moving counter decrement
Avoid the slightly awkward rs_ctx-> i = i + 1
2018-10-16 10:45:24 +02:00
Manuel Pégourié-Gonnard a58e011ac0 Fix alignment in a macro definition 2018-10-16 10:42:47 +02:00
Manuel Pégourié-Gonnard b843b15a02 Fix function name to fit conventions 2018-10-16 10:41:31 +02:00
Manuel Pégourié-Gonnard ee68cff813 Fix or improve some comments (and whitespace) 2018-10-15 15:27:49 +02:00
Manuel Pégourié-Gonnard 125af948c3 Merge branch 'development-restricted' into iotssl-1260-non-blocking-ecc-restricted
* development-restricted: (578 commits)
  Update library version number to 2.13.1
  Don't define _POSIX_C_SOURCE in header file
  Don't declare and define gmtime()-mutex on Windows platforms
  Correct preprocessor guards determining use of gmtime()
  Correct documentation of mbedtls_platform_gmtime_r()
  Correct typo in documentation of mbedtls_platform_gmtime_r()
  Correct POSIX version check to determine presence of gmtime_r()
  Improve documentation of mbedtls_platform_gmtime_r()
  platform_utils.{c/h} -> platform_util.{c/h}
  Don't include platform_time.h if !MBEDTLS_HAVE_TIME
  Improve wording of documentation of MBEDTLS_PLATFORM_GMTIME_R_ALT
  Fix typo in documentation of MBEDTLS_PLATFORM_GMTIME_R_ALT
  Replace 'thread safe' by 'thread-safe' in the documentation
  Improve documentation of MBEDTLS_HAVE_TIME_DATE
  ChangeLog: Add missing renamings gmtime -> gmtime_r
  Improve documentation of MBEDTLS_HAVE_TIME_DATE
  Minor documentation improvements
  Style: Add missing period in documentation in threading.h
  Rename mbedtls_platform_gmtime() to mbedtls_platform_gmtime_r()
  Guard decl and use of gmtime mutex by HAVE_TIME_DATE and !GMTIME_ALT
  ...
2018-09-11 12:39:14 +02:00
Ron Eldor 34b03ef78f Remove redundant else statement
Remove `else` statement, as it is redundant. resolves #1776
2018-08-20 10:39:27 +03:00
Angus Gratton 608a487b9c Fix memory leak in ecp_mul_comb() if ecp_precompute_comb() fails
In ecp_mul_comb(), if (!p_eq_g && grp->T == NULL) and then ecp_precompute_comb() fails (which can
happen due to OOM), then the new array of points T will be leaked (as it's newly allocated, but
hasn't been asigned to grp->T yet).

Symptom was a memory leak in ECDHE key exchange under low memory conditions.
2018-07-27 09:15:34 +10:00
Manuel Pégourié-Gonnard 95e2ecae95 Fix IAR warning
The IAR compiler doesn't like it when we assign an int to an enum variable.

"C:\builds\ws\mbedtls-restricted-pr\library\ecp.c",509  Error[Pe188]:
          enumerated type mixed with another type
2018-06-20 10:29:47 +02:00
Manuel Pégourié-Gonnard da19f4c79f Merge branch 'development' into iotssl-1260-non-blocking-ecc-restricted
Summary of merge conflicts:

include/mbedtls/ecdh.h -> documentation style
include/mbedtls/ecdsa.h -> documentation style
include/mbedtls/ecp.h -> alt style, new error codes, documentation style
include/mbedtls/error.h -> new error codes
library/error.c -> new error codes (generated anyway)
library/ecp.c:
    - code of an extracted function was changed
library/ssl_cli.c:
    - code addition on one side near code change on the other side
      (ciphersuite validation)
library/x509_crt.c -> various things
    - top fo file: helper structure added near old zeroize removed
    - documentation of find_parent_in()'s signature: improved on one side,
      added arguments on the other side
    - documentation of find_parent()'s signature: same as above
    - verify_chain(): variables initialised later to give compiler an
      opportunity to warn us if not initialised on a code path
    - find_parent(): funcion structure completely changed, for some reason git
      tried to insert a paragraph of the old structure...
    - merge_flags_with_cb(): data structure changed, one line was fixed with a
      cast to keep MSVC happy, this cast is already in the new version
    - in verify_restratable(): adjacent independent changes (function
      signature on one line, variable type on the next)
programs/ssl/ssl_client2.c:
    - testing for IN_PROGRESS return code near idle() (event-driven):
      don't wait for data in the the socket if ECP_IN_PROGRESS
tests/data_files/Makefile: adjacent independent additions
tests/suites/test_suite_ecdsa.data: adjacent independent additions
tests/suites/test_suite_x509parse.data: adjacent independent additions

