Merge pull request #7903 from valeriosetti/issue7773
Define PSA_WANT_xxx_KEY_PAIR_yyy step 2/DH
diff --git a/ChangeLog.d/ssl_premaster_secret-empty.txt b/ChangeLog.d/ssl_premaster_secret-empty.txt
new file mode 100644
index 0000000..0ce5f36
--- /dev/null
+++ b/ChangeLog.d/ssl_premaster_secret-empty.txt
@@ -0,0 +1,3 @@
+Bugfix
+ * Fix a compilation error on some platforms when including mbedtls/ssl.h
+ with all TLS support disabled. Fixes #6628.
diff --git a/docs/architecture/psa-migration/outcome-analysis.sh b/docs/architecture/psa-migration/outcome-analysis.sh
index b26963b..1805a3c 100755
--- a/docs/architecture/psa-migration/outcome-analysis.sh
+++ b/docs/architecture/psa-migration/outcome-analysis.sh
@@ -43,8 +43,11 @@
fi
}
-# save current HEAD
-HEAD=$(git branch --show-current)
+# save current HEAD.
+# Note: this can optionally be updated to
+# HEAD=$(git branch --show-current)
+# when using a Git version above 2.22
+HEAD=$(git rev-parse --abbrev-ref HEAD)
# get the numbers before this PR for default and full
cleanup
diff --git a/include/mbedtls/build_info.h b/include/mbedtls/build_info.h
index 4717063..bc5cad8 100644
--- a/include/mbedtls/build_info.h
+++ b/include/mbedtls/build_info.h
@@ -161,6 +161,37 @@
#define MBEDTLS_PK_PARSE_EC_COMPRESSED
#endif
+/* Helper symbol to state that there is support for ECDH, either through
+ * library implementation (ECDH_C) or through PSA. */
+#if (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_ECDH)) || \
+ (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C))
+#define MBEDTLS_CAN_ECDH
+#endif
+
+/* PK module can achieve ECDSA functionalities by means of either software
+ * implementations (ECDSA_C) or through a PSA driver. The following defines
+ * are meant to list these capabilities in a general way which abstracts how
+ * they are implemented under the hood. */
+#if !defined(MBEDTLS_USE_PSA_CRYPTO)
+#if defined(MBEDTLS_ECDSA_C)
+#define MBEDTLS_PK_CAN_ECDSA_SIGN
+#define MBEDTLS_PK_CAN_ECDSA_VERIFY
+#endif /* MBEDTLS_ECDSA_C */
+#else /* MBEDTLS_USE_PSA_CRYPTO */
+#if defined(PSA_WANT_ALG_ECDSA)
+#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC)
+#define MBEDTLS_PK_CAN_ECDSA_SIGN
+#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC */
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+#define MBEDTLS_PK_CAN_ECDSA_VERIFY
+#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
+#endif /* PSA_WANT_ALG_ECDSA */
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
+
+#if defined(MBEDTLS_PK_CAN_ECDSA_VERIFY) || defined(MBEDTLS_PK_CAN_ECDSA_SIGN)
+#define MBEDTLS_PK_CAN_ECDSA_SOME
+#endif
+
/* If MBEDTLS_PSA_CRYPTO_C is defined, make sure MBEDTLS_PSA_CRYPTO_CLIENT
* is defined as well to include all PSA code.
*/
@@ -222,16 +253,6 @@
#undef MBEDTLS_SSL_EARLY_DATA
#endif
-#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) || \
- defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
-#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED
-#endif
-
-#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) || \
- defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
-#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED
-#endif
-
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
(defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED))
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index 6a8ccad..7a87971 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -275,19 +275,6 @@
#error "MBEDTLS_HMAC_DRBG_C defined, but not all prerequisites"
#endif
-/* Helper for ECDSA dependencies, will be undefined at the end of the file */
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-#if (defined(PSA_WANT_ALG_ECDSA) || \
- defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA)) && \
- defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC)
-#define MBEDTLS_PK_HAVE_ECDSA
-#endif
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-#if defined(MBEDTLS_ECDSA_C)
-#define MBEDTLS_PK_HAVE_ECDSA
-#endif
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
/* Helper for JPAKE dependencies, will be undefined at the end of the file */
#if defined(MBEDTLS_USE_PSA_CRYPTO)
#if defined(PSA_WANT_ALG_JPAKE) && defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC)
@@ -299,17 +286,6 @@
#endif
#endif /* MBEDTLS_USE_PSA_CRYPTO */
-/* Helper for ECDH dependencies, will be undefined at the end of the file */
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-#if defined(PSA_WANT_ALG_ECDH) && defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC)
-#define MBEDTLS_PK_HAVE_ECDH
-#endif
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-#if defined(MBEDTLS_ECDH_C)
-#define MBEDTLS_PK_HAVE_ECDH
-#endif
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
/* Helper for curve SECP256R1 */
#if defined(MBEDTLS_USE_PSA_CRYPTO)
#if defined(PSA_WANT_ECC_SECP_R1_256)
@@ -322,14 +298,14 @@
#endif /* MBEDTLS_USE_PSA_CRYPTO */
#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) && \
- ( !defined(MBEDTLS_PK_HAVE_ECDH) || \
- !defined(MBEDTLS_PK_HAVE_ECDSA) || \
+ ( !defined(MBEDTLS_CAN_ECDH) || \
+ !defined(MBEDTLS_PK_CAN_ECDSA_SIGN) || \
!defined(MBEDTLS_X509_CRT_PARSE_C) )
#error "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED defined, but not all prerequisites"
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
- ( !defined(MBEDTLS_PK_HAVE_ECDH) || !defined(MBEDTLS_RSA_C) || \
+ ( !defined(MBEDTLS_CAN_ECDH) || !defined(MBEDTLS_RSA_C) || \
!defined(MBEDTLS_X509_CRT_PARSE_C) )
#error "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED defined, but not all prerequisites"
#endif
@@ -339,7 +315,7 @@
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) && \
- !defined(MBEDTLS_PK_HAVE_ECDH)
+ !defined(MBEDTLS_CAN_ECDH)
#error "MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED defined, but not all prerequisites"
#endif
@@ -350,14 +326,14 @@
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
- ( !defined(MBEDTLS_PK_HAVE_ECDH) || !defined(MBEDTLS_RSA_C) || \
+ ( !defined(MBEDTLS_CAN_ECDH) || !defined(MBEDTLS_RSA_C) || \
!defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_PKCS1_V15) )
#error "MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED defined, but not all prerequisites"
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \
- ( !defined(MBEDTLS_PK_HAVE_ECDH) || \
- !defined(MBEDTLS_PK_HAVE_ECDSA) || \
+ ( !defined(MBEDTLS_CAN_ECDH) || \
+ !defined(MBEDTLS_PK_CAN_ECDSA_SIGN) || \
!defined(MBEDTLS_X509_CRT_PARSE_C) )
#error "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED defined, but not all prerequisites"
#endif
@@ -814,8 +790,9 @@
#endif
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
-#if !( (defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)) && defined(MBEDTLS_X509_CRT_PARSE_C) && \
- ( defined(MBEDTLS_PK_HAVE_ECDSA) || defined(MBEDTLS_PKCS1_V21) ) )
+#if !( (defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)) && \
+ defined(MBEDTLS_X509_CRT_PARSE_C) && \
+ ( defined(MBEDTLS_PK_CAN_ECDSA_SIGN) || defined(MBEDTLS_PKCS1_V21) ) )
#error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED defined, but not all prerequisites"
#endif
#endif
@@ -1129,9 +1106,7 @@
#endif
/* Undefine helper symbols */
-#undef MBEDTLS_PK_HAVE_ECDSA
#undef MBEDTLS_PK_HAVE_JPAKE
-#undef MBEDTLS_PK_HAVE_ECDH
#undef MBEDTLS_MD_HAVE_SHA256
#undef MBEDTLS_MD_HAVE_SHA384
#undef MBEDTLS_MD_HAVE_SHA512
diff --git a/include/mbedtls/debug.h b/include/mbedtls/debug.h
index 74f5d55..d6dd152 100644
--- a/include/mbedtls/debug.h
+++ b/include/mbedtls/debug.h
@@ -280,7 +280,10 @@
const char *text, const mbedtls_x509_crt *crt);
#endif
-#if defined(MBEDTLS_ECDH_C)
+/* Note: the MBEDTLS_ECDH_C guard here is mandatory because this debug function
+ only works for the built-in implementation. */
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) && \
+ defined(MBEDTLS_ECDH_C)
typedef enum {
MBEDTLS_DEBUG_ECDH_Q,
MBEDTLS_DEBUG_ECDH_QP,
@@ -307,7 +310,8 @@
const char *file, int line,
const mbedtls_ecdh_context *ecdh,
mbedtls_debug_ecdh_attr attr);
-#endif
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED &&
+ MBEDTLS_ECDH_C */
#ifdef __cplusplus
}
diff --git a/include/mbedtls/mbedtls_config.h b/include/mbedtls/mbedtls_config.h
index 30e4d13..719bbed 100644
--- a/include/mbedtls/mbedtls_config.h
+++ b/include/mbedtls/mbedtls_config.h
@@ -3997,4 +3997,13 @@
*/
//#define MBEDTLS_P256M_EXAMPLE_DRIVER_ENABLED
+
+/**
+ * Uncomment to enable using new bignum code in the ECC modules.
+ *
+ * \warning This is currently experimental, incomplete and therefore should not
+ * be used in production.
+ */
+//#define MBEDTLS_ECP_WITH_MPI_UINT
+
/** \} name SECTION: Module configuration options */
diff --git a/include/mbedtls/md.h b/include/mbedtls/md.h
index 5831e12..dde95c5 100644
--- a/include/mbedtls/md.h
+++ b/include/mbedtls/md.h
@@ -467,8 +467,8 @@
const mbedtls_md_info_t *mbedtls_md_info_from_string(const char *md_name);
/**
- * \brief This function extracts the message-digest name from the
- * message-digest information structure.
+ * \brief This function returns the name of the message digest for
+ * the message-digest information structure given.
*
* \param md_info The information structure of the message-digest algorithm
* to use.
diff --git a/include/mbedtls/pk.h b/include/mbedtls/pk.h
index b5d12cf..f56c942 100644
--- a/include/mbedtls/pk.h
+++ b/include/mbedtls/pk.h
@@ -171,37 +171,6 @@
#endif
#endif /* defined(MBEDTLS_USE_PSA_CRYPTO) */
-/**
- * \brief The following defines are meant to list ECDSA capabilities of the
- * PK module in a general way (without any reference to how this
- * is achieved, which can be either through PSA driver or
- * MBEDTLS_ECDSA_C)
- */
-#if !defined(MBEDTLS_USE_PSA_CRYPTO)
-#if defined(MBEDTLS_ECDSA_C)
-#define MBEDTLS_PK_CAN_ECDSA_SIGN
-#define MBEDTLS_PK_CAN_ECDSA_VERIFY
-#endif
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-#if defined(PSA_WANT_ALG_ECDSA)
-#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC)
-#define MBEDTLS_PK_CAN_ECDSA_SIGN
-#endif
-#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
-#define MBEDTLS_PK_CAN_ECDSA_VERIFY
-#endif
-#endif /* PSA_WANT_ALG_ECDSA */
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
-#if defined(MBEDTLS_PK_CAN_ECDSA_VERIFY) || defined(MBEDTLS_PK_CAN_ECDSA_SIGN)
-#define MBEDTLS_PK_CAN_ECDSA_SOME
-#endif
-
-#if (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_ECDH)) || \
- (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C))
-#define MBEDTLS_PK_CAN_ECDH
-#endif
-
/* Internal helper to define which fields in the pk_context structure below
* should be used for EC keys: legacy ecp_keypair or the raw (PSA friendly)
* format. It should be noticed that this only affect how data is stored, not
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index e4d817f..920efa9 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -42,7 +42,7 @@
#include "mbedtls/md.h"
-#if defined(MBEDTLS_ECDH_C)
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED)
#include "mbedtls/ecdh.h"
#endif
@@ -619,6 +619,7 @@
/* Dummy type used only for its size */
union mbedtls_ssl_premaster_secret {
+ unsigned char dummy; /* Make the union non-empty even with SSL disabled */
#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
unsigned char _pms_rsa[48]; /* RFC 5246 8.1.1 */
#endif
diff --git a/include/mbedtls/ssl_ciphersuites.h b/include/mbedtls/ssl_ciphersuites.h
index 17b8ff7..2db5209 100644
--- a/include/mbedtls/ssl_ciphersuites.h
+++ b/include/mbedtls/ssl_ciphersuites.h
@@ -346,11 +346,6 @@
#define MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED
#endif
-#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) || \
- defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
-#define MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED
-#endif
-
/* Key exchanges using DHE */
#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
@@ -364,6 +359,62 @@
#define MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED
#endif
+/* TLS 1.2 key exchanges using ECDH or ECDHE*/
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) || \
+ defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
+#define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED
+#endif
+
+/* TLS 1.3 PSK key exchanges */
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) || \
+ defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
+#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED
+#endif
+
+/* TLS 1.2 or 1.3 key exchanges with PSK */
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) || \
+ defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
+#define MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED
+#endif
+
+/* TLS 1.3 ephemeral key exchanges */
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) || \
+ defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
+#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED
+#endif
+
+/* TLS 1.3 key exchanges using ECDHE */
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED) && \
+ defined(PSA_WANT_ALG_ECDH)
+#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_ECDHE_ENABLED
+#endif
+
+/* TLS 1.2 or 1.3 key exchanges using ECDH or ECDHE */
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_ECDHE_ENABLED)
+#define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED
+#endif
+
+/* TLS 1.2 XXDH key exchanges: ECDH or ECDHE or FFDH */
+#if (defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED))
+#define MBEDTLS_KEY_EXCHANGE_SOME_XXDH_1_2_ENABLED
+#endif
+
+/* The handshake params structure has a set of fields called xxdh_psa which are used:
+ * - by TLS 1.2 with `USE_PSA` to do ECDH or ECDHE;
+ * - by TLS 1.3 to do ECDHE or FFDHE.
+ * The following macros can be used to guard their declaration and use.
+ */
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) && \
+ defined(MBEDTLS_USE_PSA_CRYPTO)
+#define MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_1_2_ENABLED
+#endif
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_1_2_ENABLED) || \
+ defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
+#define MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED
+#endif
+
typedef struct mbedtls_ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t;
#define MBEDTLS_CIPHERSUITE_WEAK 0x01 /**< Weak ciphersuite flag */
diff --git a/include/psa/crypto_sizes.h b/include/psa/crypto_sizes.h
index 8cc965b..0d0300d 100644
--- a/include/psa/crypto_sizes.h
+++ b/include/psa/crypto_sizes.h
@@ -633,10 +633,18 @@
* This macro expands to a compile-time constant integer. This value
* is the maximum size of a signature in bytes.
*/
-#define PSA_SIGNATURE_MAX_SIZE \
- (PSA_BITS_TO_BYTES(PSA_VENDOR_RSA_MAX_KEY_BITS) > PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE ? \
- PSA_BITS_TO_BYTES(PSA_VENDOR_RSA_MAX_KEY_BITS) : \
- PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE)
+#define PSA_SIGNATURE_MAX_SIZE 1
+
+#if (defined(PSA_WANT_ALG_ECDSA) || defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA)) && \
+ (PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE > PSA_SIGNATURE_MAX_SIZE)
+#undef PSA_SIGNATURE_MAX_SIZE
+#define PSA_SIGNATURE_MAX_SIZE PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE
+#endif
+#if (defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) || defined(PSA_WANT_ALG_RSA_PSS)) && \
+ (PSA_BITS_TO_BYTES(PSA_VENDOR_RSA_MAX_KEY_BITS) > PSA_SIGNATURE_MAX_SIZE)
+#undef PSA_SIGNATURE_MAX_SIZE
+#define PSA_SIGNATURE_MAX_SIZE PSA_BITS_TO_BYTES(PSA_VENDOR_RSA_MAX_KEY_BITS)
+#endif
/** Sufficient output buffer size for psa_asymmetric_encrypt().
