coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

ssl: size _pms_ecdh against PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE

Browse Source 
In PSA-client-only builds (MBEDTLS_PSA_CRYPTO_C disabled, e.g. NS-side
mbedtls dispatching to a secure PSA service like TF-M), the local
ECP_LIGHT cascade does not run and MBEDTLS_ECP_MAX_BYTES collapses to 1.
The `_pms_ecdh` and `_pms_ecdhe_psk` members of `union
mbedtls_ssl_premaster_secret` then declare 1-byte arrays. In builds
where only ECDHE-RSA / ECDHE-ECDSA is enabled (no PSK, no ECJPAKE), the
whole union ends up that small, and psa_raw_key_agreement() returns
PSA_ERROR_BUFFER_TOO_SMALL during the TLS 1.2 ECDHE handshake. The
handshake aborts as MBEDTLS_ERR_SSL_HW_ACCEL_FAILED with no path to
success in this configuration.

Introduce MBEDTLS_SSL_PMS_ECDH_SIZE as
max(PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE, MBEDTLS_ECP_MAX_BYTES) so
both legacy ECP and PSA-client builds get a sufficient buffer.
PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE is always defined, sized by the
enabled PSA_WANT_ECC_* curves.

Signed-off-by: Paulo Santos <paulo.santos-ext@hexagon.com>
This commit is contained in:
Paulo Santos 2026-05-20 14:39:00 -03:00
parent 701132e5b3
commit cf6d40a92d
No known key found for this signature in database
2 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog.d/fix-pms-ecdh-psa-client-size.txt Normal file
View File

@ -0,0 +1,8 @@
Bugfix
* Fix TLS 1.2 ECDHE handshakes failing in PSA-client-only
builds (MBEDTLS_PSA_CRYPTO_C disabled) where
MBEDTLS_ECP_MAX_BYTES collapses to 1 and the
premaster-secret union sized below
PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE caused
psa_raw_key_agreement() to return PSA_ERROR_BUFFER_TOO_SMALL.
Fixes #10757.

18
include/mbedtls/ssl.h
View File

@ -648,18 +648,32 @@
#endif
#endif /* !MBEDTLS_PSK_MAX_LEN */
/**
* In PSA-client-only builds (MBEDTLS_PSA_CRYPTO_C off, e.g. NS-side
* mbedtls dispatching to a secure PSA service like TF-M) the local
* ECP_LIGHT cascade does not run and MBEDTLS_ECP_MAX_BYTES collapses
* to 1. Take the larger of that and PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE,
* which is sized by the enabled PSA_WANT_ECC_* curves and is always
* defined, so psa_raw_key_agreement() has a real output buffer to
* write the ECDH shared secret into.
*/
#define MBEDTLS_SSL_PMS_ECDH_SIZE \
(PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE > MBEDTLS_ECP_MAX_BYTES \
? PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE \
: MBEDTLS_ECP_MAX_BYTES)
/* Dummy type used only for its size */
union mbedtls_ssl_premaster_secret {
unsigned char dummy; /* Make the union non-empty even with SSL disabled */
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
unsigned char _pms_ecdh[MBEDTLS_ECP_MAX_BYTES]; /* RFC 4492 5.10 */
unsigned char _pms_ecdh[MBEDTLS_SSL_PMS_ECDH_SIZE]; /* RFC 4492 5.10 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
unsigned char _pms_psk[4 + 2 * MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 2 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
unsigned char _pms_ecdhe_psk[4 + MBEDTLS_ECP_MAX_BYTES
unsigned char _pms_ecdhe_psk[4 + MBEDTLS_SSL_PMS_ECDH_SIZE
+ MBEDTLS_PSK_MAX_LEN]; /* RFC 5489 2 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)