From aacb344f31df28f0a2431edc33d138dbb5335fa2 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 16 Mar 2026 15:21:02 +0000 Subject: [PATCH 1/3] Add parentheses to unsafe macros Signed-off-by: Ben Taylor This is a manual backport, not a direct cherry-pick, because the 3.6 branch uses different file paths and keeps a direct PSA_ALG_JPAKE comparison in the PAKE size macros. (cherry picked from commit ebda5da117af7e57bad47bc3337e364365a8f357) --- include/psa/crypto_extra.h | 24 +++++++++---------- include/psa/crypto_values.h | 2 +- library/ecp_curves.c | 4 ++-- library/pk_internal.h | 2 +- library/sha3.c | 2 +- tests/suites/test_suite_psa_crypto.function | 7 ++++++ .../test_suite_psa_crypto_pake.function | 7 ++++++ 7 files changed, 31 insertions(+), 17 deletions(-) diff --git a/include/psa/crypto_extra.h b/include/psa/crypto_extra.h index 03566305d7..9f0438357e 100644 --- a/include/psa/crypto_extra.h +++ b/include/psa/crypto_extra.h @@ -1090,10 +1090,10 @@ typedef uint32_t psa_pake_primitive_t; * Return 0 if the requested primitive can't be encoded as * ::psa_pake_primitive_t. */ -#define PSA_PAKE_PRIMITIVE(pake_type, pake_family, pake_bits) \ - ((pake_bits & 0xFFFF) != pake_bits) ? 0 : \ - ((psa_pake_primitive_t) (((pake_type) << 24 | \ - (pake_family) << 16) | (pake_bits))) +#define PSA_PAKE_PRIMITIVE(pake_type, pake_family, pake_bits) \ + ((((pake_bits) & 0xFFFF) != (pake_bits)) ? 0 : \ + ((psa_pake_primitive_t) ((((pake_type) << 24) | \ + ((pake_family) << 16)) | (pake_bits)))) /** The key share being sent to or received from the peer. * @@ -1170,12 +1170,12 @@ typedef uint32_t psa_pake_primitive_t; * return 0. */ #define PSA_PAKE_OUTPUT_SIZE(alg, primitive, output_step) \ - (alg == PSA_ALG_JPAKE && \ - primitive == PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, \ + ((alg) == PSA_ALG_JPAKE && \ + (primitive) == PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, \ PSA_ECC_FAMILY_SECP_R1, 256) ? \ ( \ - output_step == PSA_PAKE_STEP_KEY_SHARE ? 65 : \ - output_step == PSA_PAKE_STEP_ZK_PUBLIC ? 65 : \ + (output_step) == PSA_PAKE_STEP_KEY_SHARE ? 65 : \ + (output_step) == PSA_PAKE_STEP_ZK_PUBLIC ? 65 : \ 32 \ ) : \ 0) @@ -1200,12 +1200,12 @@ typedef uint32_t psa_pake_primitive_t; * the parameters are incompatible, return 0. */ #define PSA_PAKE_INPUT_SIZE(alg, primitive, input_step) \ - (alg == PSA_ALG_JPAKE && \ - primitive == PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, \ + ((alg) == PSA_ALG_JPAKE && \ + (primitive) == PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, \ PSA_ECC_FAMILY_SECP_R1, 256) ? \ ( \ - input_step == PSA_PAKE_STEP_KEY_SHARE ? 65 : \ - input_step == PSA_PAKE_STEP_ZK_PUBLIC ? 65 : \ + (input_step) == PSA_PAKE_STEP_KEY_SHARE ? 65 : \ + (input_step) == PSA_PAKE_STEP_ZK_PUBLIC ? 65 : \ 32 \ ) : \ 0) diff --git a/include/psa/crypto_values.h b/include/psa/crypto_values.h index 5e49e0d70e..e7155e5f03 100644 --- a/include/psa/crypto_values.h +++ b/include/psa/crypto_values.h @@ -590,7 +590,7 @@ 0)) /** Check if the curve of given family is Weierstrass elliptic curve. */ -#define PSA_ECC_FAMILY_IS_WEIERSTRASS(family) ((family & 0xc0) == 0) +#define PSA_ECC_FAMILY_IS_WEIERSTRASS(family) (((family) & 0xc0) == 0) /** SEC Koblitz curves over prime fields. * diff --git a/library/ecp_curves.c b/library/ecp_curves.c index 7e219954e0..20581f1f8b 100644 --- a/library/ecp_curves.c +++ b/library/ecp_curves.c @@ -5012,14 +5012,14 @@ int mbedtls_ecp_mod_p192_raw(mbedtls_mpi_uint *Np, size_t Nn) #if defined(MBEDTLS_HAVE_INT32) /* 32 bit */ -#define MAX32 X_limbs +#define MAX32 (X_limbs) #define A(j) X[j] #define STORE32 X[i] = (mbedtls_mpi_uint) cur; #define STORE0 X[i] = 0; #else /* 64 bit */ -#define MAX32 X_limbs * 2 +#define MAX32 ((X_limbs) * 2) #define A(j) \ (j) % 2 ? \ (uint32_t) (X[(j) / 2] >> 32) : \ diff --git a/library/pk_internal.h b/library/pk_internal.h index d1c26421d4..a57b5545bf 100644 --- a/library/pk_internal.h +++ b/library/pk_internal.h @@ -153,7 +153,7 @@ static inline mbedtls_ecp_group_id mbedtls_pk_get_ec_group_id(const mbedtls_pk_c #endif /* MBEDTLS_ECP_HAVE_CURVE25519 || MBEDTLS_ECP_DP_CURVE448 */ #define MBEDTLS_PK_IS_RFC8410_GROUP_ID(id) \ - ((id == MBEDTLS_ECP_DP_CURVE25519) || (id == MBEDTLS_ECP_DP_CURVE448)) + (((id) == MBEDTLS_ECP_DP_CURVE25519) || ((id) == MBEDTLS_ECP_DP_CURVE448)) static inline int mbedtls_pk_is_rfc8410(const mbedtls_pk_context *pk) { diff --git a/library/sha3.c b/library/sha3.c index 57385595f5..a34e742fef 100644 --- a/library/sha3.c +++ b/library/sha3.c @@ -72,7 +72,7 @@ * YMMV. */ /* Helper macro to set the values of the higher bits in unused low positions */ -#define H(b63, b31, b15) (b63 << 6 | b31 << 5 | b15 << 4) +#define H(b63, b31, b15) (((b63) << 6) | ((b31) << 5) | ((b15) << 4)) static const uint8_t iota_r_packed[24] = { H(0, 0, 0) | 0x01, H(0, 0, 1) | 0x82, H(1, 0, 1) | 0x8a, H(1, 1, 1) | 0x00, H(0, 0, 1) | 0x8b, H(0, 1, 0) | 0x01, H(1, 1, 1) | 0x81, H(1, 0, 1) | 0x09, diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index 22c3c5f827..1685450c8b 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -11173,6 +11173,7 @@ void ecjpake_size_macros() { const psa_algorithm_t alg = PSA_ALG_JPAKE; const size_t bits = 256; + const psa_pake_primitive_t invalid_primitive = 1; const psa_pake_primitive_t prim = PSA_PAKE_PRIMITIVE( PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, bits); const psa_key_type_t key_type = PSA_KEY_TYPE_ECC_KEY_PAIR( @@ -11209,5 +11210,11 @@ void ecjpake_size_macros() PSA_PAKE_INPUT_MAX_SIZE); TEST_LE_U(PSA_PAKE_INPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PROOF), PSA_PAKE_INPUT_MAX_SIZE); + + /* Invalid primitives must not match the supported J-PAKE suite. */ + TEST_EQUAL(PSA_PAKE_OUTPUT_SIZE(alg, invalid_primitive, + PSA_PAKE_STEP_KEY_SHARE), 0); + TEST_EQUAL(PSA_PAKE_INPUT_SIZE(alg, invalid_primitive, + PSA_PAKE_STEP_KEY_SHARE), 0); } /* END_CASE */ diff --git a/tests/suites/test_suite_psa_crypto_pake.function b/tests/suites/test_suite_psa_crypto_pake.function index 303ef0deaf..905df8ebc7 100644 --- a/tests/suites/test_suite_psa_crypto_pake.function +++ b/tests/suites/test_suite_psa_crypto_pake.function @@ -937,6 +937,7 @@ void ecjpake_size_macros() { const psa_algorithm_t alg = PSA_ALG_JPAKE; const size_t bits = 256; + const psa_pake_primitive_t invalid_primitive = 1; const psa_pake_primitive_t prim = PSA_PAKE_PRIMITIVE( PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, bits); const psa_key_type_t key_type = PSA_KEY_TYPE_ECC_KEY_PAIR( @@ -973,6 +974,12 @@ void ecjpake_size_macros() PSA_PAKE_INPUT_MAX_SIZE); TEST_LE_U(PSA_PAKE_INPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PROOF), PSA_PAKE_INPUT_MAX_SIZE); + + /* Invalid primitives must not match the supported J-PAKE suite. */ + TEST_EQUAL(PSA_PAKE_OUTPUT_SIZE(alg, invalid_primitive, + PSA_PAKE_STEP_KEY_SHARE), 0); + TEST_EQUAL(PSA_PAKE_INPUT_SIZE(alg, invalid_primitive, + PSA_PAKE_STEP_KEY_SHARE), 0); } /* END_CASE */ From d76aeff750f0f705e393989a574e7b6d66ade64a Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Tue, 17 Mar 2026 08:30:48 +0000 Subject: [PATCH 2/3] Remove surplus parentheses Signed-off-by: Ben Taylor This is a manual backport, not a direct cherry-pick, because the 3.6 PAKE macros retain a direct PSA_ALG_JPAKE comparison where the source branch adjusted a PSA_ALG_IS_JPAKE call. (cherry picked from commit 733ed07f29144ee9b99165e36eaf9b9b69317834) --- library/ecp_curves.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/ecp_curves.c b/library/ecp_curves.c index 20581f1f8b..3c38f3a305 100644 --- a/library/ecp_curves.c +++ b/library/ecp_curves.c @@ -5019,7 +5019,7 @@ int mbedtls_ecp_mod_p192_raw(mbedtls_mpi_uint *Np, size_t Nn) #else /* 64 bit */ -#define MAX32 ((X_limbs) * 2) +#define MAX32 (X_limbs * 2) #define A(j) \ (j) % 2 ? \ (uint32_t) (X[(j) / 2] >> 32) : \ From 191b8cb03a58121bd8807948262bb5bc5fb363e3 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Tue, 17 Mar 2026 08:34:15 +0000 Subject: [PATCH 3/3] Correct code style Signed-off-by: Ben Taylor (cherry picked from commit ef8c07b36af416958079e8f783e14c5330a27791) --- include/psa/crypto_extra.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/psa/crypto_extra.h b/include/psa/crypto_extra.h index 9f0438357e..8b7274ec0c 100644 --- a/include/psa/crypto_extra.h +++ b/include/psa/crypto_extra.h @@ -1172,7 +1172,7 @@ typedef uint32_t psa_pake_primitive_t; #define PSA_PAKE_OUTPUT_SIZE(alg, primitive, output_step) \ ((alg) == PSA_ALG_JPAKE && \ (primitive) == PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, \ - PSA_ECC_FAMILY_SECP_R1, 256) ? \ + PSA_ECC_FAMILY_SECP_R1, 256) ? \ ( \ (output_step) == PSA_PAKE_STEP_KEY_SHARE ? 65 : \ (output_step) == PSA_PAKE_STEP_ZK_PUBLIC ? 65 : \ @@ -1202,7 +1202,7 @@ typedef uint32_t psa_pake_primitive_t; #define PSA_PAKE_INPUT_SIZE(alg, primitive, input_step) \ ((alg) == PSA_ALG_JPAKE && \ (primitive) == PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, \ - PSA_ECC_FAMILY_SECP_R1, 256) ? \ + PSA_ECC_FAMILY_SECP_R1, 256) ? \ ( \ (input_step) == PSA_PAKE_STEP_KEY_SHARE ? 65 : \ (input_step) == PSA_PAKE_STEP_ZK_PUBLIC ? 65 : \