*
@@ -948,10 +956,29 @@
*
* See also #PSA_EXPORT_KEY_OUTPUT_SIZE(\p key_type, \p key_bits).
*/
-#define PSA_EXPORT_KEY_PAIR_MAX_SIZE \
- PSA_MAX_OF_THREE(PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS), \
- PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS), \
- PSA_KEY_EXPORT_FFDH_KEY_PAIR_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS))
+#define PSA_EXPORT_KEY_PAIR_MAX_SIZE 1
+
+#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) && \
+ (PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS) > \
+ PSA_EXPORT_KEY_PAIR_MAX_SIZE)
+#undef PSA_EXPORT_KEY_PAIR_MAX_SIZE
+#define PSA_EXPORT_KEY_PAIR_MAX_SIZE \
+ PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)
+#endif
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) && \
+ (PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS) > \
+ PSA_EXPORT_KEY_PAIR_MAX_SIZE)
+#undef PSA_EXPORT_KEY_PAIR_MAX_SIZE
+#define PSA_EXPORT_KEY_PAIR_MAX_SIZE \
+ PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS)
+#endif
+#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) && \
+ (PSA_KEY_EXPORT_FFDH_KEY_PAIR_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS) > \
+ PSA_EXPORT_KEY_PAIR_MAX_SIZE)
+#undef PSA_EXPORT_KEY_PAIR_MAX_SIZE
+#define PSA_EXPORT_KEY_PAIR_MAX_SIZE \
+ PSA_KEY_EXPORT_FFDH_KEY_PAIR_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS)
+#endif
/** Sufficient buffer size for exporting any asymmetric public key.
*
@@ -962,11 +989,29 @@
*
* See also #PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(\p key_type, \p key_bits).
*/
-#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE \
- PSA_MAX_OF_THREE(PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS), \
- PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS), \
- PSA_KEY_EXPORT_FFDH_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS))
+#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE 1
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \
+ (PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS) > \
+ PSA_EXPORT_PUBLIC_KEY_MAX_SIZE)
+#undef PSA_EXPORT_PUBLIC_KEY_MAX_SIZE
+#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE \
+ PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)
+#endif
+#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) && \
+ (PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS) > \
+ PSA_EXPORT_PUBLIC_KEY_MAX_SIZE)
+#undef PSA_EXPORT_PUBLIC_KEY_MAX_SIZE
+#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE \
+ PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS)
+#endif
+#if defined(PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY) && \
+ (PSA_KEY_EXPORT_FFDH_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS) > \
+ PSA_EXPORT_PUBLIC_KEY_MAX_SIZE)
+#undef PSA_EXPORT_PUBLIC_KEY_MAX_SIZE
+#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE \
+ PSA_KEY_EXPORT_FFDH_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS)
+#endif
/** Sufficient output buffer size for psa_raw_key_agreement().
*
@@ -1002,11 +1047,18 @@
*
* See also #PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(\p key_type, \p key_bits).
*/
-#define PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE \
- (PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS) > \
- PSA_BITS_TO_BYTES(PSA_VENDOR_FFDH_MAX_KEY_BITS) ? \
- PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS) : \
- PSA_BITS_TO_BYTES(PSA_VENDOR_FFDH_MAX_KEY_BITS))
+#define PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE 1
+
+#if defined(PSA_WANT_ALG_ECDH) && \
+ (PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS) > PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE)
+#undef PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE
+#define PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS)
+#endif
+#if defined(PSA_WANT_ALG_FFDH) && \
+ (PSA_BITS_TO_BYTES(PSA_VENDOR_FFDH_MAX_KEY_BITS) > PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE)
+#undef PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE
+#define PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE PSA_BITS_TO_BYTES(PSA_VENDOR_FFDH_MAX_KEY_BITS)
+#endif
/** The default IV size for a cipher algorithm, in bytes.
*
diff --git a/library/debug.c b/library/debug.c
index 0f02929..56bc3f6 100644
--- a/library/debug.c
+++ b/library/debug.c
@@ -397,7 +397,8 @@
}
#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_X509_REMOVE_INFO */
-#if defined(MBEDTLS_ECDH_C)
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) && \
+ defined(MBEDTLS_ECDH_C)
static void mbedtls_debug_printf_ecdh_internal(const mbedtls_ssl_context *ssl,
int level, const char *file,
int line,
@@ -443,6 +444,7 @@
}
#endif
}
-#endif /* MBEDTLS_ECDH_C */
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED &&
+ MBEDTLS_ECDH_C */
#endif /* MBEDTLS_DEBUG_C */
diff --git a/library/ecp.c b/library/ecp.c
index 049a1e0..25af631 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -591,9 +591,11 @@
}
if (grp->h != 1) {
+ mbedtls_mpi_free(&grp->P);
mbedtls_mpi_free(&grp->A);
mbedtls_mpi_free(&grp->B);
mbedtls_ecp_point_free(&grp->G);
+ mbedtls_mpi_free(&grp->N);
}
if (!ecp_group_is_static_comb_table(grp) && grp->T != NULL) {
@@ -3639,7 +3641,7 @@
#if defined(MBEDTLS_TEST_HOOKS)
MBEDTLS_STATIC_TESTABLE
-mbedtls_ecp_variant mbedtls_ecp_get_variant()
+mbedtls_ecp_variant mbedtls_ecp_get_variant(void)
{
return MBEDTLS_ECP_VARIANT_WITH_MPI_STRUCT;
}
diff --git a/library/ecp_curves.c b/library/ecp_curves.c
index 8ed1ce0..4ea36e3 100644
--- a/library/ecp_curves.c
+++ b/library/ecp_curves.c
@@ -24,14 +24,9 @@
#if defined(MBEDTLS_ECP_LIGHT)
#include "mbedtls/ecp.h"
-#include "mbedtls/platform.h"
#include "mbedtls/platform_util.h"
#include "mbedtls/error.h"
-#include "mbedtls/platform.h"
-
-#include "constant_time_internal.h"
-
#include "bn_mul.h"
#include "bignum_core.h"
#include "ecp_invasive.h"
@@ -4509,13 +4504,10 @@
#endif
#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
-
-#if defined(ECP_LOAD_GROUP) || defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || \
- defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
+#if defined(ECP_LOAD_GROUP)
/*
* Create an MPI from embedded constants
- * (assumes len is an exact multiple of sizeof(mbedtls_mpi_uint) and
- * len < 1048576)
+ * (assumes len is an exact multiple of sizeof(mbedtls_mpi_uint))
*/
static inline void ecp_mpi_load(mbedtls_mpi *X, const mbedtls_mpi_uint *p, size_t len)
{
@@ -4523,9 +4515,7 @@
X->n = (unsigned short) (len / sizeof(mbedtls_mpi_uint));
X->p = (mbedtls_mpi_uint *) p;
}
-#endif
-#if defined(ECP_LOAD_GROUP)
/*
* Set an MPI to static value 1
*/
@@ -4578,28 +4568,18 @@
/* Forward declarations */
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
static int ecp_mod_p192(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p192_raw(mbedtls_mpi_uint *Np, size_t Nn);
#endif
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
static int ecp_mod_p224(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p224_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
static int ecp_mod_p256(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p256_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif
#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
static int ecp_mod_p384(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
static int ecp_mod_p521(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p521_raw(mbedtls_mpi_uint *N_p, size_t N_n);
#endif
#define NIST_MODP(P) grp->modp = ecp_mod_ ## P;
@@ -4610,28 +4590,18 @@
/* Additional forward declarations */
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
static int ecp_mod_p255(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p255_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif
#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
static int ecp_mod_p448(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p448_raw(mbedtls_mpi_uint *, size_t);
#endif
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
static int ecp_mod_p192k1(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p192k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif
#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
static int ecp_mod_p224k1(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p224k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif
#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
static int ecp_mod_p256k1(mbedtls_mpi *);
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p256k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif
#if defined(ECP_LOAD_GROUP)
@@ -4659,21 +4629,9 @@
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
/* Constants used by ecp_use_curve25519() */
static const mbedtls_mpi_sint curve25519_a24 = 0x01DB42;
-
-/* P = 2^255 - 19 */
-static const mbedtls_mpi_uint curve25519_p[] = {
- MBEDTLS_BYTES_TO_T_UINT_8(0xED, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0X7F)
-};
-
-/* N = 2^252 + 27742317777372353535851937790883648493 */
-static const mbedtls_mpi_uint curve25519_n[] = {
- MBEDTLS_BYTES_TO_T_UINT_8(0XED, 0XD3, 0XF5, 0X5C, 0X1A, 0X63, 0X12, 0X58),
- MBEDTLS_BYTES_TO_T_UINT_8(0XD6, 0X9C, 0XF7, 0XA2, 0XDE, 0XF9, 0XDE, 0X14),
- MBEDTLS_BYTES_TO_T_UINT_8(0X00, 0X00, 0X00, 0X00, 0x00, 0x00, 0x00, 0x00),
- MBEDTLS_BYTES_TO_T_UINT_8(0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10)
+static const unsigned char curve25519_part_of_n[] = {
+ 0x14, 0xDE, 0xF9, 0xDE, 0xA2, 0xF7, 0x9C, 0xD6,
+ 0x58, 0x12, 0x63, 0x1A, 0x5C, 0xF5, 0xD3, 0xED,
};
/*
@@ -4686,11 +4644,16 @@
/* Actually ( A + 2 ) / 4 */
MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->A, curve25519_a24));
- ecp_mpi_load(&grp->P, curve25519_p, sizeof(curve25519_p));
-
+ /* P = 2^255 - 19 */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->P, 1));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&grp->P, 255));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&grp->P, &grp->P, 19));
grp->pbits = mbedtls_mpi_bitlen(&grp->P);
- ecp_mpi_load(&grp->N, curve25519_n, sizeof(curve25519_n));
+ /* N = 2^252 + 27742317777372353535851937790883648493 */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&grp->N,
+ curve25519_part_of_n, sizeof(curve25519_part_of_n)));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&grp->N, 252, 1));
/* Y intentionally not set, since we use x/z coordinates.
* This is used as a marker to identify Montgomery curves! */
@@ -4713,29 +4676,11 @@
#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
/* Constants used by ecp_use_curve448() */
static const mbedtls_mpi_sint curve448_a24 = 0x98AA;
-
-/* P = 2^448 - 2^224 - 1 */
-static const mbedtls_mpi_uint curve448_p[] = {
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFE, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0X00, 0X00, 0X00, 0X00, 0X00, 0X00, 0X00, 0X00)
-};
-
-/* N = 2^446 - 13818066809895115352007386748515426880336692474882178609894547503885 */
-static const mbedtls_mpi_uint curve448_n[] = {
- MBEDTLS_BYTES_TO_T_UINT_8(0XF3, 0X44, 0X58, 0XAB, 0X92, 0XC2, 0X78, 0X23),
- MBEDTLS_BYTES_TO_T_UINT_8(0X55, 0X8F, 0XC5, 0X8D, 0X72, 0XC2, 0X6C, 0X21),
- MBEDTLS_BYTES_TO_T_UINT_8(0X90, 0X36, 0XD6, 0XAE, 0X49, 0XDB, 0X4E, 0XC4),
- MBEDTLS_BYTES_TO_T_UINT_8(0XE9, 0X23, 0XCA, 0X7C, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF),
- MBEDTLS_BYTES_TO_T_UINT_8(0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF, 0X3F),
- MBEDTLS_BYTES_TO_T_UINT_8(0X00, 0X00, 0X00, 0X00, 0X00, 0X00, 0X00, 0X00)
+static const unsigned char curve448_part_of_n[] = {
+ 0x83, 0x35, 0xDC, 0x16, 0x3B, 0xB1, 0x24,
+ 0xB6, 0x51, 0x29, 0xC9, 0x6F, 0xDE, 0x93,
+ 0x3D, 0x8D, 0x72, 0x3A, 0x70, 0xAA, 0xDC,
+ 0x87, 0x3D, 0x6D, 0x54, 0xA7, 0xBB, 0x0D,
};
/*
@@ -4743,12 +4688,20 @@
*/
static int ecp_use_curve448(mbedtls_ecp_group *grp)
{
+ mbedtls_mpi Ns;
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ mbedtls_mpi_init(&Ns);
+
/* Actually ( A + 2 ) / 4 */
MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->A, curve448_a24));
- ecp_mpi_load(&grp->P, curve448_p, sizeof(curve448_p));
+ /* P = 2^448 - 2^224 - 1 */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->P, 1));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&grp->P, 224));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&grp->P, &grp->P, 1));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&grp->P, 224));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&grp->P, &grp->P, 1));
grp->pbits = mbedtls_mpi_bitlen(&grp->P);
/* Y intentionally not set, since we use x/z coordinates.
@@ -4757,12 +4710,17 @@
MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->G.Z, 1));
mbedtls_mpi_free(&grp->G.Y);
- ecp_mpi_load(&grp->N, curve448_n, sizeof(curve448_n));
+ /* N = 2^446 - 13818066809895115352007386748515426880336692474882178609894547503885 */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&grp->N, 446, 1));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&Ns,
+ curve448_part_of_n, sizeof(curve448_part_of_n)));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&grp->N, &grp->N, &Ns));
/* Actually, the required msb for private keys */
grp->nbits = 447;
cleanup:
+ mbedtls_mpi_free(&Ns);
if (ret != 0) {
mbedtls_ecp_group_free(grp);
}
@@ -4912,12 +4870,10 @@
}
#define WIDTH 8 / sizeof(mbedtls_mpi_uint)
-#define A(i) Np + (i) * WIDTH
-#define ADD(i) add64(p, A(i), &c)
+#define A(i) N->p + (i) * WIDTH
+#define ADD(i) add64(p, A(i), &c)
#define NEXT p += WIDTH; carry64(p, &c)
-#define LAST p += WIDTH; do *p = 0; while (++p < end)
-#define RESET last_carry[0] = c; c = 0; p = Np
-#define ADD_LAST add64(p, last_carry, &c)
+#define LAST p += WIDTH; *p = c; while (++p < end) *p = 0
/*
* Fast quasi-reduction modulo p192 (FIPS 186-3 D.2.1)
@@ -4925,67 +4881,33 @@
static int ecp_mod_p192(mbedtls_mpi *N)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(192) * 2;
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
- ret = mbedtls_ecp_mod_p192_raw(N->p, expected_width);
+ mbedtls_mpi_uint c = 0;
+ mbedtls_mpi_uint *p, *end;
+
+ /* Make sure we have enough blocks so that A(5) is legal */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, 6 * WIDTH));
+
+ p = N->p;
+ end = p + N->n;
+
+ ADD(3); ADD(5); NEXT; // A0 += A3 + A5
+ ADD(3); ADD(4); ADD(5); NEXT; // A1 += A3 + A4 + A5
+ ADD(4); ADD(5); LAST; // A2 += A4 + A5
cleanup:
return ret;
}
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p192_raw(mbedtls_mpi_uint *Np, size_t Nn)
-{
- mbedtls_mpi_uint c = 0, last_carry[WIDTH] = { 0 };
- mbedtls_mpi_uint *p, *end;
-
- if (Nn != BITS_TO_LIMBS(192) * 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- p = Np;
- end = p + Nn;
-
- ADD(3); ADD(5); NEXT; // A0 += A3 + A5
- ADD(3); ADD(4); ADD(5); NEXT; // A1 += A3 + A4 + A5
- ADD(4); ADD(5); // A2 += A4 + A5
-
- RESET;
-
- /* Use the reduction for the carry as well:
- * 2^192 * last_carry = 2^64 * last_carry + last_carry mod P192
- * It can generate a carry. */
- ADD_LAST; NEXT; // A0 += last_carry
- ADD_LAST; NEXT; // A1 += last_carry
- // A2 += carry
-
- RESET;
-
- /* Use the reduction for the carry as well:
- * 2^192 * last_carry = 2^64 * last_carry + last_carry mod P192
- */
- ADD_LAST; NEXT; // A0 += last_carry
- ADD_LAST; NEXT; // A1 += last_carry
- // A2 += carry
-
- LAST;
-
- return 0;
-}
-
#undef WIDTH
#undef A
#undef ADD
#undef NEXT
#undef LAST
-#undef RESET
-#undef ADD_LAST
#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
-
/*
* The reader is advised to first understand ecp_mod_p192() since the same
* general structure is used here, but with additional complications:
@@ -5006,209 +4928,161 @@
#if defined(MBEDTLS_HAVE_INT32) /* 32 bit */
-#define MAX32 X_limbs
-#define A(j) X[j]
-#define STORE32 X[i] = (mbedtls_mpi_uint) cur;
-#define STORE0 X[i] = 0;
+#define MAX32 N->n
+#define A(j) N->p[j]
+#define STORE32 N->p[i] = cur;
-#else /* 64 bit */
+#else /* 64-bit */
-#define MAX32 X_limbs * 2
-#define A(j) \
- (j) % 2 ? \
- (uint32_t) (X[(j) / 2] >> 32) : \
- (uint32_t) (X[(j) / 2])
-#define STORE32 \
- if (i % 2) { \
- X[i/2] &= 0x00000000FFFFFFFF; \
- X[i/2] |= (uint64_t) (cur) << 32; \
- } else { \
- X[i/2] &= 0xFFFFFFFF00000000; \
- X[i/2] |= (uint32_t) cur; \
+#define MAX32 N->n * 2
+#define A(j) (j) % 2 ? (uint32_t) (N->p[(j)/2] >> 32) : \
+ (uint32_t) (N->p[(j)/2])
+#define STORE32 \
+ if (i % 2) { \
+ N->p[i/2] &= 0x00000000FFFFFFFF; \
+ N->p[i/2] |= ((mbedtls_mpi_uint) cur) << 32; \
+ } else { \
+ N->p[i/2] &= 0xFFFFFFFF00000000; \
+ N->p[i/2] |= (mbedtls_mpi_uint) cur; \
}
-#define STORE0 \
- if (i % 2) { \
- X[i/2] &= 0x00000000FFFFFFFF; \
- } else { \
- X[i/2] &= 0xFFFFFFFF00000000; \
- }
+#endif /* sizeof( mbedtls_mpi_uint ) */
-#endif
-
-static inline int8_t extract_carry(int64_t cur)
+/*
+ * Helpers for addition and subtraction of chunks, with signed carry.
