Merge branch 'development-restricted' into mbedtls-2.23.0r0
This commit is contained in:
Janos Follath
Коммит
4d1884916b
|
|
@ -0,0 +1,15 @@
|
|||
Changes
|
||||
* The ECP module, enabled by `MBEDTLS_ECP_C`, now depends on
|
||||
`MBEDTLS_CTR_DRBG_C` or `MBEDTLS_HMAC_DRBG_C` for some side-channel
|
||||
coutermeasures. If side channels are not a concern, this dependency can
|
||||
be avoided by enabling the new option `MBEDTLS_ECP_NO_INTERNAL_RNG`.
|
||||
|
||||
Security
|
||||
* Fix side channel in mbedtls_ecp_check_pub_priv() and
|
||||
mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a
|
||||
private key that didn't include the uncompressed public key), as well as
|
||||
mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL
|
||||
f_rng argument. An attacker with access to precise enough timing and
|
||||
memory access information (typically an untrusted operating system
|
||||
attacking a secure enclave) could fully recover the ECC private key.
|
||||
Found and reported by Alejandro Cabrera Aldaya and Billy Brumley.
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
Security
|
||||
* Fix issue in Lucky 13 counter-measure that could make it ineffective when
|
||||
hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT
|
||||
macros). This would cause the original Lucky 13 attack to be possible in
|
||||
those configurations, allowing an active network attacker to recover
|
||||
plaintext after repeated timing measurements under some conditions.
|
||||
Reported and fix suggested by Luc Perneel in #3246.
|
||||
|
|
@ -156,6 +156,14 @@
|
|||
#error "MBEDTLS_ECP_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_C) && !( \
|
||||
defined(MBEDTLS_ECP_ALT) || \
|
||||
defined(MBEDTLS_CTR_DRBG_C) || \
|
||||
defined(MBEDTLS_HMAC_DRBG_C) || \
|
||||
defined(MBEDTLS_ECP_NO_INTERNAL_RNG))
|
||||
#error "MBEDTLS_ECP_C requires a DRBG module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)
|
||||
#error "MBEDTLS_PK_PARSE_C defined, but not all prerequesites"
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -781,6 +781,28 @@
|
|||
*/
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
*
|
||||
* When this option is disabled, mbedtls_ecp_mul() will make use of an
|
||||
* internal RNG when called with a NULL \c f_rng argument, in order to protect
|
||||
* against some side-channel attacks.
|
||||
*
|
||||
* This protection introduces a dependency of the ECP module on one of the
|
||||
* DRBG modules. For very constrained implementations that don't require this
|
||||
* protection (for example, because you're only doing signature verification,
|
||||
* so not manipulating any secret, or because local/physical side-channel
|
||||
* attacks are outside your threat model), it might be desirable to get rid of
|
||||
* that dependency.
|
||||
*
|
||||
* \warning Enabling this option makes some uses of ECP vulnerable to some
|
||||
* side-channel attacks. Only enable it if you know that's not a problem for
|
||||
* your use case.
|
||||
*
|
||||
* Uncomment this macro to disable some counter-measures in ECP.
|
||||
*/
|
||||
//#define MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_ECP_RESTARTABLE
|
||||
*
|
||||
|
|
|
|||
|
|
@ -846,6 +846,9 @@ int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group *grp,
|
|||
* intermediate results to prevent potential timing attacks
|
||||
* targeting these results. We recommend always providing
|
||||
* a non-NULL \p f_rng. The overhead is negligible.
|
||||
* Note: unless #MBEDTLS_ECP_NO_INTERNAL_RNG is defined, when
|
||||
* \p f_rng is NULL, an internal RNG (seeded from the value
|
||||
* of \p m) will be used instead.
|
||||
*
|
||||
* \param grp The ECP group to use.
|
||||
* This must be initialized and have group parameters
|
||||
|
|
|
|||
|
|
@ -104,6 +104,8 @@ typedef struct mbedtls_md_context_t
|
|||
* \brief This function returns the list of digests supported by the
|
||||
* generic digest module.
|
||||
*
|
||||
* \note The list starts with the strongest available hashes.
|
||||
*
|
||||
* \return A statically allocated array of digests. Each element
|
||||
* in the returned list is an integer belonging to the
|
||||
* message-digest enumeration #mbedtls_md_type_t.
