coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 23:00:03 +08:00
Code Issues Packages Projects Releases Wiki Activity
33,194 Commits 183 Branches 286 Tags Multiple Licenses 220 MiB
Commit Graph

33194 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
minosgalanakis
915442dbed
Merge pull request #1614 from yiwu0b11/mbedtls_pk_ecc_set_pubkey-overread-3.6 
Backport 3.6: Fix 1-byte overread in ECC key parsing
 2026-06-02 10:05:35 +01:00
Manuel Pégourié-Gonnard
8f4a4eac98 pk: fix side channel in RSA decryption 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-06-02 09:36:41 +02:00
Manuel Pégourié-Gonnard
689a05df0b pk: test RSA decrypt with buffer too small 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-06-02 09:36:38 +02:00
Manuel Pégourié-Gonnard
682d8f3e89 psa-rsa: also protect OUTPUT_TOO_LARGE 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-06-02 09:24:16 +02:00
Ben Taylor
85f3f6f894 Add missing header 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-02 08:19:02 +01:00
Ben Taylor
b555410883 Add mbedtls_chacha20_check_counter_wrap to header 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-01 14:43:50 +01:00
Manuel Pégourié-Gonnard
f1dc979f27 psa: avoid leaking padding errors 
Padding errors should be indistiguishable from success.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-06-01 10:10:14 +02:00
Manuel Pégourié-Gonnard
503c1375c8 psa-rsa: fix side channel on invalid padding 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-06-01 10:08:52 +02:00
Manuel Pégourié-Gonnard
859cf0788d psa-rsa: call pkcs1_v15 function directly 
Like the OAEP path calls the OAEP function directly

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-06-01 09:52:33 +02:00
Ronald Cron
4c70413087
Merge pull request #1555 from gilles-peskine-arm/ssl_tls13_prepare_new_session_ticket-psa_get_random-3.6 
Backport 3.6: Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure
 2026-05-29 16:19:37 +02:00
Ben Taylor
ea9848e14a Adapt ChaCha20 counter helper for 3.6 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:24:49 +01:00
Ben Taylor
96cb584a5e Reject overlong PSA ChaChaPoly lengths 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:17:53 +01:00
Ben Taylor
3df9fac129 Reject overlong ChaChaPoly updates 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:17:45 +01:00
Ben Taylor
dcf3b11749 Tidy ChaCha20 counter limit handling 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:17:36 +01:00
Ben Taylor
7bf0215f8d Add guard to prevent wraparound if SIZE_MAX > UINT64_MAX in chacha20 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:17:29 +01:00
Ben Taylor
3a358b0677 Remove unused cast 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:17:21 +01:00
Ben Taylor
130b914ff2 remove duplicate chacha20_check_counter_wrap functionality in chacha20 and chacha20_neon 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:17:14 +01:00
Ben Taylor
0e9be79ea3 Add simplification of if statement in chacha20 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:17:07 +01:00
Ben Taylor
56b050d738 Add use of keystream_bytes_used as the exhausted marker 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:17:00 +01:00
Ben Taylor
609b1c51b1 Add fix for chacha20 counter overflow bug 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:16:53 +01:00
Ben Taylor
515f81c852 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:16:44 +01:00
Ben Taylor
e05f169677 Add test for chacha20 counter overflow bug 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-29 13:16:38 +01:00
Ronald Cron
14ff18114f
Merge pull request #1635 from valeriosetti/issue1569-backport-3.6 
[backport 3.6] TLS 1.3 certificate chain signature algorithm policy gap
 2026-05-29 13:34:52 +02:00
Manuel Pégourié-Gonnard
e3aaf2e614
Merge pull request #1625 from mpg/restricted-check-small-factors-3.6 
[3.6] Fix timing leak in RSA prime generation
 2026-05-28 23:52:59 +02:00
Manuel Pégourié-Gonnard
a03dafab12
Merge pull request #1633 from mpg/restricted-everest-small-order-3.6 
[3.6] Everest small order
 2026-05-28 23:44:35 +02:00
Gilles Peskine
8b7af9d421 Improve changelog wording 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-28 16:32:09 +02:00
Yi Wu
3208173d3d tests: update compressed EC outcome filters 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-05-28 15:10:45 +01:00
Yi Wu
94883a3a85 tests: add EC public key parser coverage 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-05-28 15:10:31 +01:00
Yi Wu
0e2d7037db Backport EC public key 1 byte overread 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-05-28 15:10:14 +01:00
Valerio Setti
b9c8c9c427 changelog: fix typos 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-28 13:19:14 +02:00
Valerio Setti
b66d56bc5f changelog: add note about issue 1569 resolution 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-28 13:19:14 +02:00
Valerio Setti
4620095cdd ssl: improve documentation of mbedtls_ssl_conf_sig_algs() 
Clarify that the 'sig_algs' set through this function are only enforced
during the key exchange and that 'mbedtls_ssl_conf_cert_profile()' should
instead be used to enforce the same algorithms when verifying certificates.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-28 13:19:14 +02:00
Manuel Pégourié-Gonnard
6cfab6ce95 ecdh: fix off-by-1 in test comments/names 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-28 12:24:29 +02:00
Manuel Pégourié-Gonnard
ba5e4c156e Add test for x448 invalid inputs 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-28 12:24:29 +02:00
Manuel Pégourié-Gonnard
db94fb0686 Add tests for x25519 non-standard/invalid inputs 
We want to reject small order points for two reasons:
- Those give rise to side channels attacks where the underlying field
  arithmetic is not constant time (which our bignum isn't so far),
  see the "May the Fourth" paper mentioned in ecp.
- Those force the shared secret to be all-bytes zero, which is bad for
  protocols that might require contributory behaviour.

Honest peers will never send low-order points anyway.

While at it, test that we are clipping the input to 255 bits (ie, that
we are unsetting bit 256) as required by the RFC.

Again, honest peers will never send strings with bit 256 set. But the
RFC says to accept such strings anyway, so that's what we do.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-28 12:24:29 +02:00
Gilles Peskine
07f45b8768 Fix lax basicConstraints parsing 
When parsing the basicConstraints extension, reject junk after the SEQUENCE
inside the extension (which is probably benign), and reject a SEQUENCE that
extends beyond the extension (could be very dangerous).

Add a non-regression test where a certificate that is technically malformed,
but accepted as a leaf certificate by OpenSSL and other X.509
implementations, to be accepted as a CA certificate by Mbed TLS.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-26 20:46:23 +02:00
Gilles Peskine
412b8d91e0 Update framework with test certificate with basicConstraints overflow 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-26 20:46:23 +02:00
Minos Galanakis
c8187a51d0 ssl_write_supported_groups_ext: Updated documentation 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-26 10:31:34 +01:00
Manuel Pégourié-Gonnard
c6a1f9c838 bignum: fix a typo in a comment 
The exact value doesn't matter anyway, but since we mention it, it might
as well be correct.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-26 10:06:50 +02:00
Nadav0077
b0d5c0c80a
Harden serialized data deserialization 
Reject malformed TLS 1.3 serialized sessions instead of accepting
unterminated strings or extra trailing data, and reject serialized SSL
contexts whose DTLS Connection ID length exceeds the maximum supported
size instead of overflowing the internal buffer.

Backport of #10715 (development). The dedicated CID-length test from
#10715 relies on test helpers that do not exist on 3.6 (notably
mbedtls_test_ssl_dtls_join_endpoints and mbedtls_test_ssl_perform_connection)
and is therefore omitted from this backport; the production fix and the
TLS 1.3 session-load tests are backported unchanged.

Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>
 2026-05-22 13:16:58 +03:00
Manuel Pégourié-Gonnard
075e76b65b bignum: compact primality check for small values 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-22 00:49:08 +02:00
Manuel Pégourié-Gonnard
1a3cfa5fe7 bignum: make small primes product static 
Avoid a heap allocation every time it is used.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-22 00:38:10 +02:00
Manuel Pégourié-Gonnard
7a29052238 Fix side-channel in prime checking/generation 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-22 00:35:55 +02:00
Manuel Pégourié-Gonnard
72991252c8
Merge pull request #1621 from mpg/resricted-ecp-modp-polish-3.6 
[3.6] Improve ECC optimized modp
 2026-05-22 00:01:04 +02:00
Manuel Pégourié-Gonnard
05ce3e90eb ecp: fix a typo in a comment 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-21 12:08:44 +02:00
Manuel Pégourié-Gonnard
51f6079c1b ecp: update doc for Koblitz raw quasi-reductions 
Those no longer allocate, so they can no longer return that error. This
was missed in the commit that removed heap allocations.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-21 12:07:32 +02:00
Minos Galanakis
89c0c7da25 test_suite_ssl: Added MBEDTLS_DEBUG_C guards to logs 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-20 15:13:13 +01:00
Minos Galanakis
b82b797b2c test_suite_ssl: Restructured reject_hrr_selecting_unoffered_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-20 15:13:06 +01:00
Minos Galanakis
e42c6d7937 test_suite_ssl: Renamed hrr_reject_selecting_unoffered_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-20 15:12:54 +01:00
Minos Galanakis
5decd98cf4 sll_client: align TLS 1.3 supported_groups filtering with PSA curve support 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-20 15:12:42 +01:00