+ */
+static inline void add32(uint32_t *dst, uint32_t src, signed char *carry)
{
- return (int8_t) (cur >> 32);
+ *dst += src;
+ *carry += (*dst < src);
}
-#define ADD(j) cur += A(j)
-#define SUB(j) cur -= A(j)
+static inline void sub32(uint32_t *dst, uint32_t src, signed char *carry)
+{
+ *carry -= (*dst < src);
+ *dst -= src;
+}
-#define ADD_CARRY(cc) cur += (cc)
-#define SUB_CARRY(cc) cur -= (cc)
-
-#define ADD_LAST ADD_CARRY(last_c)
-#define SUB_LAST SUB_CARRY(last_c)
+#define ADD(j) add32(&cur, A(j), &c);
+#define SUB(j) sub32(&cur, A(j), &c);
/*
* Helpers for the main 'loop'
*/
-#define INIT(b) \
- int8_t c = 0, last_c; \
- int64_t cur; \
- size_t i = 0; \
+#define INIT(b) \
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; \
+ signed char c = 0, cc; \
+ uint32_t cur; \
+ size_t i = 0, bits = (b); \
+ /* N is the size of the product of two b-bit numbers, plus one */ \
+ /* limb for fix_negative */ \
+ MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, (b) * 2 / biL + 1)); \
LOAD32;
-#define NEXT \
- c = extract_carry(cur); \
- STORE32; i++; LOAD32; \
- ADD_CARRY(c);
+#define NEXT \
+ STORE32; i++; LOAD32; \
+ cc = c; c = 0; \
+ if (cc < 0) \
+ sub32(&cur, -cc, &c); \
+ else \
+ add32(&cur, cc, &c); \
-#define RESET \
- c = extract_carry(cur); \
- last_c = c; \
- STORE32; i = 0; LOAD32; \
- c = 0; \
+#define LAST \
+ STORE32; i++; \
+ cur = c > 0 ? c : 0; STORE32; \
+ cur = 0; while (++i < MAX32) { STORE32; } \
+ if (c < 0) mbedtls_ecp_fix_negative(N, c, bits);
-#define LAST \
- c = extract_carry(cur); \
- STORE32; i++; \
- if (c != 0) \
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; \
- while (i < MAX32) { STORE0; i++; }
+/*
+ * If the result is negative, we get it in the form
+ * c * 2^bits + N, with c negative and N positive shorter than 'bits'
+ */
+static void mbedtls_ecp_fix_negative(mbedtls_mpi *N, signed char c, size_t bits)
+{
+ size_t i;
+
+ /* Set N := 2^bits - 1 - N. We know that 0 <= N < 2^bits, so
+ * set the absolute value to 0xfff...fff - N. There is no carry
+ * since we're subtracting from all-bits-one. */
+ for (i = 0; i <= bits / 8 / sizeof(mbedtls_mpi_uint); i++) {
+ N->p[i] = ~(mbedtls_mpi_uint) 0 - N->p[i];
+ }
+ /* Add 1, taking care of the carry. */
+ i = 0;
+ do {
+ ++N->p[i];
+ } while (N->p[i++] == 0 && i <= bits / 8 / sizeof(mbedtls_mpi_uint));
+ /* Invert the sign.
+ * Now N = N0 - 2^bits where N0 is the initial value of N. */
+ N->s = -1;
+
+ /* Add |c| * 2^bits to the absolute value. Since c and N are
+ * negative, this adds c * 2^bits. */
+ mbedtls_mpi_uint msw = (mbedtls_mpi_uint) -c;
+#if defined(MBEDTLS_HAVE_INT64)
+ if (bits == 224) {
+ msw <<= 32;
+ }
+#endif
+ N->p[bits / 8 / sizeof(mbedtls_mpi_uint)] += msw;
+}
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
-
/*
* Fast quasi-reduction modulo p224 (FIPS 186-3 D.2.2)
*/
static int ecp_mod_p224(mbedtls_mpi *N)
{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(224) * 2;
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
- ret = mbedtls_ecp_mod_p224_raw(N->p, expected_width);
+ INIT(224);
+
+ SUB(7); SUB(11); NEXT; // A0 += -A7 - A11
+ SUB(8); SUB(12); NEXT; // A1 += -A8 - A12
+ SUB(9); SUB(13); NEXT; // A2 += -A9 - A13
+ SUB(10); ADD(7); ADD(11); NEXT; // A3 += -A10 + A7 + A11
+ SUB(11); ADD(8); ADD(12); NEXT; // A4 += -A11 + A8 + A12
+ SUB(12); ADD(9); ADD(13); NEXT; // A5 += -A12 + A9 + A13
+ SUB(13); ADD(10); LAST; // A6 += -A13 + A10
+
cleanup:
return ret;
}
-
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p224_raw(mbedtls_mpi_uint *X, size_t X_limbs)
-{
- if (X_limbs != BITS_TO_LIMBS(224) * 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- INIT(224);
-
- SUB(7); SUB(11); NEXT; // A0 += -A7 - A11
- SUB(8); SUB(12); NEXT; // A1 += -A8 - A12
- SUB(9); SUB(13); NEXT; // A2 += -A9 - A13
- SUB(10); ADD(7); ADD(11); NEXT; // A3 += -A10 + A7 + A11
- SUB(11); ADD(8); ADD(12); NEXT; // A4 += -A11 + A8 + A12
- SUB(12); ADD(9); ADD(13); NEXT; // A5 += -A12 + A9 + A13
- SUB(13); ADD(10); // A6 += -A13 + A10
-
- RESET;
-
- /* Use 2^224 = P + 2^96 - 1 to modulo reduce the final carry */
- SUB_LAST; NEXT; // A0 -= last_c
- ; NEXT; // A1
- ; NEXT; // A2
- ADD_LAST; NEXT; // A3 += last_c
- ; NEXT; // A4
- ; NEXT; // A5
- // A6
-
- /* The carry reduction cannot generate a carry
- * (see commit 73e8553 for details)*/
-
- LAST;
-
- return 0;
-}
-
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
-
/*
* Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
*/
static int ecp_mod_p256(mbedtls_mpi *N)
{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(256) * 2;
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
- ret = mbedtls_ecp_mod_p256_raw(N->p, expected_width);
+ INIT(256);
+
+ ADD(8); ADD(9);
+ SUB(11); SUB(12); SUB(13); SUB(14); NEXT; // A0
+
+ ADD(9); ADD(10);
+ SUB(12); SUB(13); SUB(14); SUB(15); NEXT; // A1
+
+ ADD(10); ADD(11);
+ SUB(13); SUB(14); SUB(15); NEXT; // A2
+
+ ADD(11); ADD(11); ADD(12); ADD(12); ADD(13);
+ SUB(15); SUB(8); SUB(9); NEXT; // A3
+
+ ADD(12); ADD(12); ADD(13); ADD(13); ADD(14);
+ SUB(9); SUB(10); NEXT; // A4
+
+ ADD(13); ADD(13); ADD(14); ADD(14); ADD(15);
+ SUB(10); SUB(11); NEXT; // A5
+
+ ADD(14); ADD(14); ADD(15); ADD(15); ADD(14); ADD(13);
+ SUB(8); SUB(9); NEXT; // A6
+
+ ADD(15); ADD(15); ADD(15); ADD(8);
+ SUB(10); SUB(11); SUB(12); SUB(13); LAST; // A7
+
cleanup:
return ret;
}
-
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p256_raw(mbedtls_mpi_uint *X, size_t X_limbs)
-{
- if (X_limbs != BITS_TO_LIMBS(256) * 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- INIT(256);
-
- ADD(8); ADD(9);
- SUB(11); SUB(12); SUB(13); SUB(14); NEXT; // A0
-
- ADD(9); ADD(10);
- SUB(12); SUB(13); SUB(14); SUB(15); NEXT; // A1
-
- ADD(10); ADD(11);
- SUB(13); SUB(14); SUB(15); NEXT; // A2
-
- ADD(11); ADD(11); ADD(12); ADD(12); ADD(13);
- SUB(15); SUB(8); SUB(9); NEXT; // A3
-
- ADD(12); ADD(12); ADD(13); ADD(13); ADD(14);
- SUB(9); SUB(10); NEXT; // A4
-
- ADD(13); ADD(13); ADD(14); ADD(14); ADD(15);
- SUB(10); SUB(11); NEXT; // A5
-
- ADD(14); ADD(14); ADD(15); ADD(15); ADD(14); ADD(13);
- SUB(8); SUB(9); NEXT; // A6
-
- ADD(15); ADD(15); ADD(15); ADD(8);
- SUB(10); SUB(11); SUB(12); SUB(13); // A7
-
- RESET;
-
- /* Use 2^224 * (2^32 - 1) + 2^192 + 2^96 - 1
- * to modulo reduce the final carry. */
- ADD_LAST; NEXT; // A0
- ; NEXT; // A1
- ; NEXT; // A2
- SUB_LAST; NEXT; // A3
- ; NEXT; // A4
- ; NEXT; // A5
- SUB_LAST; NEXT; // A6
- ADD_LAST; // A7
-
- RESET;
-
- /* Use 2^224 * (2^32 - 1) + 2^192 + 2^96 - 1
- * to modulo reduce the carry generated by the previous reduction. */
- ADD_LAST; NEXT; // A0
- ; NEXT; // A1
- ; NEXT; // A2
- SUB_LAST; NEXT; // A3
- ; NEXT; // A4
- ; NEXT; // A5
- SUB_LAST; NEXT; // A6
- ADD_LAST; // A7
-
- LAST;
-
- return 0;
-}
-
#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
@@ -5217,110 +5091,55 @@
*/
static int ecp_mod_p384(mbedtls_mpi *N)
{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(384) * 2;
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
- ret = mbedtls_ecp_mod_p384_raw(N->p, expected_width);
-cleanup:
- return ret;
-}
-
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *X, size_t X_limbs)
-{
- if (X_limbs != BITS_TO_LIMBS(384) * 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
INIT(384);
ADD(12); ADD(21); ADD(20);
- SUB(23); NEXT; // A0
+ SUB(23); NEXT; // A0
ADD(13); ADD(22); ADD(23);
- SUB(12); SUB(20); NEXT; // A1
+ SUB(12); SUB(20); NEXT; // A2
ADD(14); ADD(23);
- SUB(13); SUB(21); NEXT; // A2
+ SUB(13); SUB(21); NEXT; // A2
ADD(15); ADD(12); ADD(20); ADD(21);
- SUB(14); SUB(22); SUB(23); NEXT; // A3
+ SUB(14); SUB(22); SUB(23); NEXT; // A3
ADD(21); ADD(21); ADD(16); ADD(13); ADD(12); ADD(20); ADD(22);
- SUB(15); SUB(23); SUB(23); NEXT; // A4
+ SUB(15); SUB(23); SUB(23); NEXT; // A4
ADD(22); ADD(22); ADD(17); ADD(14); ADD(13); ADD(21); ADD(23);
- SUB(16); NEXT; // A5
+ SUB(16); NEXT; // A5
ADD(23); ADD(23); ADD(18); ADD(15); ADD(14); ADD(22);
- SUB(17); NEXT; // A6
+ SUB(17); NEXT; // A6
ADD(19); ADD(16); ADD(15); ADD(23);
- SUB(18); NEXT; // A7
+ SUB(18); NEXT; // A7
ADD(20); ADD(17); ADD(16);
- SUB(19); NEXT; // A8
+ SUB(19); NEXT; // A8
ADD(21); ADD(18); ADD(17);
- SUB(20); NEXT; // A9
+ SUB(20); NEXT; // A9
ADD(22); ADD(19); ADD(18);
- SUB(21); NEXT; // A10
+ SUB(21); NEXT; // A10
ADD(23); ADD(20); ADD(19);
- SUB(22); // A11
+ SUB(22); LAST; // A11
- RESET;
-
- /* Use 2^384 = P + 2^128 + 2^96 - 2^32 + 1 to modulo reduce the final carry */
- ADD_LAST; NEXT; // A0
- SUB_LAST; NEXT; // A1
- ; NEXT; // A2
- ADD_LAST; NEXT; // A3
- ADD_LAST; NEXT; // A4
- ; NEXT; // A5
- ; NEXT; // A6
- ; NEXT; // A7
- ; NEXT; // A8
- ; NEXT; // A9
- ; NEXT; // A10
- // A11
-
- RESET;
-
- ADD_LAST; NEXT; // A0
- SUB_LAST; NEXT; // A1
- ; NEXT; // A2
- ADD_LAST; NEXT; // A3
- ADD_LAST; NEXT; // A4
- ; NEXT; // A5
- ; NEXT; // A6
- ; NEXT; // A7
- ; NEXT; // A8
- ; NEXT; // A9
- ; NEXT; // A10
- // A11
-
- LAST;
-
- return 0;
+cleanup:
+ return ret;
}
#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
-#undef LOAD32
-#undef MAX32
#undef A
+#undef LOAD32
#undef STORE32
-#undef STORE0
-#undef ADD
-#undef SUB
-#undef ADD_CARRY
-#undef SUB_CARRY
-#undef ADD_LAST
-#undef SUB_LAST
+#undef MAX32
#undef INIT
#undef NEXT
-#undef RESET
#undef LAST
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED ||
@@ -5328,6 +5147,11 @@
MBEDTLS_ECP_DP_SECP384R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
+/*
+ * Here we have an actual Mersenne prime, so things are more straightforward.
+ * However, chunks are aligned on a 'weird' boundary (521 bits).