|
||||
|
|
|
|||
229
library/ecp.c
229
library/ecp.c
|
|
@ -105,6 +105,16 @@
|
|||
|
||||
#include "mbedtls/ecp_internal.h"
|
||||
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
#if defined(MBEDTLS_HMAC_DRBG_C)
|
||||
#include "mbedtls/hmac_drbg.h"
|
||||
#elif defined(MBEDTLS_CTR_DRBG_C)
|
||||
#include "mbedtls/ctr_drbg.h"
|
||||
#else
|
||||
#error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||
|
||||
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
||||
!defined(inline) && !defined(__cplusplus)
|
||||
#define inline __inline
|
||||
|
|
@ -118,6 +128,144 @@
|
|||
static unsigned long add_count, dbl_count, mul_count;
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
/*
|
||||
* Currently ecp_mul() takes a RNG function as an argument, used for
|
||||
* side-channel protection, but it can be NULL. The initial reasoning was
|
||||
* that people will pass non-NULL RNG when they care about side-channels, but
|
||||
* unfortunately we have some APIs that call ecp_mul() with a NULL RNG, with
|
||||
* no opportunity for the user to do anything about it.
|
||||
*
|
||||
* The obvious strategies for addressing that include:
|
||||
* - change those APIs so that they take RNG arguments;
|
||||
* - require a global RNG to be available to all crypto modules.
|
||||
*
|
||||
* Unfortunately those would break compatibility. So what we do instead is
|
||||
* have our own internal DRBG instance, seeded from the secret scalar.
|
||||
*
|
||||
* The following is a light-weight abstraction layer for doing that with
|
||||
* HMAC_DRBG (first choice) or CTR_DRBG.
|
||||
*/
|
||||
|
||||
#if defined(MBEDTLS_HMAC_DRBG_C)
|
||||
|
||||
/* DRBG context type */
|
||||
typedef mbedtls_hmac_drbg_context ecp_drbg_context;
|
||||
|
||||
/* DRBG context init */
|
||||
static inline void ecp_drbg_init( ecp_drbg_context *ctx )
|
||||
{
|
||||
mbedtls_hmac_drbg_init( ctx );
|
||||
}
|
||||
|
||||
/* DRBG context free */
|
||||
static inline void ecp_drbg_free( ecp_drbg_context *ctx )
|
||||
{
|
||||
mbedtls_hmac_drbg_free( ctx );
|
||||
}
|
||||
|
||||
/* DRBG function */
|
||||
static inline int ecp_drbg_random( void *p_rng,
|
||||
unsigned char *output, size_t output_len )
|
||||
{
|
||||
return( mbedtls_hmac_drbg_random( p_rng, output, output_len ) );
|
||||
}
|
||||
|
||||
/* DRBG context seeding */
|
||||
static int ecp_drbg_seed( ecp_drbg_context *ctx,
|
||||
const mbedtls_mpi *secret, size_t secret_len )
|
||||
{
|
||||
int ret;
|
||||
unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES];
|
||||
/* The list starts with strong hashes */
|
||||
const mbedtls_md_type_t md_type = mbedtls_md_list()[0];
|
||||
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_type );
|
||||
|
||||
if( secret_len > MBEDTLS_ECP_MAX_BYTES )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret,
|
||||
secret_bytes, secret_len ) );
|
||||
|
||||
ret = mbedtls_hmac_drbg_seed_buf( ctx, md_info, secret_bytes, secret_len );
|
||||
|
||||
cleanup:
|
||||
mbedtls_platform_zeroize( secret_bytes, secret_len );
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#elif defined(MBEDTLS_CTR_DRBG_C)
|
||||
|
||||
/* DRBG context type */
|
||||
typedef mbedtls_ctr_drbg_context ecp_drbg_context;
|
||||
|
||||
/* DRBG context init */
|
||||
static inline void ecp_drbg_init( ecp_drbg_context *ctx )
|
||||
{
|
||||
mbedtls_ctr_drbg_init( ctx );
|
||||
}
|
||||
|
||||
/* DRBG context free */
|
||||
static inline void ecp_drbg_free( ecp_drbg_context *ctx )
|
||||
{
|
||||
mbedtls_ctr_drbg_free( ctx );
|
||||
}
|
||||
|
||||
/* DRBG function */
|
||||
static inline int ecp_drbg_random( void *p_rng,
|
||||
unsigned char *output, size_t output_len )
|
||||
{
|
||||
return( mbedtls_ctr_drbg_random( p_rng, output, output_len ) );
|
||||
}
|
||||
|
||||
/*
|
||||
* Since CTR_DRBG doesn't have a seed_buf() function the way HMAC_DRBG does,
|
||||
* we need to pass an entropy function when seeding. So we use a dummy
|
||||
* function for that, and pass the actual entropy as customisation string.
