Merge pull request #8050 from gilles-peskine-arm/all.sh-remove-crypto_full_no_cipher
Remove redundant test component component_test_crypto_full_no_cipher
diff --git a/ChangeLog.d/00README.md b/ChangeLog.d/00README.md
index d2ea73d..2fbc989 100644
--- a/ChangeLog.d/00README.md
+++ b/ChangeLog.d/00README.md
@@ -21,6 +21,9 @@
* Performance improvements, unless they are particularly significant.
* Changes to parts of the code base that users don't interact with directly,
such as test code and test data.
+* Fixes for compiler warnings. Releases typically contain a number of fixes
+ of this kind, so we will only mention them in the Changelog if they are
+ particularly significant.
Until Mbed TLS 2.24.0, we required changelog entries in more cases.
Looking at older changelog entries is good practice for how to write a
diff --git a/ChangeLog.d/improve-doc-on-ecp-curve-optimized-representation.txt b/ChangeLog.d/improve-doc-on-ecp-curve-optimized-representation.txt
new file mode 100644
index 0000000..8fdc588
--- /dev/null
+++ b/ChangeLog.d/improve-doc-on-ecp-curve-optimized-representation.txt
@@ -0,0 +1,3 @@
+Features
+ * The documentation of mbedtls_ecp_group now describes the optimized
+ representation of A for some curves. Fixes #8045.
diff --git a/ChangeLog.d/x509-ec-algorithm-identifier-fix.txt b/ChangeLog.d/x509-ec-algorithm-identifier-fix.txt
new file mode 100644
index 0000000..c1de491
--- /dev/null
+++ b/ChangeLog.d/x509-ec-algorithm-identifier-fix.txt
@@ -0,0 +1,4 @@
+Bugfix
+ * Fix x509 certificate generation to conform to RFC 5480 / RFC 5758 when
+ using ECC key. The certificate was rejected by some crypto frameworks.
+ Fixes #2924.
diff --git a/docs/architecture/psa-thread-safety.md b/docs/architecture/psa-thread-safety.md
new file mode 100644
index 0000000..b0ca808
--- /dev/null
+++ b/docs/architecture/psa-thread-safety.md
@@ -0,0 +1,284 @@
+Thread safety of the PSA subsystem
+==================================
+
+## Requirements
+
+### Backward compatibility requirement
+
+Code that is currently working must keep working. There can be an exception for code that uses features that are advertised as experimental; for example, it would be annoying but ok to add extra requirements for drivers.
+
+(In this section, “currently” means Mbed TLS releases without proper concurrency management: 3.0.0, 3.1.0, and any other subsequent 3.x version.)
+
+In particular, if you either protect all PSA calls with a mutex, or only ever call PSA functions from a single thread, your application currently works and must keep working. If your application currently builds and works with `MBEDTLS_PSA_CRYPTO_C` and `MBEDTLS_THREADING_C` enabled, it must keep building and working.
+
+As a consequence, we must not add a new platform requirement beyond mutexes for the base case. It would be ok to add new platform requirements if they're only needed for PSA drivers, or if they're only performance improvements.
+
+Tempting platform requirements that we cannot add to the default `MBEDTLS_THREADING_C` include:
+
+* Releasing a mutex from a different thread than the one that acquired it. This isn't even guaranteed to work with pthreads.
+* New primitives such as semaphores or condition variables.
+
+### Correctness out of the box
+
+If you build with `MBEDTLS_PSA_CRYPTO_C` and `MBEDTLS_THREADING_C`, the code must be functionally correct: no race conditions, deadlocks or livelocks.
+
+The [PSA Crypto API specification](https://armmbed.github.io/mbed-crypto/html/overview/conventions.html#concurrent-calls) defines minimum expectations for concurrent calls. They must work as if they had been executed one at a time, except that the following cases have undefined behavior:
+
+* Destroying a key while it's in use.
+* Concurrent calls using the same operation object. (An operation object may not be used by more than one thread at a time. But it can move from one thread to another between calls.)
+* Overlap of an output buffer with an input or output of a concurrent call.
+* Modification of an input buffer during a call.
+
+Note that while the specification does not define the behavior in such cases, Mbed TLS can be used as a crypto service. It's acceptable if an application can mess itself up, but it is not acceptable if an application can mess up the crypto service. As a consequence, destroying a key while it's in use may violate the security property that all key material is erased as soon as `psa_destroy_key` returns, but it may not cause data corruption or read-after-free inside the key store.
+
+### No spinning
+
+The code must not spin on a potentially non-blocking task. For example, this is proscribed:
+```
+lock(m);
+while (!its_my_turn) {
+ unlock(m);
+ lock(m);
+}
+```
+
+Rationale: this can cause battery drain, and can even be a livelock (spinning forever), e.g. if the thread that might unblock this one has a lower priority.
+
+### Driver requirements
+
+At the time of writing, the driver interface specification does not consider multithreaded environments.
+
+We need to define clear policies so that driver implementers know what to expect. Here are two possible policies at two ends of the spectrum; what is desirable is probably somewhere in between.
+
+* Driver entry points may be called concurrently from multiple threads, even if they're using the same key, and even including destroying a key while an operation is in progress on it.
+* At most one driver entry point is active at any given time.
+
+A more reasonable policy could be:
+
+* By default, each driver only has at most one entry point active at any given time. In other words, each driver has its own exclusive lock.
+* Drivers have an optional `"thread_safe"` boolean property. If true, it allows concurrent calls to this driver.