+ */
+
/* Size of p521 in terms of mbedtls_mpi_uint */
#define P521_WIDTH (521 / 8 / sizeof(mbedtls_mpi_uint) + 1)
@@ -5335,81 +5159,48 @@
#define P521_MASK 0x01FF
/*
- * Fast quasi-reduction modulo p521 = 2^521 - 1 (FIPS 186-3 D.2.5)
+ * Fast quasi-reduction modulo p521 (FIPS 186-3 D.2.5)
+ * Write N as A1 + 2^521 A0, return A0 + A1
*/
static int ecp_mod_p521(mbedtls_mpi *N)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(521) * 2;
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
- ret = mbedtls_ecp_mod_p521_raw(N->p, expected_width);
+ size_t i;
+ mbedtls_mpi M;
+ mbedtls_mpi_uint Mp[P521_WIDTH + 1];
+ /* Worst case for the size of M is when mbedtls_mpi_uint is 16 bits:
+ * we need to hold bits 513 to 1056, which is 34 limbs, that is
+ * P521_WIDTH + 1. Otherwise P521_WIDTH is enough. */
+
+ if (N->n < P521_WIDTH) {
+ return 0;
+ }
+
+ /* M = A1 */
+ M.s = 1;
+ M.n = N->n - (P521_WIDTH - 1);
+ if (M.n > P521_WIDTH + 1) {
+ M.n = P521_WIDTH + 1;
+ }
+ M.p = Mp;
+ memcpy(Mp, N->p + P521_WIDTH - 1, M.n * sizeof(mbedtls_mpi_uint));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&M, 521 % (8 * sizeof(mbedtls_mpi_uint))));
+
+ /* N = A0 */
+ N->p[P521_WIDTH - 1] &= P521_MASK;
+ for (i = P521_WIDTH; i < N->n; i++) {
+ N->p[i] = 0;
+ }
+
+ /* N = A0 + A1 */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_add_abs(N, N, &M));
+
cleanup:
return ret;
}
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p521_raw(mbedtls_mpi_uint *X, size_t X_limbs)
-{
- mbedtls_mpi_uint carry = 0;
-
- if (X_limbs != BITS_TO_LIMBS(521) * 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- /* Step 1: Reduction to P521_WIDTH limbs */
- /* Helper references for bottom part of X */
- mbedtls_mpi_uint *X0 = X;
- size_t X0_limbs = P521_WIDTH;
- /* Helper references for top part of X */
- mbedtls_mpi_uint *X1 = X + X0_limbs;
- size_t X1_limbs = X_limbs - X0_limbs;
- /* Split X as X0 + 2^P521_WIDTH X1 and compute X0 + 2^(biL - 9) X1.
- * (We are using that 2^P521_WIDTH = 2^(512 + biL) and that
- * 2^(512 + biL) X1 = 2^(biL - 9) X1 mod P521.)
- * The high order limb of the result will be held in carry and the rest
- * in X0 (that is the result will be represented as
- * 2^P521_WIDTH carry + X0).
- *
- * Also, note that the resulting carry is either 0 or 1:
- * X0 < 2^P521_WIDTH = 2^(512 + biL) and X1 < 2^(P521_WIDTH-biL) = 2^512
- * therefore
- * X0 + 2^(biL - 9) X1 < 2^(512 + biL) + 2^(512 + biL - 9)
- * which in turn is less than 2 * 2^(512 + biL).
- */
- mbedtls_mpi_uint shift = ((mbedtls_mpi_uint) 1u) << (biL - 9);
- carry = mbedtls_mpi_core_mla(X0, X0_limbs, X1, X1_limbs, shift);
- /* Set X to X0 (by clearing the top part). */
- memset(X1, 0, X1_limbs * sizeof(mbedtls_mpi_uint));
-
- /* Step 2: Reduction modulo P521
- *
- * At this point X is reduced to P521_WIDTH limbs. What remains is to add
- * the carry (that is 2^P521_WIDTH carry) and to reduce mod P521. */
-
- /* 2^P521_WIDTH carry = 2^(512 + biL) carry = 2^(biL - 9) carry mod P521.
- * Also, recall that carry is either 0 or 1. */
- mbedtls_mpi_uint addend = carry << (biL - 9);
- /* Keep the top 9 bits and reduce the rest, using 2^521 = 1 mod P521. */
- addend += (X[P521_WIDTH - 1] >> 9);
- X[P521_WIDTH - 1] &= P521_MASK;
-
- /* Reuse the top part of X (already zeroed) as a helper array for
- * carrying out the addition. */
- mbedtls_mpi_uint *addend_arr = X + P521_WIDTH;
- addend_arr[0] = addend;
- (void) mbedtls_mpi_core_add(X, X, addend_arr, P521_WIDTH);
- /* Both addends were less than P521 therefore X < 2 * P521. (This also means
- * that the result fit in P521_WIDTH limbs and there won't be any carry.) */
-
- /* Clear the reused part of X. */
- addend_arr[0] = 0;
-
- return 0;
-}
-
#undef P521_WIDTH
#undef P521_MASK
-
#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
#endif /* MBEDTLS_ECP_NIST_OPTIM */
@@ -5425,57 +5216,27 @@
*/
static int ecp_mod_p255(mbedtls_mpi *N)
{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(255) * 2;
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
- ret = mbedtls_ecp_mod_p255_raw(N->p, expected_width);
-cleanup:
- return ret;
-}
+ mbedtls_mpi_uint Mp[P255_WIDTH];
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p255_raw(mbedtls_mpi_uint *X, size_t X_Limbs)
-{
-
- if (X_Limbs != BITS_TO_LIMBS(255) * 2) {
+ /* Helper references for top part of N */
+ mbedtls_mpi_uint * const NT_p = N->p + P255_WIDTH;
+ const size_t NT_n = N->n - P255_WIDTH;
+ if (N->n <= P255_WIDTH) {
+ return 0;
+ }
+ if (NT_n > P255_WIDTH) {
return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
}
- mbedtls_mpi_uint *carry = mbedtls_calloc(P255_WIDTH, ciL);
- if (carry == NULL) {
- return MBEDTLS_ERR_ECP_ALLOC_FAILED;
- }
+ /* Split N as N + 2^256 M */
+ memcpy(Mp, NT_p, sizeof(mbedtls_mpi_uint) * NT_n);
+ memset(NT_p, 0, sizeof(mbedtls_mpi_uint) * NT_n);
- /* Step 1: Reduction to P255_WIDTH limbs */
- if (X_Limbs > P255_WIDTH) {
- /* Helper references for top part of X */
- mbedtls_mpi_uint * const A1 = X + P255_WIDTH;
- const size_t A1_limbs = X_Limbs - P255_WIDTH;
+ /* N = A0 + 38 * A1 */
+ mbedtls_mpi_core_mla(N->p, P255_WIDTH + 1,
+ Mp, NT_n,
+ 38);
- /* X = A0 + 38 * A1, capture carry out */
- *carry = mbedtls_mpi_core_mla(X, P255_WIDTH, A1, A1_limbs, 38);
- /* Clear top part */
- memset(A1, 0, sizeof(mbedtls_mpi_uint) * A1_limbs);
- }
-
- /* Step 2: Reduce to <2p
- * Split as A0 + 2^255*c, with c a scalar, and compute A0 + 19*c */
- *carry <<= 1;
- *carry += (X[P255_WIDTH - 1] >> (biL - 1));
- *carry *= 19;
-
- /* Clear top bit */
- X[P255_WIDTH - 1] <<= 1; X[P255_WIDTH - 1] >>= 1;
- /* Since the top bit for X has been cleared 0 + 0 + Carry
- * will not overflow.
- *
- * Furthermore for 2p = 2^256-38. When a carry propagation on the highest
- * limb occurs, X > 2^255 and all the remaining bits on the limb are zero.
- * - If X < 2^255 ==> X < 2p
- * - If X > 2^255 ==> X < 2^256 - 2^255 < 2p */
- (void) mbedtls_mpi_core_add(X, X, carry, P255_WIDTH);
-
- mbedtls_free(carry);
return 0;
}
#endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
@@ -5492,144 +5253,67 @@
#define P224_WIDTH_MAX DIV_ROUND_UP(P224_SIZE, sizeof(mbedtls_mpi_uint))
#define P224_UNUSED_BITS ((P224_WIDTH_MAX * sizeof(mbedtls_mpi_uint) * 8) - 224)
+/*
+ * Fast quasi-reduction modulo p448 = 2^448 - 2^224 - 1
+ * Write N as A0 + 2^448 A1 and A1 as B0 + 2^224 B1, and return
+ * A0 + A1 + B1 + (B0 + B1) * 2^224. This is different to the reference
+ * implementation of Curve448, which uses its own special 56-bit limbs rather
+ * than a generic bignum library. We could squeeze some extra speed out on
+ * 32-bit machines by splitting N up into 32-bit limbs and doing the
+ * arithmetic using the limbs directly as we do for the NIST primes above,
+ * but for 64-bit targets it should use half the number of operations if we do
+ * the reduction with 224-bit limbs, since mpi_add_mpi will then use 64-bit adds.
+ */
static int ecp_mod_p448(mbedtls_mpi *N)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(448) * 2;
+ size_t i;
+ mbedtls_mpi M, Q;
+ mbedtls_mpi_uint Mp[P448_WIDTH + 1], Qp[P448_WIDTH];
- /* This is required as some tests and use cases do not pass in a Bignum of
- * the correct size, and expect the growth to be done automatically, which
- * will no longer happen. */
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
-
- ret = mbedtls_ecp_mod_p448_raw(N->p, N->n);
-
-cleanup:
- return ret;
-}
-
-/*
- * Fast quasi-reduction modulo p448 = 2^448 - 2^224 - 1
- * Write X as A0 + 2^448 A1 and A1 as B0 + 2^224 B1, and return A0 + A1 + B1 +
- * (B0 + B1) * 2^224. This is different to the reference implementation of
- * Curve448, which uses its own special 56-bit limbs rather than a generic
- * bignum library. We could squeeze some extra speed out on 32-bit machines by
- * splitting N up into 32-bit limbs and doing the arithmetic using the limbs
- * directly as we do for the NIST primes above, but for 64-bit targets it should
- * use half the number of operations if we do the reduction with 224-bit limbs,
- * since mpi_core_add will then use 64-bit adds.
- */
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p448_raw(mbedtls_mpi_uint *X, size_t X_limbs)
-{
- size_t round;
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-
- if (X_limbs != BITS_TO_LIMBS(448) * 2) {
+ if (N->n <= P448_WIDTH) {
return 0;
}
- size_t M_limbs = X_limbs - (P448_WIDTH);
-
- if (M_limbs > P448_WIDTH) {
- /* Shouldn't be called with X larger than 2^896! */
+ /* M = A1 */
+ M.s = 1;
+ M.n = N->n - (P448_WIDTH);
+ if (M.n > P448_WIDTH) {
+ /* Shouldn't be called with N larger than 2^896! */
return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
}
+ M.p = Mp;
+ memset(Mp, 0, sizeof(Mp));
+ memcpy(Mp, N->p + P448_WIDTH, M.n * sizeof(mbedtls_mpi_uint));
- /* Both M and Q require an extra limb to catch carries. */
- M_limbs++;
-
- const size_t Q_limbs = M_limbs;
- mbedtls_mpi_uint *M = NULL;
- mbedtls_mpi_uint *Q = NULL;
-
- M = mbedtls_calloc(M_limbs, ciL);
-
- if (M == NULL) {
- return MBEDTLS_ERR_ECP_ALLOC_FAILED;
+ /* N = A0 */
+ for (i = P448_WIDTH; i < N->n; i++) {
+ N->p[i] = 0;
}
- Q = mbedtls_calloc(Q_limbs, ciL);
+ /* N += A1 */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(N, N, &M));
- if (Q == NULL) {
- ret = MBEDTLS_ERR_ECP_ALLOC_FAILED;
- goto cleanup;
+ /* Q = B1, N += B1 */
+ Q = M;
+ Q.p = Qp;
+ memcpy(Qp, Mp, sizeof(Qp));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&Q, 224));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(N, N, &Q));
+
+ /* M = (B0 + B1) * 2^224, N += M */
+ if (sizeof(mbedtls_mpi_uint) > 4) {
+ Mp[P224_WIDTH_MIN] &= ((mbedtls_mpi_uint)-1) >> (P224_UNUSED_BITS);
}
-
- /* M = A1 */
- memset(M, 0, (M_limbs * ciL));
- /* Do not copy into the overflow limb, as this would read past the end of
- * X. */
- memcpy(M, X + P448_WIDTH, ((M_limbs - 1) * ciL));
-
- /* X = A0 */
- memset(X + P448_WIDTH, 0, ((M_limbs - 1) * ciL));
-
- /* X = X + M = A0 + A1 */
- /* Carry here fits in oversize X. Oversize M means it will get
- * added in, not returned as carry. */
- (void) mbedtls_mpi_core_add(X, X, M, M_limbs);
-
- /* Q = B1 = M >> 224 */
- memcpy(Q, (char *) M + P224_SIZE, P224_SIZE);
- memset((char *) Q + P224_SIZE, 0, P224_SIZE);
-
- /* X = X + Q = (A0 + A1) + B1
- * Oversize Q catches potential carry here when X is already max 448 bits.
- */
- (void) mbedtls_mpi_core_add(X, X, Q, Q_limbs);
-
- /* M = B0 */
-#ifdef MBEDTLS_HAVE_INT64
- M[P224_WIDTH_MIN] &= ((mbedtls_mpi_uint)-1) >> (P224_UNUSED_BITS);
- #endif
- memset(M + P224_WIDTH_MAX, 0, ((M_limbs - P224_WIDTH_MAX) * ciL));
-
- /* M = M + Q = B0 + B1 */
- (void) mbedtls_mpi_core_add(M, M, Q, Q_limbs);
-
- /* M = (B0 + B1) * 2^224 */
- /* Shifted carry bit from the addition fits in oversize M. */
- memmove((char *) M + P224_SIZE, M, P224_SIZE + ciL);
- memset(M, 0, P224_SIZE);
-
- /* X = X + M = (A0 + A1 + B1) + (B0 + B1) * 2^224 */
- (void) mbedtls_mpi_core_add(X, X, M, M_limbs);
-
- /* In the second and third rounds A1 and B0 have at most 1 non-zero limb and
- * B1=0.
- * Using this we need to calculate:
- * A0 + A1 + B1 + (B0 + B1) * 2^224 = A0 + A1 + B0 * 2^224. */
- for (round = 0; round < 2; ++round) {
-
- /* M = A1 */
- memset(M, 0, (M_limbs * ciL));
- memcpy(M, X + P448_WIDTH, ((M_limbs - 1) * ciL));
-
- /* X = A0 */
- memset(X + P448_WIDTH, 0, ((M_limbs - 1) * ciL));
-
- /* M = A1 + B0 * 2^224
- * We know that only one limb of A1 will be non-zero and that it will be
- * limb 0. We also know that B0 is the bottom 224 bits of A1 (which is
- * then shifted up 224 bits), so, given M is currently A1 this turns
- * into:
- * M = M + (M << 224)
- * As the single non-zero limb in B0 will be A1 limb 0 shifted up by 224
- * bits, we can just move that into the right place, shifted up
- * accordingly.*/
- M[P224_WIDTH_MIN] = M[0] << (224 & (biL - 1));
-
- /* X = A0 + (A1 + B0 * 2^224) */
- (void) mbedtls_mpi_core_add(X, X, M, M_limbs);
+ for (i = P224_WIDTH_MAX; i < M.n; ++i) {
+ Mp[i] = 0;
}
-
- ret = 0;
+ MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(&M, &M, &Q));
+ M.n = P448_WIDTH + 1; /* Make room for shifted carry bit from the addition */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&M, 224));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(N, N, &M));
cleanup:
- mbedtls_free(M);
- mbedtls_free(Q);
-
return ret;
}
#endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
@@ -5637,408 +5321,149 @@
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
-
/*
* Fast quasi-reduction modulo P = 2^s - R,
* with R about 33 bits, used by the Koblitz curves.
*
- * Write X as A0 + 2^224 A1, return A0 + R * A1.
+ * Write N as A0 + 2^224 A1, return A0 + R * A1.
+ * Actually do two passes, since R is big.