|
||||
* (During seeding of CTR_DRBG the entropy input and customisation string are
|
||||
* concatenated before being used to update the secret state.)
|
||||
*/
|
||||
static int ecp_ctr_drbg_null_entropy(void *ctx, unsigned char *out, size_t len)
|
||||
{
|
||||
(void) ctx;
|
||||
memset( out, 0, len );
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
/* DRBG context seeding */
|
||||
static int ecp_drbg_seed( ecp_drbg_context *ctx,
|
||||
const mbedtls_mpi *secret, size_t secret_len )
|
||||
{
|
||||
int ret;
|
||||
unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES];
|
||||
|
||||
if( secret_len > MBEDTLS_ECP_MAX_BYTES )
|
||||
{
|
||||
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret,
|
||||
secret_bytes, secret_len ) );
|
||||
|
||||
ret = mbedtls_ctr_drbg_seed( ctx, ecp_ctr_drbg_null_entropy, NULL,
|
||||
secret_bytes, secret_len );
|
||||
|
||||
cleanup:
|
||||
mbedtls_platform_zeroize( secret_bytes, secret_len );
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#else
|
||||
#error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
|
||||
#endif /* DRBG modules */
|
||||
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||
|
||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||
/*
|
||||
* Maximum number of "basic operations" to be done in a row.
|
||||
|
|
@ -165,6 +313,10 @@ struct mbedtls_ecp_restart_mul
|
|||
ecp_rsm_comb_core, /* ecp_mul_comb_core() */
|
||||
ecp_rsm_final_norm, /* do the final normalization */
|
||||
} state;
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
ecp_drbg_context drbg_ctx;
|
||||
unsigned char drbg_seeded;
|
||||
#endif
|
||||
};
|
||||
|
||||
/*
|
||||
|
|
@ -177,6 +329,10 @@ static void ecp_restart_rsm_init( mbedtls_ecp_restart_mul_ctx *ctx )
|
|||
ctx->T = NULL;
|
||||
ctx->T_size = 0;
|
||||
ctx->state = ecp_rsm_init;
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
ecp_drbg_init( &ctx->drbg_ctx );
|
||||
ctx->drbg_seeded = 0;
|
||||
#endif
|
||||
}
|
||||
|
||||
/*
|
||||
|
|
@ -198,6 +354,10 @@ static void ecp_restart_rsm_free( mbedtls_ecp_restart_mul_ctx *ctx )
|
|||
mbedtls_free( ctx->T );
|
||||
}
|
||||
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
ecp_drbg_free( &ctx->drbg_ctx );
|
||||
#endif
|
||||
|
||||
ecp_restart_rsm_init( ctx );
|
||||
}
|
||||
|
||||
|
|
@ -1897,7 +2057,9 @@ static int ecp_mul_comb_core( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R
|
|||
i = d;
|
||||
MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, T_size, x[i] ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 1 ) );
|
||||
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
if( f_rng != 0 )
|
||||
#endif
|
||||
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
|
||||
}
|
||||
|
||||
|
|
@ -2018,6 +2180,7 @@ static int ecp_mul_comb_after_precomp( const mbedtls_ecp_group *grp,
|
|||
rs_ctx->rsm->state = ecp_rsm_final_norm;
|
||||
|
||||
final_norm:
|
||||
MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
|
||||
#endif
|
||||
/*
|
||||
* Knowledge of the jacobian coordinates may leak the last few bits of the
|
||||
|
|
@ -2030,10 +2193,11 @@ final_norm:
|
|||
*
|
||||
* Avoid the leak by randomizing coordinates before we normalize them.