* development: (1059 commits)
  Change symlink to hardlink to avoid permission issues
  Fix out-of-tree testing symlinks on Windows
  Updated version number to 2.10.0 for release
  Add a disabled CMAC define in the no-entropy configuration
  Adapt the ARIA test cases for new ECB function
  Fix file permissions for ssl.h
  Add ChangeLog entry for PR#1651
  Fix MicroBlaze register typo.
  Fix typo in doc and copy missing warning
  Fix edit mistake in cipher_wrap.c
  Update CTR doc for the 64-bit block cipher
  Update CTR doc for other 128-bit block ciphers
  Slightly tune ARIA CTR documentation
  Remove double declaration of mbedtls_ssl_list_ciphersuites
  Update CTR documentation
  Use zeroize function from new platform_util
  Move to new header style for ALT implementations
  Add ifdef for selftest in header file
  Fix typo in comments
  Use more appropriate type for local variable
  ...
2018-06-13 09:52:54 +02:00
Andres Amaya Garcia 1f6301b3c8 Rename mbedtls_zeroize to mbedtls_platform_zeroize 2018-04-17 10:00:21 -05:00
Andres Amaya Garcia e32df087fb Remove individual copies of mbedtls_zeroize()
This commit removes all the static occurrencies of the function
mbedtls_zeroize() in each of the individual .c modules. Instead the
function has been moved to utils.h that is included in each of the
modules.
2018-04-17 09:19:05 -05:00
Nicholas Wilson 08f3ef1861 Basic support for Curve448, similar to the current level of support for Curve25519 2018-03-29 14:29:06 +01:00
Hanno Becker 7c8cb9c28b Fix information leak in ecp_gen_keypair_base
The function mbedtls_ecp_gen_keypair_base did not wipe the stack buffer used to
hold the private exponent before returning. This commit fixes this by not using
a stack buffer in the first place but instead calling mpi_fill_random directly
to acquire the necessary random MPI.
2017-10-17 15:19:38 +01:00
Manuel Pégourié-Gonnard 196d1338ba Fix uninitialised variable in some configs 2017-08-28 13:14:27 +02:00
Manuel Pégourié-Gonnard fd87e354f6 Improve comments on parity trick 2017-08-24 14:21:19 +02:00
Manuel Pégourié-Gonnard 95aedfea33 Remove redundant test on curve type
If rsm != NULL then the curve type has to be Short Weierstrass, as we don't
implement restartable Montgomery now. If and when we do, then it's better to
check for the subcontext only, and not for the curve type.
2017-08-24 13:47:04 +02:00
Manuel Pégourié-Gonnard 11556e2846 Clarify initialization of T in mul_comb()
Exactly one of three ways will be used, so make that clear by using an
if 1 else if 2 else 3 structure.

While at it, don't initialize variables at declaration, just to make extra
sure they're properly initialized afterwards in all code paths.
2017-08-24 13:42:34 +02:00
Manuel Pégourié-Gonnard 4ed1dab474 ECP: move state changes closer to operations
Systematically assign state just before the next operation that may return,
rather that just after the previous one. This makes things more local. (For
example, previously precompute_comb() has to handle a state reset for
mul_comb_core(), a kind of coupling that's best avoided.)

Note that this change doesn't move the location of state updates relative
to any potential return point, which is all that matters.
2017-08-24 11:02:04 +02:00
Manuel Pégourié-Gonnard c9efa00871 ECP: Use explicit state assignments
Incrementing the state is error-prone as we can end up doing it too many times
(loops) or not enough (skipped branches), or just make programming mistakes
(eg. the state was incremented twice at the end, so it ended up with a value
not in the enum...)

This is the first step of the rework, the next one will rationalize where the
state assignments are done.
2017-08-24 10:25:06 +02:00
Manuel Pégourié-Gonnard db4a8eb992 Use ECP_RS_ENTER/LEAVE() macros, as in ECDSA 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard b948f7dc20 Don't bother to free NULL subcontexts 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard 28d162829b Avoid unnecessary xxx_copy() calls
The call would anyway check for pointer equality and return early, but it
doesn't hurt to save a function call, and also this follows more uniformly the
pattern that those two lines go together:

    #if defined(MBEDTLS_ECP_RESTARTBLE)
    if( rs_ctx != NULL && ...
2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard 5bd38b1144 Replace memset() calls with xxx_init() calls
And follow calloc() calls with xxx_init() too
2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard 92cceb29bd Make some names more consistent 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard ebac5d3797 Fix some whitespace & style issues 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard 7037e222ea Improve comments and doc for ECP 2017-08-23 14:30:36 +02:00
Manuel Pégourié-Gonnard 31f0ef7b19 Fix style issues introduced earlier 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 675439620d Improve sign/key_tries handling
(Unrelated to restartable work, just noticed while staring at the code.)

Checking at the end is inefficient as we might give up when we just generated
a valid signature or key.
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 5314f234ca Make verify_restartable() actually restartable 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard a0c5bcc2bc Add infrastructure for ecdsa_verify_restartable() 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard c751148cc5 Make some macros/functions public
These will be needed in other modules that already include ecp.h
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard b5a50e754d Always declare restartable function variants
Otherwise code that uses these functions in other modules will have to do:

    #if defined(MBEDTLS_ECP_RESTARTABLE)
    ret = do_stuff( there, may, be, many, args );
    #else
    ret = do_stuff( their, may, be, namy, args, rs_ctx );
    #fi

and there is a risk that the arg list will differ when code is updated, and
this might not be caught immediately by tests because this depends on a
config.h compile-time option which are harder to test.

Always declaring the restartable variants of the API functions avoids this
problem; the cost in ROM size should be negligible.
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 4b9c51ef32 Rename EARLY_RETURN -> RESTARTABLE
This is more consistent with function and context names.
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard a7937f9967 Add public function generating private keys
This will be useful for restartable ECDH and ECDSA. Currently they call
mbedtls_ecp_gen_keypair(); one could make that one restartable, but that means
adding its own sub-context, while ECDH and ECDSA (will) have their own
contexts already, so switching to this saves one extra context.
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 1631d63d0c Make muladd_restartable() actually restartable 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 54dd6527f0 Introduce muladd_restartable() and its sub-context
Only the administrative parts for now, not actually restartable so far.
2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard a08cd1a77f Avoid re-checking argument on restart 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard 3a256128d6 Reset ops_done at the right time
This should only be done in the top-level function.

Also, we need to know if we indeed are the top-level function or not: for
example, when mbedtls_ecp_muladd() calls mbedtls_ecp_mul(), the later should
not reset ops_done. This is handled by the "depth" parameter in the restart
context.
2017-08-09 11:44:53 +02:00