*/
+#define P_KOBLITZ_MAX (256 / 8 / sizeof(mbedtls_mpi_uint)) // Max limbs in P
#define P_KOBLITZ_R (8 / sizeof(mbedtls_mpi_uint)) // Limbs in R
-
-static inline int ecp_mod_koblitz(mbedtls_mpi_uint *X,
- size_t X_limbs,
- mbedtls_mpi_uint *R,
- size_t bits)
+static inline int ecp_mod_koblitz(mbedtls_mpi *N, mbedtls_mpi_uint *Rp, size_t p_limbs,
+ size_t adjust, size_t shift, mbedtls_mpi_uint mask)
{
- int ret = 0;
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ size_t i;
+ mbedtls_mpi M, R;
+ mbedtls_mpi_uint Mp[P_KOBLITZ_MAX + P_KOBLITZ_R + 1];
- /* Determine if A1 is aligned to limb bitsize. If not then the used limbs
- * of P, A0 and A1 must be set accordingly and there is a middle limb
- * which is shared by A0 and A1 and need to handle accordingly.
- */
- size_t shift = bits % biL;
- size_t adjust = (shift + biL - 1) / biL;
- size_t P_limbs = bits / biL + adjust;
- mbedtls_mpi_uint mask = 0;
-
- mbedtls_mpi_uint *A1 = mbedtls_calloc(P_limbs, ciL);
- if (A1 == NULL) {
- return MBEDTLS_ERR_ECP_ALLOC_FAILED;
+ if (N->n < p_limbs) {
+ return 0;
}
- /* Create a buffer to store the value of `R * A1` */
- size_t R_limbs = P_KOBLITZ_R;
- size_t M_limbs = P_limbs + R_limbs;
- mbedtls_mpi_uint *M = mbedtls_calloc(M_limbs, ciL);
- if (M == NULL) {
- ret = MBEDTLS_ERR_ECP_ALLOC_FAILED;
- goto cleanup;
+ /* Init R */
+ R.s = 1;
+ R.p = Rp;
+ R.n = P_KOBLITZ_R;
+
+ /* Common setup for M */
+ M.s = 1;
+ M.p = Mp;
+
+ /* M = A1 */
+ M.n = (unsigned short) (N->n - (p_limbs - adjust));
+ if (M.n > p_limbs + adjust) {
+ M.n = (unsigned short) (p_limbs + adjust);
+ }
+ memset(Mp, 0, sizeof(Mp));
+ memcpy(Mp, N->p + p_limbs - adjust, M.n * sizeof(mbedtls_mpi_uint));
+ if (shift != 0) {
+ MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&M, shift));
+ }
+ M.n += R.n; /* Make room for multiplication by R */
+
+ /* N = A0 */
+ if (mask != 0) {
+ N->p[p_limbs - 1] &= mask;
+ }
+ for (i = p_limbs; i < N->n; i++) {
+ N->p[i] = 0;
}
- if (adjust != 0) {
- mask = ((mbedtls_mpi_uint) 1 << shift) - 1;
+ /* N = A0 + R * A1 */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(&M, &M, &R));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_add_abs(N, N, &M));
+
+ /* Second pass */
+
+ /* M = A1 */
+ M.n = (unsigned short) (N->n - (p_limbs - adjust));
+ if (M.n > p_limbs + adjust) {
+ M.n = (unsigned short) (p_limbs + adjust);
+ }
+ memset(Mp, 0, sizeof(Mp));
+ memcpy(Mp, N->p + p_limbs - adjust, M.n * sizeof(mbedtls_mpi_uint));
+ if (shift != 0) {
+ MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&M, shift));
+ }
+ M.n += R.n; /* Make room for multiplication by R */
+
+ /* N = A0 */
+ if (mask != 0) {
+ N->p[p_limbs - 1] &= mask;
+ }
+ for (i = p_limbs; i < N->n; i++) {
+ N->p[i] = 0;
}
- /* Two passes are needed to reduce the value of `A0 + R * A1` and then
- * we need an additional one to reduce the possible overflow during
- * the addition.
- */
- for (size_t pass = 0; pass < 3; pass++) {
- /* Copy A1 */
- memcpy(A1, X + P_limbs - adjust, P_limbs * ciL);
-
- /* Shift A1 to be aligned */
- if (shift != 0) {
- mbedtls_mpi_core_shift_r(A1, P_limbs, shift);
- }
-
- /* Zeroize the A1 part of the shared limb */
- if (mask != 0) {
- X[P_limbs - 1] &= mask;
- }
-
- /* X = A0
- * Zeroize the A1 part of X to keep only the A0 part.
- */
- for (size_t i = P_limbs; i < X_limbs; i++) {
- X[i] = 0;
- }
-
- /* X = A0 + R * A1 */
- mbedtls_mpi_core_mul(M, A1, P_limbs, R, R_limbs);
- (void) mbedtls_mpi_core_add(X, X, M, P_limbs + R_limbs);
-
- /* Carry can not be generated since R is a 33-bit value and stored in
- * 64 bits. The result value of the multiplication is at most
- * P length + 33 bits in length and the result value of the addition
- * is at most P length + 34 bits in length. So the result of the
- * addition always fits in P length + 64 bits.
- */
- }
+ /* N = A0 + R * A1 */
+ MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(&M, &M, &R));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_add_abs(N, N, &M));
cleanup:
- mbedtls_free(M);
- mbedtls_free(A1);
-
return ret;
}
-
#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED) ||
MBEDTLS_ECP_DP_SECP224K1_ENABLED) ||
MBEDTLS_ECP_DP_SECP256K1_ENABLED) */
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
-
/*
* Fast quasi-reduction modulo p192k1 = 2^192 - R,
* with R = 2^32 + 2^12 + 2^8 + 2^7 + 2^6 + 2^3 + 1 = 0x01000011C9
*/
static int ecp_mod_p192k1(mbedtls_mpi *N)
{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(192) * 2;
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
- ret = mbedtls_ecp_mod_p192k1_raw(N->p, expected_width);
-
-cleanup:
- return ret;
-}
-
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p192k1_raw(mbedtls_mpi_uint *X, size_t X_limbs)
-{
static mbedtls_mpi_uint Rp[] = {
- MBEDTLS_BYTES_TO_T_UINT_8(0xC9, 0x11, 0x00, 0x00,
- 0x01, 0x00, 0x00, 0x00)
+ MBEDTLS_BYTES_TO_T_UINT_8(0xC9, 0x11, 0x00, 0x00, 0x01, 0x00, 0x00,
+ 0x00)
};
- if (X_limbs != BITS_TO_LIMBS(192) * 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- return ecp_mod_koblitz(X, X_limbs, Rp, 192);
+ return ecp_mod_koblitz(N, Rp, 192 / 8 / sizeof(mbedtls_mpi_uint), 0, 0,
+ 0);
}
-
#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
-
/*
* Fast quasi-reduction modulo p224k1 = 2^224 - R,
* with R = 2^32 + 2^12 + 2^11 + 2^9 + 2^7 + 2^4 + 2 + 1 = 0x0100001A93
*/
static int ecp_mod_p224k1(mbedtls_mpi *N)
{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(224) * 2;
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
- ret = mbedtls_ecp_mod_p224k1_raw(N->p, expected_width);
-
-cleanup:
- return ret;
-}
-
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p224k1_raw(mbedtls_mpi_uint *X, size_t X_limbs)
-{
static mbedtls_mpi_uint Rp[] = {
- MBEDTLS_BYTES_TO_T_UINT_8(0x93, 0x1A, 0x00, 0x00,
- 0x01, 0x00, 0x00, 0x00)
+ MBEDTLS_BYTES_TO_T_UINT_8(0x93, 0x1A, 0x00, 0x00, 0x01, 0x00, 0x00,
+ 0x00)
};
- if (X_limbs != BITS_TO_LIMBS(224) * 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- return ecp_mod_koblitz(X, X_limbs, Rp, 224);
+#if defined(MBEDTLS_HAVE_INT64)
+ return ecp_mod_koblitz(N, Rp, 4, 1, 32, 0xFFFFFFFF);
+#else
+ return ecp_mod_koblitz(N, Rp, 224 / 8 / sizeof(mbedtls_mpi_uint), 0, 0,
+ 0);
+#endif
}
#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
-
/*
* Fast quasi-reduction modulo p256k1 = 2^256 - R,
* with R = 2^32 + 2^9 + 2^8 + 2^7 + 2^6 + 2^4 + 1 = 0x01000003D1
*/
static int ecp_mod_p256k1(mbedtls_mpi *N)
{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t expected_width = BITS_TO_LIMBS(256) * 2;
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
- ret = mbedtls_ecp_mod_p256k1_raw(N->p, expected_width);
-
-cleanup:
- return ret;
-}
-
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_mod_p256k1_raw(mbedtls_mpi_uint *X, size_t X_limbs)
-{
static mbedtls_mpi_uint Rp[] = {
- MBEDTLS_BYTES_TO_T_UINT_8(0xD1, 0x03, 0x00, 0x00,
- 0x01, 0x00, 0x00, 0x00)
+ MBEDTLS_BYTES_TO_T_UINT_8(0xD1, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00,
+ 0x00)
};
-
- if (X_limbs != BITS_TO_LIMBS(256) * 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- return ecp_mod_koblitz(X, X_limbs, Rp, 256);
+ return ecp_mod_koblitz(N, Rp, 256 / 8 / sizeof(mbedtls_mpi_uint), 0, 0,
+ 0);
}
-
#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
-#if defined(MBEDTLS_TEST_HOOKS)
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_modulus_setup(mbedtls_mpi_mod_modulus *N,
- const mbedtls_ecp_group_id id,
- const mbedtls_ecp_modulus_type ctype)
-{
- mbedtls_mpi_modp_fn modp = NULL;
- mbedtls_mpi_uint *p = NULL;
- size_t p_limbs;
-
- if (!(ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE || \
- ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_SCALAR)) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- switch (id) {
-#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
- case MBEDTLS_ECP_DP_SECP192R1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
-#if defined(MBEDTLS_ECP_NIST_OPTIM)
- modp = &mbedtls_ecp_mod_p192_raw;
-#endif
- p = (mbedtls_mpi_uint *) secp192r1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp192r1_p));
- } else {
- p = (mbedtls_mpi_uint *) secp192r1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp192r1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
- case MBEDTLS_ECP_DP_SECP224R1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
-#if defined(MBEDTLS_ECP_NIST_OPTIM)
- modp = &mbedtls_ecp_mod_p224_raw;
-#endif
- p = (mbedtls_mpi_uint *) secp224r1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp224r1_p));
- } else {
- p = (mbedtls_mpi_uint *) secp224r1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp224r1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
- case MBEDTLS_ECP_DP_SECP256R1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
-#if defined(MBEDTLS_ECP_NIST_OPTIM)
- modp = &mbedtls_ecp_mod_p256_raw;
-#endif
- p = (mbedtls_mpi_uint *) secp256r1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp256r1_p));
- } else {
- p = (mbedtls_mpi_uint *) secp256r1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp256r1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
- case MBEDTLS_ECP_DP_SECP384R1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
-#if defined(MBEDTLS_ECP_NIST_OPTIM)
- modp = &mbedtls_ecp_mod_p384_raw;
-#endif
- p = (mbedtls_mpi_uint *) secp384r1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp384r1_p));
- } else {
- p = (mbedtls_mpi_uint *) secp384r1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp384r1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
- case MBEDTLS_ECP_DP_SECP521R1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
-#if defined(MBEDTLS_ECP_NIST_OPTIM)
- modp = &mbedtls_ecp_mod_p521_raw;
-#endif
- p = (mbedtls_mpi_uint *) secp521r1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp521r1_p));
- } else {
- p = (mbedtls_mpi_uint *) secp521r1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp521r1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
- case MBEDTLS_ECP_DP_BP256R1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
- p = (mbedtls_mpi_uint *) brainpoolP256r1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(brainpoolP256r1_p));
- } else {
- p = (mbedtls_mpi_uint *) brainpoolP256r1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(brainpoolP256r1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
- case MBEDTLS_ECP_DP_BP384R1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
- p = (mbedtls_mpi_uint *) brainpoolP384r1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(brainpoolP384r1_p));
- } else {
- p = (mbedtls_mpi_uint *) brainpoolP384r1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(brainpoolP384r1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
- case MBEDTLS_ECP_DP_BP512R1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
- p = (mbedtls_mpi_uint *) brainpoolP512r1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(brainpoolP512r1_p));
- } else {
- p = (mbedtls_mpi_uint *) brainpoolP512r1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(brainpoolP512r1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
- case MBEDTLS_ECP_DP_CURVE25519:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
- modp = &mbedtls_ecp_mod_p255_raw;
- p = (mbedtls_mpi_uint *) curve25519_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(curve25519_p));
- } else {
- p = (mbedtls_mpi_uint *) curve25519_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(curve25519_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
- case MBEDTLS_ECP_DP_SECP192K1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
- modp = &mbedtls_ecp_mod_p192k1_raw;
- p = (mbedtls_mpi_uint *) secp192k1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp192k1_p));
- } else {
- p = (mbedtls_mpi_uint *) secp192k1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp192k1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
- case MBEDTLS_ECP_DP_SECP224K1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
- modp = &mbedtls_ecp_mod_p224k1_raw;
- p = (mbedtls_mpi_uint *) secp224k1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp224k1_p));
- } else {
- p = (mbedtls_mpi_uint *) secp224k1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp224k1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
- case MBEDTLS_ECP_DP_SECP256K1:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
- modp = &mbedtls_ecp_mod_p256k1_raw;
- p = (mbedtls_mpi_uint *) secp256k1_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp256k1_p));
- } else {
- p = (mbedtls_mpi_uint *) secp256k1_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(secp256k1_n));
- }
- break;
-#endif
-
-#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
- case MBEDTLS_ECP_DP_CURVE448:
- if (ctype == (mbedtls_ecp_modulus_type) MBEDTLS_ECP_MOD_COORDINATE) {
- modp = &mbedtls_ecp_mod_p448_raw;
- p = (mbedtls_mpi_uint *) curve448_p;
- p_limbs = CHARS_TO_LIMBS(sizeof(curve448_p));
- } else {
- p = (mbedtls_mpi_uint *) curve448_n;
- p_limbs = CHARS_TO_LIMBS(sizeof(curve448_n));
- }
- break;
-#endif
-
- default:
- case MBEDTLS_ECP_DP_NONE:
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- if (modp != NULL) {
- if (mbedtls_mpi_mod_optred_modulus_setup(N, p, p_limbs, modp)) {
- return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- }
- } else {
- if (mbedtls_mpi_mod_modulus_setup(N, p, p_limbs)) {
- return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- }
- }
- return 0;
-}
-#endif /* MBEDTLS_TEST_HOOKS */
#endif /* !MBEDTLS_ECP_ALT */
+
#endif /* MBEDTLS_ECP_LIGHT */
#endif /* MBEDTLS_ECP_WITH_MPI_UINT */
diff --git a/library/ecp_invasive.h b/library/ecp_invasive.h
index db9dee3..bb3b127 100644
--- a/library/ecp_invasive.h
+++ b/library/ecp_invasive.h
@@ -40,11 +40,6 @@
MBEDTLS_ECP_MOD_SCALAR
} mbedtls_ecp_modulus_type;
-/* Provide a commented-out definition so that `check_names.py` knows that
- * it's not a typo.
