From d530841b72eaad53dbe206ef3fa55983a5eea426 Mon Sep 17 00:00:00 2001 From: Nadav Tasher Date: Tue, 10 Dec 2024 20:55:30 +0200 Subject: [PATCH 1/4] Added minimal TLSv1.3 AES-GCP configuration Signed-off-by: Nadav Tasher --- configs/config-aes-gcm-tls1_3.h | 62 +++++++++++++++++++ configs/crypto-config-aes-gcm-tls1_3.h | 30 +++++++++ tests/scripts/components-configuration-tls.sh | 7 ++- 3 files changed, 98 insertions(+), 1 deletion(-) create mode 100644 configs/config-aes-gcm-tls1_3.h create mode 100644 configs/crypto-config-aes-gcm-tls1_3.h diff --git a/configs/config-aes-gcm-tls1_3.h b/configs/config-aes-gcm-tls1_3.h new file mode 100644 index 0000000000..e885713c30 --- /dev/null +++ b/configs/config-aes-gcm-tls1_3.h @@ -0,0 +1,62 @@ +/** + * \file config-aes-gcm-tls1_3.h + * + * \brief Minimal configuration for a TLS 1.3 only client with AES-GCM ciphersuites + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#define TF_PSA_CRYPTO_CONFIG_FILE "../configs/crypto-config-aes-gcm-tls1_3.h" + +/* Crypto support */ +#define MBEDTLS_PSA_CRYPTO_C + +/* Mbed TLS modules */ +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#define MBEDTLS_CTR_DRBG_C +#define MBEDTLS_ENTROPY_C +#define MBEDTLS_MD_C +#define MBEDTLS_NET_C +#define MBEDTLS_OID_C +#define MBEDTLS_PK_C +#define MBEDTLS_PK_PARSE_C +#define MBEDTLS_SSL_CLI_C +#define MBEDTLS_SSL_TLS_C +#define MBEDTLS_X509_USE_C +#define MBEDTLS_X509_CRT_PARSE_C + +/* Configuration values for test suite */ +#define MBEDTLS_BASE64_C +#define MBEDTLS_PEM_PARSE_C +#define MBEDTLS_X509_CREATE_C + +/* TLS protocol feature support */ +#define MBEDTLS_SSL_PROTO_TLS1_3 +#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE +#define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE +#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED + +/* + * Use only AES-GCM ciphersuites, and + * save ROM and a few bytes of RAM by specifying our own ciphersuite list + */ +#define MBEDTLS_SSL_CIPHERSUITES \ + MBEDTLS_TLS1_3_AES_128_GCM_SHA256, \ + MBEDTLS_TLS1_3_AES_256_GCM_SHA384 + +/* + * You should adjust this to the exact number of sources you're using: default + * is the "platform_entropy_poll" source, but you may want to add other ones + * Minimum is 2 for the entropy test suite. + */ +#define MBEDTLS_ENTROPY_MAX_SOURCES 2 + +/* Error messages and TLS debugging traces + * (huge code size increase, needed for tests/ssl-opt.sh) */ +//#define MBEDTLS_DEBUG_C +//#define MBEDTLS_ERROR_C + diff --git a/configs/crypto-config-aes-gcm-tls1_3.h b/configs/crypto-config-aes-gcm-tls1_3.h new file mode 100644 index 0000000000..7e0fde0500 --- /dev/null +++ b/configs/crypto-config-aes-gcm-tls1_3.h @@ -0,0 +1,30 @@ +/** + * \file crypto-config-aes-gcm-tls1_3.h + * + * \brief Minimal crypto configuration for a TLS 1.3 only client with AES-GCM ciphersuites + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +/** + * To be used in conjunction with configs/config-aes-gcm-tls1_3.h */ + +#ifndef PSA_CRYPTO_CONFIG_H +#define PSA_CRYPTO_CONFIG_H + +#define PSA_WANT_ALG_GCM 1 +#define PSA_WANT_ALG_ECDH 1 +#define PSA_WANT_ALG_ECDSA 1 +#define PSA_WANT_ALG_SHA_256 1 +#define PSA_WANT_ALG_SHA_384 