Merge remote-tracking branch 'public/pr/2952' into baremetal
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 746b38a..39808f9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -185,7 +185,10 @@
add_subdirectory(library)
add_subdirectory(include)
-add_subdirectory(tinycrypt)
+
+if(USE_TINYCRYPT)
+ add_subdirectory(tinycrypt)
+endif()
if(ENABLE_PROGRAMS)
add_subdirectory(programs)
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index fe9c594..ce348d9 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -110,6 +110,10 @@
#error "MBEDTLS_USE_TINYCRYPT defined, but it cannot be defined with MBEDTLS_NO_64BIT_MULTIPLICATION"
#endif
+#if defined(MBEDTLS_USE_TINYCRYPT) && !defined(MBEDTLS_SHA256_C)
+#error "MBEDTLS_USE_TINYCRYPT defined, but not MBEDTLS_SHA256_C"
+#endif
+
#if defined(MBEDTLS_USE_TINYCRYPT) && \
!( defined(MBEDTLS_SSL_CONF_SINGLE_EC) && \
MBEDTLS_SSL_CONF_SINGLE_EC_TLS_ID == 23 && \
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 87012da..dbb84b4 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -2649,6 +2649,7 @@
* MBEDTLS_SSL_CONF_SINGLE_EC
* MBEDTLS_SSL_CONF_SINGLE_EC_TLS_ID == 23
* MBEDTLS_SSL_CONF_SINGLE_UECC_GRP_ID == MBEDTLS_UECC_DP_SECP256R1
+ * MBEDTLS_SHA256_C
*
* \see MBEDTLS_SSL_CONF_RNG
*
diff --git a/include/mbedtls/error.h b/include/mbedtls/error.h
index 31f294f..a52f9f5 100644
--- a/include/mbedtls/error.h
+++ b/include/mbedtls/error.h
@@ -86,7 +86,7 @@
* CHACHA20 3 0x0051-0x0055
* POLY1305 3 0x0057-0x005B
* CHACHAPOLY 2 0x0054-0x0056
- * PLATFORM 1 0x0070-0x0072
+ * PLATFORM 3 0x0070-0x0072 0x0071-0x0071
*
* High-level module nr (3 bits - 0x0...-0x7...)
* Name ID Nr of Errors
diff --git a/include/mbedtls/hmac_drbg.h b/include/mbedtls/hmac_drbg.h
index ed03854..f38337a 100644
--- a/include/mbedtls/hmac_drbg.h
+++ b/include/mbedtls/hmac_drbg.h
@@ -70,8 +70,8 @@
/* \} name SECTION: Module settings */
-#define MBEDTLS_HMAC_DRBG_PR_OFF 0 /**< No prediction resistance */
-#define MBEDTLS_HMAC_DRBG_PR_ON 1 /**< Prediction resistance enabled */
+#define MBEDTLS_HMAC_DRBG_PR_OFF 0x55555555 /**< No prediction resistance */
+#define MBEDTLS_HMAC_DRBG_PR_ON 0x2AAAAAAA /**< Prediction resistance enabled */
#ifdef __cplusplus
extern "C" {
@@ -202,7 +202,8 @@
* \param add_len Length of additional data, or 0
*
* \return \c 0 on success, or an error from the underlying
- * hash calculation.
+ * hash calculation or
+ * MBEDTLS_ERR_PLATFORM_FAULT_DETECTED.
*
* \note Additional data is optional, pass NULL and 0 as second
* third argument if no additional data is being used.
@@ -237,7 +238,8 @@
* \return 0 if successful, or
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED, or
* MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG, or
- * MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG.
+ * MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG, or
+ * MBEDTLS_ERR_PLATFORM_FAULT_DETECTED.
*/
int mbedtls_hmac_drbg_random_with_add( void *p_rng,
unsigned char *output, size_t output_len,
@@ -255,7 +257,9 @@
*
* \return 0 if successful, or
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED, or
- * MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG
+ * MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG,
+ * MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG, or
+ * MBEDTLS_ERR_PLATFORM_FAULT_DETECTED.
*/
int mbedtls_hmac_drbg_random( void *p_rng, unsigned char *output, size_t out_len );
diff --git a/include/mbedtls/platform.h b/include/mbedtls/platform.h
index 89fe8a7..ec1df15 100644
--- a/include/mbedtls/platform.h
+++ b/include/mbedtls/platform.h
@@ -39,13 +39,16 @@
#include MBEDTLS_CONFIG_FILE
#endif
+#define MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED -0x0070 /**< Hardware accelerator failed */
+#define MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED -0x0072 /**< The requested feature is not supported by the platform */
+#define MBEDTLS_ERR_PLATFORM_FAULT_DETECTED -0x0071 /**< A hardware fault was detected in a critical path. As a security precaution this should be treated as a potential physical attack */
+
+#if defined(MBEDTLS_PLATFORM_C)
+
#if defined(MBEDTLS_HAVE_TIME)
#include "platform_time.h"
#endif
-#define MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED -0x0070 /**< Hardware accelerator failed */
-#define MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED -0x0072 /**< The requested feature is not supported by the platform */
-
#ifdef __cplusplus
extern "C" {
#endif
@@ -364,4 +367,6 @@
}
#endif
+#endif /* MBEDTLS_PLATFORM_C */
+
#endif /* platform.h */
diff --git a/include/mbedtls/platform_util.h b/include/mbedtls/platform_util.h
index 586f0d9..e20f1c3 100644
--- a/include/mbedtls/platform_util.h
+++ b/include/mbedtls/platform_util.h
@@ -238,6 +238,13 @@
*/
uint32_t mbedtls_platform_random_in_range( size_t num );
+/**
+ * \brief This function does nothing, but can be inserted between
+ * successive reads to a volatile local variable to prevent
+ * compilers from optimizing them away.
+ */
+void mbedtls_platform_enforce_volatile_reads( void );
+
#if defined(MBEDTLS_HAVE_TIME_DATE)
/**
* \brief Platform-specific implementation of gmtime_r()
diff --git a/include/mbedtls/x509.h b/include/mbedtls/x509.h
index c31847d..b2ad182 100644
--- a/include/mbedtls/x509.h
+++ b/include/mbedtls/x509.h
@@ -85,6 +85,8 @@
* \{
*/
/* Reminder: update x509_crt_verify_strings[] in library/x509_crt.c */
+/* Reminder: update X509_BADCERT_FI_EXTRA in library/x509_crt.c if using more
+ * that 24 bits */
#define MBEDTLS_X509_BADCERT_EXPIRED 0x01 /**< The certificate validity has expired. */
#define MBEDTLS_X509_BADCERT_REVOKED 0x02 /**< The certificate has been revoked (is on a CRL). */
#define MBEDTLS_X509_BADCERT_CN_MISMATCH 0x04 /**< The certificate Common Name (CN) does not match with the expected CN. */
diff --git a/include/tinycrypt/ecc.h b/include/tinycrypt/ecc.h
index 2da74b3..6a85a55 100644
--- a/include/tinycrypt/ecc.h
+++ b/include/tinycrypt/ecc.h
@@ -73,7 +73,6 @@
*
*/
-#if defined(MBEDTLS_USE_TINYCRYPT)
#ifndef __TC_UECC_H__
#define __TC_UECC_H__
@@ -83,6 +82,13 @@
extern "C" {
#endif
+/* Return values for functions, chosen with large Hamming distances between
+ * them (especially to SUCESS) to mitigate the impact of fault injection
+ * attacks flipping a low number of bits. */
+#define UECC_SUCCESS 0
+#define UECC_FAILURE 0x75555555
+#define UECC_FAULT_DETECTED 0x7aaaaaaa
+
/* Word size (4 bytes considering 32-bits architectures) */
#define uECC_WORD_SIZE 4
@@ -113,23 +119,6 @@
#define NUM_ECC_BYTES (uECC_WORD_SIZE*NUM_ECC_WORDS)
#define NUM_ECC_BITS 256
-/* structure that represents an elliptic curve (e.g. p256):*/
-struct uECC_Curve_t;
-typedef const struct uECC_Curve_t * uECC_Curve;
-struct uECC_Curve_t {
- wordcount_t num_words;
- wordcount_t num_bytes;
- bitcount_t num_n_bits;
- uECC_word_t p[NUM_ECC_WORDS];
- uECC_word_t n[NUM_ECC_WORDS];
- uECC_word_t G[NUM_ECC_WORDS * 2];
- uECC_word_t b[NUM_ECC_WORDS];
- void (*double_jacobian)(uECC_word_t * X1, uECC_word_t * Y1, uECC_word_t * Z1,
- uECC_Curve curve);
- void (*x_side)(uECC_word_t *result, const uECC_word_t *x, uECC_Curve curve);
- void (*mmod_fast)(uECC_word_t *result, uECC_word_t *product);
-};
-
/*
* @brief computes doubling of point ion jacobian coordinates, in place.
* @param X1 IN/OUT -- x coordinate
@@ -138,16 +127,7 @@
* @param curve IN -- elliptic curve
*/
void double_jacobian_default(uECC_word_t * X1, uECC_word_t * Y1,
- uECC_word_t * Z1, uECC_Curve curve);
-
-/*
- * @brief Computes x^3 + ax + b. result must not overlap x.
- * @param result OUT -- x^3 + ax + b
- * @param x IN -- value of x
- * @param curve IN -- elliptic curve
- */
-void x_side_default(uECC_word_t *result, const uECC_word_t *x,
- uECC_Curve curve);
+ uECC_word_t * Z1);
/*
* @brief Computes result = product % curve_p
@@ -164,42 +144,10 @@
((num_bits + ((uECC_WORD_SIZE * 8) - 1)) / (uECC_WORD_SIZE * 8))
#define BITS_TO_BYTES(num_bits) ((num_bits + 7) / 8)
-/* definition of curve NIST p-256: */
-static const struct uECC_Curve_t curve_secp256r1 = {
- NUM_ECC_WORDS,
- NUM_ECC_BYTES,
- 256, /* num_n_bits */ {
- BYTES_TO_WORDS_8(FF, FF, FF, FF, FF, FF, FF, FF),
- BYTES_TO_WORDS_8(FF, FF, FF, FF, 00, 00, 00, 00),
- BYTES_TO_WORDS_8(00, 00, 00, 00, 00, 00, 00, 00),
- BYTES_TO_WORDS_8(01, 00, 00, 00, FF, FF, FF, FF)
- }, {
- BYTES_TO_WORDS_8(51, 25, 63, FC, C2, CA, B9, F3),
- BYTES_TO_WORDS_8(84, 9E, 17, A7, AD, FA, E6, BC),
- BYTES_TO_WORDS_8(FF, FF, FF, FF, FF, FF, FF, FF),
- BYTES_TO_WORDS_8(00, 00, 00, 00, FF, FF, FF, FF)
- }, {
- BYTES_TO_WORDS_8(96, C2, 98, D8, 45, 39, A1, F4),
- BYTES_TO_WORDS_8(A0, 33, EB, 2D, 81, 7D, 03, 77),
- BYTES_TO_WORDS_8(F2, 40, A4, 63, E5, E6, BC, F8),
- BYTES_TO_WORDS_8(47, 42, 2C, E1, F2, D1, 17, 6B),
-
- BYTES_TO_WORDS_8(F5, 51, BF, 37, 68, 40, B6, CB),
- BYTES_TO_WORDS_8(CE, 5E, 31, 6B, 57, 33, CE, 2B),
- BYTES_TO_WORDS_8(16, 9E, 0F, 7C, 4A, EB, E7, 8E),
- BYTES_TO_WORDS_8(9B, 7F, 1A, FE, E2, 42, E3, 4F)
- }, {
- BYTES_TO_WORDS_8(4B, 60, D2, 27, 3E, 3C, CE, 3B),
- BYTES_TO_WORDS_8(F6, B0, 53, CC, B0, 06, 1D, 65),
- BYTES_TO_WORDS_8(BC, 86, 98, 76, 55, BD, EB, B3),
- BYTES_TO_WORDS_8(E7, 93, 3A, AA, D8, 35, C6, 5A)
- },
- &double_jacobian_default,
- &x_side_default,
- &vli_mmod_fast_secp256r1
-};
-
-uECC_Curve uECC_secp256r1(void);
+extern const uECC_word_t curve_p[NUM_ECC_WORDS];
+extern const uECC_word_t curve_n[NUM_ECC_WORDS];
+extern const uECC_word_t curve_G[2 * NUM_ECC_WORDS];
+extern const uECC_word_t curve_b[NUM_ECC_WORDS];
/*
* @brief Generates a random integer in the range 0 < random < top.
@@ -254,24 +202,24 @@
* @param curve IN -- elliptic curve
* @return size of a private key for the curve in bytes.
*/
-int uECC_curve_private_key_size(uECC_Curve curve);
+int uECC_curve_private_key_size(void);
/*
* @brief computes the size of a public key for the curve in bytes.
* @param curve IN -- elliptic curve
* @return the size of a public key for the curve in bytes.
*/
-int uECC_curve_public_key_size(uECC_Curve curve);
+int uECC_curve_public_key_size(void);
/*
* @brief Compute the corresponding public key for a private key.
* @param private_key IN -- The private key to compute the public key for
* @param public_key OUT -- Will be filled in with the corresponding public key
* @param curve
- * @return Returns 1 if key was computed successfully, 0 if an error occurred.
+ * @return UECC_SUCCESS or UECC_FAILURE or UECC_FAULT_DETECTED
*/
int uECC_compute_public_key(const uint8_t *private_key,
- uint8_t *public_key, uECC_Curve curve);
+ uint8_t *public_key);
/*
* @brief Compute public-key.
@@ -279,9 +227,10 @@
* @param result OUT -- public-key
* @param private_key IN -- private-key
* @param curve IN -- elliptic curve
+ * @return UECC_SUCCESS or UECC_FAILURE or UECC_FAULT_DETECTED
*/
uECC_word_t EccPoint_compute_public_key(uECC_word_t *result,
- uECC_word_t *private_key, uECC_Curve curve);
+ uECC_word_t *private_key);
/*
* @brief Point multiplication algorithm using Montgomery's ladder with co-Z
@@ -292,10 +241,10 @@
* @param result OUT -- returns scalar*point
* @param point IN -- elliptic curve point
* @param scalar IN -- scalar
- * @param curve IN -- elliptic curve
+ * @return UECC_SUCCESS or UECC_FAILURE or UECC_FAULT_DETECTED
*/
int EccPoint_mult_safer(uECC_word_t * result, const uECC_word_t * point,
- const uECC_word_t * scalar, uECC_Curve curve);
+ const uECC_word_t * scalar);
/*
* @brief Constant-time comparison to zero - secure way to compare long integers
@@ -308,10 +257,9 @@
/*
* @brief Check if 'point' is the point at infinity
* @param point IN -- elliptic curve point
- * @param curve IN -- elliptic curve
* @return if 'point' is the point at infinity, 0 otherwise.