- */
-//#define MBEDTLS_ECP_WITH_MPI_UINT
-
typedef enum {
MBEDTLS_ECP_VARIANT_NONE = 0,
MBEDTLS_ECP_VARIANT_WITH_MPI_STRUCT,
diff --git a/library/md.c b/library/md.c
index 3589d63..2cac50c 100644
--- a/library/md.c
+++ b/library/md.c
@@ -76,102 +76,75 @@
#error "Internal error: MBEDTLS_MD_MAX_SIZE < PSA_HASH_MAX_SIZE"
#endif
+#if defined(MBEDTLS_MD_C)
+#define MD_INFO(type, out_size, block_size) type, out_size, block_size,
+#else
+#define MD_INFO(type, out_size, block_size) type, out_size,
+#endif
+
#if defined(MBEDTLS_MD_CAN_MD5)
-const mbedtls_md_info_t mbedtls_md5_info = {
- "MD5",
- MBEDTLS_MD_MD5,
- 16,
- 64,
+static const mbedtls_md_info_t mbedtls_md5_info = {
+ MD_INFO(MBEDTLS_MD_MD5, 16, 64)
};
#endif
#if defined(MBEDTLS_MD_CAN_RIPEMD160)
-const mbedtls_md_info_t mbedtls_ripemd160_info = {
- "RIPEMD160",
- MBEDTLS_MD_RIPEMD160,
- 20,
- 64,
+static const mbedtls_md_info_t mbedtls_ripemd160_info = {
+ MD_INFO(MBEDTLS_MD_RIPEMD160, 20, 64)
};
#endif
#if defined(MBEDTLS_MD_CAN_SHA1)
-const mbedtls_md_info_t mbedtls_sha1_info = {
- "SHA1",
- MBEDTLS_MD_SHA1,
- 20,
- 64,
+static const mbedtls_md_info_t mbedtls_sha1_info = {
+ MD_INFO(MBEDTLS_MD_SHA1, 20, 64)
};
#endif
#if defined(MBEDTLS_MD_CAN_SHA224)
-const mbedtls_md_info_t mbedtls_sha224_info = {
- "SHA224",
- MBEDTLS_MD_SHA224,
- 28,
- 64,
+static const mbedtls_md_info_t mbedtls_sha224_info = {
+ MD_INFO(MBEDTLS_MD_SHA224, 28, 64)
};
#endif
#if defined(MBEDTLS_MD_CAN_SHA256)
-const mbedtls_md_info_t mbedtls_sha256_info = {
- "SHA256",
- MBEDTLS_MD_SHA256,
- 32,
- 64,
+static const mbedtls_md_info_t mbedtls_sha256_info = {
+ MD_INFO(MBEDTLS_MD_SHA256, 32, 64)
};
#endif
#if defined(MBEDTLS_MD_CAN_SHA384)
-const mbedtls_md_info_t mbedtls_sha384_info = {
- "SHA384",
- MBEDTLS_MD_SHA384,
- 48,
- 128,
+static const mbedtls_md_info_t mbedtls_sha384_info = {
+ MD_INFO(MBEDTLS_MD_SHA384, 48, 128)
};
#endif
#if defined(MBEDTLS_MD_CAN_SHA512)
-const mbedtls_md_info_t mbedtls_sha512_info = {
- "SHA512",
- MBEDTLS_MD_SHA512,
- 64,
- 128,
+static const mbedtls_md_info_t mbedtls_sha512_info = {
+ MD_INFO(MBEDTLS_MD_SHA512, 64, 128)
};
#endif
#if defined(MBEDTLS_MD_CAN_SHA3_224)
-const mbedtls_md_info_t mbedtls_sha3_224_info = {
- "SHA3-224",
- MBEDTLS_MD_SHA3_224,
- 28,
- 144,
+static const mbedtls_md_info_t mbedtls_sha3_224_info = {
+ MD_INFO(MBEDTLS_MD_SHA3_224, 28, 144)
};
#endif
#if defined(MBEDTLS_MD_CAN_SHA3_256)
-const mbedtls_md_info_t mbedtls_sha3_256_info = {
- "SHA3-256",
- MBEDTLS_MD_SHA3_256,
- 32,
- 136,
+static const mbedtls_md_info_t mbedtls_sha3_256_info = {
+ MD_INFO(MBEDTLS_MD_SHA3_256, 32, 136)
};
#endif
#if defined(MBEDTLS_MD_CAN_SHA3_384)
-const mbedtls_md_info_t mbedtls_sha3_384_info = {
- "SHA3-384",
- MBEDTLS_MD_SHA3_384,
- 48,
- 104,
+static const mbedtls_md_info_t mbedtls_sha3_384_info = {
+ MD_INFO(MBEDTLS_MD_SHA3_384, 48, 104)
};
#endif
#if defined(MBEDTLS_MD_CAN_SHA3_512)
-const mbedtls_md_info_t mbedtls_sha3_512_info = {
- "SHA3-512",
- MBEDTLS_MD_SHA3_512,
- 64,
- 72,
+static const mbedtls_md_info_t mbedtls_sha3_512_info = {
+ MD_INFO(MBEDTLS_MD_SHA3_512, 64, 72)
};
#endif
@@ -856,69 +829,77 @@
return supported_digests;
}
+typedef struct {
+ const char *md_name;
+ mbedtls_md_type_t md_type;
+} md_name_entry;
+
+static const md_name_entry md_names[] = {
+#if defined(MBEDTLS_MD_CAN_MD5)
+ { "MD5", MBEDTLS_MD_MD5 },
+#endif
+#if defined(MBEDTLS_MD_CAN_RIPEMD160)
+ { "RIPEMD160", MBEDTLS_MD_RIPEMD160 },
+#endif
+#if defined(MBEDTLS_MD_CAN_SHA1)
+ { "SHA1", MBEDTLS_MD_SHA1 },
+ { "SHA", MBEDTLS_MD_SHA1 }, // compatibility fallback
+#endif
+#if defined(MBEDTLS_MD_CAN_SHA224)
+ { "SHA224", MBEDTLS_MD_SHA224 },
+#endif
+#if defined(MBEDTLS_MD_CAN_SHA256)
+ { "SHA256", MBEDTLS_MD_SHA256 },
+#endif
+#if defined(MBEDTLS_MD_CAN_SHA384)
+ { "SHA384", MBEDTLS_MD_SHA384 },
+#endif
+#if defined(MBEDTLS_MD_CAN_SHA512)
+ { "SHA512", MBEDTLS_MD_SHA512 },
+#endif
+#if defined(MBEDTLS_MD_CAN_SHA3_224)
+ { "SHA3-224", MBEDTLS_MD_SHA3_224 },
+#endif
+#if defined(MBEDTLS_MD_CAN_SHA3_256)
+ { "SHA3-256", MBEDTLS_MD_SHA3_256 },
+#endif
+#if defined(MBEDTLS_MD_CAN_SHA3_384)
+ { "SHA3-384", MBEDTLS_MD_SHA3_384 },
+#endif
+#if defined(MBEDTLS_MD_CAN_SHA3_512)
+ { "SHA3-512", MBEDTLS_MD_SHA3_512 },
+#endif
+ { NULL, MBEDTLS_MD_NONE },
+};
+
const mbedtls_md_info_t *mbedtls_md_info_from_string(const char *md_name)
{
if (NULL == md_name) {
return NULL;
}
- /* Get the appropriate digest information */
-#if defined(MBEDTLS_MD_CAN_MD5)
- if (!strcmp("MD5", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_MD5);
+ const md_name_entry *entry = md_names;
+ while (entry->md_name != NULL &&
+ strcmp(entry->md_name, md_name) != 0) {
+ ++entry;
}
-#endif
-#if defined(MBEDTLS_MD_CAN_RIPEMD160)
- if (!strcmp("RIPEMD160", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_RIPEMD160);
+
+ return mbedtls_md_info_from_type(entry->md_type);
+}
+
+const char *mbedtls_md_get_name(const mbedtls_md_info_t *md_info)
+{
+ if (md_info == NULL) {
+ return NULL;
}
-#endif
-#if defined(MBEDTLS_MD_CAN_SHA1)
- if (!strcmp("SHA1", md_name) || !strcmp("SHA", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_SHA1);
+
+ const md_name_entry *entry = md_names;
+ while (entry->md_type != MBEDTLS_MD_NONE &&
+ entry->md_type != md_info->type) {
+ ++entry;
}
-#endif
-#if defined(MBEDTLS_MD_CAN_SHA224)
- if (!strcmp("SHA224", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_SHA224);
- }
-#endif
-#if defined(MBEDTLS_MD_CAN_SHA256)
- if (!strcmp("SHA256", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_SHA256);
- }
-#endif
-#if defined(MBEDTLS_MD_CAN_SHA384)
- if (!strcmp("SHA384", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_SHA384);
- }
-#endif
-#if defined(MBEDTLS_MD_CAN_SHA512)
- if (!strcmp("SHA512", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_SHA512);
- }
-#endif
-#if defined(MBEDTLS_MD_CAN_SHA3_224)
- if (!strcmp("SHA3-224", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_SHA3_224);
- }
-#endif
-#if defined(MBEDTLS_MD_CAN_SHA3_256)
- if (!strcmp("SHA3-256", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_SHA3_256);
- }
-#endif
-#if defined(MBEDTLS_MD_CAN_SHA3_384)
- if (!strcmp("SHA3-384", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_SHA3_384);
- }
-#endif
-#if defined(MBEDTLS_MD_CAN_SHA3_512)
- if (!strcmp("SHA3-512", md_name)) {
- return mbedtls_md_info_from_type(MBEDTLS_MD_SHA3_512);
- }
-#endif
- return NULL;
+
+ return entry->md_name;
}
const mbedtls_md_info_t *mbedtls_md_info_from_ctx(
@@ -1119,15 +1100,6 @@
return ret;
}
-const char *mbedtls_md_get_name(const mbedtls_md_info_t *md_info)
-{
- if (md_info == NULL) {
- return NULL;
- }
-
- return md_info->name;
-}
-
#endif /* MBEDTLS_MD_C */
#endif /* MBEDTLS_MD_LIGHT */
diff --git a/library/md_wrap.h b/library/md_wrap.h
index 5e1e327..166b43b 100644
--- a/library/md_wrap.h
+++ b/library/md_wrap.h
@@ -39,47 +39,18 @@
* Allows message digest functions to be called in a generic way.
*/
struct mbedtls_md_info_t {
- /** Name of the message digest */
- const char *name;
-
/** Digest identifier */
mbedtls_md_type_t type;
/** Output length of the digest function in bytes */
unsigned char size;
+#if defined(MBEDTLS_MD_C)
/** Block length of the digest function in bytes */
unsigned char block_size;
+#endif
};
-#if defined(MBEDTLS_MD5_C)
-extern const mbedtls_md_info_t mbedtls_md5_info;
-#endif
-#if defined(MBEDTLS_RIPEMD160_C)
-extern const mbedtls_md_info_t mbedtls_ripemd160_info;
-#endif
-#if defined(MBEDTLS_SHA1_C)
-extern const mbedtls_md_info_t mbedtls_sha1_info;
-#endif
-#if defined(MBEDTLS_SHA224_C)
-extern const mbedtls_md_info_t mbedtls_sha224_info;
-#endif
-#if defined(MBEDTLS_SHA256_C)
-extern const mbedtls_md_info_t mbedtls_sha256_info;
-#endif
-#if defined(MBEDTLS_SHA384_C)
-extern const mbedtls_md_info_t mbedtls_sha384_info;
-#endif
-#if defined(MBEDTLS_SHA512_C)
-extern const mbedtls_md_info_t mbedtls_sha512_info;
-#endif
-#if defined(MBEDTLS_SHA3_C)
-extern const mbedtls_md_info_t mbedtls_sha3_224_info;
-extern const mbedtls_md_info_t mbedtls_sha3_256_info;
-extern const mbedtls_md_info_t mbedtls_sha3_384_info;
-extern const mbedtls_md_info_t mbedtls_sha3_512_info;
-#endif
-
#ifdef __cplusplus
}
#endif
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index d37bb59..4510193 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -72,7 +72,6 @@
#include "mbedtls/gcm.h"
#include "mbedtls/md5.h"
#include "mbedtls/md.h"
-#include "md_wrap.h"
#include "mbedtls/pk.h"
#include "pk_wrap.h"
#include "mbedtls/platform_util.h"
diff --git a/library/psa_crypto_hash.h b/library/psa_crypto_hash.h
index d6bbd3f..2dfb011 100644
--- a/library/psa_crypto_hash.h
+++ b/library/psa_crypto_hash.h
@@ -23,8 +23,6 @@
#include <psa/crypto.h>
-#include "md_wrap.h"
-
/** Calculate the hash (digest) of a message using Mbed TLS routines.
*
* \note The signature of this function is that of a PSA driver hash_compute
diff --git a/library/ssl_ciphersuites.c b/library/ssl_ciphersuites.c
index b833472..a0cf530 100644
--- a/library/ssl_ciphersuites.c
+++ b/library/ssl_ciphersuites.c
@@ -2021,7 +2021,8 @@
#endif /* MBEDTLS_PK_C */
-#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_ECDSA_C) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
int mbedtls_ssl_ciphersuite_uses_ec(const mbedtls_ssl_ciphersuite_t *info)
{
@@ -2038,7 +2039,8 @@
return 0;
}
}
-#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED*/
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED ||
+ * MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED*/
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
int mbedtls_ssl_ciphersuite_uses_psk(const mbedtls_ssl_ciphersuite_t *info)
diff --git a/library/ssl_client.c b/library/ssl_client.c
index 9acc44f..dc2b650 100644
--- a/library/ssl_client.c
+++ b/library/ssl_client.c
@@ -374,7 +374,8 @@
}
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
- (defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
+ (defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_ECDSA_C) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED))
*tls12_uses_ec |= mbedtls_ssl_ciphersuite_uses_ec(ciphersuite_info);
#endif
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index 5074c3a..f4264fb 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -753,32 +753,20 @@
mbedtls_dhm_context dhm_ctx; /*!< DHM key exchange */
#endif
-#if defined(MBEDTLS_ECDH_C) && !defined(MBEDTLS_USE_PSA_CRYPTO)
+#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
+ defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
mbedtls_ecdh_context ecdh_ctx; /*!< ECDH key exchange */
-#endif /* MBEDTLS_ECDH_C && !MBEDTLS_USE_PSA_CRYPTO */
+#endif /* !MBEDTLS_USE_PSA_CRYPTO &&
+ MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED */
-#if defined(PSA_WANT_ALG_ECDH) && defined(PSA_WANT_ALG_FFDH)
-#if (MBEDTLS_PSA_MAX_FFDH_PUBKEY_LENGTH >= MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH)
-#define SSL_XXDH_PSA_PEERKEY_SIZE MBEDTLS_PSA_MAX_FFDH_PUBKEY_LENGTH
-#else
-#define SSL_XXDH_PSA_PEERKEY_SIZE MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
-#endif
-#elif defined(PSA_WANT_ALG_ECDH)
-#define SSL_XXDH_PSA_PEERKEY_SIZE MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
-#else
-#define SSL_XXDH_PSA_PEERKEY_SIZE MBEDTLS_PSA_MAX_FFDH_PUBKEY_LENGTH
-#endif
-
-#if (defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)) && \
- (defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3))
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED)
psa_key_type_t xxdh_psa_type;
- size_t xxdh_bits;
+ size_t xxdh_psa_bits;
mbedtls_svc_key_id_t xxdh_psa_privkey;
uint8_t xxdh_psa_privkey_is_external;
- unsigned char xxdh_psa_peerkey[SSL_XXDH_PSA_PEERKEY_SIZE];
+ unsigned char xxdh_psa_peerkey[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE];
size_t xxdh_psa_peerkey_len;
-#endif /* (PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH) &&
- (MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3) */
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED */
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
#if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -794,7 +782,8 @@
#endif
#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
-#if defined(MBEDTLS_PK_CAN_ECDH) || defined(MBEDTLS_PK_CAN_ECDSA_SOME) || \
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) || \
+ defined(MBEDTLS_PK_CAN_ECDSA_SOME) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
uint16_t *curves_tls_id; /*!< List of TLS IDs of supported elliptic curves */
#endif
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 33f9dc8..37b52f5 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -987,7 +987,8 @@
#if defined(MBEDTLS_DHM_C)
mbedtls_dhm_init(&handshake->dhm_ctx);
#endif
-#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
+#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
+ defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
mbedtls_ecdh_init(&handshake->ecdh_ctx);
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
@@ -4132,7 +4133,8 @@
#if defined(MBEDTLS_DHM_C)
mbedtls_dhm_free(&handshake->dhm_ctx);
#endif
-#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
+#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
+ defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
mbedtls_ecdh_free(&handshake->ecdh_ctx);
#endif
@@ -4158,7 +4160,8 @@
#endif
#endif
-#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) || \
+ defined(MBEDTLS_PK_CAN_ECDSA_SOME) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
/* explicit void pointer cast for buggy MS compiler */
mbedtls_free((void *) handshake->curves_tls_id);
@@ -4216,13 +4219,11 @@
mbedtls_ssl_buffering_free(ssl);
#endif /* MBEDTLS_SSL_PROTO_DTLS */
-#if (defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)) && \
- (defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3))
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED)
if (handshake->xxdh_psa_privkey_is_external == 0) {
psa_destroy_key(handshake->xxdh_psa_privkey);
}
-#endif /* (PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH) &&
- (MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3) */
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED */
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
mbedtls_ssl_transform_free(handshake->transform_handshake);
diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c
index 519ed61..a0560b0 100644
--- a/library/ssl_tls12_client.c
+++ b/library/ssl_tls12_client.c
@@ -99,7 +99,8 @@
}
#endif /* MBEDTLS_SSL_RENEGOTIATION */
-#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_ECDSA_C) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
MBEDTLS_CHECK_RETURN_CRITICAL
@@ -130,8 +131,8 @@
return 0;
}
-#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
- MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED ||
+ MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
MBEDTLS_CHECK_RETURN_CRITICAL
@@ -547,7 +548,8 @@
p += ext_len;
#endif
-#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_ECDSA_C) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
if (uses_ec) {
if ((ret = ssl_write_supported_point_formats_ext(ssl, p, end,
@@ -815,7 +817,8 @@
}
#endif /* MBEDTLS_SSL_SESSION_TICKETS */
-#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_ECDSA_C) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_parse_supported_point_formats_ext(mbedtls_ssl_context *ssl,
@@ -837,9 +840,10 @@
while (list_size > 0) {
if (p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
p[0] == MBEDTLS_ECP_PF_COMPRESSED) {
-#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
+#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
+ defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
ssl->handshake->ecdh_ctx.point_format = p[0];
-#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_ECDH_C */
+#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED */
#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedtls_ecjpake_set_point_format(&ssl->handshake->ecjpake_ctx,
@@ -858,8 +862,8 @@
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
}
-#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
- MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED ||
+ MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
MBEDTLS_CHECK_RETURN_CRITICAL
@@ -1543,8 +1547,8 @@
break;
#endif /* MBEDTLS_SSL_SESSION_TICKETS */
-#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
- defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
MBEDTLS_SSL_DEBUG_MSG(3,
("found supported_point_formats extension"));
@@ -1555,7 +1559,7 @@
}
break;
-#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || MBEDTLS_ECDSA_C ||
MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
@@ -1763,7 +1767,7 @@
return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
}
handshake->xxdh_psa_type = key_type;
- handshake->xxdh_bits = ec_bits;
+ handshake->xxdh_psa_bits = ec_bits;
/* Keep a copy of the peer's public key */
ecpoint_len = *(*p)++;
@@ -1771,18 +1775,9 @@
return MBEDTLS_ERR_SSL_DECODE_ERROR;
}
- /* When FFDH is enabled, the array handshake->xxdh_psa_peer_key size takes into account
- the sizes of the FFDH keys which are at least 2048 bits.
- The size of the array is thus greater than 256 bytes which is greater than any
- possible value of ecpoint_len (type uint8_t) and the check below can be skipped.*/
-#if !defined(PSA_WANT_ALG_FFDH)
- if (ecpoint_len > sizeof(handshake->xxdh_psa_peerkey)) {
+ if (ecpoint_len > PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)) {
return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
}
-#else
- MBEDTLS_STATIC_ASSERT(sizeof(handshake->xxdh_psa_peerkey) >= UINT8_MAX,
- "peer key buffer too small");
-#endif
memcpy(handshake->xxdh_psa_peerkey, *p, ecpoint_len);
handshake->xxdh_psa_peerkey_len = ecpoint_len;
@@ -2046,7 +2041,7 @@
/* If the above conversion to TLS ID was fine, then also this one will be,
so there is no need to check the return value here */
mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id, &key_type,
- &ssl->handshake->xxdh_bits);
+ &ssl->handshake->xxdh_psa_bits);
ssl->handshake->xxdh_psa_type = key_type;
@@ -2797,7 +2792,7 @@
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
psa_set_key_type(&key_attributes, handshake->xxdh_psa_type);
- psa_set_key_bits(&key_attributes, handshake->xxdh_bits);
+ psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits);
/* Generate ECDH private key. */
status = psa_generate_key(&key_attributes,
@@ -2969,7 +2964,7 @@
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
psa_set_key_type(&key_attributes, handshake->xxdh_psa_type);
- psa_set_key_bits(&key_attributes, handshake->xxdh_bits);
+ psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits);
/* Generate ECDH private key. */
status = psa_generate_key(&key_attributes,
diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c
index 38afc7d..9b992d6 100644
--- a/library/ssl_tls12_server.c
+++ b/library/ssl_tls12_server.c
@@ -148,7 +148,8 @@
return 0;
}
-#if defined(MBEDTLS_PK_CAN_ECDH) || defined(MBEDTLS_PK_CAN_ECDSA_SOME) || \
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_PK_CAN_ECDSA_SOME) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
/*
* Function for parsing a supported groups (TLS 1.3) or supported elliptic
@@ -273,9 +274,10 @@
while (list_size > 0) {
if (p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
p[0] == MBEDTLS_ECP_PF_COMPRESSED) {
-#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
+#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
+ defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
ssl->handshake->ecdh_ctx.point_format = p[0];
-#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_ECDH_C */
+#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED */
#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedtls_ecjpake_set_point_format(&ssl->handshake->ecjpake_ctx,
@@ -291,8 +293,8 @@
return 0;
}
-#endif /* MBEDTLS_PK_CAN_ECDH || MBEDTLS_PK_CAN_ECDSA_SOME ||
- MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED ||
+ MBEDTLS_PK_CAN_ECDSA_SOME || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
MBEDTLS_CHECK_RETURN_CRITICAL
@@ -835,7 +837,8 @@
#endif
-#if defined(MBEDTLS_PK_CAN_ECDH) || defined(MBEDTLS_PK_CAN_ECDSA_SOME)
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_PK_CAN_ECDSA_SOME)
if (mbedtls_ssl_ciphersuite_uses_ec(suite_info) &&
(ssl->handshake->curves_tls_id == NULL ||
ssl->handshake->curves_tls_id[0] == 0)) {
@@ -1379,7 +1382,8 @@
break;
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
-#if defined(MBEDTLS_PK_CAN_ECDH) || defined(MBEDTLS_PK_CAN_ECDSA_SOME) || \
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_PK_CAN_ECDSA_SOME) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
MBEDTLS_SSL_DEBUG_MSG(3, ("found supported elliptic curves extension"));
@@ -1399,8 +1403,8 @@
return ret;
}
break;
-#endif /* MBEDTLS_PK_CAN_ECDH || MBEDTLS_PK_CAN_ECDSA_SOME ||
- MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || \
+ MBEDTLS_PK_CAN_ECDSA_SOME || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
@@ -1893,8 +1897,8 @@
}
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
-#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
- defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
static void ssl_write_supported_point_formats_ext(mbedtls_ssl_context *ssl,
unsigned char *buf,
size_t *olen)
@@ -1921,7 +1925,8 @@
*olen = 6;
}
-#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || MBEDTLS_ECDSA_C ||
+ MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl,
@@ -2350,8 +2355,8 @@
ext_len += olen;
#endif
-#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
- defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
+ defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
const mbedtls_ssl_ciphersuite_t *suite =
mbedtls_ssl_ciphersuite_from_id(ssl->session_negotiate->ciphersuite);
if (suite != NULL && mbedtls_ssl_ciphersuite_uses_ec(suite)) {
@@ -2642,7 +2647,7 @@
}
ssl->handshake->xxdh_psa_type = psa_get_key_type(&key_attributes);
- ssl->handshake->xxdh_bits = psa_get_key_bits(&key_attributes);
+ ssl->handshake->xxdh_psa_bits = psa_get_key_bits(&key_attributes);
psa_reset_key_attributes(&key_attributes);
@@ -2666,7 +2671,7 @@
/* If the above conversion to TLS ID was fine, then also this one will
be, so there is no need to check the return value here */
mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id, &key_type,
- &ssl->handshake->xxdh_bits);
+ &ssl->handshake->xxdh_psa_bits);
ssl->handshake->xxdh_psa_type = key_type;
@@ -2675,7 +2680,7 @@
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
psa_set_key_type(&key_attributes,
PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type));
- psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_bits);
+ psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits);
key_len = PSA_BITS_TO_BYTES(key->grp.pbits);
ret = mbedtls_ecp_write_key(key, buf, key_len);
@@ -2983,13 +2988,13 @@
return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
}
handshake->xxdh_psa_type = key_type;
- handshake->xxdh_bits = ec_bits;
+ handshake->xxdh_psa_bits = ec_bits;
key_attributes = psa_key_attributes_init();
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
psa_set_key_type(&key_attributes, handshake->xxdh_psa_type);
- psa_set_key_bits(&key_attributes, handshake->xxdh_bits);
+ psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits);
/*
* ECParameters curve_params
diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index 8b261d6..77325c3 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -35,7 +35,7 @@
#include "ssl_debug_helpers.h"
#include "md_psa.h"
-#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
/* Define a local translating function to save code size by not using too many
* arguments in each translating place. */
static int local_err_translation(psa_status_t status)
@@ -194,7 +194,7 @@
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
-#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
if (mbedtls_ssl_tls13_named_group_is_ecdhe(group_id) ||
mbedtls_ssl_tls13_named_group_is_ffdh(group_id)) {
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
@@ -211,7 +211,7 @@
ssl->handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
return 0;
} else
-#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
+#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
if (0 /* other KEMs? */) {
/* Do something */
}
@@ -503,7 +503,7 @@
return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
}
-#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
if (mbedtls_ssl_tls13_named_group_is_ecdhe(group) ||
mbedtls_ssl_tls13_named_group_is_ffdh(group)) {
MBEDTLS_SSL_DEBUG_MSG(2,
@@ -513,7 +513,7 @@
return ret;
}
} else
-#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
+#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
if (0 /* other KEMs? */) {
/* Do something */
} else {
diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index d6f72f8..a063084 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -39,8 +39,7 @@
#include "psa/crypto.h"
#include "psa_util_internal.h"
-#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) || \
- defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
/* Define a local translating function to save code size by not using too many
* arguments in each translating place. */
static int local_err_translation(psa_status_t status)
@@ -1497,7 +1496,7 @@
return ret;
}
-#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
int mbedtls_ssl_tls13_read_public_xxdhe_share(mbedtls_ssl_context *ssl,
const unsigned char *buf,
@@ -1593,13 +1592,13 @@
}
handshake->xxdh_psa_type = key_type;
- ssl->handshake->xxdh_bits = bits;
+ ssl->handshake->xxdh_psa_bits = bits;
key_attributes = psa_key_attributes_init();
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
psa_set_key_algorithm(&key_attributes, alg);
psa_set_key_type(&key_attributes, handshake->xxdh_psa_type);
- psa_set_key_bits(&key_attributes, handshake->xxdh_bits);
+ psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits);
/* Generate ECDH/FFDH private key. */
status = psa_generate_key(&key_attributes,
@@ -1626,7 +1625,7 @@
return 0;
}
-#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
+#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
/* RFC 8446 section 4.2
*
diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c
index 0167835..89bba04 100644
--- a/library/ssl_tls13_server.c
+++ b/library/ssl_tls13_server.c
@@ -838,7 +838,7 @@
#define SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH 1
-#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
/*
* ssl_tls13_parse_key_shares_ext() verifies whether the information in the
* extension is correct and stores the first acceptable key share and its
@@ -941,7 +941,7 @@
}
return 0;
}
-#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
+#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_tls13_client_hello_has_exts(mbedtls_ssl_context *ssl,
@@ -1565,7 +1565,7 @@
break;
#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH*/
-#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
case MBEDTLS_TLS_EXT_KEY_SHARE:
MBEDTLS_SSL_DEBUG_MSG(3, ("found key share extension"));
@@ -1590,7 +1590,7 @@
}
break;
-#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
+#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
/* Already parsed */
@@ -1920,7 +1920,7 @@
*out_len = 0;
-#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
+#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group) ||
mbedtls_ssl_tls13_named_group_is_ffdh(named_group)) {
ret = mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange(
@@ -1932,7 +1932,7 @@
return ret;
}
} else
-#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
+#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
if (0 /* Other kinds of KEMs */) {
} else {
((void) ssl);
diff --git a/programs/fuzz/common.c b/programs/fuzz/common.c
index 75021bb..98aa403 100644
--- a/programs/fuzz/common.c
+++ b/programs/fuzz/common.c
@@ -13,7 +13,7 @@
}
#endif
-void dummy_init()
+void dummy_init(void)
{
#if defined(MBEDTLS_PLATFORM_TIME_ALT)
mbedtls_platform_set_time(dummy_constant_time);
diff --git a/programs/fuzz/common.h b/programs/fuzz/common.h
index bc817bd..094383c 100644
--- a/programs/fuzz/common.h
+++ b/programs/fuzz/common.h
@@ -15,7 +15,7 @@
#if defined(MBEDTLS_HAVE_TIME)
mbedtls_time_t dummy_constant_time(mbedtls_time_t *time);
#endif
-void dummy_init();
+void dummy_init(void);
int dummy_send(void *ctx, const unsigned char *buf, size_t len);
int fuzz_recv(void *ctx, unsigned char *buf, size_t len);
diff --git a/programs/ssl/ssl_context_info.c b/programs/ssl/ssl_context_info.c
index a5f0650..855b091 100644
--- a/programs/ssl/ssl_context_info.c
+++ b/programs/ssl/ssl_context_info.c
@@ -125,12 +125,12 @@
/*
* Basic printing functions
*/
-void print_version()
+void print_version(void)
{
printf("%s v%d.%d\n", PROG_NAME, VER_MAJOR, VER_MINOR);
}
-void print_usage()
+void print_usage(void)
{
print_version();
printf("\nThis program is used to deserialize an Mbed TLS SSL session from the base64 code provided\n"
@@ -179,7 +179,7 @@
/*
* Exit from the program in case of error
*/
-void error_exit()
+void error_exit(void)
{
if (NULL != b64_file) {
fclose(b64_file);
diff --git a/programs/test/udp_proxy.c b/programs/test/udp_proxy.c
index ac527f2..685e336 100644
--- a/programs/test/udp_proxy.c
+++ b/programs/test/udp_proxy.c
@@ -644,7 +644,7 @@
memcpy(&prev[prev_len++], delay, sizeof(packet));
}
-int send_delayed()
+int send_delayed(void)
{
uint8_t offset;
int ret;
diff --git a/scripts/code_style.py b/scripts/code_style.py
index 7de93b0..ddd0a98 100755
--- a/scripts/code_style.py
+++ b/scripts/code_style.py
@@ -81,11 +81,15 @@
universal_newlines=True)
src_files = output.split()
if since:
- output = subprocess.check_output(["git", "diff", "--name-only",
- since, "--"] +
- src_files,
- universal_newlines=True)
- src_files = output.split()
+ # get all files changed in commits since the starting point
+ cmd = ["git", "log", since + "..HEAD", "--name-only", "--pretty=", "--"] + src_files
+ output = subprocess.check_output(cmd, universal_newlines=True)
+ committed_changed_files = output.split()
+ # and also get all files with uncommitted changes
+ cmd = ["git", "diff", "--name-only", "--"] + src_files
+ output = subprocess.check_output(cmd, universal_newlines=True)
+ uncommitted_changed_files = output.split()
+ src_files = list(set(committed_changed_files + uncommitted_changed_files))
generated_files = list_generated_files()
# Don't correct style for third-party files (and, for simplicity,
@@ -189,9 +193,10 @@
parser.add_argument('-f', '--fix', action='store_true',
help=('modify source files to fix the code style '
'(default: print diff, do not modify files)'))
- parser.add_argument('-s', '--since', metavar='COMMIT',
+ parser.add_argument('-s', '--since', metavar='COMMIT', const='development', nargs='?',
help=('only check files modified since the specified commit'
- ' (e.g. --since=HEAD~3 or --since=development)'))
+ ' (e.g. --since=HEAD~3 or --since=development). If no'
+ ' commit is specified, default to development.'))
