The goal is to catch possible bugs where we would compute the output
length based on the bitlength of the shared secret MPI. So, what matters
is the most significant byte, even for Montgomery curves where the
all values are written out little endian.
The values were generated by the following sage script. The script could
be a bit more compact by using E.random_point() instead of the
conventional base point G as the peer's key, but I prefered making the
script deterministic so its output can easily be checked.
p256 = {
"name": "p256",
"p": 2^224 * (2^32 - 1) + 2^192 + 2^96 - 1,
"a": -3,
"b": 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b,
"gx": 0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296,
"gy": 0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5,
}
p521 = {
"name": "p521",
"p": 2^521 - 1,
"a": -3,
"b": 0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00,
"gx": 0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66,
"gy": 0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650,
}
x255 = {
"name": "x25519",
"p": 2^255 - 19,
"a": 486662,
"gx": 9,
"gy": 14781619447589544791020593568409986887264606134616475288964881837755586237401,
}
x448 = {
"name": "x448",
"p": 2^448 - 2^224 - 1,
"a": 156326,
"gx": 5,
"gy": 355293926785568175264127502063783334808976399387714271831880898435169088786967410002932673765864550910142774147268105838985595290606362,
}
def byte_len(i):
return (i.bit_length() + 7) // 8
def leading0(name, p, gx, gy, a, b=None):
is_montgomery = b is None
if is_montgomery:
E = EllipticCurve(GF(p), [0, a, 0, 1, 0])
increment = 8 # x22519 scalars have the low 3 bits unset
else:
E = EllipticCurve(GF(p), [a, b])
increment = 1
G = E(gx, gy)
s = 2^(p.bit_length() - 1) # x25519 scalars have bit 254 set
Z = G * s
while byte_len(Z.x().lift()) >= byte_len(p):
s += increment
Z += increment * G
print(name)
if is_montgomery:
nbytes = byte_len(p)
print(f"s: {s.to_bytes(nbytes, "little").hex()}")
print(f"G: {G.x().lift().to_bytes(nbytes, "little").hex()}")
print(f"Z: {Z.x().lift().to_bytes(nbytes, "little").hex()}")
else:
nibbles = byte_len(p) * 2
print(f"s: {s:0{nibbles}x}")
print(f"G: 04{G.x().lift():0{nibbles}x}{G.y().lift():0{nibbles}x}")
print(f"Z: {Z.x().lift():0{nibbles}x}")
leading0(**p256)
leading0(**p521)
leading0(**x255)
leading0(**x448)
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
commit 4ac4008fa0 ("Access
ssl->hostname through abstractions in certificate verification").
Due to this an unused function warning can occur if neither SNI nor
handshake is enabled.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
Move a bunch of files from `scripts` and `mbedtls/scripts` to the framework.
Most are not called from any scripts invoked by the CI, but a couple are.
A subsequent commit will adapt the scripts. None of these scripts are
referenced from other repositories except in documentation.
The following files will be removed, and added to `mbedtls-framework`:
* `scripts/ecp_comb_table.py`
* `scripts/massif_max.pl`
* `tests/scripts/audit-validity-dates.py` (moved to `scripts/`)
* `tests/scripts/gen_ctr_drbg.pl` (moved to `scripts/`)
* `tests/scripts/gen_gcm_decrypt.pl` (moved to `scripts/`)
* `tests/scripts/gen_gcm_encrypt.pl` (moved to `scripts/`)
* `tests/scripts/gen_pkcs1_v21_sign_verify.pl` (moved to `scripts/`)
* `tests/scripts/generate-afl-tests.sh` (moved to `scripts/`)
* `tests/scripts/generate_server9_bad_saltlen.py` (moved to `scripts/`)
* `tests/scripts/run-metatests.sh` (moved to `scripts/`)
* `tests/scripts/run_demos.py` (moved to `scripts/`)
* `tests/scripts/test_config_script.py` (moved to `scripts/`)
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
For each received ClientHello fragment, check
that its epoch is zero and update the
record-level sequence number.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
In DTLS reassembly tests, the server may receive a close_notify alert at the
end of a test. In this case, the Mbed TLS server logs an error, so these tests
should not check for the absence of the string "error" in the server logs.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
