Opaque PSKs configured through mbedtls_ssl_conf_psk_opaque() were broken in TLS 1.3: the client computed an incorrect PSK binder, the server rejected the PSK identity, and the early key schedule exported the key with psa_export_key(), which fails for non-exportable keys.
Consume non-exportable opaque PSKs directly with psa_key_derivation_input_key(). Exportable PSKs (in particular raw PSKs imported by mbedtls_ssl_set_hs_psk()) keep the byte path, which works with whatever hash the negotiated ciphersuite requires: a key imported with a concrete HKDF-Extract policy cannot be a derivation input for another hash, and PSA_ALG_ANY_HASH policies are not accepted for KDF inputs either.
Also fix a NULL dereference when importing a TLS 1.3 resumption PSK before the ciphersuite is negotiated, and guard the mbedtls_ssl_get_opaque_psk() call, which only exists when MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED is defined.
ssl_client2/ssl_server2 now import opaque PSKs with the HKDF-Extract algorithm of the negotiated ciphersuite for TLS 1.3.
Fixes Mbed-TLS#10956.
Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
Call mbedtls_test_ssl_check_context_after_session_reset both in programs
(ssl_client2 and ssl_server2) and tests to ensure that the SSL context
has been properly handled when mbedtls_ssl_session_reset was called.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
In `ssl_client2`, the existing option `renegotiate=1` causes the client to
initiate renegotiation immediately after the initial handshake. Add a
variant `renegotiate=2` that initiates renegotiation after one data exchange.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Since Mbed TLS 3.6.0, all officially supported versions of Visual Studio
a printf function family that is sufficiently compliant to C99 for our
purposes, in particular supporting `%zu` for `size_t`. The only platform
without `%zu` that we semi-officially support is older versions of MinGW,
still used in our CI. MinGW provides either a Windows legacy printf or a
standards-compliant printf depending on the value of
`__USE_MINGW_ANSI_STDIO` when compiling each C file. Force the use of the
compliant version. Don't rely on `MBEDTLS_PRINTF_SIZET`, which is defined in
`<mbedtls/debug.h>` and no longer considers the Windows legacy version in
Mbed TLS >= 4.1.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Replace mbedtls_psa_get_random with psa_generate_random, as this is a backwards
compatibility layer that is now longer required
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
Remove the drbg module and entropy functions from the sample programs as these are
now handled by their PSA equivalents
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
PK restartable operations are now implemented using PSA interruptible
ones, so mbedtls_ecp_set_max_ops() can be removed in favor of
psa_interruptible_set_max_ops().
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
We no longer use decrypt TLS 1.2 (never did in 1.3) so we no longer need
this path. Further simplifications could probably be made (we currently
have an enum type with only one possible value...) but for now I'm
trying to keep changes minimal.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