# --subset is almost useless: it only matters if there are no files
# ('code_style.py' without arguments checks all files known to Git,
# 'code_style.py --subset' does nothing). In particular,
diff --git a/scripts/config.py b/scripts/config.py
index 3e957fd..4ff5166 100755
--- a/scripts/config.py
+++ b/scripts/config.py
@@ -195,6 +195,7 @@
'MBEDTLS_DEPRECATED_WARNING', # conflicts with deprecated options
'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED', # influences the use of ECDH in TLS
'MBEDTLS_ECP_NO_FALLBACK', # removes internal ECP implementation
+ 'MBEDTLS_ECP_WITH_MPI_UINT', # disables the default ECP and is experimental
'MBEDTLS_ENTROPY_FORCE_SHA256', # interacts with CTR_DRBG_128_BIT_KEY
'MBEDTLS_HAVE_SSE2', # hardware dependency
'MBEDTLS_MEMORY_BACKTRACE', # depends on MEMORY_BUFFER_ALLOC_C
@@ -204,6 +205,7 @@
'MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES', # removes a feature
'MBEDTLS_NO_PLATFORM_ENTROPY', # removes a feature
'MBEDTLS_NO_UDBL_DIVISION', # influences anything that uses bignum
+ 'MBEDTLS_P256M_EXAMPLE_DRIVER_ENABLED', # influences SECP256R1 KeyGen/ECDH/ECDSA
'MBEDTLS_PLATFORM_NO_STD_FUNCTIONS', # removes a feature
'MBEDTLS_PSA_CRYPTO_CONFIG', # toggles old/new style PSA config
'MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG', # behavior change + build dependency
@@ -213,11 +215,10 @@
'MBEDTLS_RSA_NO_CRT', # influences the use of RSA in X.509 and TLS
'MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY', # interacts with *_USE_A64_CRYPTO_IF_PRESENT
'MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY', # interacts with *_USE_A64_CRYPTO_IF_PRESENT
+ 'MBEDTLS_SSL_RECORD_SIZE_LIMIT', # in development, currently breaks other tests
'MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN', # build dependency (clang+memsan)
'MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND', # build dependency (valgrind headers)
'MBEDTLS_X509_REMOVE_INFO', # removes a feature
- 'MBEDTLS_SSL_RECORD_SIZE_LIMIT', # in development, currently breaks other tests
- 'MBEDTLS_P256M_EXAMPLE_DRIVER_ENABLED' # influences SECP256R1 KeyGen/ECDH/ECDSA
])
def is_seamless_alt(name):
diff --git a/scripts/output_env.sh b/scripts/output_env.sh
index 1d9e0fa..5356132 100755
--- a/scripts/output_env.sh
+++ b/scripts/output_env.sh
@@ -105,9 +105,37 @@
print_version "gcc" "--version" "" "head -n 1"
echo
+if [ -n "${GCC_EARLIEST+set}" ]; then
+ print_version "${GCC_EARLIEST}" "--version" "" "head -n 1"
+else
+ echo " GCC_EARLIEST : Not configured."
+fi
+echo
+
+if [ -n "${GCC_LATEST+set}" ]; then
+ print_version "${GCC_LATEST}" "--version" "" "head -n 1"
+else
+ echo " GCC_LATEST : Not configured."
+fi
+echo
+
print_version "clang" "--version" "" "head -n 2"
echo
+if [ -n "${CLANG_EARLIEST+set}" ]; then
+ print_version "${CLANG_EARLIEST}" "--version" "" "head -n 2"
+else
+ echo " CLANG_EARLIEST : Not configured."
+fi
+echo
+
+if [ -n "${CLANG_LATEST+set}" ]; then
+ print_version "${CLANG_LATEST}" "--version" "" "head -n 2"
+else
+ echo " CLANG_LATEST : Not configured."
+fi
+echo
+
print_version "ldd" "--version" "" "head -n 1"
echo
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 18633cb..386a949 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -176,7 +176,10 @@
: ${ARMC6_BIN_DIR:=/usr/bin}
: ${ARM_NONE_EABI_GCC_PREFIX:=arm-none-eabi-}
: ${ARM_LINUX_GNUEABI_GCC_PREFIX:=arm-linux-gnueabi-}
-
+ : ${CLANG_LATEST:="clang-latest"}
+ : ${CLANG_EARLIEST:="clang-earliest"}
+ : ${GCC_LATEST:="gcc-latest"}
+ : ${GCC_EARLIEST:="gcc-earliest"}
# if MAKEFLAGS is not set add the -j option to speed up invocations of make
if [ -z "${MAKEFLAGS+set}" ]; then
export MAKEFLAGS="-j$(all_sh_nproc)"
@@ -191,9 +194,7 @@
# Gather the list of available components. These are the functions
# defined in this script whose name starts with "component_".
- # Parse the script with sed. This way we get the functions in the order
- # they are defined.
- ALL_COMPONENTS=$(sed -n 's/^ *component_\([0-9A-Z_a-z]*\) *().*/\1/p' <"$0")
+ ALL_COMPONENTS=$(compgen -A function component_ | sed 's/component_//')
# Exclude components that are not supported on this platform.
SUPPORTED_COMPONENTS=
@@ -275,6 +276,10 @@
Tool path options:
--armc5-bin-dir=<ARMC5_bin_dir_path> ARM Compiler 5 bin directory.
--armc6-bin-dir=<ARMC6_bin_dir_path> ARM Compiler 6 bin directory.
+ --clang-earliest=<Clang_earliest_path> Earliest version of clang available
+ --clang-latest=<Clang_latest_path> Latest version of clang available
+ --gcc-earliest=<GCC_earliest_path> Earliest version of GCC available
+ --gcc-latest=<GCC_latest_path> Latest version of GCC available
--gnutls-cli=<GnuTLS_cli_path> GnuTLS client executable to use for most tests.
--gnutls-serv=<GnuTLS_serv_path> GnuTLS server executable to use for most tests.
--gnutls-legacy-cli=<GnuTLS_cli_path> GnuTLS client executable to use for legacy tests.
@@ -441,9 +446,13 @@
--armcc) no_armcc=;;
--armc5-bin-dir) shift; ;; # assignment to ARMC5_BIN_DIR done in pre_parse_command_line_for_dirs
--armc6-bin-dir) shift; ;; # assignment to ARMC6_BIN_DIR done in pre_parse_command_line_for_dirs
+ --clang-earliest) shift; CLANG_EARLIEST="$1";;
+ --clang-latest) shift; CLANG_LATEST="$1";;
--error-test) error_test=$((error_test + 1));;
--except) all_except=1;;
--force|-f) FORCE=1;;
+ --gcc-earliest) shift; GCC_EARLIEST="$1";;
+ --gcc-latest) shift; GCC_LATEST="$1";;
--gnutls-cli) shift; GNUTLS_CLI="$1";;
--gnutls-legacy-cli) shift; GNUTLS_LEGACY_CLI="$1";;
--gnutls-legacy-serv) shift; GNUTLS_LEGACY_SERV="$1";;
@@ -1028,8 +1037,9 @@
component_test_default_cmake_gcc_asan_new_bignum () {
msg "build: cmake, gcc, ASan" # ~ 1 min 50s
+ scripts/config.py set MBEDTLS_ECP_WITH_MPI_UINT
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
- make CFLAGS="-D MBEDTLS_ECP_WITH_MPI_UINT"
+ make
msg "test: main suites (inc. selftests) (ASan build)" # ~ 50s
make test
@@ -1086,8 +1096,9 @@
component_test_full_cmake_gcc_asan_new_bignum () {
msg "build: full config, cmake, gcc, ASan"
scripts/config.py full
+ scripts/config.py set MBEDTLS_ECP_WITH_MPI_UINT
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
- make CFLAGS="-D MBEDTLS_ECP_WITH_MPI_UINT"
+ make
msg "test: main suites (inc. selftests) (full config, ASan build)"
make test
@@ -1122,8 +1133,9 @@
msg "build: full config, cmake, gcc, ASan"
scripts/config.py full
scripts/config.py set MBEDTLS_TEST_HOOKS
+ scripts/config.py set MBEDTLS_ECP_WITH_MPI_UINT
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
- make CFLAGS="-DMBEDTLS_ECP_WITH_MPI_UINT"
+ make
msg "test: main suites (inc. selftests) (full config, ASan build)"
make test
@@ -4025,6 +4037,7 @@
test_build_opt () {
info=$1 cc=$2; shift 2
+ $cc --version
for opt in "$@"; do
msg "build/test: $cc $opt, $info" # ~ 30s
make CC="$cc" CFLAGS="$opt -std=c99 -pedantic -Wall -Wextra -Werror"
@@ -4037,14 +4050,45 @@
done
}
-component_test_clang_opt () {
+# For FreeBSD we invoke the function by name so this condition is added
+# to disable the existing test_clang_opt function for linux.
+if [[ $(uname) != "Linux" ]]; then
+ component_test_clang_opt () {
+ scripts/config.py full
+ test_build_opt 'full config' clang -O0 -Os -O2
+ }
+fi
+
+component_test_clang_latest_opt () {
scripts/config.py full
- test_build_opt 'full config' clang -O0 -Os -O2
+ test_build_opt 'full config' "$CLANG_LATEST" -O0 -Os -O2
+}
+support_test_clang_latest_opt () {
+ type "$CLANG_LATEST" >/dev/null 2>/dev/null
}
-component_test_gcc_opt () {
+component_test_clang_earliest_opt () {
scripts/config.py full
- test_build_opt 'full config' gcc -O0 -Os -O2
+ test_build_opt 'full config' "$CLANG_EARLIEST" -O0
+}
+support_test_clang_earliest_opt () {
+ type "$CLANG_EARLIEST" >/dev/null 2>/dev/null
+}
+
+component_test_gcc_latest_opt () {
+ scripts/config.py full
+ test_build_opt 'full config' "$GCC_LATEST" -O0 -Os -O2
+}
+support_test_gcc_latest_opt () {
+ type "$GCC_LATEST" >/dev/null 2>/dev/null
+}
+
+component_test_gcc_earliest_opt () {
+ scripts/config.py full
+ test_build_opt 'full config' "$GCC_EARLIEST" -O0
+}
+support_test_gcc_earliest_opt () {
+ type "$GCC_EARLIEST" >/dev/null 2>/dev/null
}
component_build_mbedtls_config_file () {
@@ -4210,6 +4254,20 @@
make test
}
+component_test_have_int32_cmake_new_bignum () {
+ msg "build: gcc, force 32-bit bignum limbs, new bignum interface, test hooks (ASan build)"
+ scripts/config.py unset MBEDTLS_HAVE_ASM
+ scripts/config.py unset MBEDTLS_AESNI_C
+ scripts/config.py unset MBEDTLS_PADLOCK_C
+ scripts/config.py unset MBEDTLS_AESCE_C
+ scripts/config.py set MBEDTLS_TEST_HOOKS
+ scripts/config.py set MBEDTLS_ECP_WITH_MPI_UINT
+ make CC=gcc CFLAGS="$ASAN_CFLAGS -Werror -Wall -Wextra -DMBEDTLS_HAVE_INT32" LDFLAGS="$ASAN_CFLAGS"
+
+ msg "test: gcc, force 32-bit bignum limbs, new bignum interface, test hooks (ASan build)"
+ make test
+}
+
component_test_no_udbl_division () {
msg "build: MBEDTLS_NO_UDBL_DIVISION native" # ~ 10s
scripts/config.py full
diff --git a/tests/scripts/generate_test_code.py b/tests/scripts/generate_test_code.py
index ff7f9b9..76806de 100755
--- a/tests/scripts/generate_test_code.py
+++ b/tests/scripts/generate_test_code.py
@@ -667,6 +667,11 @@
code = code.replace(name, 'test_' + name, 1)
name = 'test_' + name
+ # If a test function has no arguments then add 'void' argument to
+ # avoid "-Wstrict-prototypes" warnings from clang
+ if len(args) == 0:
+ code = code.replace('()', '(void)', 1)
+
for line in funcs_f:
if re.search(END_CASE_REGEX, line):
break
diff --git a/tests/scripts/test_generate_test_code.py b/tests/scripts/test_generate_test_code.py
index fe748ae..b32d184 100755
--- a/tests/scripts/test_generate_test_code.py
+++ b/tests/scripts/test_generate_test_code.py
@@ -647,7 +647,7 @@
self.assertEqual(arg, [])
expected = '''#line 1 "test_suite_ut.function"
-void test_func()
+void test_func(void)
{
ba ba black sheep
have you any wool
@@ -690,7 +690,7 @@
expected = '''#line 1 "test_suite_ut.function"
-void test_func()
+void test_func(void)
{
ba ba black sheep
have you any wool
@@ -750,7 +750,7 @@
void
-test_func()
+test_func(void)
{
ba ba black sheep
have you any wool
@@ -803,7 +803,7 @@
-void test_func()
+void test_func(void)
{
ba ba black sheep
have you any wool
@@ -1139,7 +1139,7 @@
#if defined(MBEDTLS_ENTROPY_NV_SEED)
#if defined(MBEDTLS_FS_IO)
#line 13 "test_suite_ut.function"
-void test_func1()
+void test_func1(void)
{
exit:
;
@@ -1156,7 +1156,7 @@
#if defined(MBEDTLS_ENTROPY_NV_SEED)
#if defined(MBEDTLS_FS_IO)
#line 19 "test_suite_ut.function"
-void test_func2()
+void test_func2(void)
{
exit:
;
diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function
index 1b8a84c..962745c 100644
--- a/tests/suites/test_suite_ecp.function
+++ b/tests/suites/test_suite_ecp.function
@@ -1267,7 +1267,7 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
+/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_WITH_MPI_UINT */
void ecp_mod_p_generic_raw(int curve_id,
char *input_N,
char *input_X,
@@ -1390,7 +1390,7 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
+/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_WITH_MPI_UINT */
void ecp_mod_setup(char *input_A, int id, int ctype, int iret)
{
int ret;
@@ -1432,7 +1432,7 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
+/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_WITH_MPI_UINT */
void ecp_mod_mul_inv(char *input_A, int id, int ctype)
{
size_t limbs;
@@ -1489,7 +1489,7 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
+/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_WITH_MPI_UINT */
void ecp_mod_add_sub(char *input_A, char *input_B, int id, int ctype)
{
size_t p_A_limbs;
@@ -1540,7 +1540,7 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
+/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_WITH_MPI_UINT */
void ecp_mod_read_write(char *input_A, int id, int ctype)
{
size_t limbs;
@@ -1603,7 +1603,7 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
+/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_WITH_MPI_UINT */
void ecp_mod_random(int id, int ctype)
{
size_t limbs;
diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function
index b9dadcf..b58077b 100644
--- a/tests/suites/test_suite_psa_crypto.function
+++ b/tests/suites/test_suite_psa_crypto.function
@@ -1590,7 +1590,11 @@
TEST_LE_U(exported_length,
PSA_EXPORT_KEY_OUTPUT_SIZE(type,
psa_get_key_bits(&got_attributes)));
- TEST_LE_U(exported_length, PSA_EXPORT_KEY_PAIR_MAX_SIZE);
+ if (PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
+ TEST_LE_U(exported_length, PSA_EXPORT_KEY_PAIR_MAX_SIZE);
+ } else if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type)) {
+ TEST_LE_U(exported_length, PSA_EXPORT_PUBLIC_KEY_MAX_SIZE);
+ }
destroy:
/* Destroy the key */
diff --git a/tests/suites/test_suite_psa_crypto_op_fail.function b/tests/suites/test_suite_psa_crypto_op_fail.function
index 55dce89..20942bf 100644
--- a/tests/suites/test_suite_psa_crypto_op_fail.function
+++ b/tests/suites/test_suite_psa_crypto_op_fail.function
@@ -360,7 +360,7 @@
mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
uint8_t public_key[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE] = { 0 };
size_t public_key_length = SIZE_MAX;
- uint8_t output[PSA_SIGNATURE_MAX_SIZE] = { 0 };
+ uint8_t output[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE] = { 0 };
size_t length = SIZE_MAX;
psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;