|
||||
*/
|
||||
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
if( f_rng != 0 )
|
||||
#endif
|
||||
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, RR, f_rng, p_rng ) );
|
||||
|
||||
MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
|
||||
MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, RR ) );
|
||||
|
||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||
|
|
@ -2104,11 +2268,44 @@ static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
|||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
unsigned char w, p_eq_g, i;
|
||||
size_t d;
|
||||
unsigned char T_size, T_ok;
|
||||
mbedtls_ecp_point *T;
|
||||
unsigned char T_size = 0, T_ok = 0;
|
||||
mbedtls_ecp_point *T = NULL;
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
ecp_drbg_context drbg_ctx;
|
||||
|
||||
ecp_drbg_init( &drbg_ctx );
|
||||
#endif
|
||||
|
||||
ECP_RS_ENTER( rsm );
|
||||
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
if( f_rng == NULL )
|
||||
{
|
||||
/* Adjust pointers */
|
||||
f_rng = &ecp_drbg_random;
|
||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||
if( rs_ctx != NULL && rs_ctx->rsm != NULL )
|
||||
p_rng = &rs_ctx->rsm->drbg_ctx;
|
||||
else
|
||||
#endif
|
||||
p_rng = &drbg_ctx;
|
||||
|
||||
/* Initialize internal DRBG if necessary */
|
||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||
if( rs_ctx == NULL || rs_ctx->rsm == NULL ||
|
||||
rs_ctx->rsm->drbg_seeded == 0 )
|
||||
#endif
|
||||
{
|
||||
const size_t m_len = ( grp->nbits + 7 ) / 8;
|
||||
MBEDTLS_MPI_CHK( ecp_drbg_seed( p_rng, m, m_len ) );
|
||||
}
|
||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||
if( rs_ctx != NULL && rs_ctx->rsm != NULL )
|
||||
rs_ctx->rsm->drbg_seeded = 1;
|
||||
#endif
|
||||
}
|
||||
#endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||
|
||||
/* Is P the base point ? */
|
||||
#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
|
||||
p_eq_g = ( mbedtls_mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 &&
|
||||
|
|
@ -2180,6 +2377,10 @@ static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
|||
|
||||
cleanup:
|
||||
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
ecp_drbg_free( &drbg_ctx );
|
||||
#endif
|
||||
|
||||
/* does T belong to the group? */
|
||||
if( T == grp->T )
|
||||
T = NULL;
|
||||
|
|
@ -2370,9 +2571,23 @@ static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
|||
unsigned char b;
|
||||
mbedtls_ecp_point RP;
|
||||
mbedtls_mpi PX;
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
ecp_drbg_context drbg_ctx;
|
||||
|
||||
ecp_drbg_init( &drbg_ctx );
|
||||
#endif
|
||||
mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX );
|
||||
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
if( f_rng == NULL )
|
||||
{
|
||||
const size_t m_len = ( grp->nbits + 7 ) / 8;
|
||||
MBEDTLS_MPI_CHK( ecp_drbg_seed( &drbg_ctx, m, m_len ) );
|
||||
f_rng = &ecp_drbg_random;
|
||||
p_rng = &drbg_ctx;
|
||||
}
|
||||
#endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||
|
||||
/* Save PX and read from P before writing to R, in case P == R */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &PX, &P->X ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &RP, P ) );
|
||||
|
|
@ -2386,7 +2601,9 @@ static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
|||
MOD_ADD( RP.X );
|
||||
|
||||
/* Randomize coordinates of the starting point */
|
||||
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
if( f_rng != NULL )
|
||||
#endif
|
||||
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
|
||||
|
||||
/* Loop invariant: R = result so far, RP = R + P */
|
||||
|
|
@ -2419,12 +2636,18 @@ static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
|||
*
|
||||
* Avoid the leak by randomizing coordinates before we normalize them.
|
||||
*/
|
||||
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
if( f_rng != NULL )
|
||||
#endif
|
||||
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, R, f_rng, p_rng ) );
|
||||
|
||||
MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) );
|
||||
|
||||
cleanup:
|
||||
#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
ecp_drbg_free( &drbg_ctx );
|
||||
#endif
|
||||
|
||||
mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX );
|
||||
|
||||
return( ret );
|
||||
|
|
|
|||
|
|
@ -1578,6 +1578,8 @@ int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
|
|||
* linking an extra division function in some builds).
|
||||
*/
|
||||
size_t j, extra_run = 0;
|
||||
/* This size is enough to server either as input to
|
||||
* md_process() or as output to md_finish() */
|
||||
unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
|
||||
|
||||
/*
|
||||
|
|
@ -1633,10 +1635,15 @@ int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
|
|||
ssl_read_memory( data + rec->data_len, padlen );
|
||||
mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
|
||||
|
||||
/* Call mbedtls_md_process at least once due to cache attacks
|
||||
* that observe whether md_process() was called of not */
|
||||
/* Dummy calls to compression function.
|
||||
* Call mbedtls_md_process at least once due to cache attacks
|
||||
* that observe whether md_process() was called of not.