*/
-uECC_word_t EccPoint_isZero(const uECC_word_t *point, uECC_Curve curve);
+uECC_word_t EccPoint_isZero(const uECC_word_t *point);
/*
* @brief computes the sign of left - right, in constant time.
@@ -356,7 +304,7 @@
* @param curve IN -- elliptic curve
*/
void XYcZ_add(uECC_word_t * X1, uECC_word_t * Y1, uECC_word_t * X2,
- uECC_word_t * Y2, uECC_Curve curve);
+ uECC_word_t * Y2);
/*
* @brief Computes (x1 * z^2, y1 * z^3)
@@ -415,7 +363,7 @@
* @param left IN -- left term in comparison
* @param right IN -- right term in comparison
* @param num_words IN -- number of words
- * @return Returns 0 if left == right, 1 otherwise.
+ * @return Returns 0 if left == right, non-zero otherwise.
*/
uECC_word_t uECC_vli_equal(const uECC_word_t *left, const uECC_word_t *right);
@@ -487,7 +435,7 @@
* @exception returns -2 if x or y is smaller than p,
* @exception returns -3 if y^2 != x^3 + ax + b.
*/
-int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve);
+int uECC_valid_point(const uECC_word_t *point);
/*
* @brief Check if a public key is valid.
@@ -503,7 +451,7 @@
* time computing a shared secret or verifying a signature using an invalid
* public key.
*/
-int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve);
+int uECC_valid_public_key(const uint8_t *public_key);
/*
* @brief Converts an integer in uECC native format to big-endian bytes.
@@ -528,4 +476,3 @@
#endif
#endif /* __TC_UECC_H__ */
-#endif /* MBEDTLS_USE_TINYCRYPT */
diff --git a/include/tinycrypt/ecc_dh.h b/include/tinycrypt/ecc_dh.h
index a2edb01..c443f85 100644
--- a/include/tinycrypt/ecc_dh.h
+++ b/include/tinycrypt/ecc_dh.h
@@ -71,7 +71,6 @@
* Security: The curve NIST p-256 provides approximately 128 bits of security.
*/
-#if defined(MBEDTLS_USE_TINYCRYPT)
#ifndef __TC_ECC_DH_H__
#define __TC_ECC_DH_H__
@@ -83,8 +82,7 @@
/**
* @brief Create a public/private key pair.
- * @return returns TC_CRYPTO_SUCCESS (1) if the key pair was generated successfully
- * returns TC_CRYPTO_FAIL (0) if error while generating key pair
+ * @return UECC_SUCCESS or UECC_FAILURE or UECC_FAULT_DETECTED
*
* @param p_public_key OUT -- Will be filled in with the public key. Must be at
* least 2 * the curve size (in bytes) long. For curve secp256r1, p_public_key
@@ -97,7 +95,7 @@
* @warning A cryptographically-secure PRNG function must be set (using
* uECC_set_rng()) before calling uECC_make_key().
*/
-int uECC_make_key(uint8_t *p_public_key, uint8_t *p_private_key, uECC_Curve curve);
+int uECC_make_key(uint8_t *p_public_key, uint8_t *p_private_key);
#ifdef ENABLE_TESTS
@@ -108,14 +106,13 @@
* uECC_make_key() function for real applications.
*/
int uECC_make_key_with_d(uint8_t *p_public_key, uint8_t *p_private_key,
- unsigned int *d, uECC_Curve curve);
+ unsigned int *d);
#endif
/**
* @brief Compute a shared secret given your secret key and someone else's
* public key.
- * @return returns TC_CRYPTO_SUCCESS (1) if the shared secret was computed successfully
- * returns TC_CRYPTO_FAIL (0) otherwise
+ * @return UECC_SUCCESS or UECC_FAILURE or UECC_FAULT_DETECTED
*
* @param p_secret OUT -- Will be filled in with the shared secret value. Must be
* the same size as the curve size (for curve secp256r1, secret must be 32 bytes
@@ -128,11 +125,10 @@
* order to produce a cryptographically secure symmetric key.
*/
int uECC_shared_secret(const uint8_t *p_public_key, const uint8_t *p_private_key,
- uint8_t *p_secret, uECC_Curve curve);
+ uint8_t *p_secret);
#ifdef __cplusplus
}
#endif
#endif /* __TC_ECC_DH_H__ */
-#endif /* MBEDTLS_USE_TINYCRYPT */
diff --git a/include/tinycrypt/ecc_dsa.h b/include/tinycrypt/ecc_dsa.h
index e54a77e..0001ecb 100644
--- a/include/tinycrypt/ecc_dsa.h
+++ b/include/tinycrypt/ecc_dsa.h
@@ -80,7 +80,6 @@
* the signer's public key and the signature values (r and s).
*/
-#if defined(MBEDTLS_USE_TINYCRYPT)
#ifndef __TC_ECC_DSA_H__
#define __TC_ECC_DSA_H__
@@ -92,8 +91,7 @@
/**
* @brief Generate an ECDSA signature for a given hash value.
- * @return returns TC_CRYPTO_SUCCESS (1) if the signature generated successfully
- * returns TC_CRYPTO_FAIL (0) if an error occurred.
+ * @return UECC_SUCCESS or UECC_FAILURE or UECC_FAULT_DETECTED
*
* @param p_private_key IN -- Your private key.
* @param p_message_hash IN -- The hash of the message to sign.
@@ -109,7 +107,7 @@
* attack.
*/
int uECC_sign(const uint8_t *p_private_key, const uint8_t *p_message_hash,
- unsigned p_hash_size, uint8_t *p_signature, uECC_Curve curve);
+ unsigned p_hash_size, uint8_t *p_signature);
#ifdef ENABLE_TESTS
/*
@@ -117,14 +115,13 @@
* Refer to uECC_sign() function for real applications.
*/
int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
- unsigned int hash_size, uECC_word_t *k, uint8_t *signature,
- uECC_Curve curve);
+ unsigned int hash_size, uECC_word_t *k, uint8_t *signature)
#endif
/**
* @brief Verify an ECDSA signature.
- * @return returns TC_SUCCESS (1) if the signature is valid
- * returns TC_FAIL (0) if the signature is invalid.
+ * @return returns UECC_SUCCESS if the signature is valid
+ * returns UECC_FAILURE if the signature is invalid.
*
* @param p_public_key IN -- The signer's public key.
* @param p_message_hash IN -- The hash of the signed data.
@@ -136,11 +133,10 @@
* the signature values (hash_size and signature).
*/
int uECC_verify(const uint8_t *p_public_key, const uint8_t *p_message_hash,
- unsigned int p_hash_size, const uint8_t *p_signature, uECC_Curve curve);
+ unsigned int p_hash_size, const uint8_t *p_signature);
#ifdef __cplusplus
}
#endif
#endif /* __TC_ECC_DSA_H__ */
-#endif /* MBEDTLS_USE_TINYCRYPT */
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index 89f7275..0156856 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -1,4 +1,5 @@
option(USE_STATIC_MBEDTLS_LIBRARY "Build mbed TLS static library." ON)
+option(USE_TINYCRYPT "Include TinyCrypt." ON)
option(USE_SHARED_MBEDTLS_LIBRARY "Build mbed TLS shared library." OFF)
option(LINK_WITH_PTHREAD "Explicitly link mbed TLS library to pthread." OFF)
@@ -123,7 +124,9 @@
set(libs ${libs} pthread)
endif()
-set(libs ${libs} tinycrypt)
+if(USE_TINYCRYPT)
+ set(libs ${libs} tinycrypt)
+endif()
if (NOT USE_STATIC_MBEDTLS_LIBRARY AND NOT USE_SHARED_MBEDTLS_LIBRARY)
message(FATAL_ERROR "Need to choose static or shared mbedtls build!")
diff --git a/library/Makefile b/library/Makefile
index 4154c6a..96a9d60 100644
--- a/library/Makefile
+++ b/library/Makefile
@@ -99,8 +99,7 @@
ripemd160.o rsa_internal.o rsa.o \
sha1.o sha256.o sha512.o \
threading.o timing.o version.o \
- version_features.o xtea.o \
- ecc.o ecc_dh.o ecc_dsa.o
+ version_features.o xtea.o
OBJS_X509= certs.o pkcs11.o x509.o
@@ -110,6 +109,17 @@
ssl_srv.o ssl_ticket.o \
ssl_tls.o
+# Default to always build TinyCrypt
+ifndef TINYCRYPT_BUILD
+TINYCRYPT_BUILD=1
+endif
+
+ifeq ($(TINYCRYPT_BUILD),1)
+# Add TinyCrypt to the targets and Makefile path
+VPATH = ../tinycrypt
+OBJS_CRYPTO += ecc.o ecc_dh.o ecc_dsa.o
+endif
+
.SILENT:
.PHONY: all static shared clean
diff --git a/library/error.c b/library/error.c
index c993524..74c9d0b 100644
--- a/library/error.c
+++ b/library/error.c
@@ -841,6 +841,8 @@
mbedtls_snprintf( buf, buflen, "PLATFORM - Hardware accelerator failed" );
if( use_ret == -(MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED) )
mbedtls_snprintf( buf, buflen, "PLATFORM - The requested feature is not supported by the platform" );
+ if( use_ret == -(MBEDTLS_ERR_PLATFORM_FAULT_DETECTED) )
+ mbedtls_snprintf( buf, buflen, "PLATFORM - A hardware fault was detected in a critical path. As a security precaution this should be treated as a potential physical attack" );
#endif /* MBEDTLS_PLATFORM_C */
#if defined(MBEDTLS_POLY1305_C)
diff --git a/library/hmac_drbg.c b/library/hmac_drbg.c
index d0de5de..82703b0 100644
--- a/library/hmac_drbg.c
+++ b/library/hmac_drbg.c
@@ -34,6 +34,7 @@
#if defined(MBEDTLS_HMAC_DRBG_C)
#include "mbedtls/hmac_drbg.h"
+#include "mbedtls/platform.h"
#include "mbedtls/platform_util.h"
#include <string.h>
@@ -51,6 +52,9 @@
#endif /* MBEDTLS_SELF_TEST */
#endif /* MBEDTLS_PLATFORM_C */
+#define HMAC_NONCE_YES 0x4AAAAAAA
+#define HMAC_NONCE_NO 0x75555555
+
/*
* HMAC_DRBG context initialization
*/
@@ -74,42 +78,76 @@
mbedtls_md_get_handle( &ctx->md_ctx ) );
unsigned char rounds = ( additional != NULL && add_len != 0 ) ? 2 : 1;
unsigned char sep[1];
+ volatile unsigned int flow_counter = 0;
unsigned char K[MBEDTLS_MD_MAX_SIZE];
- int ret;
+ int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
for( sep[0] = 0; sep[0] < rounds; sep[0]++ )
{
/* Step 1 or 4 */
+ flow_counter++;
if( ( ret = mbedtls_md_hmac_reset( &ctx->md_ctx ) ) != 0 )
goto exit;
+
+ flow_counter++;
if( ( ret = mbedtls_md_hmac_update( &ctx->md_ctx,
ctx->V, md_len ) ) != 0 )
goto exit;
+
+ flow_counter++;
if( ( ret = mbedtls_md_hmac_update( &ctx->md_ctx,
sep, 1 ) ) != 0 )
goto exit;
+
if( rounds == 2 )
{
+ flow_counter++;
if( ( ret = mbedtls_md_hmac_update( &ctx->md_ctx,
additional, add_len ) ) != 0 )
goto exit;
}
+
+ flow_counter++;
if( ( ret = mbedtls_md_hmac_finish( &ctx->md_ctx, K ) ) != 0 )
goto exit;
/* Step 2 or 5 */
+ flow_counter++;
if( ( ret = mbedtls_md_hmac_starts( &ctx->md_ctx, K, md_len ) ) != 0 )
goto exit;
+
+ flow_counter++;
if( ( ret = mbedtls_md_hmac_update( &ctx->md_ctx,
ctx->V, md_len ) ) != 0 )
goto exit;
+
+ flow_counter++;
if( ( ret = mbedtls_md_hmac_finish( &ctx->md_ctx, ctx->V ) ) != 0 )
goto exit;
+ flow_counter++;
}
exit:
+
mbedtls_platform_zeroize( K, sizeof( K ) );
- return( ret );
+ /* Check for possible attack.