1 +#define PSA_WANT_ALG_HKDF_EXPAND 1 +#define PSA_WANT_ALG_HKDF_EXTRACT 1 +#define PSA_WANT_ECC_SECP_R1_256 1 + +#define PSA_WANT_KEY_TYPE_AES 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 + +#endif /* PSA_CRYPTO_CONFIG_H */ diff --git a/tests/scripts/components-configuration-tls.sh b/tests/scripts/components-configuration-tls.sh index 83795012f3..ff368bd38d 100644 --- a/tests/scripts/components-configuration-tls.sh +++ b/tests/scripts/components-configuration-tls.sh @@ -658,4 +658,9 @@ component_test_depends_py_kex () { tests/scripts/depends.py kex } - +component_test_config_minimal_tls1_3 () { + msg "build: configs/config-aes-gcm-tls1_3.h" + MBEDTLS_CONFIG="configs/config-aes-gcm-tls1_3.h" + CC=$ASAN_CC cmake -D GEN_FILES=Off -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan . + make +} From 24d7049852c77fa858c2383daa7a53008bbb47e7 Mon Sep 17 00:00:00 2001 From: Nadav Tasher Date: Sat, 11 Jan 2025 17:40:59 +0200 Subject: [PATCH 2/4] Remove non-applicable config option Signed-off-by: Nadav Tasher --- configs/config-aes-gcm-tls1_3.h | 1 - 1 file changed, 1 deletion(-) diff --git a/configs/config-aes-gcm-tls1_3.h b/configs/config-aes-gcm-tls1_3.h index e885713c30..f1d5ef984e 100644 --- a/configs/config-aes-gcm-tls1_3.h +++ b/configs/config-aes-gcm-tls1_3.h @@ -37,7 +37,6 @@ #define MBEDTLS_SSL_PROTO_TLS1_3 #define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE #define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE -#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED #define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED /* From ba507e30875f4331bf22ba2557d6be8d2b07b045 Mon Sep 17 00:00:00 2001 From: Nadav Tasher Date: Sat, 11 Jan 2025 18:07:06 +0200 Subject: [PATCH 3/4] Removed non-RFC required AES_256_GCM_SHA384 ciphersuite Signed-off-by: Nadav Tasher --- configs/config-aes-gcm-tls1_3.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/configs/config-aes-gcm-tls1_3.h b/configs/config-aes-gcm-tls1_3.h index f1d5ef984e..b249d46182 100644 --- a/configs/config-aes-gcm-tls1_3.h +++ b/configs/config-aes-gcm-tls1_3.h @@ -44,8 +44,7 @@ * save ROM and a few bytes of RAM by specifying our own ciphersuite list */ #define MBEDTLS_SSL_CIPHERSUITES \ - MBEDTLS_TLS1_3_AES_128_GCM_SHA256, \ - MBEDTLS_TLS1_3_AES_256_GCM_SHA384 + MBEDTLS_TLS1_3_AES_128_GCM_SHA256 /* * You should adjust this to the exact number of sources you're using: default From 8edf8981c59754deb3a793aa7ee416bd45c95137 Mon Sep 17 00:00:00 2001 From: Nadav Tasher Date: Sun, 12 Jan 2025 22:49:09 +0200 Subject: [PATCH 4/4] test_suite_x509write: fix test dependency error in oid_from_numeric_string Signed-off-by: Nadav Tasher --- tests/suites/test_suite_x509write.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function index d0fdd8aeef..39da59ebfc 100644 --- a/tests/suites/test_suite_x509write.function +++ b/tests/suites/test_suite_x509write.function @@ -766,7 +766,7 @@ void x509_set_extension_length_check() } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_X509_USE_C */ +/* BEGIN_CASE depends_on:MBEDTLS_X509_CREATE_C */ void oid_from_numeric_string(char *oid_str, int error_ret, data_t *exp_oid_buf) {