From 3bf4e9df037c27c27333b66b962ea77bd6d20cd7 Mon Sep 17 00:00:00 2001 From: Cal Abel Date: Fri, 3 Jul 2026 20:48:07 -0400 Subject: [PATCH] Fix async hardware TLS compatibility with upstream tests Signed-off-by: Cal Abel --- library/ssl_tls.c | 21 ++++----------------- library/ssl_tls12_client.c | 6 ++++++ library/ssl_tls12_server.c | 2 +- library/ssl_tls13_keys.c | 7 ++++--- library/x509write_csr.c | 2 +- tf-psa-crypto | 2 +- 6 files changed, 17 insertions(+), 23 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 0a2f83aa16..817273180b 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -458,18 +458,14 @@ static int ssl_tls12_session_load(mbedtls_ssl_session *session, static int ssl_update_checksum_start(mbedtls_ssl_context *, const unsigned char *, size_t); -#if defined(PSA_WANT_ALG_SHA_256) +#if defined(PSA_WANT_ALG_SHA_256) && !defined(PSA_WANT_ALG_SHA_512) static int ssl_update_checksum_sha256(mbedtls_ssl_context *, const unsigned char *, size_t); #endif /* PSA_WANT_ALG_SHA_256*/ -#if defined(PSA_WANT_ALG_SHA_384) +#if defined(PSA_WANT_ALG_SHA_384) && !defined(PSA_WANT_ALG_SHA_512) static int ssl_update_checksum_sha384(mbedtls_ssl_context *, const unsigned char *, size_t); #endif /* PSA_WANT_ALG_SHA_384*/ -#if defined(PSA_WANT_ALG_SHA_512) -static int ssl_update_checksum_sha512(mbedtls_ssl_context *, const unsigned char *, size_t); -#endif /* PSA_WANT_ALG_SHA_512 */ - int mbedtls_ssl_tls_prf(const mbedtls_tls_prf_types prf, const unsigned char *secret, size_t slen, const char *label, @@ -923,7 +919,7 @@ static int ssl_update_checksum_start(mbedtls_ssl_context *ssl, return 0; } -#if defined(PSA_WANT_ALG_SHA_256) +#if defined(PSA_WANT_ALG_SHA_256) && !defined(PSA_WANT_ALG_SHA_512) static int ssl_update_checksum_sha256(mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len) { @@ -932,7 +928,7 @@ static int ssl_update_checksum_sha256(mbedtls_ssl_context *ssl, } #endif -#if defined(PSA_WANT_ALG_SHA_384) +#if defined(PSA_WANT_ALG_SHA_384) && !defined(PSA_WANT_ALG_SHA_512) static int ssl_update_checksum_sha384(mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len) { @@ -941,15 +937,6 @@ static int ssl_update_checksum_sha384(mbedtls_ssl_context *ssl, } #endif -#if defined(PSA_WANT_ALG_SHA_512) -static int ssl_update_checksum_sha512(mbedtls_ssl_context *ssl, - const unsigned char *buf, size_t len) -{ - return mbedtls_md_error_from_psa(psa_hash_update( - &ssl->handshake->fin_sha512_psa, buf, len)); -} -#endif - static void ssl_handshake_params_init(mbedtls_ssl_handshake_params *handshake) { memset(handshake, 0, sizeof(mbedtls_ssl_handshake_params)); diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 901752655e..9f1f81f937 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -3195,6 +3195,12 @@ sign: return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } + ret = ssl->handshake->calc_verify(ssl, hash, &hashlen); + if (0 != ret) { + MBEDTLS_SSL_DEBUG_RET(1, ("calc_verify"), ret); + return ret; + } + MBEDTLS_PUT_UINT16_BE(selected_sig_alg, ssl->out_msg, 4); /* Info from md_alg will be used instead */ diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 884c8fd4a4..27f199759f 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -3206,7 +3206,7 @@ static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl) { int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; size_t i, sig_len; - unsigned char hash[48]; + unsigned char hash[64]; unsigned char *hash_start = hash; size_t hashlen; mbedtls_pk_sigalg_t pk_alg; diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index 1231e55731..ec066d4102 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -1446,9 +1446,6 @@ static int ssl_tls13_key_schedule_stage_handshake(mbedtls_ssl_context *ssl) /* Compute ECDH shared secret. */ psa_status_t status = PSA_ERROR_GENERIC_ERROR; psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; - mbedtls_svc_key_id_t shared_secret_key = MBEDTLS_SVC_KEY_ID_INIT; - psa_status_t shared_secret_key_destruction_status = - PSA_ERROR_GENERIC_ERROR; status = psa_get_key_attributes(handshake->xxdh_psa_privkey, &key_attributes); @@ -1467,6 +1464,10 @@ static int ssl_tls13_key_schedule_stage_handshake(mbedtls_ssl_context *ssl) #if defined(MBEDTLS_ASYNC_HARDWARE_ECDH) && \ defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) + mbedtls_svc_key_id_t shared_secret_key = MBEDTLS_SVC_KEY_ID_INIT; + psa_status_t shared_secret_key_destruction_status = + PSA_ERROR_GENERIC_ERROR; + if (handshake->xxdh_psa_iop_active == 0) { psa_key_attributes_t secret_attributes = psa_key_attributes_init(); diff --git a/library/x509write_csr.c b/library/x509write_csr.c index 22651032b1..6f3fcc3250 100644 --- a/library/x509write_csr.c +++ b/library/x509write_csr.c @@ -226,7 +226,7 @@ static int x509write_csr_der_internal(mbedtls_x509write_csr *ctx, return MBEDTLS_ERR_X509_INVALID_ALG; } - if ((ret = mbedtls_pk_sign_ext(pk_alg, ctx->key, ctx->md_alg, hash, 0, + if ((ret = mbedtls_pk_sign_ext(pk_alg, ctx->key, ctx->md_alg, hash, hash_len, sig, sig_size, &sig_len)) != 0) { return ret; } diff --git a/tf-psa-crypto b/tf-psa-crypto index 2a327c5e75..886d403744 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 2a327c5e75f1c87d205370fc967732e674a22a69 +Subproject commit 886d403744605f262cd9dfd54f8d8f8beff42c95