+ * Counters needs to have correct values when returning success
+ */
+ if ( ret != 0 )
+ return( ret ); // error case, return immediately
+
+ if ( ( ( flow_counter == 8 ) && ( sep[0] == 1 ) ) ||
+ ( ( flow_counter == 18 ) && ( sep[0] == 2 ) ) )
+ {
+ flow_counter = flow_counter - sep[0];
+ // Double check flow_counter
+ if ( ( flow_counter == 7 ) || ( flow_counter == 16 ) )
+ {
+ return ret; // success, return 0 from ret
+ }
+ }
+
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
}
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
@@ -125,10 +163,10 @@
* Simplified HMAC_DRBG initialisation (for use with deterministic ECDSA)
*/
int mbedtls_hmac_drbg_seed_buf( mbedtls_hmac_drbg_context *ctx,
- mbedtls_md_handle_t md_info,
- const unsigned char *data, size_t data_len )
+ mbedtls_md_handle_t md_info,
+ const unsigned char *data, size_t data_len )
{
- int ret;
+ int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
if( ( ret = mbedtls_md_setup( &ctx->md_ctx, md_info, 1 ) ) != 0 )
return( ret );
@@ -146,7 +184,7 @@
if( ( ret = mbedtls_hmac_drbg_update_ret( ctx, data, data_len ) ) != 0 )
return( ret );
- return( 0 );
+ return( ret );
}
/*
@@ -160,22 +198,19 @@
{
unsigned char seed[MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT];
size_t seedlen = 0;
+ size_t total_entropy_len;
int ret;
+ if( use_nonce == HMAC_NONCE_NO )
+ total_entropy_len = ctx->entropy_len;
+ else
+ total_entropy_len = ctx->entropy_len * 3 / 2;
+
+ /* III. Check input length */
+ if( len > MBEDTLS_HMAC_DRBG_MAX_INPUT ||
+ total_entropy_len + len > MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT )
{
- size_t total_entropy_len;
-
- if( use_nonce == 0 )
- total_entropy_len = ctx->entropy_len;
- else
- total_entropy_len = ctx->entropy_len * 3 / 2;
-
- /* III. Check input length */
- if( len > MBEDTLS_HMAC_DRBG_MAX_INPUT ||
- total_entropy_len + len > MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT )
- {
- return( MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG );
- }
+ return( MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG );
}
memset( seed, 0, MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT );
@@ -190,7 +225,7 @@
/* For initial seeding, allow adding of nonce generated
* from the entropy source. See Sect 8.6.7 in SP800-90A. */
- if( use_nonce )
+ if( use_nonce == HMAC_NONCE_YES )
{
/* Note: We don't merge the two calls to f_entropy() in order
* to avoid requesting too much entropy from f_entropy()
@@ -225,9 +260,20 @@
ctx->reseed_counter = 1;
exit:
+
/* 4. Done */
mbedtls_platform_zeroize( seed, seedlen );
- return( ret );
+
+ if ( ret != 0 )
+ return ret;
+
+ if ( ret == 0 && ctx->reseed_counter == 1 )
+ {
+ /* All ok, return 0 from ret */
+ return ret;
+ }
+
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
}
/*
@@ -236,8 +282,7 @@
int mbedtls_hmac_drbg_reseed( mbedtls_hmac_drbg_context *ctx,
const unsigned char *additional, size_t len )
{
- return( hmac_drbg_reseed_core( ctx, additional, len,
- 0 /* no nonce */ ) );
+ return( hmac_drbg_reseed_core( ctx, additional, len, HMAC_NONCE_NO ) );
}
/*
@@ -286,13 +331,12 @@
md_size <= 28 ? 24 : /* 224-bits hash -> 192 bits */
32; /* better (256+) -> 256 bits */
- if( ( ret = hmac_drbg_reseed_core( ctx, custom, len,
- 1 /* add nonce */ ) ) != 0 )
+ if( ( ret = hmac_drbg_reseed_core( ctx, custom, len, HMAC_NONCE_YES ) ) != 0 )
{
return( ret );
}
- return( 0 );
+ return( ret );
}
/*
@@ -329,6 +373,8 @@
const unsigned char *additional, size_t add_len )
{
int ret;
+ volatile unsigned char *output_fi = output;
+ volatile size_t out_len_fi = out_len;
mbedtls_hmac_drbg_context *ctx = (mbedtls_hmac_drbg_context *) p_rng;
size_t md_len = mbedtls_md_get_size(
mbedtls_md_get_handle( &ctx->md_ctx ) );
@@ -390,7 +436,21 @@
exit:
/* 8. Done */
- return( ret );
+
+ if ( ret != 0 )
+ return ret;
+
+ /*
+ * Check doubled variables and illegal conditions in case of possible
+ * attack.
+ */
+ if ( ( out_len_fi == out_len ) && ( output_fi == output) &&
+ ( left == 0 ) )
+ {
+ return ret; // Success, return 0
+ }
+
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
}
/*
diff --git a/library/md.c b/library/md.c
index d9d6509..4f03acc 100644
--- a/library/md.c
+++ b/library/md.c
@@ -32,6 +32,7 @@
#if defined(MBEDTLS_MD_C)
#include "mbedtls/md.h"
+#include "mbedtls/platform.h"
#include "mbedtls/platform_util.h"
#if defined(MBEDTLS_PLATFORM_C)
@@ -525,7 +526,7 @@
int ret;
unsigned char sum[MBEDTLS_MD_MAX_SIZE];
unsigned char *ipad, *opad;
- size_t i;
+ size_t i = 0;
mbedtls_md_handle_t md_info;
@@ -575,16 +576,27 @@
if( ( ret = mbedtls_md_info_starts( md_info, ctx->md_ctx ) ) != 0 )
goto cleanup;
+ i++; // Use i as flow control
+
if( ( ret = mbedtls_md_info_update( md_info, ctx->md_ctx, ipad,
mbedtls_md_info_block_size( md_info ) ) ) != 0 )
{
goto cleanup;
}
+ i++; // Use i as flow control now
+
cleanup:
mbedtls_platform_zeroize( sum, sizeof( sum ) );
- return( ret );
+ if ( ret != 0 )
+ return ret;
+
+ /* Check possible fault injection */
+ if ( ( i - 2 ) == keylen )
+ return ret; // success, return 0 from ret
+
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
}
int mbedtls_md_hmac_update( mbedtls_md_context_t *ctx,
@@ -653,7 +665,7 @@
if( ( ret = mbedtls_md_info_finish( md_info, ctx->md_ctx, output ) ) != 0 )
return( ret );
- return( 0 );
+ return( ret );
}
int mbedtls_md_hmac_reset( mbedtls_md_context_t *ctx )
diff --git a/library/pk.c b/library/pk.c
index 29123eb..dfdd4d1 100644
--- a/library/pk.c
+++ b/library/pk.c
@@ -577,9 +577,9 @@
const unsigned char *sig, size_t sig_len )
{
int ret;
+ volatile int ret_fi;
uint8_t signature[2*NUM_ECC_BYTES];
unsigned char *p;
- const struct uECC_Curve_t * uecc_curve = uECC_secp256r1();
const mbedtls_uecc_keypair *keypair = (const mbedtls_uecc_keypair *) ctx;
((void) md_alg);
@@ -589,12 +589,22 @@
if( ret != 0 )
return( ret );
- ret = uECC_verify( keypair->public_key, hash,
- (unsigned) hash_len, signature, uecc_curve );
- if( ret == 0 )
- return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
+ ret_fi = uECC_verify( keypair->public_key, hash,
+ (unsigned) hash_len, signature );
- return( 0 );
+ if( ret_fi == UECC_FAULT_DETECTED )
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
+
+ if( ret_fi == UECC_SUCCESS )
+ {
+ mbedtls_platform_enforce_volatile_reads();
+ if( ret_fi == UECC_SUCCESS )
+ return( 0 );
+ else
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
+ }
+
+ return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
}
/*
@@ -693,7 +703,6 @@
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
{
const mbedtls_uecc_keypair *keypair = (const mbedtls_uecc_keypair *) ctx;
- const struct uECC_Curve_t * uecc_curve = uECC_secp256r1();
int ret;
/*
@@ -713,9 +722,10 @@
*/
#define MAX_SECP256R1_ECDSA_SIG_LEN ( 3 + 2 * ( 3 + NUM_ECC_BYTES ) )
- ret = uECC_sign( keypair->private_key, hash, hash_len, sig, uecc_curve );
- /* TinyCrypt uses 0 to signal errors. */
- if( ret == 0 )
+ ret = uECC_sign( keypair->private_key, hash, hash_len, sig );
+ if( ret == UECC_FAULT_DETECTED )
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
+ if( ret != UECC_SUCCESS )
return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
*sig_len = 2 * NUM_ECC_BYTES;
diff --git a/library/pkparse.c b/library/pkparse.c
index 4562f65..3f20225 100644
--- a/library/pkparse.c
+++ b/library/pkparse.c
@@ -986,9 +986,10 @@
if( !pubkey_done )
{
ret = uECC_compute_public_key( keypair->private_key,
- keypair->public_key,
- uECC_secp256r1() );
- if( ret == 0 )
+ keypair->public_key );
+ if( ret == UECC_FAULT_DETECTED )
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
+ if( ret != UECC_SUCCESS )
return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
}
diff --git a/library/platform_util.c b/library/platform_util.c
index db46fe9..16867aa 100644
--- a/library/platform_util.c
+++ b/library/platform_util.c
@@ -165,6 +165,15 @@
#endif
}
+/* Some compilers (armcc 5 for example) optimize away successive reads from a
+ * volatile local variable (which we use as a counter-measure to fault
+ * injection attacks), unless there is a call to an external function between
+ * them. This functions doesn't need to do anything, it just needs to be
+ * in another compilation unit. So here's a function that does nothing. */
+void mbedtls_platform_enforce_volatile_reads( void )
+{
+}
+
#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_PLATFORM_GMTIME_R_ALT)
#include <time.h>
#if !defined(_WIN32) && (defined(unix) || \
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index f7d331f..7c03b41 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -3567,9 +3567,7 @@
== MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
{
- const struct uECC_Curve_t * uecc_curve = uECC_secp256r1();
((void) n);
- ((void) ret);
if( (size_t)( end - p ) < 2 * NUM_ECC_BYTES + 2 )
return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
@@ -3577,11 +3575,11 @@
*p++ = 2 * NUM_ECC_BYTES + 1;
*p++ = 0x04; /* uncompressed point presentation */
- if( !uECC_make_key( p, ssl->handshake->ecdh_privkey,
- uecc_curve ) )
- {
+ ret = uECC_make_key( p, ssl->handshake->ecdh_privkey );
+ if( ret == UECC_FAULT_DETECTED )
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
+ if( ret != UECC_SUCCESS )
return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
- }
p += 2 * NUM_ECC_BYTES;
}
else
@@ -3718,9 +3716,7 @@
== MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
{
#if defined(MBEDTLS_USE_TINYCRYPT)
- const struct uECC_Curve_t * uecc_curve = uECC_secp256r1();
((void) n);
- ((void) ret);
if( (size_t)( end - p ) < 2 * NUM_ECC_BYTES + 2 )
return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
@@ -3728,11 +3724,11 @@
*p++ = 2 * NUM_ECC_BYTES + 1;
*p++ = 0x04; /* uncompressed point presentation */
- if( !uECC_make_key( p, ssl->handshake->ecdh_privkey,
- uecc_curve ) )
- {
+ ret = uECC_make_key( p, ssl->handshake->ecdh_privkey );
+ if( ret == UECC_FAULT_DETECTED )
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
+ if( ret != UECC_SUCCESS )
return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
- }
p += 2 * NUM_ECC_BYTES;
#else /* MBEDTLS_USE_TINYCRYPT */
/*
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index a9f983e..1ef8f94 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -3279,9 +3279,6 @@
unsigned char *dig_signed = NULL;
#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
#endif /* MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED */
-#if defined(MBEDTLS_USE_TINYCRYPT)
- const struct uECC_Curve_t * uecc_curve = uECC_secp256r1();
-#endif
(void) ciphersuite_info; /* unused in some configurations */
#if !defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
@@ -3413,6 +3410,7 @@
#if defined(MBEDTLS_USE_TINYCRYPT)
{
+ int ret;
static const unsigned char ecdh_param_hdr[] = {
MBEDTLS_SSL_EC_TLS_NAMED_CURVE,
0 /* high bits of secp256r1 TLS ID */,
@@ -3429,13 +3427,12 @@
ecdh_param_hdr, sizeof( ecdh_param_hdr ) );
ssl->out_msglen += sizeof( ecdh_param_hdr );
- if( !uECC_make_key( &ssl->out_msg[ ssl->out_msglen ],
- ssl->handshake->ecdh_privkey,
- uecc_curve ) )
- {
- MBEDTLS_SSL_DEBUG_MSG( 1, ( "Key creation failed" ) );
- return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
- }
+ ret = uECC_make_key( &ssl->out_msg[ ssl->out_msglen ],
+ ssl->handshake->ecdh_privkey );
+ if( ret == UECC_FAULT_DETECTED )
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
+ if( ret != UECC_SUCCESS )
+ return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
ssl->out_msglen += 2*NUM_ECC_BYTES;
}
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 988c593..c12af96 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -1973,16 +1973,13 @@
mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
== MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
{
- const struct uECC_Curve_t * uecc_curve = uECC_secp256r1();
- ((void) ret);
-
- if( !uECC_shared_secret( ssl->handshake->ecdh_peerkey,
- ssl->handshake->ecdh_privkey,
- ssl->handshake->premaster,
- uecc_curve ) )
- {
+ ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
+ ssl->handshake->ecdh_privkey,
+ ssl->handshake->premaster );
+ if( ret == UECC_FAULT_DETECTED )
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
+ if( ret != UECC_SUCCESS )
return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
- }
ssl->handshake->pmslen = NUM_ECC_BYTES;
}
@@ -2170,16 +2167,13 @@
size_t zlen;
#if defined(MBEDTLS_USE_TINYCRYPT)
- const struct uECC_Curve_t * uecc_curve = uECC_secp256r1();
- ((void) ret);
-
- if( !uECC_shared_secret( ssl->handshake->ecdh_peerkey,
- ssl->handshake->ecdh_privkey,
- p + 2,
- uecc_curve ) )
- {
+ ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
+ ssl->handshake->ecdh_privkey,
+ p + 2 );
+ if( ret == UECC_FAULT_DETECTED )
+ return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
+ if( ret != UECC_SUCCESS )
return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
- }
zlen = NUM_ECC_BYTES;
#else /* MBEDTLS_USE_TINYCRYPT */
diff --git a/library/x509_crt.c b/library/x509_crt.c
index e537983..fd3fa1a 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -43,6 +43,7 @@
#include "mbedtls/x509_internal.h"
#include "mbedtls/oid.h"
#include "mbedtls/platform_util.h"
+#include "mbedtls/platform.h"
#include <string.h>
@@ -2884,6 +2885,10 @@
return( 0 );
}
+/* This value is different enough from 0 that it's hard for an active physical
+ * attacker to reach it just by flipping a few bits. */
+#define X509_SIGNATURE_IS_GOOD 0x7f5a5a5a
+
/*
* Find a suitable parent for child in candidates, or return NULL.
*
@@ -2915,7 +2920,8 @@
* - [in] child: certificate for which we're looking for a parent
* - [in] candidates: chained list of potential parents
* - [out] r_parent: parent found (or NULL)
- * - [out] r_signature_is_good: 1 if child signature by parent is valid, or 0
+ * - [out] r_signature_is_good: set to X509_SIGNATURE_IS_GOOD if
+ * child signature by parent is valid, or to 0
* - [in] top: 1 if candidates consists of trusted roots, ie we're at the top
* of the chain, 0 otherwise
* - [in] path_cnt: number of intermediates seen so far
@@ -2938,8 +2944,9 @@
mbedtls_x509_crt_restart_ctx *rs_ctx )
{
int ret;
+ volatile int ret_fi = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
mbedtls_x509_crt *parent_crt;
- int signature_is_good;
+ int signature_is_good = 0;
#if defined(MBEDTLS_HAVE_TIME_DATE)
mbedtls_x509_crt *fallback_parent;
@@ -3018,10 +3025,10 @@
continue;
/* Signature */
- ret = x509_crt_check_signature( child_sig, parent_crt, rs_ctx );
+ ret_fi = x509_crt_check_signature( child_sig, parent_crt, rs_ctx );
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
- if( rs_ctx != NULL && ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
+ if( rs_ctx != NULL && ret_fi == MBEDTLS_ERR_ECP_IN_PROGRESS )
{
/* save state */
rs_ctx->parent = parent_crt;
@@ -3030,13 +3037,17 @@
rs_ctx->fallback_signature_is_good = fallback_signature_is_good;
#endif /* MBEDTLS_HAVE_TIME_DATE */
- return( ret );
+ return( ret_fi );
}
-#else
- (void) ret;
#endif
- signature_is_good = ret == 0;
+ if( ret_fi == 0 )
+ {
+ mbedtls_platform_enforce_volatile_reads();
+ if( ret_fi == 0 )
+ signature_is_good = X509_SIGNATURE_IS_GOOD;
+ }
+
if( top && ! signature_is_good )
continue;
@@ -3318,6 +3329,23 @@
#endif /* MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
/*
+ * This is used in addition to the flag for a specific issue, to ensure that
+ * it is not possible for an active physical attacker to entirely clear the
+ * flags just by flipping a single bit. Take advantage of the fact that all
+ * values defined in include/mbedtls/x509.h so far are 24-bit or less, so the
+ * top byte is free.
+ *
+ * Currently this protection is not compatible with the vrfy callback (as it
+ * can observ and modify flags freely), so it's only enabled when the callback
+ * is disabled.
+ */
+#if defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
+#define X509_BADCERT_FI_EXTRA 0xff000000u
+#else
+#define X509_BADCERT_FI_EXTRA 0u
+#endif
+
+/*
* Build and verify a certificate chain
*
* Given a peer-provided list of certificates EE, C1, ..., Cn and
@@ -3374,6 +3402,7 @@
int parent_is_trusted;
int child_is_trusted;
int signature_is_good;
+ volatile int signature_is_good_fi;
unsigned self_cnt;
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
@@ -3422,9 +3451,9 @@
#if !defined(MBEDTLS_X509_CRT_REMOVE_TIME)
/* Check time-validity (all certificates) */
if( mbedtls_x509_time_is_past( &child->valid_to ) )
- *flags |= MBEDTLS_X509_BADCERT_EXPIRED;
+ *flags |= MBEDTLS_X509_BADCERT_EXPIRED | X509_BADCERT_FI_EXTRA;
if( mbedtls_x509_time_is_future( &child->valid_from ) )
- *flags |= MBEDTLS_X509_BADCERT_FUTURE;
+ *flags |= MBEDTLS_X509_BADCERT_FUTURE | X509_BADCERT_FI_EXTRA;
#endif /* !MBEDTLS_X509_CRT_REMOVE_TIME */
/* Stop here for trusted roots (but not for trusted EE certs) */
@@ -3444,10 +3473,10 @@
/* Check signature algorithm: MD & PK algs */
if( x509_profile_check_md_alg( profile, child->sig_md ) != 0 )
- *flags |= MBEDTLS_X509_BADCERT_BAD_MD;
+ *flags |= MBEDTLS_X509_BADCERT_BAD_MD | X509_BADCERT_FI_EXTRA;
if( x509_profile_check_pk_alg( profile, child->sig_pk ) != 0 )
- *flags |= MBEDTLS_X509_BADCERT_BAD_PK;
+ *flags |= MBEDTLS_X509_BADCERT_BAD_PK | X509_BADCERT_FI_EXTRA;
/* Special case: EE certs that are locally trusted */
if( x509_crt_verify_chain_len( ver_chain ) == 1 && self_issued &&
@@ -3495,7 +3524,7 @@
/* No parent? We're done here */
if( parent_crt == NULL )
{
- *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED;
+ *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED | X509_BADCERT_FI_EXTRA;
return( 0 );
}
@@ -3516,8 +3545,13 @@
}
/* signature was checked while searching parent */
- if( ! signature_is_good )
- *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED;
+ signature_is_good_fi = signature_is_good;
+ if( signature_is_good_fi != X509_SIGNATURE_IS_GOOD )
+ *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED | X509_BADCERT_FI_EXTRA;
+
+ mbedtls_platform_enforce_volatile_reads();
+ if( signature_is_good_fi != X509_SIGNATURE_IS_GOOD )
+ *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED | X509_BADCERT_FI_EXTRA;
{
mbedtls_pk_context *parent_pk;
@@ -3527,7 +3561,7 @@
/* check size of signing key */
if( x509_profile_check_key( profile, parent_pk ) != 0 )
- *flags |= MBEDTLS_X509_BADCERT_BAD_KEY;
+ *flags |= MBEDTLS_X509_BADCERT_BAD_KEY | X509_BADCERT_FI_EXTRA;
mbedtls_x509_crt_pk_release( parent_crt );
}
@@ -3658,7 +3692,7 @@
if( ret != 0 )
ret = MBEDTLS_ERR_X509_FATAL_ERROR;
- *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH | X509_BADCERT_FI_EXTRA;
return( ret );
}
#endif /* !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
@@ -3747,6 +3781,7 @@
int ret;
mbedtls_x509_crt_verify_chain ver_chain;
uint32_t ee_flags;
+ volatile uint32_t flags_fi = (uint32_t) -1;
*flags = 0;
ee_flags = 0;
@@ -3780,10 +3815,10 @@
pk_type = mbedtls_pk_get_type( pk );
if( x509_profile_check_pk_alg( profile, pk_type ) != 0 )
- ee_flags |= MBEDTLS_X509_BADCERT_BAD_PK;
+ ee_flags |= MBEDTLS_X509_BADCERT_BAD_PK | X509_BADCERT_FI_EXTRA;
if( x509_profile_check_key( profile, pk ) != 0 )
- ee_flags |= MBEDTLS_X509_BADCERT_BAD_KEY;
+ ee_flags |= MBEDTLS_X509_BADCERT_BAD_KEY | X509_BADCERT_FI_EXTRA;
mbedtls_x509_crt_pk_release( crt );
}
@@ -3823,10 +3858,19 @@
return( ret );
}
- if( *flags != 0 )
- return( MBEDTLS_ERR_X509_CERT_VERIFY_FAILED );
+ flags_fi = *flags;
+ if( flags_fi == 0 )
+ {
+ mbedtls_platform_enforce_volatile_reads();
+ if( flags_fi == 0 )
+ return( 0 );
+ }
- return( 0 );
+ /* Preserve the API by removing internal extra bits - from now on the
+ * fact that flags is non-zero is also redundantly encoded by the
+ * non-zero return value from this function. */
+ *flags &= ~ X509_BADCERT_FI_EXTRA;
+ return( MBEDTLS_ERR_X509_CERT_VERIFY_FAILED );
}
/*
diff --git a/scripts/config.pl b/scripts/config.pl
index 619c5ca..ff522b6 100755
--- a/scripts/config.pl
+++ b/scripts/config.pl
@@ -213,11 +213,15 @@
# Check the config file is present
if (! -f $config_file) {
- chdir '..' or die;
-
- # Confirm this is the project root directory and try again
- if ( !(-d 'scripts' && -d 'include' && -d 'library' && -f $config_file) ) {
- die "If no file specified, must be run from the project root or scripts directory.\n";
+ if ( -d 'importer' && -d 'inc' && -d 'src') {
+ $config_file = "inc/mbedtls/config.h";
+ }
+ else {
+ chdir '..' or die;
+ # Confirm this is the project root directory and try again
+ if ( !(-d 'scripts' && -d 'include' && -d 'library' && -f $config_file) ) {
+ die "If no file specified, must be run from the project root or scripts directory.\n";
+ }
}
}
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 02f96a9..42ef32d 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -1491,7 +1491,7 @@
msg "build: arm-none-eabi-gcc MBEDTLS_NO_64BIT_MULTIPLICATION, make" # ~ 10s
scripts/config.pl baremetal
scripts/config.pl set MBEDTLS_NO_64BIT_MULTIPLICATION
- make CC=arm-none-eabi-gcc AR=arm-none-eabi-ar LD=arm-none-eabi-ld CFLAGS='-Werror -O1 -march=armv6-m -mthumb' lib
+ make TINYCRYPT_BUILD=0 CC=arm-none-eabi-gcc AR=arm-none-eabi-ar LD=arm-none-eabi-ld CFLAGS='-Werror -O1 -march=armv6-m -mthumb' lib
echo "Checking that software 64-bit multiplication is not required"
if_build_succeeded not grep __aeabi_lmul library/*.o
}
diff --git a/tests/scripts/basic-build-test.sh b/tests/scripts/basic-build-test.sh
index 8990dfb..d559fa5 100755
--- a/tests/scripts/basic-build-test.sh
+++ b/tests/scripts/basic-build-test.sh
@@ -25,13 +25,37 @@
#
# This script has been written to be generic and should work on any shell.
#
-# Usage: basic-build-tests.sh
+# Usage: basic-build-tests.sh to run all tests
+# basic-build-tests.sh unit_test to run only unit tests
#
# Abort on errors (and uninitiliased variables)
set -eu
-if [ -d library -a -d include -a -d tests ]; then :; else
+CONFIG_H='include/mbedtls/config.h'
+CONFIG_BAK="$CONFIG_H.bak"
+
+UNIT_TESTS_ONLY=0
+
+echo
+if [ -z ${1+x} ]
+then
+ echo "Running all tests"
+else
+ if [ "$1" = "unit_test" ]
+ then
+ echo "Running only unit tests"
+ UNIT_TESTS_ONLY=1
+ fi
+fi
+echo
+
+# Check test environment. If importer, src and inc folders are present then
+# there is a different directory structure and we need to adapt to it.
+if [ -d importer -a -d inc -a -d src ]; then
+ CONFIG_H='inc/mbedtls/config.h'
+ CONFIG_BAK="$CONFIG_H.bak"
+elif [ -d library -a -d include -a -d tests ]; then :; else
echo "Must be run from mbed TLS root" >&2
exit 1
fi
@@ -49,9 +73,6 @@
export GNUTLS_CLI="$GNUTLS_CLI"
export GNUTLS_SERV="$GNUTLS_SERV"
-CONFIG_H='include/mbedtls/config.h'
-CONFIG_BAK="$CONFIG_H.bak"
-
# Step 0 - print build environment info
OPENSSL="$OPENSSL" \
OPENSSL_LEGACY="$OPENSSL_LEGACY" \
@@ -79,6 +100,12 @@
perl scripts/run-test-suites.pl -v 2 |tee unit-test-$TEST_OUTPUT
echo
+# only unit test are run?
+if [ $UNIT_TESTS_ONLY -eq 1 ]
+then
+ exit 0
+fi
+
# Step 2b - System Tests
sh ssl-opt.sh |tee sys-test-$TEST_OUTPUT
echo
diff --git a/tests/scripts/list-symbols.sh b/tests/scripts/list-symbols.sh
index 930722c..12b3281 100755
--- a/tests/scripts/list-symbols.sh
+++ b/tests/scripts/list-symbols.sh
@@ -16,7 +16,7 @@
scripts/config.pl full
make clean
make_ret=
-CFLAGS=-fno-asynchronous-unwind-tables make lib \
+CFLAGS=-fno-asynchronous-unwind-tables TINYCRYPT_BUILD=0 make lib \
>list-symbols.make.log 2>&1 ||
{
make_ret=$?
diff --git a/tests/suites/test_suite_pk.function b/tests/suites/test_suite_pk.function
index 2fd48c2..61bf95c 100644
--- a/tests/suites/test_suite_pk.function
+++ b/tests/suites/test_suite_pk.function
@@ -35,9 +35,8 @@
int ret;
ret = uECC_make_key( mbedtls_pk_uecc( *pk )->public_key,
- mbedtls_pk_uecc( *pk )->private_key,
- uECC_secp256r1() );
- if( ret == 0 )
+ mbedtls_pk_uecc( *pk )->private_key );
+ if( ret != UECC_SUCCESS )
return( -1 );
return( 0 );
diff --git a/tests/suites/test_suite_pkparse.function b/tests/suites/test_suite_pkparse.function
index a4d9466..54fa7af 100644
--- a/tests/suites/test_suite_pkparse.function
+++ b/tests/suites/test_suite_pkparse.function
@@ -93,8 +93,7 @@
TEST_ASSERT( mbedtls_ecp_check_pubkey( &eckey->grp, &eckey->Q ) == 0 );
#else
uecckey = mbedtls_pk_uecc( ctx );
- TEST_ASSERT( uECC_valid_public_key( uecckey->public_key,
- uECC_secp256r1() ) == 0 );
+ TEST_ASSERT( uECC_valid_public_key( uecckey->public_key ) == 0 );
#endif /* MBEDTLS_USE_TINYCRYPT */
}
@@ -136,11 +135,9 @@
TEST_ASSERT( mbedtls_ecp_check_privkey( &eckey->grp, &eckey->d ) == 0 );
#else
uecckey = mbedtls_pk_uecc( ctx );
- TEST_ASSERT( uECC_valid_public_key( uecckey->public_key,
- uECC_secp256r1() ) == 0 );
+ TEST_ASSERT( uECC_valid_public_key( uecckey->public_key ) == 0 );
TEST_ASSERT( uECC_compute_public_key( uecckey->private_key,
- tmp_pubkey,
- uECC_secp256r1() ) != 0 );
+ tmp_pubkey ) == UECC_SUCCESS );
TEST_ASSERT( memcmp( tmp_pubkey, uecckey->public_key,
sizeof( tmp_pubkey ) ) == 0 );
#endif /* MBEDTLS_USE_TINYCRYPT */
diff --git a/tests/suites/test_suite_tinycrypt.data b/tests/suites/test_suite_tinycrypt.data
index ac2a8e2..2c4d54b 100644
--- a/tests/suites/test_suite_tinycrypt.data
+++ b/tests/suites/test_suite_tinycrypt.data
@@ -8,4 +8,4 @@
ecdh_primitive_testvec:"C88F01F510D9AC3F70A292DAA2316DE544E9AAB8AFE84049C62A9C57862D1433":"DAD0B65394221CF9B051E1FECA5787D098DFE637FC90B9EF945D0C3772581180":"5271A0461CDB8252D61F1C456FA3E59AB1F45B33ACCF5F58389E0577B8990BB3":"C6EF9C5D78AE012A011164ACB397CE2088685D8F06BF9BE0B283AB46476BEE53":"D12DFB5289C8D4F81208B70270398C342296970A0BCCB74C736FC7554494BF63":"56FBF3CA366CC23E8157854C13C58D6AAC23F046ADA30F8353E74F33039872AB":"D6840F6B42F6EDAFD13116E0E12565202FEF8E9ECE7DCE03812464D04B9442DE"
ECDSA primitive rfc 4754 p256
-ecdsa_primitive_testvec:"2442A5CC0ECD015FA3CA31DC8E2BBC70BF42D60CBCA20085E0822CB04235E970":"6FC98BD7E50211A4A27102FA3549DF79EBCB4BF246B80945CDDFE7D509BBFD7D":"BA7816BF8F01CFEA414140DE5DAE2223B00361A396177A9CB410FF61F20015AD":"CB28E0999B9C7715FD0A80D8E47A77079716CBBF917DD72E97566EA1C066957C":"86FA3BB4E26CAD5BF90B7F81899256CE7594BB1EA0C89212748BFF3B3D5B0315":1
+ecdsa_primitive_testvec:"2442A5CC0ECD015FA3CA31DC8E2BBC70BF42D60CBCA20085E0822CB04235E970":"6FC98BD7E50211A4A27102FA3549DF79EBCB4BF246B80945CDDFE7D509BBFD7D":"BA7816BF8F01CFEA414140DE5DAE2223B00361A396177A9CB410FF61F20015AD":"CB28E0999B9C7715FD0A80D8E47A77079716CBBF917DD72E97566EA1C066957C":"86FA3BB4E26CAD5BF90B7F81899256CE7594BB1EA0C89212748BFF3B3D5B0315"
diff --git a/tests/suites/test_suite_tinycrypt.function b/tests/suites/test_suite_tinycrypt.function
index 24b331d..3247e05 100644
--- a/tests/suites/test_suite_tinycrypt.function
+++ b/tests/suites/test_suite_tinycrypt.function
@@ -21,17 +21,15 @@
uint8_t secret1[NUM_ECC_BYTES] = {0};
uint8_t secret2[NUM_ECC_BYTES] = {0};
- const struct uECC_Curve_t * curve = uECC_secp256r1();
-
uECC_set_rng( &uecc_rng_wrapper );
- TEST_ASSERT( uECC_make_key( public1, private1, curve ) != 0 );
+ TEST_ASSERT( uECC_make_key( public1, private1 ) == UECC_SUCCESS );
- TEST_ASSERT( uECC_make_key( public2, private2, curve ) != 0 );
+ TEST_ASSERT( uECC_make_key( public2, private2 ) == UECC_SUCCESS );
- TEST_ASSERT( uECC_shared_secret( public2, private1, secret1, curve ) != 0 );
+ TEST_ASSERT( uECC_shared_secret( public2, private1, secret1 ) == UECC_SUCCESS );
- TEST_ASSERT( uECC_shared_secret( public1, private2, secret2, curve ) != 0 );
+ TEST_ASSERT( uECC_shared_secret( public1, private2, secret2 ) == UECC_SUCCESS );
TEST_ASSERT( memcmp( secret1, secret2, sizeof( secret1 ) ) == 0 );
}
@@ -45,17 +43,15 @@
uint8_t hash[NUM_ECC_BYTES] = {0};
uint8_t sig[2*NUM_ECC_BYTES] = {0};
- const struct uECC_Curve_t * curve = uECC_secp256r1();
-
uECC_set_rng( &uecc_rng_wrapper );
TEST_ASSERT( rnd_std_rand( NULL, hash, NUM_ECC_BYTES ) == 0 );
- TEST_ASSERT( uECC_make_key( public, private, curve ) != 0 );
+ TEST_ASSERT( uECC_make_key( public, private ) == UECC_SUCCESS );
- TEST_ASSERT( uECC_sign( private, hash, sizeof( hash ), sig, curve ) != 0 );
+ TEST_ASSERT( uECC_sign( private, hash, sizeof( hash ), sig ) == UECC_SUCCESS );
- TEST_ASSERT( uECC_verify( public, hash, sizeof( hash ), sig, curve ) != 0 );
+ TEST_ASSERT( uECC_verify( public, hash, sizeof( hash ), sig ) == UECC_SUCCESS );
}
/* END_CASE */
@@ -64,7 +60,6 @@
data_t * yA_str, data_t * private2,
data_t * xB_str, data_t * yB_str, data_t * z_str )
{
- const struct uECC_Curve_t * curve = uECC_secp256r1();
uint8_t public1[2*NUM_ECC_BYTES] = {0};
uint8_t public2[2*NUM_ECC_BYTES] = {0};
uint8_t secret1[NUM_ECC_BYTES] = {0};
@@ -76,9 +71,9 @@
memcpy( public2 + NUM_ECC_BYTES, yB_str->x, yB_str->len );
// Compute shared secrets and compare to test vector secret
- TEST_ASSERT( uECC_shared_secret( public2, private1->x, secret1, curve ) != 0 );
+ TEST_ASSERT( uECC_shared_secret( public2, private1->x, secret1 ) == UECC_SUCCESS );
- TEST_ASSERT( uECC_shared_secret( public1, private2->x, secret2, curve ) != 0 );
+ TEST_ASSERT( uECC_shared_secret( public1, private2->x, secret2 ) == UECC_SUCCESS );
TEST_ASSERT( memcmp( secret1, secret2, sizeof( secret1 ) ) == 0 );
TEST_ASSERT( memcmp( secret1, z_str->x, sizeof( secret1 ) ) == 0 );
@@ -88,10 +83,8 @@
/* BEGIN_CASE depends_on:MBEDTLS_USE_TINYCRYPT */
void ecdsa_primitive_testvec( data_t * xQ_str, data_t * yQ_str,
- data_t * hash, data_t * r_str, data_t * s_str,
- int result )
+ data_t * hash, data_t * r_str, data_t * s_str )
{
- const struct uECC_Curve_t * curve = uECC_secp256r1();
uint8_t pub_bytes[2*NUM_ECC_BYTES] = {0};
uint8_t sig_bytes[2*NUM_ECC_BYTES] = {0};
@@ -101,7 +94,7 @@
memcpy( sig_bytes + NUM_ECC_BYTES, s_str->x, r_str->len );
TEST_ASSERT( uECC_verify( pub_bytes, hash->x, hash->len,
- sig_bytes, curve ) == result );
+ sig_bytes ) == UECC_SUCCESS );
// Alter the signature and check the verification fails
for( int i = 0; i < 2*NUM_ECC_BYTES; i++ )
@@ -109,7 +102,7 @@
uint8_t temp = sig_bytes[i];
sig_bytes[i] = ( sig_bytes[i] + 1 ) % 256;
TEST_ASSERT( uECC_verify( pub_bytes, hash->x, hash->len,
- sig_bytes, curve ) == 0 );
+ sig_bytes ) == UECC_FAILURE );
sig_bytes[i] = temp;
}
diff --git a/tinycrypt/ecc.c b/tinycrypt/ecc.c
index d01c676..a0333b0 100644
--- a/tinycrypt/ecc.c
+++ b/tinycrypt/ecc.c
@@ -63,11 +63,117 @@
#include MBEDTLS_CONFIG_FILE
#endif
-#if defined(MBEDTLS_USE_TINYCRYPT)
#include <tinycrypt/ecc.h>
#include "mbedtls/platform_util.h"
+#include "mbedtls/sha256.h"
#include <string.h>
+/* Parameters for curve NIST P-256 aka secp256r1 */
+const uECC_word_t curve_p[NUM_ECC_WORDS] = {
+ BYTES_TO_WORDS_8(FF, FF, FF, FF, FF, FF, FF, FF),
+ BYTES_TO_WORDS_8(FF, FF, FF, FF, 00, 00, 00, 00),
+ BYTES_TO_WORDS_8(00, 00, 00, 00, 00, 00, 00, 00),
+ BYTES_TO_WORDS_8(01, 00, 00, 00, FF, FF, FF, FF)
+};
+const uECC_word_t curve_n[NUM_ECC_WORDS] = {
+ BYTES_TO_WORDS_8(51, 25, 63, FC, C2, CA, B9, F3),
+ BYTES_TO_WORDS_8(84, 9E, 17, A7, AD, FA, E6, BC),
+ BYTES_TO_WORDS_8(FF, FF, FF, FF, FF, FF, FF, FF),
+ BYTES_TO_WORDS_8(00, 00, 00, 00, FF, FF, FF, FF)
+};
+const uECC_word_t curve_G[2 * NUM_ECC_WORDS] = {
+ BYTES_TO_WORDS_8(96, C2, 98, D8, 45, 39, A1, F4),
+ BYTES_TO_WORDS_8(A0, 33, EB, 2D, 81, 7D, 03, 77),
+ BYTES_TO_WORDS_8(F2, 40, A4, 63, E5, E6, BC, F8),
+ BYTES_TO_WORDS_8(47, 42, 2C, E1, F2, D1, 17, 6B),
+ BYTES_TO_WORDS_8(F5, 51, BF, 37, 68, 40, B6, CB),
+ BYTES_TO_WORDS_8(CE, 5E, 31, 6B, 57, 33, CE, 2B),
+ BYTES_TO_WORDS_8(16, 9E, 0F, 7C, 4A, EB, E7, 8E),
+ BYTES_TO_WORDS_8(9B, 7F, 1A, FE, E2, 42, E3, 4F)
+};
+const uECC_word_t curve_b[NUM_ECC_WORDS] = {
+ BYTES_TO_WORDS_8(4B, 60, D2, 27, 3E, 3C, CE, 3B),
+ BYTES_TO_WORDS_8(F6, B0, 53, CC, B0, 06, 1D, 65),
+ BYTES_TO_WORDS_8(BC, 86, 98, 76, 55, BD, EB, B3),
+ BYTES_TO_WORDS_8(E7, 93, 3A, AA, D8, 35, C6, 5A)
+};
+
+static int uECC_update_param_sha256(mbedtls_sha256_context *ctx,
+ const uECC_word_t val[NUM_ECC_WORDS])
+{
+ uint8_t bytes[NUM_ECC_BYTES];
+
+ uECC_vli_nativeToBytes(bytes, NUM_ECC_BYTES, val);
+ return mbedtls_sha256_update_ret(ctx, bytes, NUM_ECC_BYTES);
+}
+
+static int uECC_compute_param_sha256(unsigned char output[32])
+{
+ int ret = UECC_FAILURE;
+ mbedtls_sha256_context ctx;
+
+ mbedtls_sha256_init( &ctx );
+
+ if (mbedtls_sha256_starts_ret(&ctx, 0) != 0) {
+ goto exit;
+ }
+
+ if (uECC_update_param_sha256(&ctx, curve_p) != 0 ||
+ uECC_update_param_sha256(&ctx, curve_n) != 0 ||
+ uECC_update_param_sha256(&ctx, curve_G) != 0 ||
+ uECC_update_param_sha256(&ctx, curve_G + NUM_ECC_WORDS) != 0 ||
+ uECC_update_param_sha256(&ctx, curve_b) != 0)
+ {
+ goto exit;
+ }
+
+ if (mbedtls_sha256_finish_ret(&ctx, output) != 0) {
+ goto exit;
+ }
+
+ ret = UECC_SUCCESS;
+
+exit:
+ mbedtls_sha256_free( &ctx );
+
+ return ret;
+}
+
+/*
+ * Check integrity of curve parameters.
+ * Return 0 if everything's OK, non-zero otherwise.
+ */
+static int uECC_check_curve_integrity(void)
+{
+ unsigned char computed[32];
+ static const unsigned char reference[32] = {
+ 0x2d, 0xa1, 0xa4, 0x64, 0x45, 0x28, 0x0d, 0xe1,
+ 0x93, 0xf9, 0x29, 0x2f, 0xac, 0x3e, 0xe2, 0x92,
+ 0x76, 0x0a, 0xe2, 0xbc, 0xce, 0x2a, 0xa2, 0xc6,
+ 0x38, 0xf2, 0x19, 0x1d, 0x76, 0x72, 0x93, 0x49,
+ };
+ unsigned char diff = 0;
+ unsigned char tmp1, tmp2;
+ volatile unsigned i;
+
+ if (uECC_compute_param_sha256(computed) != UECC_SUCCESS) {
+ return UECC_FAILURE;
+ }
+
+ for (i = 0; i < 32; i++) {
+ /* make sure the order of volatile accesses is well-defined */
+ tmp1 = computed[i];
+ tmp2 = reference[i];
+ diff |= tmp1 ^ tmp2;
+ }
+
+ /* i should be 32 */
+ mbedtls_platform_enforce_volatile_reads();
+ diff |= (unsigned char) i ^ 32;
+
+ return diff;
+}
+
/* IMPORTANT: Make sure a cryptographically-secure PRNG is set and the platform
* has access to enough entropy in order to feed the PRNG regularly. */
#if default_RNG_defined
@@ -86,14 +192,14 @@
return g_rng_function;
}
-int uECC_curve_private_key_size(uECC_Curve curve)
+int uECC_curve_private_key_size(void)
{
- return BITS_TO_BYTES(curve->num_n_bits);
+ return BITS_TO_BYTES(NUM_ECC_BITS);
}
-int uECC_curve_public_key_size(uECC_Curve curve)
+int uECC_curve_public_key_size(void)
{
- return 2 * curve->num_bytes;
+ return 2 * NUM_ECC_BYTES;
}
void uECC_vli_clear(uECC_word_t *vli)
@@ -180,12 +286,20 @@
{
uECC_word_t diff = 0;
- wordcount_t i;
+ uECC_word_t tmp1, tmp2;
+ volatile int i;
for (i = NUM_ECC_WORDS - 1; i >= 0; --i) {
- diff |= (left[i] ^ right[i]);
+ tmp1 = left[i];
+ tmp2 = right[i];
+ diff |= (tmp1 ^ tmp2);
}
- return !(diff == 0);
+
+ /* i should be -1 now */
+ mbedtls_platform_enforce_volatile_reads();
+ diff |= i ^ -1;
+
+ return diff;
}
uECC_word_t cond_set(uECC_word_t p_true, uECC_word_t p_false, unsigned int cond)
@@ -576,12 +690,12 @@
/* ------ Point operations ------ */
void double_jacobian_default(uECC_word_t * X1, uECC_word_t * Y1,
- uECC_word_t * Z1, uECC_Curve curve)
+ uECC_word_t * Z1)
{
/* t1 = X, t2 = Y, t3 = Z */
uECC_word_t t4[NUM_ECC_WORDS];
uECC_word_t t5[NUM_ECC_WORDS];
- wordcount_t num_words = curve->num_words;
+ wordcount_t num_words = NUM_ECC_WORDS;
if (uECC_vli_isZero(Z1)) {
return;
@@ -593,15 +707,15 @@
uECC_vli_modMult_fast(Y1, Y1, Z1); /* t2 = y1*z1 = z3 */
uECC_vli_modMult_fast(Z1, Z1, Z1); /* t3 = z1^2 */
- uECC_vli_modAdd(X1, X1, Z1, curve->p); /* t1 = x1 + z1^2 */
- uECC_vli_modAdd(Z1, Z1, Z1, curve->p); /* t3 = 2*z1^2 */
- uECC_vli_modSub(Z1, X1, Z1, curve->p); /* t3 = x1 - z1^2 */
+ uECC_vli_modAdd(X1, X1, Z1, curve_p); /* t1 = x1 + z1^2 */
+ uECC_vli_modAdd(Z1, Z1, Z1, curve_p); /* t3 = 2*z1^2 */
+ uECC_vli_modSub(Z1, X1, Z1, curve_p); /* t3 = x1 - z1^2 */
uECC_vli_modMult_fast(X1, X1, Z1); /* t1 = x1^2 - z1^4 */
- uECC_vli_modAdd(Z1, X1, X1, curve->p); /* t3 = 2*(x1^2 - z1^4) */
- uECC_vli_modAdd(X1, X1, Z1, curve->p); /* t1 = 3*(x1^2 - z1^4) */
+ uECC_vli_modAdd(Z1, X1, X1, curve_p); /* t3 = 2*(x1^2 - z1^4) */
+ uECC_vli_modAdd(X1, X1, Z1, curve_p); /* t1 = 3*(x1^2 - z1^4) */
if (uECC_vli_testBit(X1, 0)) {
- uECC_word_t l_carry = uECC_vli_add(X1, X1, curve->p);
+ uECC_word_t l_carry = uECC_vli_add(X1, X1, curve_p);
uECC_vli_rshift1(X1);
X1[num_words - 1] |= l_carry << (uECC_WORD_BITS - 1);
} else {
@@ -610,34 +724,34 @@
/* t1 = 3/2*(x1^2 - z1^4) = B */
uECC_vli_modMult_fast(Z1, X1, X1); /* t3 = B^2 */
- uECC_vli_modSub(Z1, Z1, t5, curve->p); /* t3 = B^2 - A */
- uECC_vli_modSub(Z1, Z1, t5, curve->p); /* t3 = B^2 - 2A = x3 */
- uECC_vli_modSub(t5, t5, Z1, curve->p); /* t5 = A - x3 */
+ uECC_vli_modSub(Z1, Z1, t5, curve_p); /* t3 = B^2 - A */
+ uECC_vli_modSub(Z1, Z1, t5, curve_p); /* t3 = B^2 - 2A = x3 */
+ uECC_vli_modSub(t5, t5, Z1, curve_p); /* t5 = A - x3 */
uECC_vli_modMult_fast(X1, X1, t5); /* t1 = B * (A - x3) */
/* t4 = B * (A - x3) - y1^4 = y3: */
- uECC_vli_modSub(t4, X1, t4, curve->p);
+ uECC_vli_modSub(t4, X1, t4, curve_p);
uECC_vli_set(X1, Z1);
uECC_vli_set(Z1, Y1);
uECC_vli_set(Y1, t4);
}
-void x_side_default(uECC_word_t *result,
- const uECC_word_t *x,
- uECC_Curve curve)
+/*
+ * @brief Computes x^3 + ax + b. result must not overlap x.
+ * @param result OUT -- x^3 + ax + b
+ * @param x IN -- value of x
+ * @param curve IN -- elliptic curve
+ */
+static void x_side_default(uECC_word_t *result,
+ const uECC_word_t *x)
{
uECC_word_t _3[NUM_ECC_WORDS] = {3}; /* -a = 3 */
uECC_vli_modMult_fast(result, x, x); /* r = x^2 */
- uECC_vli_modSub(result, result, _3, curve->p); /* r = x^2 - 3 */
+ uECC_vli_modSub(result, result, _3, curve_p); /* r = x^2 - 3 */
uECC_vli_modMult_fast(result, result, x); /* r = x^3 - 3x */
/* r = x^3 - 3x + b: */
- uECC_vli_modAdd(result, result, curve->b, curve->p);
-}
-
-uECC_Curve uECC_secp256r1(void)
-{
- return &curve_secp256r1;
+ uECC_vli_modAdd(result, result, curve_b, curve_p);
}
void vli_mmod_fast_secp256r1(unsigned int *result, unsigned int*product)
@@ -730,20 +844,19 @@
if (carry < 0) {
do {
- carry += uECC_vli_add(result, result, curve_secp256r1.p);
+ carry += uECC_vli_add(result, result, curve_p);
}
while (carry < 0);
} else {
while (carry ||
- uECC_vli_cmp_unsafe(curve_secp256r1.p, result) != 1) {
- carry -= uECC_vli_sub(result, result, curve_secp256r1.p);
+ uECC_vli_cmp_unsafe(curve_p, result) != 1) {
+ carry -= uECC_vli_sub(result, result, curve_p);
}
}
}
-uECC_word_t EccPoint_isZero(const uECC_word_t *point, uECC_Curve curve)
+uECC_word_t EccPoint_isZero(const uECC_word_t *point)
{
- (void) curve;
return uECC_vli_isZero(point);
}
@@ -760,8 +873,7 @@
/* P = (x1, y1) => 2P, (x2, y2) => P' */
static void XYcZ_initial_double(uECC_word_t * X1, uECC_word_t * Y1,
uECC_word_t * X2, uECC_word_t * Y2,
- const uECC_word_t * const initial_Z,
- uECC_Curve curve)
+ const uECC_word_t * const initial_Z)
{
uECC_word_t z[NUM_ECC_WORDS];
if (initial_Z) {
@@ -775,7 +887,7 @@
uECC_vli_set(Y2, Y1);
apply_z(X1, Y1, z);
- curve->double_jacobian(X1, Y1, z, curve);
+ double_jacobian_default(X1, Y1, z);
apply_z(X2, Y2, z);
}
@@ -785,31 +897,28 @@
{
/* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */
uECC_word_t t5[NUM_ECC_WORDS];
- const uECC_Curve curve = &curve_secp256r1;
- uECC_vli_modSub(t5, X2, X1, curve->p); /* t5 = x2 - x1 */
+ uECC_vli_modSub(t5, X2, X1, curve_p); /* t5 = x2 - x1 */
uECC_vli_modMult_rnd(t5, t5, t5, s); /* t5 = (x2 - x1)^2 = A */
uECC_vli_modMult_rnd(X1, X1, t5, s); /* t1 = x1*A = B */
uECC_vli_modMult_rnd(X2, X2, t5, s); /* t3 = x2*A = C */
- uECC_vli_modSub(Y2, Y2, Y1, curve->p); /* t4 = y2 - y1 */
+ uECC_vli_modSub(Y2, Y2, Y1, curve_p); /* t4 = y2 - y1 */
uECC_vli_modMult_rnd(t5, Y2, Y2, s); /* t5 = (y2 - y1)^2 = D */
- uECC_vli_modSub(t5, t5, X1, curve->p); /* t5 = D - B */
- uECC_vli_modSub(t5, t5, X2, curve->p); /* t5 = D - B - C = x3 */
- uECC_vli_modSub(X2, X2, X1, curve->p); /* t3 = C - B */
+ uECC_vli_modSub(t5, t5, X1, curve_p); /* t5 = D - B */
+ uECC_vli_modSub(t5, t5, X2, curve_p); /* t5 = D - B - C = x3 */
+ uECC_vli_modSub(X2, X2, X1, curve_p); /* t3 = C - B */
uECC_vli_modMult_rnd(Y1, Y1, X2, s); /* t2 = y1*(C - B) */
- uECC_vli_modSub(X2, X1, t5, curve->p); /* t3 = B - x3 */
+ uECC_vli_modSub(X2, X1, t5, curve_p); /* t3 = B - x3 */
uECC_vli_modMult_rnd(Y2, Y2, X2, s); /* t4 = (y2 - y1)*(B - x3) */
- uECC_vli_modSub(Y2, Y2, Y1, curve->p); /* t4 = y3 */
+ uECC_vli_modSub(Y2, Y2, Y1, curve_p); /* t4 = y3 */
uECC_vli_set(X2, t5);
}
void XYcZ_add(uECC_word_t * X1, uECC_word_t * Y1,
- uECC_word_t * X2, uECC_word_t * Y2,
- uECC_Curve curve)
+ uECC_word_t * X2, uECC_word_t * Y2)
{
- (void) curve;
XYcZ_add_rnd(X1, Y1, X2, Y2, NULL);
}
@@ -825,32 +934,31 @@
uECC_word_t t5[NUM_ECC_WORDS];
uECC_word_t t6[NUM_ECC_WORDS];
uECC_word_t t7[NUM_ECC_WORDS];
- const uECC_Curve curve = &curve_secp256r1;
- uECC_vli_modSub(t5, X2, X1, curve->p); /* t5 = x2 - x1 */
+ uECC_vli_modSub(t5, X2, X1, curve_p); /* t5 = x2 - x1 */
uECC_vli_modMult_rnd(t5, t5, t5, s); /* t5 = (x2 - x1)^2 = A */
uECC_vli_modMult_rnd(X1, X1, t5, s); /* t1 = x1*A = B */
uECC_vli_modMult_rnd(X2, X2, t5, s); /* t3 = x2*A = C */
- uECC_vli_modAdd(t5, Y2, Y1, curve->p); /* t5 = y2 + y1 */
- uECC_vli_modSub(Y2, Y2, Y1, curve->p); /* t4 = y2 - y1 */
+ uECC_vli_modAdd(t5, Y2, Y1, curve_p); /* t5 = y2 + y1 */
+ uECC_vli_modSub(Y2, Y2, Y1, curve_p); /* t4 = y2 - y1 */
- uECC_vli_modSub(t6, X2, X1, curve->p); /* t6 = C - B */
+ uECC_vli_modSub(t6, X2, X1, curve_p); /* t6 = C - B */
uECC_vli_modMult_rnd(Y1, Y1, t6, s); /* t2 = y1 * (C - B) = E */
- uECC_vli_modAdd(t6, X1, X2, curve->p); /* t6 = B + C */
+ uECC_vli_modAdd(t6, X1, X2, curve_p); /* t6 = B + C */
uECC_vli_modMult_rnd(X2, Y2, Y2, s); /* t3 = (y2 - y1)^2 = D */
- uECC_vli_modSub(X2, X2, t6, curve->p); /* t3 = D - (B + C) = x3 */
+ uECC_vli_modSub(X2, X2, t6, curve_p); /* t3 = D - (B + C) = x3 */
- uECC_vli_modSub(t7, X1, X2, curve->p); /* t7 = B - x3 */
+ uECC_vli_modSub(t7, X1, X2, curve_p); /* t7 = B - x3 */
uECC_vli_modMult_rnd(Y2, Y2, t7, s); /* t4 = (y2 - y1)*(B - x3) */
/* t4 = (y2 - y1)*(B - x3) - E = y3: */
- uECC_vli_modSub(Y2, Y2, Y1, curve->p);
+ uECC_vli_modSub(Y2, Y2, Y1, curve_p);
uECC_vli_modMult_rnd(t7, t5, t5, s); /* t7 = (y2 + y1)^2 = F */
- uECC_vli_modSub(t7, t7, t6, curve->p); /* t7 = F - (B + C) = x3' */
- uECC_vli_modSub(t6, t7, X1, curve->p); /* t6 = x3' - B */
+ uECC_vli_modSub(t7, t7, t6, curve_p); /* t7 = F - (B + C) = x3' */
+ uECC_vli_modSub(t6, t7, X1, curve_p); /* t6 = x3' - B */
uECC_vli_modMult_rnd(t6, t6, t5, s); /* t6 = (y2+y1)*(x3' - B) */
/* t2 = (y2+y1)*(x3' - B) - E = y3': */
- uECC_vli_modSub(Y1, t6, Y1, curve->p);
+ uECC_vli_modSub(Y1, t6, Y1, curve_p);
uECC_vli_set(X1, t7);
}
@@ -867,14 +975,13 @@
uECC_word_t nb;
const wordcount_t num_words = NUM_ECC_WORDS;
const bitcount_t num_bits = NUM_ECC_BITS + 1; /* from regularize_k */
- const uECC_Curve curve = uECC_secp256r1();
ecc_wait_state_t wait_state;
ecc_wait_state_t * const ws = g_rng_function ? &wait_state : NULL;
uECC_vli_set(Rx[1], point);
uECC_vli_set(Ry[1], point + num_words);
- XYcZ_initial_double(Rx[1], Ry[1], Rx[0], Ry[0], initial_Z, curve);
+ XYcZ_initial_double(Rx[1], Ry[1], Rx[0], Ry[0], initial_Z);
for (i = num_bits - 2; i > 0; --i) {
ecc_wait_state_reset(ws);
@@ -888,10 +995,10 @@
XYcZ_addC_rnd(Rx[1 - nb], Ry[1 - nb], Rx[nb], Ry[nb], ws);
/* Find final 1/Z value. */
- uECC_vli_modSub(z, Rx[1], Rx[0], curve->p); /* X1 - X0 */
+ uECC_vli_modSub(z, Rx[1], Rx[0], curve_p); /* X1 - X0 */
uECC_vli_modMult_fast(z, z, Ry[1 - nb]); /* Yb * (X1 - X0) */
uECC_vli_modMult_fast(z, z, point); /* xP * Yb * (X1 - X0) */
- uECC_vli_modInv(z, z, curve->p); /* 1 / (xP * Yb * (X1 - X0))*/
+ uECC_vli_modInv(z, z, curve_p); /* 1 / (xP * Yb * (X1 - X0))*/
/* yP / (xP * Yb * (X1 - X0)) */
uECC_vli_modMult_fast(z, z, point + num_words);
/* Xb * yP / (xP * Yb * (X1 - X0)) */
@@ -911,19 +1018,18 @@
wordcount_t num_n_words = NUM_ECC_WORDS;
bitcount_t num_n_bits = NUM_ECC_BITS;
- const uECC_Curve curve = uECC_secp256r1();
- uECC_word_t carry = uECC_vli_add(k0, k, curve->n) ||
+ uECC_word_t carry = uECC_vli_add(k0, k, curve_n) ||
(num_n_bits < ((bitcount_t)num_n_words * uECC_WORD_SIZE * 8) &&
uECC_vli_testBit(k0, num_n_bits));
- uECC_vli_add(k1, k0, curve->n);
+ uECC_vli_add(k1, k0, curve_n);
return carry;
}
int EccPoint_mult_safer(uECC_word_t * result, const uECC_word_t * point,
- const uECC_word_t * scalar, uECC_Curve curve)
+ const uECC_word_t * scalar)
{
uECC_word_t tmp[NUM_ECC_WORDS];
uECC_word_t s[NUM_ECC_WORDS];
@@ -931,10 +1037,32 @@
wordcount_t num_words = NUM_ECC_WORDS;
uECC_word_t carry;
uECC_word_t *initial_Z = 0;
- int r;
+ int r = UECC_FAULT_DETECTED;
+ volatile int problem;
- if (curve != uECC_secp256r1())
- return 0;
+ /* Protect against faults modifying curve paremeters in flash */
+ problem = -1;
+ problem = uECC_check_curve_integrity();
+ if (problem != 0) {
+ return UECC_FAULT_DETECTED;
+ }
+ mbedtls_platform_enforce_volatile_reads();
+ if (problem != 0) {
+ return UECC_FAULT_DETECTED;
+ }
+
+ /* Protects against invalid curve attacks */
+ problem = -1;
+ problem = uECC_valid_point(point);
+ if (problem != 0) {
+ /* invalid input, can happen without fault */
+ return UECC_FAILURE;
+ }
+ mbedtls_platform_enforce_volatile_reads();
+ if (problem != 0) {
+ /* failure on second check means fault, though */
+ return UECC_FAULT_DETECTED;
+ }
/* Regularize the bitcount for the private key so that attackers cannot use a
* side channel attack to learn the number of leading zeros. */
@@ -943,15 +1071,43 @@
/* If an RNG function was specified, get a random initial Z value to
* protect against side-channel attacks such as Template SPA */
if (g_rng_function) {
- if (!uECC_generate_random_int(k2[carry], curve->p, num_words)) {
- r = 0;
+ if (!uECC_generate_random_int(k2[carry], curve_p, num_words)) {
+ r = UECC_FAILURE;
goto clear_and_out;
}
initial_Z = k2[carry];
}
EccPoint_mult(result, point, k2[!carry], initial_Z);
- r = 1;
+
+ /* Protect against fault injections that would make the resulting
+ * point not lie on the intended curve */
+ problem = -1;
+ problem = uECC_valid_point(result);
+ if (problem != 0) {
+ r = UECC_FAULT_DETECTED;
+ goto clear_and_out;
+ }
+ mbedtls_platform_enforce_volatile_reads();
+ if (problem != 0) {
+ r = UECC_FAULT_DETECTED;
+ goto clear_and_out;
+ }
+
+ /* Protect against faults modifying curve paremeters in flash */
+ problem = -1;
+ problem = uECC_check_curve_integrity();
+ if (problem != 0) {
+ r = UECC_FAULT_DETECTED;
+ goto clear_and_out;
+ }
+ mbedtls_platform_enforce_volatile_reads();
+ if (problem != 0) {
+ r = UECC_FAULT_DETECTED;
+ goto clear_and_out;
+ }
+
+ r = UECC_SUCCESS;
clear_and_out:
/* erasing temporary buffer used to store secret: */
@@ -963,28 +1119,9 @@
}
uECC_word_t EccPoint_compute_public_key(uECC_word_t *result,
- uECC_word_t *private_key,
- uECC_Curve curve)
+ uECC_word_t *private_key)
{
-
- uECC_word_t tmp1[NUM_ECC_WORDS];
- uECC_word_t tmp2[NUM_ECC_WORDS];
- uECC_word_t *p2[2] = {tmp1, tmp2};
- uECC_word_t carry;
-
- if (curve != uECC_secp256r1())
- return 0;
-
- /* Regularize the bitcount for the private key so that attackers cannot
- * use a side channel attack to learn the number of leading zeros. */
- carry = regularize_k(private_key, tmp1, tmp2);
-
- EccPoint_mult(result, curve->G, p2[!carry], 0);
-
- if (EccPoint_isZero(result, curve)) {
- return 0;
- }
- return 1;
+ return EccPoint_mult_safer(result, curve_G, private_key);
}
/* Converts an integer in uECC native format to big-endian bytes. */
@@ -1037,84 +1174,87 @@
}
-int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve)
+int uECC_valid_point(const uECC_word_t *point)
{
uECC_word_t tmp1[NUM_ECC_WORDS];
uECC_word_t tmp2[NUM_ECC_WORDS];
- wordcount_t num_words = curve->num_words;
+ wordcount_t num_words = NUM_ECC_WORDS;
+ volatile uECC_word_t diff = 0xffffffff;
/* The point at infinity is invalid. */
- if (EccPoint_isZero(point, curve)) {
+ if (EccPoint_isZero(point)) {
return -1;
}
/* x and y must be smaller than p. */
- if (uECC_vli_cmp_unsafe(curve->p, point) != 1 ||
- uECC_vli_cmp_unsafe(curve->p, point + num_words) != 1) {
+ if (uECC_vli_cmp_unsafe(curve_p, point) != 1 ||
+ uECC_vli_cmp_unsafe(curve_p, point + num_words) != 1) {
return -2;
}
uECC_vli_modMult_fast(tmp1, point + num_words, point + num_words);
- curve->x_side(tmp2, point, curve); /* tmp2 = x^3 + ax + b */
+ x_side_default(tmp2, point); /* tmp2 = x^3 + ax + b */
/* Make sure that y^2 == x^3 + ax + b */
- if (uECC_vli_equal(tmp1, tmp2) != 0)
- return -3;
+ diff = uECC_vli_equal(tmp1, tmp2);
+ if (diff == 0) {
+ mbedtls_platform_enforce_volatile_reads();
+ if (diff == 0) {
+ return 0;
+ }
+ }
- return 0;
+ return -3;
}
-int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve)
+int uECC_valid_public_key(const uint8_t *public_key)
{
uECC_word_t _public[NUM_ECC_WORDS * 2];
- uECC_vli_bytesToNative(_public, public_key, curve->num_bytes);
+ uECC_vli_bytesToNative(_public, public_key, NUM_ECC_BYTES);
uECC_vli_bytesToNative(
- _public + curve->num_words,
- public_key + curve->num_bytes,
- curve->num_bytes);
+ _public + NUM_ECC_WORDS,
+ public_key + NUM_ECC_BYTES,
+ NUM_ECC_BYTES);
- if (memcmp(_public, curve->G, NUM_ECC_WORDS * 2) == 0) {
+ if (memcmp(_public, curve_G, NUM_ECC_WORDS * 2) == 0) {
return -4;
}
- return uECC_valid_point(_public, curve);
+ return uECC_valid_point(_public);
}
-int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key,
- uECC_Curve curve)
+int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key)
{
-
+ int ret;
uECC_word_t _private[NUM_ECC_WORDS];
uECC_word_t _public[NUM_ECC_WORDS * 2];
uECC_vli_bytesToNative(
_private,
private_key,
- BITS_TO_BYTES(curve->num_n_bits));
+ BITS_TO_BYTES(NUM_ECC_BITS));
/* Make sure the private key is in the range [1, n-1]. */
if (uECC_vli_isZero(_private)) {
- return 0;
+ return UECC_FAILURE;
}
- if (uECC_vli_cmp(curve->n, _private) != 1) {
- return 0;
+ if (uECC_vli_cmp(curve_n, _private) != 1) {
+ return UECC_FAILURE;
}
/* Compute public key. */
- if (!EccPoint_compute_public_key(_public, _private, curve)) {
- return 0;
+ ret = EccPoint_compute_public_key(_public, _private);
+ if (ret != UECC_SUCCESS) {
+ return ret;
}
- uECC_vli_nativeToBytes(public_key, curve->num_bytes, _public);
+ uECC_vli_nativeToBytes(public_key, NUM_ECC_BYTES, _public);
uECC_vli_nativeToBytes(
public_key +
- curve->num_bytes, curve->num_bytes, _public + curve->num_words);
- return 1;
+ NUM_ECC_BYTES, NUM_ECC_BYTES, _public + NUM_ECC_WORDS);
+ return UECC_SUCCESS;
}
-#else
-typedef int mbedtls_dummy_tinycrypt_def;
-#endif /* MBEDTLS_USE_TINYCRYPT */
diff --git a/tinycrypt/ecc_dh.c b/tinycrypt/ecc_dh.c
index f9c0a5e..1b1ff3f 100644
--- a/tinycrypt/ecc_dh.c
+++ b/tinycrypt/ecc_dh.c
@@ -66,16 +66,15 @@
#include MBEDTLS_CONFIG_FILE
#endif
-#if defined(MBEDTLS_USE_TINYCRYPT)
#include <tinycrypt/ecc.h>
#include <tinycrypt/ecc_dh.h>
#include <string.h>
#include "mbedtls/platform_util.h"
int uECC_make_key_with_d(uint8_t *public_key, uint8_t *private_key,
- unsigned int *d, uECC_Curve curve)
+ unsigned int *d)
{
-
+ int ret;
uECC_word_t _private[NUM_ECC_WORDS];
uECC_word_t _public[NUM_ECC_WORDS * 2];
@@ -85,30 +84,32 @@
mbedtls_platform_memcpy (_private, d, NUM_ECC_BYTES);
/* Computing public-key from private: */
- if (EccPoint_compute_public_key(_public, _private, curve)) {
-
- /* Converting buffers to correct bit order: */
- uECC_vli_nativeToBytes(private_key,
- BITS_TO_BYTES(curve->num_n_bits),
- _private);
- uECC_vli_nativeToBytes(public_key,
- curve->num_bytes,
- _public);
- uECC_vli_nativeToBytes(public_key + curve->num_bytes,
- curve->num_bytes,
- _public + curve->num_words);
-
- /* erasing temporary buffer used to store secret: */
- mbedtls_platform_memset(_private, 0, NUM_ECC_BYTES);
-
- return 1;
+ ret = EccPoint_compute_public_key(_public, _private);
+ if (ret != UECC_SUCCESS) {
+ goto exit;
}
- return 0;
+
+ /* Converting buffers to correct bit order: */
+ uECC_vli_nativeToBytes(private_key,
+ BITS_TO_BYTES(NUM_ECC_BITS),
+ _private);
+ uECC_vli_nativeToBytes(public_key,
+ NUM_ECC_BYTES,
+ _public);
+ uECC_vli_nativeToBytes(public_key + NUM_ECC_BYTES,
+ NUM_ECC_BYTES,
+ _public + NUM_ECC_WORDS);
+
+exit:
+ /* erasing temporary buffer used to store secret: */
+ mbedtls_platform_memset(_private, 0, NUM_ECC_BYTES);
+
+ return ret;
}
-int uECC_make_key(uint8_t *public_key, uint8_t *private_key, uECC_Curve curve)
+int uECC_make_key(uint8_t *public_key, uint8_t *private_key)
{
-
+ int ret;
uECC_word_t _random[NUM_ECC_WORDS * 2];
uECC_word_t _private[NUM_ECC_WORDS];
uECC_word_t _public[NUM_ECC_WORDS * 2];
@@ -119,55 +120,54 @@
uECC_RNG_Function rng_function = uECC_get_rng();
if (!rng_function ||
!rng_function((uint8_t *)_random, 2 * NUM_ECC_WORDS*uECC_WORD_SIZE)) {
- return 0;
+ return UECC_FAILURE;
}
/* computing modular reduction of _random (see FIPS 186.4 B.4.1): */
- uECC_vli_mmod(_private, _random, curve->n);
+ uECC_vli_mmod(_private, _random, curve_n);
/* Computing public-key from private: */
- if (EccPoint_compute_public_key(_public, _private, curve)) {
+ ret = EccPoint_compute_public_key(_public, _private);
+ /* don't try again if a fault was detected */
+ if (ret == UECC_FAULT_DETECTED) {
+ return ret;
+ }
+ if (ret == UECC_SUCCESS) {
/* Converting buffers to correct bit order: */
uECC_vli_nativeToBytes(private_key,
- BITS_TO_BYTES(curve->num_n_bits),
+ BITS_TO_BYTES(NUM_ECC_BITS),
_private);
uECC_vli_nativeToBytes(public_key,
- curve->num_bytes,
+ NUM_ECC_BYTES,
_public);
- uECC_vli_nativeToBytes(public_key + curve->num_bytes,
- curve->num_bytes,
- _public + curve->num_words);
+ uECC_vli_nativeToBytes(public_key + NUM_ECC_BYTES,
+ NUM_ECC_BYTES,
+ _public + NUM_ECC_WORDS);
/* erasing temporary buffer that stored secret: */
mbedtls_platform_memset(_private, 0, NUM_ECC_BYTES);
- return 1;
+ return UECC_SUCCESS;
}
}
- return 0;
+ return UECC_FAILURE;
}
int uECC_shared_secret(const uint8_t *public_key, const uint8_t *private_key,
- uint8_t *secret, uECC_Curve curve)
+ uint8_t *secret)
{
uECC_word_t _public[NUM_ECC_WORDS * 2];
uECC_word_t _private[NUM_ECC_WORDS];
- wordcount_t num_words = curve->num_words;
- wordcount_t num_bytes = curve->num_bytes;
+ wordcount_t num_words = NUM_ECC_WORDS;
+ wordcount_t num_bytes = NUM_ECC_BYTES;
int r;
- /* Protect against invalid curve attacks */
- if (uECC_valid_public_key(public_key, curve) != 0) {
- r = 0;
- goto clear_and_out;
- }
-
/* Converting buffers to correct bit order: */
uECC_vli_bytesToNative(_private,
private_key,
- BITS_TO_BYTES(curve->num_n_bits));
+ BITS_TO_BYTES(NUM_ECC_BITS));
uECC_vli_bytesToNative(_public,
public_key,
num_bytes);
@@ -175,19 +175,11 @@
public_key + num_bytes,
num_bytes);
- r = EccPoint_mult_safer(_public, _public, _private, curve);
- if (r == 0)
- goto clear_and_out;
-
+ r = EccPoint_mult_safer(_public, _public, _private);
uECC_vli_nativeToBytes(secret, num_bytes, _public);
- r = !EccPoint_isZero(_public, curve);
-clear_and_out:
/* erasing temporary buffer used to store secret: */
mbedtls_platform_zeroize(_private, sizeof(_private));
return r;
}
-#else
-typedef int mbedtls_dummy_tinycrypt_def;
-#endif /* MBEDTLS_USE_TINYCRYPT */
diff --git a/tinycrypt/ecc_dsa.c b/tinycrypt/ecc_dsa.c
index 04b1bfa..8c6bb19 100644
--- a/tinycrypt/ecc_dsa.c
+++ b/tinycrypt/ecc_dsa.c
@@ -64,9 +64,9 @@
#include MBEDTLS_CONFIG_FILE
#endif
-#if defined(MBEDTLS_USE_TINYCRYPT)
#include <tinycrypt/ecc.h>
#include <tinycrypt/ecc_dsa.h>
+#include "mbedtls/platform_util.h"
#if default_RNG_defined
static uECC_RNG_Function g_rng_function = &default_CSPRNG;
@@ -75,10 +75,10 @@
#endif
static void bits2int(uECC_word_t *native, const uint8_t *bits,
- unsigned bits_size, uECC_Curve curve)
+ unsigned bits_size)
{
- unsigned num_n_bytes = BITS_TO_BYTES(curve->num_n_bits);
- unsigned num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ unsigned num_n_bytes = BITS_TO_BYTES(NUM_ECC_BITS);
+ unsigned num_n_words = BITS_TO_WORDS(NUM_ECC_BITS);
int shift;
uECC_word_t carry;
uECC_word_t *ptr;
@@ -89,10 +89,10 @@
uECC_vli_clear(native);
uECC_vli_bytesToNative(native, bits, bits_size);
- if (bits_size * 8 <= (unsigned)curve->num_n_bits) {
+ if (bits_size * 8 <= (unsigned)NUM_ECC_BITS) {
return;
}
- shift = bits_size * 8 - curve->num_n_bits;
+ shift = bits_size * 8 - NUM_ECC_BITS;
carry = 0;
ptr = native + num_n_words;
while (ptr-- > native) {
@@ -102,32 +102,31 @@
}
/* Reduce mod curve_n */
- if (uECC_vli_cmp_unsafe(curve->n, native) != 1) {
- uECC_vli_sub(native, native, curve->n);
+ if (uECC_vli_cmp_unsafe(curve_n, native) != 1) {
+ uECC_vli_sub(native, native, curve_n);
}
}
int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
- unsigned hash_size, uECC_word_t *k, uint8_t *signature,
- uECC_Curve curve)
+ unsigned hash_size, uECC_word_t *k, uint8_t *signature)
{
uECC_word_t tmp[NUM_ECC_WORDS];
uECC_word_t s[NUM_ECC_WORDS];
uECC_word_t p[NUM_ECC_WORDS * 2];
- wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ wordcount_t num_n_words = BITS_TO_WORDS(NUM_ECC_BITS);
int r;
/* Make sure 0 < k < curve_n */
if (uECC_vli_isZero(k) ||
- uECC_vli_cmp(curve->n, k) != 1) {
- return 0;
+ uECC_vli_cmp(curve_n, k) != 1) {
+ return UECC_FAILURE;
}
- r = EccPoint_mult_safer(p, curve->G, k, curve);
- if (r == 0 || uECC_vli_isZero(p)) {
- return 0;
+ r = EccPoint_mult_safer(p, curve_G, k);
+ if (r != UECC_SUCCESS) {
+ return r;
}
/* If an RNG function was specified, get a random number
@@ -136,60 +135,66 @@
uECC_vli_clear(tmp);
tmp[0] = 1;
}
- else if (!uECC_generate_random_int(tmp, curve->n, num_n_words)) {
- return 0;
+ else if (!uECC_generate_random_int(tmp, curve_n, num_n_words)) {
+ return UECC_FAILURE;
}
/* Prevent side channel analysis of uECC_vli_modInv() to determine
bits of k / the private key by premultiplying by a random number */
- uECC_vli_modMult(k, k, tmp, curve->n); /* k' = rand * k */
- uECC_vli_modInv(k, k, curve->n); /* k = 1 / k' */
- uECC_vli_modMult(k, k, tmp, curve->n); /* k = 1 / k */
+ uECC_vli_modMult(k, k, tmp, curve_n); /* k' = rand * k */
+ uECC_vli_modInv(k, k, curve_n); /* k = 1 / k' */
+ uECC_vli_modMult(k, k, tmp, curve_n); /* k = 1 / k */
- uECC_vli_nativeToBytes(signature, curve->num_bytes, p); /* store r */
+ uECC_vli_nativeToBytes(signature, NUM_ECC_BYTES, p); /* store r */
/* tmp = d: */
- uECC_vli_bytesToNative(tmp, private_key, BITS_TO_BYTES(curve->num_n_bits));
+ uECC_vli_bytesToNative(tmp, private_key, BITS_TO_BYTES(NUM_ECC_BITS));
s[num_n_words - 1] = 0;
uECC_vli_set(s, p);
- uECC_vli_modMult(s, tmp, s, curve->n); /* s = r*d */
+ uECC_vli_modMult(s, tmp, s, curve_n); /* s = r*d */
- bits2int(tmp, message_hash, hash_size, curve);
- uECC_vli_modAdd(s, tmp, s, curve->n); /* s = e + r*d */
- uECC_vli_modMult(s, s, k, curve->n); /* s = (e + r*d) / k */
- if (uECC_vli_numBits(s) > (bitcount_t)curve->num_bytes * 8) {
- return 0;
+ bits2int(tmp, message_hash, hash_size);
+ uECC_vli_modAdd(s, tmp, s, curve_n); /* s = e + r*d */
+ uECC_vli_modMult(s, s, k, curve_n); /* s = (e + r*d) / k */
+ if (uECC_vli_numBits(s) > (bitcount_t)NUM_ECC_BYTES * 8) {
+ return UECC_FAILURE;
}
- uECC_vli_nativeToBytes(signature + curve->num_bytes, curve->num_bytes, s);
- return 1;
+ uECC_vli_nativeToBytes(signature + NUM_ECC_BYTES, NUM_ECC_BYTES, s);
+ return UECC_SUCCESS;
}
int uECC_sign(const uint8_t *private_key, const uint8_t *message_hash,
- unsigned hash_size, uint8_t *signature, uECC_Curve curve)
+ unsigned hash_size, uint8_t *signature)
{
- uECC_word_t _random[2*NUM_ECC_WORDS];
- uECC_word_t k[NUM_ECC_WORDS];
- uECC_word_t tries;
+ int r;
+ uECC_word_t _random[2*NUM_ECC_WORDS];
+ uECC_word_t k[NUM_ECC_WORDS];
+ uECC_word_t tries;
for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
/* Generating _random uniformly at random: */
uECC_RNG_Function rng_function = uECC_get_rng();
if (!rng_function ||
!rng_function((uint8_t *)_random, 2*NUM_ECC_WORDS*uECC_WORD_SIZE)) {
- return 0;
+ return UECC_FAILURE;
}
// computing k as modular reduction of _random (see FIPS 186.4 B.5.1):
- uECC_vli_mmod(k, _random, curve->n);
+ uECC_vli_mmod(k, _random, curve_n);
- if (uECC_sign_with_k(private_key, message_hash, hash_size, k, signature,
- curve)) {
- return 1;
+ r = uECC_sign_with_k(private_key, message_hash, hash_size, k, signature);
+ /* don't keep trying if a fault was detected */
+ if (r == UECC_FAULT_DETECTED) {
+ return r;
}
+ if (r == UECC_SUCCESS) {
+ return UECC_SUCCESS;
+ }
+ /* else keep trying */
}
- return 0;
+ return UECC_FAILURE;
}
static bitcount_t smax(bitcount_t a, bitcount_t b)
@@ -198,8 +203,7 @@
}
int uECC_verify(const uint8_t *public_key, const uint8_t *message_hash,
- unsigned hash_size, const uint8_t *signature,
- uECC_Curve curve)
+ unsigned hash_size, const uint8_t *signature)
{
uECC_word_t u1[NUM_ECC_WORDS], u2[NUM_ECC_WORDS];
@@ -214,56 +218,54 @@
const uECC_word_t *point;
bitcount_t num_bits;
bitcount_t i;
+ volatile uECC_word_t diff;
uECC_word_t _public[NUM_ECC_WORDS * 2];
uECC_word_t r[NUM_ECC_WORDS], s[NUM_ECC_WORDS];
- wordcount_t num_words = curve->num_words;
- wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
-
- if (curve != uECC_secp256r1())
- return 0;
+ wordcount_t num_words = NUM_ECC_WORDS;
+ wordcount_t num_n_words = BITS_TO_WORDS(NUM_ECC_BITS);
rx[num_n_words - 1] = 0;
r[num_n_words - 1] = 0;
s[num_n_words - 1] = 0;
- uECC_vli_bytesToNative(_public, public_key, curve->num_bytes);
- uECC_vli_bytesToNative(_public + num_words, public_key + curve->num_bytes,
- curve->num_bytes);
- uECC_vli_bytesToNative(r, signature, curve->num_bytes);
- uECC_vli_bytesToNative(s, signature + curve->num_bytes, curve->num_bytes);
+ uECC_vli_bytesToNative(_public, public_key, NUM_ECC_BYTES);
+ uECC_vli_bytesToNative(_public + num_words, public_key + NUM_ECC_BYTES,
+ NUM_ECC_BYTES);
+ uECC_vli_bytesToNative(r, signature, NUM_ECC_BYTES);
+ uECC_vli_bytesToNative(s, signature + NUM_ECC_BYTES, NUM_ECC_BYTES);
/* r, s must not be 0. */
if (uECC_vli_isZero(r) || uECC_vli_isZero(s)) {
- return 0;
+ return UECC_FAILURE;
}
/* r, s must be < n. */
- if (uECC_vli_cmp_unsafe(curve->n, r) != 1 ||
- uECC_vli_cmp_unsafe(curve->n, s) != 1) {
- return 0;
+ if (uECC_vli_cmp_unsafe(curve_n, r) != 1 ||
+ uECC_vli_cmp_unsafe(curve_n, s) != 1) {
+ return UECC_FAILURE;
}
/* Calculate u1 and u2. */
- uECC_vli_modInv(z, s, curve->n); /* z = 1/s */
+ uECC_vli_modInv(z, s, curve_n); /* z = 1/s */
u1[num_n_words - 1] = 0;
- bits2int(u1, message_hash, hash_size, curve);
- uECC_vli_modMult(u1, u1, z, curve->n); /* u1 = e/s */
- uECC_vli_modMult(u2, r, z, curve->n); /* u2 = r/s */
+ bits2int(u1, message_hash, hash_size);
+ uECC_vli_modMult(u1, u1, z, curve_n); /* u1 = e/s */
+ uECC_vli_modMult(u2, r, z, curve_n); /* u2 = r/s */
/* Calculate sum = G + Q. */
uECC_vli_set(sum, _public);
uECC_vli_set(sum + num_words, _public + num_words);
- uECC_vli_set(tx, curve->G);
- uECC_vli_set(ty, curve->G + num_words);
- uECC_vli_modSub(z, sum, tx, curve->p); /* z = x2 - x1 */
- XYcZ_add(tx, ty, sum, sum + num_words, curve);
- uECC_vli_modInv(z, z, curve->p); /* z = 1/z */
+ uECC_vli_set(tx, curve_G);
+ uECC_vli_set(ty, curve_G + num_words);
+ uECC_vli_modSub(z, sum, tx, curve_p); /* z = x2 - x1 */
+ XYcZ_add(tx, ty, sum, sum + num_words);
+ uECC_vli_modInv(z, z, curve_p); /* z = 1/z */
apply_z(sum, sum + num_words, z);
/* Use Shamir's trick to calculate u1*G + u2*Q */
points[0] = 0;
- points[1] = curve->G;
+ points[1] = curve_G;
points[2] = _public;
points[3] = sum;
num_bits = smax(uECC_vli_numBits(u1),
@@ -278,7 +280,7 @@
for (i = num_bits - 2; i >= 0; --i) {
uECC_word_t index;
- curve->double_jacobian(rx, ry, z, curve);
+ double_jacobian_default(rx, ry, z);
index = (!!uECC_vli_testBit(u1, i)) | ((!!uECC_vli_testBit(u2, i)) << 1);
point = points[index];
@@ -286,23 +288,31 @@
uECC_vli_set(tx, point);
uECC_vli_set(ty, point + num_words);
apply_z(tx, ty, z);
- uECC_vli_modSub(tz, rx, tx, curve->p); /* Z = x2 - x1 */
- XYcZ_add(tx, ty, rx, ry, curve);
+ uECC_vli_modSub(tz, rx, tx, curve_p); /* Z = x2 - x1 */
+ XYcZ_add(tx, ty, rx, ry);
uECC_vli_modMult_fast(z, z, tz);
}
}
- uECC_vli_modInv(z, z, curve->p); /* Z = 1/Z */
+ uECC_vli_modInv(z, z, curve_p); /* Z = 1/Z */
apply_z(rx, ry, z);
/* v = x1 (mod n) */
- if (uECC_vli_cmp_unsafe(curve->n, rx) != 1) {
- uECC_vli_sub(rx, rx, curve->n);
+ if (uECC_vli_cmp_unsafe(curve_n, rx) != 1) {
+ uECC_vli_sub(rx, rx, curve_n);
}
/* Accept only if v == r. */
- return (int)(uECC_vli_equal(rx, r) == 0);
+ diff = uECC_vli_equal(rx, r);
+ if (diff == 0) {
+ mbedtls_platform_enforce_volatile_reads();
+ if (diff == 0) {
+ return UECC_SUCCESS;
+ }
+ else {
+ return UECC_FAULT_DETECTED;
+ }
+ }
+
+ return UECC_FAILURE;
}
-#else
-typedef int mbedtls_dummy_tinycrypt_def;
-#endif /* MBEDTLS_USE_TINYCRYPT */