|
||||
* Respect the usual start-(process|update)-finish sequence for
|
||||
* the sake of hardware accelerators that might require it. */
|
||||
mbedtls_md_starts( &transform->md_ctx_dec );
|
||||
for( j = 0; j < extra_run + 1; j++ )
|
||||
mbedtls_md_process( &transform->md_ctx_dec, tmp );
|
||||
mbedtls_md_finish( &transform->md_ctx_dec, tmp );
|
||||
|
||||
mbedtls_md_hmac_reset( &transform->md_ctx_dec );
|
||||
|
||||
|
|
|
|||
|
|
@ -354,6 +354,9 @@ static const char * const features[] = {
|
|||
#if defined(MBEDTLS_ECP_NIST_OPTIM)
|
||||
"MBEDTLS_ECP_NIST_OPTIM",
|
||||
#endif /* MBEDTLS_ECP_NIST_OPTIM */
|
||||
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
"MBEDTLS_ECP_NO_INTERNAL_RNG",
|
||||
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||
"MBEDTLS_ECP_RESTARTABLE",
|
||||
#endif /* MBEDTLS_ECP_RESTARTABLE */
|
||||
|
|
|
|||
|
|
@ -986,6 +986,14 @@ int query_config( const char *config )
|
|||
}
|
||||
#endif /* MBEDTLS_ECP_NIST_OPTIM */
|
||||
|
||||
#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
|
||||
if( strcmp( "MBEDTLS_ECP_NO_INTERNAL_RNG", config ) == 0 )
|
||||
{
|
||||
MACRO_EXPANSION_TO_STR( MBEDTLS_ECP_NO_INTERNAL_RNG );
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
|
||||
|
||||
#if defined(MBEDTLS_ECP_RESTARTABLE)
|
||||
if( strcmp( "MBEDTLS_ECP_RESTARTABLE", config ) == 0 )
|
||||
{
|
||||
|
|
|
|||
|
|
@ -173,6 +173,7 @@ EXCLUDE_FROM_FULL = frozenset([
|
|||
'MBEDTLS_DEPRECATED_REMOVED', # conflicts with deprecated options
|
||||
'MBEDTLS_DEPRECATED_WARNING', # conflicts with deprecated options
|
||||
'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED', # influences the use of ECDH in TLS
|
||||
'MBEDTLS_ECP_NO_INTERNAL_RNG', # removes a feature
|
||||
'MBEDTLS_ECP_RESTARTABLE', # incompatible with USE_PSA_CRYPTO
|
||||
'MBEDTLS_ENTROPY_FORCE_SHA256', # interacts with CTR_DRBG_128_BIT_KEY
|
||||
'MBEDTLS_HAVE_SSE2', # hardware dependency
|
||||
|
|
|
|||
|
|
@ -929,6 +929,43 @@ component_test_no_hmac_drbg () {
|
|||
# so there's little value in running those lengthy tests here.
|
||||
}
|
||||
|
||||
component_test_ecp_no_internal_rng () {
|
||||
msg "build: Default plus ECP_NO_INTERNAL_RNG minus DRBG modules"
|
||||
scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
scripts/config.py unset MBEDTLS_CTR_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_HMAC_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
|
||||
scripts/config.py unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
|
||||
scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
|
||||
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: ECP_NO_INTERNAL_RNG, no DRBG module"
|
||||
make test
|
||||
|
||||
# no SSL tests as they all depend on having a DRBG
|
||||
}
|
||||
|
||||
component_test_ecp_restartable_no_internal_rng () {
|
||||
msg "build: Default plus ECP_RESTARTABLE and ECP_NO_INTERNAL_RNG, no DRBG"
|
||||
scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
|
||||
scripts/config.py set MBEDTLS_ECP_RESTARTABLE
|
||||
scripts/config.py unset MBEDTLS_CTR_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_HMAC_DRBG_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
|
||||
scripts/config.py unset MBEDTLS_PSA_CRYPTO_C # requires CTR_DRBG
|
||||
scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
|
||||
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: ECP_RESTARTABLE and ECP_NO_INTERNAL_RNG, no DRBG module"
|
||||
make test
|
||||
|
||||
# no SSL tests as they all depend on having a DRBG
|
||||
}
|
||||
|
||||
component_test_new_ecdh_context () {
|
||||
msg "build: new ECDH context (ASan build)" # ~ 6 min
|
||||
scripts/config.py unset MBEDTLS_ECDH_LEGACY_CONTEXT
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче