coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,704 Commits 183 Branches 286 Tags Multiple Licenses 215 MiB
Commit Graph

7238 Commits

Author SHA1 Message Date
Minos Galanakis
1bf85a8634 mbedtls_config: Cleaned up legacy sections. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-16 08:53:48 +00:00
Minos Galanakis
80e76b66af Moved options to new sections. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-16 08:53:47 +00:00
Minos Galanakis
acd560f887 mbedtls_config: Added new section placeholders. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-16 08:53:47 +00:00
Ronald Cron
51f228cc1b Switch to actual TF-PSA-Crypto build_info.h 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-11 22:32:45 +01:00
Ronald Cron
e11ae17c60 Split check_config.h 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-11 22:32:45 +01:00
Ronald Cron
ce3c2dd30c
Merge pull request #9806 from ronald-cron-arm/finalize-split-preparation-1 
Finalize split preparation-1
 2024-12-05 13:23:09 +00:00
Ronald Cron
6924564970 Move back timing.c to mbedtls 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-04 14:25:02 +01:00
Ronald Cron
18047f0b01 Move config_adjust_legacy_crypto.h to tf-psa-crypto 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-04 14:25:02 +01:00
Ronald Cron
80963c64eb Move hkdf.h to tf-psa-crypto 
Move hkdf.h to tf-psa-crypto as
hkdf.c was.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-04 14:25:02 +01:00
Minos Galanakis
4f619e12e7 Renamed MBEDTLS_PSA_CRYPTO_CONFIG_FILE & MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE 
Files have been renamed respectively to:
- TF_PSA_CRYPTO_CONFIG_FILE
- TF_PSA_CRYPTO_USER_CONFIG_FILE

As per design proposal:
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:57:56 +00:00
Minos Galanakis
1f0d469e1d Cleaned up MbedTLS/tf-psa-crypto configs. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:57:56 +00:00
Minos Galanakis
861b90c257 Migrated General and test configuration options (contd). 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:50:53 +00:00
Minos Galanakis
cb32d084aa crypto_config: Migrated newer configuration options. 
This commit, moves configuration entries that were not present
during the design-review.

It also updates the proposal accordingly.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:50:09 +00:00
Minos Galanakis
f33250fcc1 crypto_config: Migrated MBEDTLS_NULL_CIPHER in legacy-crypto 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:49:55 +00:00
Minos Galanakis
127ffb507c crypto_config: Migrated legacy-crypto selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:49:08 +00:00
Minos Galanakis
a19e07fd14 crypto_config: Migrated crypto-drivers selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:38:02 +00:00
Minos Galanakis
626439ae50 crypto_config: Migrated PSA core selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:29:30 +00:00
Minos Galanakis
14489499e7 crypto_config: Migrated data format selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:29:15 +00:00
Minos Galanakis
45544e0bc3 crypto_config: Migrated cryptographic mechanism selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:29:04 +00:00
Minos Galanakis
2056958eb3 crypto_config: Migrated General and test configuration options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:28:51 +00:00
Minos Galanakis
25ae42e677 crypto_config: Migrated Platform options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:28:23 +00:00
Janos Follath
2761d18c00 Add issue reference for ECP_RESTARTABLE limitations 
Add reference to github issues to give a way for users to track
progress and express interest.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 13:58:15 +00:00
Janos Follath
745e561d2d Move the psa_init() warnings to _CLI and _SRV 
Now that USA_PSA_CRYPTO is always on, users need to call psa_init() with
all protocol versions.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 13:22:34 +00:00
Janos Follath
582ecd0ce1 Remove USE_PSA references from X509 documentation 
MBEDTLS_USE_PSA_CRYPTO is now always enabled we need to update the
documentation accordingly.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 12:53:05 +00:00
Janos Follath
130ece0b6e Remove USE_PSA references from SSL documentation 
MBEDTLS_USE_PSA_CRYPTO is now always enabled we need to update the
documentation accordingly.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 12:53:05 +00:00
Janos Follath
277bba89fb Remove USE_PSA references from config documentation 
MBEDTLS_USE_PSA_CRYPTO is now always enabled we need to update the
documentation accordingly.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 12:52:59 +00:00
Ronald Cron
93ba625b96 Remove MBEDTLS_PSA_CRYPTO_CONFIG configuration option 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-11-21 15:52:06 +01:00
Gilles Peskine
0068fceba3 Note the equivalence of two macros, thanks to RSA-PSK removal 
Removing the now-duplicate internal macro is left for future work.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:12 +01:00
Gilles Peskine
91e7ebebfe Remove RSA_PSK suites from cipher suite lists 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:12 +01:00
Gilles Peskine
b3ec125580 Remove mentions of RSA-PSK key exchange from documentation 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:12 +01:00
Gilles Peskine
712e9a1c3e Remove MBEDTLS_KEY_EXCHANGE_RSA_PSK 
Remove mentions of MBEDTLS_KEY_EXCHANGE_RSA_PSK that were not guarded by the
configuration option MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED. This finishes the
removal of library code that supports the RSA-PSK key exchange in TLS 1.2.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:12 +01:00
Gilles Peskine
ac767e5c69 Remove MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED 
Remove the configuration option MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED and all
code guarded by it. This remove support for the RSA-PSK key exchange in TLS
1.2.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:01 +01:00
Gilles Peskine
9863b04dec Make MBEDTLS_USE_PSA_CRYPTO no longer a selectable option 
The macro MBEDTLS_USE_PSA_CRYPTO is now always defined. It is no longer a
configuration option.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-10-30 14:23:16 +01:00
Gilles Peskine
8ed4d94166
Merge pull request #9614 from gilles-peskine-arm/use_psa_crypto-always_on 
Always enable MBEDTLS_USE_PSA_CRYPTO in all.sh
 2024-10-29 14:58:55 +00:00
Ronald Cron
5f6e69dae5
Merge pull request #9693 from Harry-Ramsey/split-revert-error-development 
Split error.h and move back error.c to mbedtls
 2024-10-25 13:12:58 +00:00
Gilles Peskine
43b4264cd8 Enable MBEDTLS_USE_PSA_CRYPTO by default 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-10-22 22:10:42 +02:00
Valerio Setti
83778d7aa9 Documentation: fix some nits 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
a006b8f6c1 check_config: prevent fully dynamic and static key stores to be enabled simultaneously 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
c2a6e8b3a9 mbedtls_config: fix/improve descriptions of PSA_STATIC_KEY_SLOT symbols 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
933b7693f4 mbedtls_config: fix descriptions for PSA static key slots 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
a7ce589fbc mbedtls_config: move MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE to the correct place 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
678e0fb3e5 psa: allow to use static key buffers instead of dynamic ones 
This helps reducing heap memory usage and, if heap memory is
not used anywhere else in an embedded device, it also reduces
code footprint since there is no need for heap management code
in this case.

A new build symbol is added for this purpose, named
MBEDTLS_PSA_STATIC_KEY_SLOTS. It's disabled by default so that
normal usage of Mbed TLS library is not affected.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Harry Ramsey
90724f7f54 Move error.h from tf-psa-crypto to Mbed TLS 
This commit moves error.h from tf-psa-crypto to Mbed TLS for 4.0
release.

Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
 2024-10-18 08:19:50 +01:00
Harry Ramsey
468c0aede9 Revert move of version.h to tf-psa-crypto libray 
This commit moves version.h back into /include/mbedtls from
tf-psa-crypto/drivers/builtin/include. This commit also changes the
necessary build files and scripts to generate version_features.c

Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
 2024-10-04 13:37:42 +01:00
Ronald Cron
96c6f5eb36
Merge pull request #9492 from eleuzi01/remove-legacy-symbol-definitions 
Remove definitions of legacy symbols
 2024-10-01 10:33:06 +00:00
Elena Uziunaite
9b0bdd0590 Remove MBEDTLS_ECP_HAVE_xxx and MBEDTLS_MD_CAN_xxx 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
7f85f1f958 Cosmetic changes 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
feb105c042 Address review comment 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
05fe6e472e Remove MBEDTLS_MD_CAN_SHA512 from header files 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
3b84b2e28c Remove legacy symbol definitions pt 2 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
c0d6943b7f Replace legacy symbols in config files 
Replace symbols that were left over in config_adjust_*.h and
check_config.h

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
e4669a5753 Remove legacy symbol definitions pt 1 
Remove straightforward definitions that only appear in
config_adjust_legacy_crypto.h

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
David Horstmann
b268d270ed
Merge pull request #9413 from sezrab/split_numeric_string_conversions_oid-development 
Split numeric string conversions out of the OID module
 2024-09-26 12:50:37 +00:00
David Horstmann
bae154d76c
Merge pull request #9385 from eleuzi01/replace-ecdsa-some 
Replace MBEDTLS_PK_HAVE_ECDSA* with PSA_WANT counterparts
 2024-09-19 13:53:18 +00:00
Sam Berry
f8db5b6f72 Move the function declarations to x509.h 
This commit moves the function declarations for
mbedtls_oid_get_numeric_string and mbedtls_oid_from_numeric_string from
oid.h to x509.h.

Signed-off-by: Sam Berry <sam.berry@arm.com>
 2024-09-18 21:23:09 +01:00
David Horstmann
7ba04a298c Bump version to 4.0.0 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2024-09-10 10:43:14 +02:00
Elena Uziunaite
9c6476461f Remove definitions of MBEDTLS_PK_CAN/HAVE_ECDSA* 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-09 11:18:10 +01:00
Elena Uziunaite
bed21b55a6 Replace MBEDTLS_PK_CAN_ECDSA_VERIFY with PSA_HAVE_ALG_ECDSA_VERIFY 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-09 11:18:10 +01:00
Elena Uziunaite
39c7d5dc4b Replace MBEDTLS_PK_CAN_ECDSA_SIGN with PSA_HAVE_ALG_ECDSA_SIGN 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-09 11:18:08 +01:00
Ronald Cron
8c95999b38
Merge pull request #9544 from eleuzi01/replace-224k1 
Replace MBEDTLS_ECP_HAVE_SECP224K1 with PSA_WANT_ECC_SECP_K1_224
 2024-09-06 15:15:35 +00:00
Elena Uziunaite
63cb13e494 Replace MBEDTLS_ECP_HAVE_SECP224K1 with PSA_WANT_ECC_SECP_K1_224 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-05 12:43:14 +01:00
Elena Uziunaite
9fc5be09cb Replace MBEDTLS_MD_CAN_SHA1 with PSA_WANT_ALG_SHA_1 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-04 18:12:59 +01:00
Manuel Pégourié-Gonnard
f3cd97dd2e
Merge pull request #9327 from eleuzi01/issue-9319 
Remove hacks about asm vs constant-flow testing
 2024-09-03 07:37:02 +00:00
Manuel Pégourié-Gonnard
0b0f090b6e Merge remote-tracking branch 'restricted/development-restricted' into dev-mergeback 
* restricted/development-restricted: (30 commits)
  Tiny fix in ChangeLog pt 2
  Tiny fix in ChangeLog
  Changelog entry for the RSA memory leak
  Edit ChangeLog entry
  Update ChangeLog
  Add test cases for extKeyUsage
  Rationalize extKeyUsage tests
  Use P_CLI when O_CLI's status is not reliable
  Rationalize keyUsage testing, round 2
  Always print detailed cert errors in test programs
  Fix 1.3 failure to update flags for (ext)KeyUsage
  Rationalize ssl-opt tests for keyUsage
  Test cert alert KEY_USAGE -> UNSUPPORTED_CERT
  Free allocated memory where methods were returning without freeing
  Force MBEDTLS_PSA_HMAC_DRBG_MD_TYPE based on CTR_DRBG
  Document that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not force HMAC
  Clean up constant-flow memsan testing
  Improve description of who is affected
  More diversified sizes in tests
  Fix stack buffer overflow in ECDSA signature format conversions
  ...
 2024-09-02 09:18:34 +02:00
Gilles Peskine
ab0af45d11
Merge pull request #9464 from gilles-peskine-arm/psa-keystore-dynamic-development 
dynamically sized key store
 2024-08-26 10:47:00 +00:00
Gilles Peskine
0a2b6e2945 Merge remote-tracking branch 'development' into development-restricted 2024-08-23 11:14:11 +02:00
Bence Szépkúti
88f3dd9f78
Merge pull request #9402 from tom-daubney-arm/remove_function_level_alt_interface 
Remove function level alt interface
 2024-08-09 17:59:51 +00:00
Gilles Peskine
9e9e1f60e2 Dynamic key store: new compilation option 
Create a new compilation option for a dynamically resized key store. The
implementation will follow in subsequent commits.

This option is off by default with custom configuration files, which is best
for typical deployments on highly constrained platforms. This option is on
by default with the provided configuration file, which is best for typical
deployments on relatively high-end platforms.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-08-09 15:41:10 +02:00
Minos Galanakis
123a625386 Resolved merge conflicts caused by file moved in #8226 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-08-08 14:11:53 +01:00
Thomas Daubney
a0cdde3588 Remove outdated documentation 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-07 17:07:49 +01:00
Gilles Peskine
2cb03a5532 Improve the documentation of MBEDTLS_PSA_KEY_SLOT_COUNT 
The description was misleading: setting the option doesn't “restrict” the
number of slots, that restriction exists anyway. Setting the option merely
determines the value of the limit.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-08-07 12:39:05 +02:00
Thomas Daubney
28647d8669 Remove MBEDTLS_ECDSA_GENKEY_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
4864424fea Remove MBEDTLS_ECDSA_SIGN_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
e3013da240 Remove MBEDTLS_ECDSA_VERIFY_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
ce5ed8555c Remove MBEDTLS_ECDH_COMPUTE_SHARED_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
51b90fb6b1 Remove MBEDTLS_ECDH_GEN_PUBLIC_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
7c0b4adfa2 Remove MBEDTLS_AES_DECRYPT_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:03 +01:00
Thomas Daubney
6cf05f9322 Remove MBEDTLS_AES_ENCRYPT_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:15:51 +01:00
Thomas Daubney
955ce58142 Remove MBEDTLS_AES_SETKEY_DEC_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:15:08 +01:00
Thomas Daubney
742a2e3619 Remove MBEDTLS_AES_SETKEY_ENC_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:09:16 +01:00
Thomas Daubney
2bcf805284 Remove MBEDTLS_DES3_CRYPT_ECB_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
29561ec658 Remove MBEDTLS_DES_CRYPT_ECB_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
43874e0a84 Remove MBEDTLS_DES_SETKEY_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
3ab1b2d00b Remove MBEDTLS_SHA512_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
297b026d0a Remove MBEDTLS_SHA256_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
2106f79c49 Remove MBEDTLS_SHA1_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
64988680c5 Remove MBEDTLS_RIPEMD160_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
72a88e7255 Remove MBEDTLS_MD5_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Elena Uziunaite
3e81411122 Remove test_valgrind_constant_flow_psa_no_asm 
+ typo fix

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-08-05 15:55:44 +01:00
Elena Uziunaite
969e9e1af0 Alter constant-flow memsan testing 
Disable asm in memsan constant-flow testing and add a check in
check_config.h

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-08-05 15:48:19 +01:00
Elena Uziunaite
83a0d9deec Replace MBEDTLS_SSL_HAVE_GCM with PSA_WANT_ALG_GCM 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-08-02 09:52:20 +01:00
Gilles Peskine
726e57f6f0
Merge pull request #1249 from gilles-peskine-arm/psa-drbg-no-hmac-document 
Document that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not force HMAC
 2024-07-31 16:47:27 +02:00
Elena Uziunaite
6121a344dd Replace MBEDTLS_SSL_HAVE_AES with PSA_WANT_KEY_TYPE_AES 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-07-30 18:42:19 +01:00
Paul Elliott
3962a38fa6
Merge pull request #9287 from Wenxing-hou/fix_some_typo 
Fix some typo for include folder
 2024-07-17 13:11:45 +00:00
Thomas Daubney
75246c0bea Remove irrelevant documentation notes 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:15:32 +01:00
Thomas Daubney
25bcf27c1a Remove MBEDTLS_SHA512_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:15:29 +01:00
Thomas Daubney
b248a93b3d Remove MBEDTLS_MD5_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:15:06 +01:00
Thomas Daubney
efc65e1168 Remove MBEDTLS_CMAC_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:14:43 +01:00
Thomas Daubney
027535c8a5 Remove MBEDTLS_SHA256_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:13:45 +01:00
Thomas Daubney
30c7701a1d Remove MBEDTLS_RIPEMD160_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:13:22 +01:00
Thomas Daubney
2cd12de614 Remove MBEDTLS_SHA1_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:05:07 +01:00
Thomas Daubney
25e2be16db Remove MBEDTLS_NIST_KW_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:55 +01:00
Thomas Daubney
a9ea6f8dd2 Remove MBEDTLS_DES_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:55 +01:00
Thomas Daubney
064f1df98f Remove MBEDTLS_ARIA_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:51 +01:00
Thomas Daubney
e9fe311ea6 Remove MBEDTLS_CAMELLIA_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:34 +01:00
Thomas Daubney
c7cb810c22 Remove MBEDTLS_GCM_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:07 +01:00
Thomas Daubney
b4914cfeb5 Remove MBEDTLS_CCM_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:04 +01:00
Thomas Daubney
4137609776 Remove MBEDTLS_AES_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:13:37 +01:00
Bence Szépkúti
3f2d9b6a4d
Merge pull request #9268 from tom-daubney-arm/remove_symmetric_crypto_alt_interface 
Remove symmetric crypto alt interface
 2024-07-12 13:27:04 +00:00
Wenxing Hou
b4d03cc179 Fix some typo for include folder 
Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
 2024-07-12 15:16:33 +08:00
Elena Uziunaite
4e6a3681e1 Replace MBEDTLS_MD_CAN_SHA256 in md.h, ssl.h, and entropy.h 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-07-11 11:13:35 +03:00
Thomas Daubney
f60ff02cf3 Remove MBEDTLS_CHACHA20_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-11 09:13:28 +01:00
Thomas Daubney
af28a17bb6 Remove MBEDTLS_CHACHAPOLY_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-11 09:13:28 +01:00
Thomas Daubney
f7ca94aea6 Remove MBEDTLS_POLY1305_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-11 09:13:28 +01:00
Thomas Daubney
9da1769237 Remove MBEDTLS_ECP_ALT and associated options 
Also removed are all options of the form
MBEDTLS_ECP_XXX_ALT as well as
MBEDTLS_ECP_NO_FALLBACK.

Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-05 14:35:10 +01:00
Thomas Daubney
e647d8f77a Remove MBEDTLS_ECJPAKE_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-05 14:35:10 +01:00
Thomas Daubney
5edad7f89f Remove MBEDTLS_DHM_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-05 14:35:10 +01:00
Thomas Daubney
f47b66eca5 Remove MBEDTLS_RSA_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-05 14:35:10 +01:00
Elena Uziunaite
cf5e3dd9f0 Replace MBEDTLS_MD_CAN_SHA384 in md.h and ssl.h 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-07-03 10:20:48 +01:00
Gilles Peskine
868d2524b8 Document that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not force HMAC 
MBEDTLS_PSA_HMAC_DRBG_MD_TYPE was documented and announced as causing the
PSA DRBG to be HMAC_DRBG. However, that was never actually implemented:
CTR_DRBG is prioritized if enabled.

Since there is a simple workaround of disabling MBEDTLS_CTR_DRBG_C if you
want to use HMAC_DRBG, we have decided to accept the actual behavior and fix
the documentation.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-07-02 16:31:28 +02:00
Ronald Cron
550a18d4d6 Move Mbed TLS crypto headers 
Move all the header files (roughly the crypto
and platform ones) necessary to build the
crypto library to
tf-psa-crypto/drivers/builtin/include/mbedtls.

Exceptions:
. some configuration related files that will not
be necessary anymore when the work on the
configuration file(s) is completed.
. build_info.h as TF-PSA-Crypto will have its
own when we had its CMake build system.

For the time being all headers are kept public
but eventually all headers in
tf-psa-crypto/drivers/builtin/include/mbedtls
will be private and the ones that remain
public (e.g. lms.h, pk.h probably ...) will be
moved to tf-psa-crypto/include/tf-psa-crypto/.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-07-01 14:59:35 +02:00
Ronald Cron
f0481f562a
Merge pull request #9258 from tom-daubney-arm/drop_padlock_support 
Drop support for VIA Padlock
 2024-06-26 07:36:04 +00:00
Thomas Daubney
4e5d183d78 Correct pluralisation errors in comments 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-06-25 15:21:48 +01:00
Manuel Pégourié-Gonnard
82658eb90c
Merge pull request #9138 from valeriosetti/issue9126 
Do not perform adjustments on legacy crypto from PSA, when MBEDTLS_PSA_CRYPTO_CLIENT && !MBEDTLS_PSA_CRYPTO_C
 2024-06-24 07:30:32 +00:00
Thomas Daubney
0d915a90ea Remove final references to padlock 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-06-20 16:45:51 +01:00
Ronald Cron
de0d7e6cd0
Merge pull request #9247 from ronald-cron-arm/move-psa-headers 
Move PSA headers to a new tf-psa-crypto directory
 2024-06-18 18:48:24 +00:00
Valerio Setti
0c0e418d63 config_psa: do not update legacy symbols in client-only PSA build 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-06-14 16:44:12 +02:00
Thomas Daubney
62af02c063 Drop support for VIA Padlock 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-06-14 10:37:13 +01:00
Ronald Cron
2581d91fda Adapt libraries installation 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-06-13 09:02:30 +02:00
Ronald Cron
d80134b56d Move PSA headers 
Move PSA headers to tf-psa-crypto
directory.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-06-12 15:22:26 +02:00
Sam Berry
3504c88916 Fix incorrect array length in function prototype 
Issue #9179 (MBEDTLS_SSL_CID_OUT_LEN_MAX changed to
MBEDTLS_SSL_CID_IN_LEN_MAX in library\ssl.h and library\ssl_tls.c)

Signed-off-by: Sam Berry <sam.berry@arm.com>
 2024-06-11 14:46:31 +01:00
Tom Cosgrove
98ffc8e7c3
Merge pull request #9178 from valeriosetti/fix-psa-cmac 
adjust_legacy_crypto: enable CIPHER_C when PSA CMAC is builtin
 2024-06-03 15:35:32 +00:00
Valerio Setti
351efa0ece crypto.h: fix documentation for some functions 
Some functions has input parameters which are erroneously
reported as "param[out]" in the documentation. This commit
fixes them.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-06-03 11:17:37 +02:00
Gilles Peskine
c8d45cd3fc Error on unexpectedly defined symbols 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
9df7806b37 Tweak wording 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
690fb5e0b0 Warn if mbedtls_config.h is included manually 
Some projects using Mbed TLS have migrated their configuration
file (config.h -> mbedtls_config.h, or MBEDTLS_CONFIG_FILE) from Mbed TLS
2.x, and kept including check_config.h. This is unnecessary since Mbed TLS
3.0, and increasingly in 3.x it may report spurious errors because the
configuration adjustments have not been done yet.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
0b8ece6beb Error out if *adjust* headers are included manually 
Some projects using Mbed TLS have migrated their configuration
file (config.h -> mbedtls_config.h, or MBEDTLS_CONFIG_FILE) from Mbed TLS
2.x, and kept including check_config.h. This is unnecessary since Mbed TLS
3.0, and increasingly in 3.x it may report spurious errors because the
configuration adjustments have not been done yet. This has led some
projects to include configuration adjustment headers manually, but only
partially or in the wrong order, which can result in silent inconsistencies.
Error out if this happens, with a message mentioning check_config.h since
that's the likely root cause.

```
perl -i -pe '$name = $ARGV; $name =~ s!include/!!; $name =~ s!_adjust_.*!_adjust_*.h!; $_ .= "\n#if !defined(MBEDTLS_CONFIG_FILES_READ)\n#error \"Do not include $name manually! This can lead to problems, \" \\\n    \"up to and including runtime errors such as buffer overflows. \" \\\n    \"If you're trying to fix a complaint from check_config.h, just remove it \" \\\n    \"from your configuration file: since Mbed TLS 3.0, it is included \" \\\n    \"automatically at the right time.\"\n#endif /* !MBEDTLS_CONFIG_FILES_READ */\n" if /^#define .*_H$/' include/*/*adjust*.h
```

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
d33eb55cce Macros to indicate the finalization level of the configuration 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
975e74cb1f Document check-config.h and *adjust*.h as internal headers 
Including *adjust*.h directly is likely to cause them to be applied at the
wrong time, resulting in an invalid or unintended configuration.

Including check_config.h at the wrong time is likely to cause spurious
errors.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Valerio Setti
a37ea269a9 adjust_legacy_crypto: enable CIPHER_C when PSA CMAC is builtin 
psa_crypto_mac.c uses mbedtls_cipher_xxx() functions to perform
CMAC operations. Therefore we need to enable CIPHER_C when
PSA CMAC is builtin.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-05-24 14:37:05 +02:00
Ronald Cron
b48c8704e6 Fix crypto_adjust_config_dependencies.h documentation 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-17 14:34:11 +02:00
Ronald Cron
c4c8bdf32e Fix PBKDF2_AES_CMAC_PRF_128 dependencies 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-17 14:34:06 +02:00
Ronald Cron
97f0ea7611 Fix the resolution of dependencies on HMAC 
The Mbed TLS implementations of ALG_TLS12_PRF,
ALG_TLS12_PSK_TO_MS, ALG_HKDF, ALG_HKDF_EXTRACT,
ALG_HKDF_EXPAND and ALG_PBKDF2 rely on HMAC
operations through the driver interface. Thus
if one of these algorithms is enabled and not
accelerated, we need ALG_HMAC to be enabled
(PSA_WANT_ALG_HMAC and PSA_WANT_KEY_TYPE_HMAC
defined). As HMAC operations occur through
the driver interface, HMAC operations can be
accelerated even if the caller algorithm
is not.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-17 14:33:44 +02:00
Ronald Cron
a33a824d8a Resolve PBKDF2_AES_CMAC_PRF_128 dependencies 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-16 08:12:03 +02:00
Ronald Cron
b0c96f47e7 Resolve some HMAC dependencies automatically 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-16 08:12:03 +02:00
Noah Pendleton
9d1e3f6a00 mbedtls_net_send API description typo fix 
Signed-off-by: Noah Pendleton <noah.pendleton@gmail.com>
 2024-05-03 11:02:22 -04:00
Valerio Setti
89f5af84af adjust_legacy_crypto: enable ASN1_[PARSE|WRITE]_C when RSA_C 
RSA needs ASN1 functions to parse/write private and public keys,
but there is no guards in the code for that. So we need to enable
ASN1 support whenever RSA is enabled.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-04-18 18:47:34 +02:00
Manuel Pégourié-Gonnard
a4b773d3bb
Merge pull request #6955 from inorick/nofa_no_session_tickets 
Guard ticket specific TLS 1.3 function with macro
 2024-04-08 08:56:17 +00:00
Ronald Cron
fe15d90f72 tls13: Fix doc of mbedtls_ssl_session_set() - 2 
Fix documentation of mbedtls_ssl_session_set()
regarding its dependency on MBEDTLS_SSL_SESSION_TICKETS
in TLS 1.3 case.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-04-04 15:52:34 +02:00
Bence Szépkúti
a376f84eb1
Merge pull request #8937 from valeriosetti/issue8712 
Clarify the documentation of mbedtls_pk_setup_opaque
 2024-04-04 13:40:57 +00:00
Ronald Cron
d85eeae740 tls13: Fix doc of mbedtls_ssl_session_set() - 1 
It was eventually decided to not support multiple
tickets in TLS 1.3 ClientHello messages thus
removing the parts in mbedtls_ssl_session_set()
documentation that were anticipating that.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-04-04 15:39:20 +02:00
Ronald Cron
66a206c26c tls13: Fix doc of mbedtls_ssl_session_get() - 2 
Fix documentation of mbedtls_ssl_session_get()
regarding its interaction with session
ticket enablement.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-04-04 15:34:22 +02:00
Ronald Cron
81bb589090 tls13: Fix doc of mbedtls_ssl_session_get() - 1 
The API has eventually not been changed to
return multiple tickets through multiple
subsequent call to it.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-04-04 15:30:55 +02:00
Ronald Cron
9314df617b tls: Fix doc of mbedtls_ssl_session_save() 
Fix documentation of mbedtls_ssl_session_save()
regarding its dependency on MBEDTLS_SSL_SESSION_TICKETS
in TLS 1.3 session case.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-04-04 14:07:50 +02:00
Valerio Setti
1c7f5dea8b pk: fix documentation of mbedtls_pk_setup_opaque() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-04-04 09:39:12 +02:00
Minos Galanakis
078f823843 Merge pull request #8990 from tom-cosgrove-arm:record-size-limit-support-is-now-released 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-03-26 12:32:00 +00:00
Tom Cosgrove
f02c6ef86d Fix typo in psa_key_production_parameters_t doc: 65535 should be 65537 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2024-03-26 12:25:07 +00:00
Tom Cosgrove
1b3b1743f5 Record size limit support is released, so remove warning about only for testing 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
 2024-03-26 12:23:49 +00:00
Valerio Setti
f9f63edbe4 pk: fix typos in description of mbedtls_pk_setup_opaque() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-25 09:38:05 +01:00
Valerio Setti
ac81e23c33 pk: add check_pair info to mbedtls_pk_setup_opaque() documentation 
This also updates use-psa-crypto.md accordingly.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-22 14:36:41 +01:00
Minos Galanakis
4492dbd286 Version Bump for 3.6.0 
./scripts/bump_version.sh --version 3.6.0 --so-crypto 16 --so-x509 7  --so-tls 21

