mbedtls_sha256_update() tracks the running byte count in a 64-bit
counter split across ctx->total[0]/[1] (32 bits each), used at
finalization to encode the message length into the padding.
ctx->total[0] += (uint32_t) ilen truncates ilen to its low 32 bits
before adding, and the overflow check right after (ctx->total[0] <
(uint32_t) ilen) only detects the single wraparound of that 32-bit
addition. Neither step ever looks at bits 32 and up of ilen itself.
So when a single update() call is passed >= 2^32 bytes on a 64-bit
platform (size_t wider than 32 bits), every byte is correctly hashed
into the message, but the length folded into the final padding block
is wrong by a multiple of 2^32 bytes, producing an incorrect digest
despite no error being returned.
Fold ilen>>32 into total[1] directly, guarded on SIZE_MAX so 32-bit
platforms (where ilen cannot exceed 2^32-1 and the shift would be
UB-adjacent) are unaffected.
Verified live: generated a 4GiB+64 byte random file, hashed it with
mbedtls_sha256_update() in a single call both before and after this
fix, and compared against sha256sum of the same file.
- before: 803ab176fbafaf3cf345cbe22e2a35715c3ae8f7fbf241a00677d4d733db0214 (wrong)
- after: 21a1f671cd9797227f341a243fed82c8fe95a769a58a6f3965e958f047e969d6 (matches sha256sum)
Also re-verified normal-sized inputs (empty string, "abc") against
known SHA-256 vectors, and that a two-call split of a 100-byte input
still agrees with a single whole-buffer call.
Fixes#10964.
Signed-off-by: Johnson Ajibi <ajibijohnson@gmail.com>
Backport the final approved implementation from Mbed-TLS/TF-PSA-Crypto#843
to mbedtls-3.6.
Enable the existing Linux getrandom syscall path when sys/syscall.h
is available and defines SYS_getrandom. Preserve the existing
glibc/Midipix detection and runtime ENOSYS fallback.
Apply the platform change to library/entropy_poll.c in this branch.
Signed-off-by: Ning Xia <hi@nosec.me>
Change the documentation of mbedtls_sha3_finish() and mbedtls_sha3()
to state that olen must be at least the digest size (28, 32, 48, or 64
for SHA3-224/256/384/512) rather than must equal it.
The implementation accepts olen larger than the digest size — it
silently writes the digest and ignores the excess. The previous docs
incorrectly suggested that olen larger than the digest size would be
an error.
Fixes#10844
Signed-off-by: AaryanCdry <AaryanCdry@users.noreply.github.com>
Make SSL test helper code potentially available to sample programs. This is
notably useful for `ssl_client2` and `ssl_server2`, which may reasonably use
some test helper code even in the default configuration.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
In terms of CMake, we want it to be part of the mbedtls_test_helpers
object collection, which as the name does not suggest, is actually for
SSL, and not part of mbedtls_test which is generic.
The easiest way to achieve that is to move the source file to
test_helpers which again as the name does not reflect is for SSL.
Then we just need ssl_server2 and ssl_client2 to link to
mbedtls_test_helpers.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
Call mbedtls_test_ssl_check_context_after_session_reset both in programs
(ssl_client2 and ssl_server2) and tests to ensure that the SSL context
has been properly handled when mbedtls_ssl_session_reset was called.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Ideally the implementation shouldn't be checked in git, but for the time
being there is no support in building source code for tests from the
binary folder, so it's accepted as a temporary solution.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Togethere with the framework counterpart ('ssl_session_reset_check.py')
this script is used to automatically generate the function
'mbedtls_test_ssl_check_context_after_session_reset()'.
The goal of this function is to verify that 'mbedtls_ssl_session_reset()'
properly handled (reset or keep) all the fields of the
'mbedtls_ssl_context' structure.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Move functions in "ssl_helpers.h" that depend on internal headers to
"ssl_helpers_internal.h". This allows to include "ssl_helpers.h" also
in programs (which do not have access to internal headers).
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
This is a manual backport, not a direct cherry-pick, because the 3.6 PAKE macros retain a direct PSA_ALG_JPAKE comparison where the source branch adjusted a PSA_ALG_IS_JPAKE call.
(cherry picked from commit 733ed07f29144ee9b99165e36eaf9b9b69317834)
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
This is a manual backport, not a direct cherry-pick, because the 3.6 branch uses different file paths and keeps a direct PSA_ALG_JPAKE comparison in the PAKE size macros.
(cherry picked from commit ebda5da117af7e57bad47bc3337e364365a8f357)