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-03-22 11:46:25 +00:00
Valerio Setti
42a3954cd3 pk: fix description of mbedtls_pk_setup_opaque for sign_ext() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-21 16:55:24 +01:00
Valerio Setti
fc6b22c95c pk: fix indentation in description of mbedtls_pk_setup_opaque() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-21 16:55:24 +01:00
Valerio Setti
80cd479fe0 pk: fix description of mbedtls_pk_setup_opaque() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-21 16:55:24 +01:00
Valerio Setti
18702d980f pk: update documentation of mbedtls_pk_setup_opaque() based on #8951 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-21 16:55:24 +01:00
Valerio Setti
55ed91e0aa pk: fix documentation for mbedtls_pk_setup_opaque() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-21 16:55:24 +01:00
Valerio Setti
622f90597e pk: improve documentation of mbedtls_pk_setup_opaque() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-21 16:55:24 +01:00
Valerio Setti
f5a6e22032 pk: fix documentation for mbedtls_pk_setup_opaque() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-21 16:55:24 +01:00
Minos Galanakis
b70f0fd9a9 Merge branch 'development' into 'development-restricted' 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-03-19 22:24:40 +00:00
Manuel Pégourié-Gonnard
af14b89824
Merge pull request #8932 from ronald-cron-arm/enable-tls13-by-default 
Enable TLS 1.3 by default
 2024-03-19 09:51:49 +00:00
Ronald Cron
27eb68d295 Enable TLS 1.3 by default 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-18 13:06:59 +01:00
Dave Rodgman
5ce1577629
Merge pull request #8928 from Ryan-Everett-arm/update-psa-thread-safety-docs 
Update psa-thread-safety.md to reflect version 3.6 changes
 2024-03-18 12:06:39 +00:00
Paul Elliott
78064ac9e0
Merge pull request #8901 from paul-elliott-arm/make_psa_global_data_safe 
Make PSA global_data thread safe
 2024-03-15 19:50:01 +00:00
Manuel Pégourié-Gonnard
c9db499299
Merge pull request #8930 from ronald-cron-arm/tls13-doc-update 
TLS 1.3: Documentation update for 3.6 release
 2024-03-15 16:41:52 +00:00
Ronald Cron
3996ebc037 Fix documentation about anti-replay defenses 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-15 15:49:11 +01:00
Ronald Cron
933aec86fd Remove experimental warnings related to early data 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-15 14:52:10 +01:00
Bence Szépkúti
567591eec7
Merge pull request #8923 from bensze01/drop-old-compilers 
Drop Support for MSVC 2013, 2015 and Arm Compiler 5
 2024-03-15 12:56:21 +00:00
Bence Szépkúti
e05b54229f Drop reference to Visual Studio 2013 from config 
All supported versions of Visual Studio support AESNI, so drop the
version number.

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2024-03-15 12:19:39 +01:00
Ronald Cron
6bee910dbd
Merge pull request #8858 from waleed-elmelegy-arm/add_alpn_to_session 
Add ALPN information in session tickets
 2024-03-15 09:50:24 +00:00
Ronald Cron
1987a7c068 Document that we do not implement the anti-replay defenses 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-15 10:46:04 +01:00
Gilles Peskine
7b333f1e88
Merge pull request #8913 from ronald-cron-arm/tls13-ticket-lifetime 
TLS 1.3: Enforce ticket maximum lifetime and discard tickets with 0 lifetime
 2024-03-14 15:59:25 +00:00
Ryan Everett
f6f973c235 Document security weakness in concurrent execution of psa_destroy_key 
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
 2024-03-14 15:54:07 +00:00
David Horstmann
4a48becdba Invert and rename config option 
Replace MBEDTLS_PSA_COPY_CALLER_BUFFERS with inverse:
!MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS. This ensures that buffer
protection is enabled by default without any change to the Mbed TLS
config file.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2024-03-14 14:47:48 +00:00
Manuel Pégourié-Gonnard
93071cfeec
Merge pull request #8920 from valeriosetti/issue8919 
Generalize some PK functions from MBEDTLS_PSA_CRYPTO_C to MBEDTLS_PSA_CRYPTO_CLIENT
 2024-03-14 11:32:23 +00:00
Waleed Elmelegy
5bc5263b2c Add code improvments and refactoring in dealing with ALPN 
Signed-off-by: Waleed Elmelegy <waleed.elmelegy@arm.com>
 2024-03-13 16:50:01 +00:00
Waleed Elmelegy
883f77cb08 Add mbedtls_ssl_session_set_alpn() function 
Signed-off-by: Waleed Elmelegy <waleed.elmelegy@arm.com>
 2024-03-13 16:50:01 +00:00
Waleed Elmelegy
2824a209bc Add ALPN information in session tickets 
Signed-off-by: Waleed Elmelegy <waleed.elmelegy@arm.com>
 2024-03-13 16:50:01 +00:00
Ronald Cron
40043d03a5
Merge pull request #8884 from ronald-cron-arm/improve-early-data-status 
TLS 1.3: CLI: Split early data user status and internal state
 2024-03-13 11:59:49 +00:00
Dave Rodgman
60c2f47f98
Merge pull request #8888 from minosgalanakis/features/add_ssl_session_accessor_8529 
[MBEDTLS_PRIVATE] Add accessor for session and ciphersuite_id
 2024-03-13 10:02:15 +00:00
Paul Elliott
4de4cc4a29
Merge pull request #8891 from Ryan-Everett-arm/document-SE_C-not-threadsafe 
Officially document non thread-safety of MBEDTLS_PSA_CRYPTO_SE_C
 2024-03-13 09:42:49 +00:00
Valerio Setti
c4c1d3af34 pk: use CRYPTO_CLIENT as guard for PK-PSA bridge functions instead of CRYPTO_C 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-13 09:52:36 +01:00
Ronald Cron
840de7ff2f tls13: cli: Rename STATUS_NOT_SENT to STATUS_NOT_INDICATED 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-12 17:48:18 +01:00
Ronald Cron
aa3593141b tls13: cli: Move definition of MBEDTLS_SSL_EARLY_DATA_STATE_xyz 
Move definition of MBEDTLS_SSL_EARLY_DATA_STATE_xyz
from ssl.h(public) to ssl_misc.h(private) even if
that means we cannot use the enum type for
early_data_state in ssl.h.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-12 17:48:18 +01:00
Ronald Cron
894df384f4 tls13: cli: Re-order early data states 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-12 17:48:18 +01:00
Ronald Cron
3641df2980 tls13: cli: Rename STATE_SENT to STATE_IND_SENT 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-12 17:48:18 +01:00
Ronald Cron
3c5a68339b tls13: cli: Rename STATE_NOT_SENT to STATE_NO_IND_SENT 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-12 17:48:18 +01:00
Ronald Cron
0c80dc1ed5 tls13: cli: Rename STATUS_NOT_SENT to STATUS_NO_IND_SENT 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-12 17:48:18 +01:00
Ronald Cron
05d7cfbd9c tls13: cli: Rename STATE_UNKNOWN to STATE_IDLE 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-12 17:48:18 +01:00
Ronald Cron
d2884662c1 tls13: cli: Split early data user status and internal state 
Do not use the return values of
mbedtls_ssl_get_early_data_status()
(MBEDTLS_SSL_EARLY_DATA_STATUS_ macros)
for the state of the negotiation and
transfer of early data during the
handshake.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-12 17:48:15 +01:00
Paul Elliott
b8e38e0e27 Add new mutex for PSA global rng data 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2024-03-12 15:36:57 +00:00
Paul Elliott
077fd87748 Add new global mutex for PSA global_data 
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
 2024-03-12 15:36:57 +00:00
David Horstmann
93fa4e1b87 Merge branch 'development' into buffer-sharing-merge 2024-03-12 15:05:06 +00:00
Gilles Peskine
bf69f2e682 New function mbedtls_pk_copy_public_from_psa 
Document and implement mbedtls_pk_copy_public_from_psa() to export the
public key of a PSA key into PK.

Unit-test it alongside mbedtls_pk_copy_from_psa().

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-03-12 15:06:45 +01:00
Manuel Pégourié-Gonnard
d7e7f48323
Merge pull request #8774 from valeriosetti/issue8709 
Implement mbedtls_pk_copy_from_psa
 2024-03-12 13:45:27 +00:00
Manuel Pégourié-Gonnard
fe164aecfc
Merge pull request #8887 from gilles-peskine-arm/pk_import_into_psa-fix_doxygen_code_blocks 
Fix intended code blocks that were not suitably indented
 2024-03-12 11:27:45 +00:00
Dave Rodgman
9cc01ccbf8
Merge pull request #8831 from yanesca/switch_to_new_exp 
Use mpi_core_exp_mod in bignum
 2024-03-11 13:40:46 +00:00
Valerio Setti
3b98c640ce pk: fix documentation for mbedtls_pk_copy_from_psa() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-11 11:34:58 +01:00
Valerio Setti
a657ae388a pk: pk_copy_from_psa() performs the conversion even if the algorithm doesn't match 
This commit also:
- fixes existing tests and add new ones
- updates documentation.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-11 11:34:58 +01:00
Valerio Setti
8fb0fe8e12 pk: fixed documentation of mbedtls_pk_copy_from_psa() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-11 11:34:58 +01:00
Valerio Setti
01ba66d56e pk: replace CRYPTO_CLIENT guards with CRYPTO_C 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-11 09:48:40 +01:00
Valerio Setti
070d95e958 pk: add mbedtls_pk_copy_from_psa() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-03-11 09:47:27 +01:00
Manuel Pégourié-Gonnard
af3e574f5f
Merge pull request #8862 from valeriosetti/issue8825 
Improve support of mbedtls_psa_get_random in client-only builds
 2024-03-10 20:06:27 +00:00
Jerry Yu
ce79488dd5 tls13: srv: Fail connection if ticket lifetime exceed 7 days 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-10 17:42:43 +01:00
Ronald Cron
7e1f9f290f
Merge pull request #8854 from ronald-cron-arm/tls13-srv-max-early-data-size 
TLS 1.3: Enforce max_early_data_size on server
 2024-03-09 00:16:07 +00:00
Ronald Cron
0050dff6ab ssl_ticket.h: Fix note in API documentation 
Since the merge of #8574 it is not the case
anymore that the lifetime of keys is twice
the lifetime of tickets.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-08 16:30:26 +01:00
Ryan Everett
32a6458880 Add a warning to the definition of MBEDTLS_PSA_CRYPTO_SE_C 
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
 2024-03-05 18:16:18 +00:00
Gilles Peskine
71cc260563
Merge pull request #8728 from minosgalanakis/features/add_mbedtls_x509_crt_get_ca_istrue_accesor_6151 
[MBEDTLS_PRIVATE] Add mbedtls_x509_crt_get_ca_istrue() accesor
 2024-03-05 18:04:06 +00:00
Dave Rodgman
3c4166aef3
Merge pull request #8863 from minosgalanakis/feature/add_ecdh_context_5016 
[MBEDTLS_PRIVATE] Add a getter for the ECDH context->grp.id member.
 2024-03-05 16:58:13 +00:00
Minos Galanakis
87b4f6d86c x509: Reworded documentation bits. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-03-05 11:05:51 +00:00
Gilles Peskine
8462146d01
Merge pull request #8867 from gilles-peskine-arm/psa_key_attributes-remove_core 
Merge psa_core_key_attributes_t back into psa_key_attributes_t
 2024-03-05 09:59:24 +00:00
Gilles Peskine
ddbe4ae901 Fix intended code blocks that were not suitably indented 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-03-04 18:30:09 +01:00
Minos Galanakis
40d4708f17 ssl: Added session getter for ciphersuite_id. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-03-04 15:57:41 +00:00
Minos Galanakis
358b448d72 ssl_ciphersuite: Added getter methods for ciphersuite id. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-03-04 15:57:41 +00:00
Minos Galanakis
2c8c364ac2 ssl: Added getter methods for session id and len. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-03-04 15:20:28 +00:00
Gilles Peskine
fad79fcdd9 Merge remote-tracking branch 'development' into ecp-write-ext-3.6 
Conflicts:
* library/pk.c: mbedtls_pk_wrap_as_opaque() changed in the feature branch
  and was removed in the target branch.
 2024-03-04 08:52:08 +01:00
Minos Galanakis
2abbac74dc x509: Added mbedtls_x509_crt_get_ca_istrue() API accessor. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-03-04 02:22:01 +00:00
Manuel Pégourié-Gonnard
e33b349c90
Merge pull request #8864 from valeriosetti/issue8848 
Deprecate or remove mbedtls_pk_wrap_as_opaque
 2024-03-01 15:54:32 +00:00
Ronald Cron
19bfe0a631 tls13: Rename early_data_count to total_early_data_size 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-01 09:29:16 +01:00
Ronald Cron
26a9811027 ssl: Add early_data_count field 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-03-01 09:03:51 +01:00
Valerio Setti
1a58e9a232 psa_util: change guard for mbedtls_psa_get_random() to CRYPTO_CLIENT 
This commit also:
- updates changelog
- add a stub function to be used in component_test_psa_crypto_client()
  test

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-02-29 16:14:29 +01:00
Ronald Cron
9b4e964c2c
Merge pull request #8760 from ronald-cron-arm/tls13-write-early-data 
TLS 1.3: Add mbedtls_ssl_write_early_data() API
 2024-02-29 14:31:55 +00:00
Minos Galanakis
d753738fc0 echd: Added mbedtls_ecdh_get_grp_id getter. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-02-29 13:31:34 +00:00
Gilles Peskine
b395e74edd mbedtls_ecp_write_key_ext(): make key const 
Having a non-const `key` parameter was anotherf defect of
mbedtls_ecp_write_key(). Take this opportunity to fix it.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 14:18:28 +01:00
Gilles Peskine
04ae479b04 mbedtls_ecp_write_key_ext: document error for no private key set 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 13:19:42 +01:00
Gilles Peskine
c0f7a8680f mbedtls_ecp_write_key(): deprecate the old function 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 13:19:42 +01:00
Gilles Peskine
acdc52e154 mbedtls_ecp_write_key_ext(): recommend over the old function in documentation 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 13:19:42 +01:00
Gilles Peskine
e3fb4ccabf mbedtls_ecp_write_key_ext(): new function 
Same as mbedtls_ecp_write_key(), but doesn't require the caller to figure out
the length of the output and possibly distinguish between Weierstrass and
Montgomery curves.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 13:19:42 +01:00
Manuel Pégourié-Gonnard
7f523bf9eb
Merge pull request #8845 from gilles-peskine-arm/ecp-write-doc-3.6 
Document ECP write functions
 2024-02-28 11:04:38 +00:00
Gilles Peskine
0eb4e7fb40 Fix code style 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 10:56:14 +01:00
Gilles Peskine
e92796ef98 Get rid of flags in attributes 
The `flags` field in `psa_key_attributes_t` was a general mechanism that
only ever got used for a single flag: to indicate that the `slot_number`
field has been set. We have switched to a dedicated indicator for that, so
we can now remove `flags`.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 01:56:16 +01:00
Gilles Peskine
972539c241 In attributes, keep track of slot number through a dedicated field 
In `psa_key_attributes_t`, keep track of whether `slot_number` has been set
through a dedicated field, rather than using a flag.

This paves the way to removing `flags`, which is not used for anything else.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 01:49:45 +01:00
Gilles Peskine
2dc2bd7097 Get rid of psa_core_key_attributes_t 
The `psa_core_key_attributes_t` structure is no longer used. Remove it.

Switch `psa_key_attributes_t` back to a simple struct, now containing
the fields that were formerly inside its `psa_core_key_attributes_t core`
member. This repairs the build with non-C11 compilers.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 01:33:49 +01:00
Gilles Peskine
2f107ae000 Don't access psa_key_attributes_t.core 
Access the fields of `psa_key_attributes_t` directly rather than through the
`core` field. This makes the `core` field obsolete.

This commit is fully automated:
```
git ls-files '*.h' '*.c' '*.function' '*.jinja' | xargs perl -l -i -pe '$core = qr/\b(core\b|MBEDTLS_PRIVATE\(core\))/; s/->$core\./->/g; s/&(\w+)\.$core\./&$1./g; s/(\w+)\.$core/$1/g'
```

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 01:30:24 +01:00
Gilles Peskine
7fad3ef3b5 Switch key slots to psa_key_attributes_t 
Switch `psa_key_slot_t` to the full `psa_key_attributes_t`, now that this
structure only has psa_core_key_attributes_t`.

To minimize the diff without breaking the build much, temporarily make
`psa_key_attributes_t` contain either the `core` field or all the fields.
This allows both things like `slot->attr.core.type` and `slot->attr.type`
to exist. The build breaks with compilers that don't support anonymous
unions and structs, which are only standard C since C11.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 01:30:24 +01:00
Gilles Peskine
0f40a41cea psa_key_attributes_t: move slot_number to core structure 
Move the `slot_number` field of `psa_key_attributes_t` to
`psa_core_key_attributes_t`. This makes ``psa_core_key_attributes_t` core`
the sole field of `psa_key_attributes_t`. This paves the way to unifying
the two structures.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-28 01:29:43 +01:00
Valerio Setti
88ae0ef286 pk: completely remove mbedtls_pk_wrap_as_opaque 
Remove instead of deprecating it.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-02-27 13:49:42 +01:00
Manuel Pégourié-Gonnard
5b5faf0898
Merge pull request #8844 from davidhorstmann-arm/restore-x509-functions-to-public 
Restore some X509 functions to public headers
 2024-02-27 10:55:16 +00:00
Valerio Setti
4c6cea549c pk: deprecate mbedtls_pk_wrap_as_opaque() 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-02-27 10:51:03 +01:00
Gilles Peskine
97c0b2f393 Remove domain parameters from psa_key_attributes_t 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-02-26 16:57:30 +01:00
David Horstmann
ef950ccb1d Un-unrestore mbedtls_x509_string_to_names() 
Re-restore mbedtls_x509_string_to_names() to public as our example
programs use it, and it is the reverse of mbedtls_x509_dn_gets().

Add a docstring, so that it is a properly documented public function.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2024-02-26 13:59:43 +00:00