+* Even with a thread-safe driver, the core never starts the destruction of a key while there are operations in progress on it, and never performs concurrent calls on the same multipart operation.
+
+### Long-term performance requirements
+
+In the short term, correctness is the important thing. We can start with a global lock.
+
+In the medium to long term, performing a slow or blocking operation (for example, a driver call, or an RSA decryption) should not block other threads, even if they're calling the same driver or using the same key object.
+
+We may want to go directly to a more sophisticated approach because when a system works with a global lock, it's typically hard to get rid of it to get more fine-grained concurrency.
+
+### Key destruction long-term requirements
+
+As noted above in [“Correctness out of the box”](#correctness-out-of-the-box), when a key is destroyed, it's ok if `psa_destroy_key` allows copies of the key to live until ongoing operations using the key return. In the long term, it would be good to guarantee that `psa_destroy_key` wipes all copies of the key material.
+
+#### Summary of guarantees when `psa_destroy_key` returns
+
+* The key identifier doesn't exist. Rationale: this is a functional requirement for persistent keys: the caller can immediately create a new key with the same identifier.
+* The resources from the key have been freed. Rationale: in a low-resource condition, this may be necessary for the caller to re-create a similar key, which should be possible.
+* The call must not block indefinitely, and in particular cannot wait for an event that is triggered by application code such as calling an abort function. Rationale: this may not strictly be a functional requirement, but it is an expectation `psa_destroy_key` does not block forever due to another thread, which could potentially be another process on a multi-process system.
+* In the long term, no copy of the key material exists. Rationale: this is a security requirement. We do not have this requirement yet, but we need to document this as a security weakness, and we would like to become compliant.
+
+## Resources to protect
+
+Analysis of the behavior of the PSA key store as of Mbed TLS 9202ba37b19d3ea25c8451fd8597fce69eaa6867.
+
+### Global variables
+
+* `psa_crypto_slot_management::global_data.key_slots[i]`: see [“Key slots”](#key-slots).
+
+* `psa_crypto_slot_management::global_data.key_slots_initialized`:
+ * `psa_initialize_key_slots`: modification.
+ * `psa_wipe_all_key_slots`: modification.
+ * `psa_get_empty_key_slot`: read.
+ * `psa_get_and_lock_key_slot`: read.
+
+* `psa_crypto::global_data.rng`: depends on the RNG implementation. See [“Random generator”](#random-generator).
+ * `psa_generate_random`: query.
+ * `mbedtls_psa_crypto_configure_entropy_sources` (only if `MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG` is enabled): setup. Only called from `psa_crypto_init` via `mbedtls_psa_random_init`, or from test code.
+ * `mbedtls_psa_crypto_free`: deinit.
+ * `psa_crypto_init`: seed (via `mbedtls_psa_random_seed`); setup via `mbedtls_psa_crypto_configure_entropy_sources.
+
+* `psa_crypto::global_data.{initialized,rng_state}`: these are bit-fields and cannot be modified independently so they must be protected by the same mutex. The following functions access these fields:
+ * `mbedtls_psa_crypto_configure_entropy_sources` [`rng_state`] (only if `MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG` is enabled): read. Only called from `psa_crypto_init` via `mbedtls_psa_random_init`, or from test code.
+ * `mbedtls_psa_crypto_free`: modification.
+ * `psa_crypto_init`: modification.
+ * Many functions via `GUARD_MODULE_INITIALIZED`: read.
+
+### Key slots
+
+#### Key slot array traversal
+
+“Occupied key slot” is determined by `psa_is_key_slot_occupied` based on `slot->attr.type`.
+
+The following functions traverse the key slot array:
+
+* `psa_get_and_lock_key_slot_in_memory`: reads `slot->attr.id`.
+* `psa_get_and_lock_key_slot_in_memory`: calls `psa_lock_key_slot` on one occupied slot.
+* `psa_get_empty_key_slot`: calls `psa_is_key_slot_occupied`.
+* `psa_get_empty_key_slot`: calls `psa_wipe_key_slot` and more modifications on one occupied slot with no active user.
+* `psa_get_empty_key_slot`: calls `psa_lock_key_slot` and more modification on one unoccupied slot.
+* `psa_wipe_all_key_slots`: writes to all slots.
+* `mbedtls_psa_get_stats`: reads from all slots.
+
+#### Key slot state
+
+The following functions modify a slot's usage state:
+
+* `psa_lock_key_slot`: writes to `slot->lock_count`.
+* `psa_unlock_key_slot`: writes to `slot->lock_count`.
+* `psa_wipe_key_slot`: writes to `slot->lock_count`.
+* `psa_destroy_key`: reads `slot->lock_count`, calls `psa_lock_key_slot`.
+* `psa_wipe_all_key_slots`: writes to all slots.
+* `psa_get_empty_key_slot`: writes to `slot->lock_count` and calls `psa_wipe_key_slot` and `psa_lock_key_slot` on one occupied slot with no active user; calls `psa_lock_key_slot` on one unoccupied slot.
+* `psa_close_key`: reads `slot->lock_count`; calls `psa_get_and_lock_key_slot_in_memory`, `psa_wipe_key_slot` and `psa_unlock_key_slot`.
+* `psa_purge_key`: reads `slot->lock_count`; calls `psa_get_and_lock_key_slot_in_memory`, `psa_wipe_key_slot` and `psa_unlock_key_slot`.
+
+**slot->attr access:**
+`psa_crypto_core.h`:
+* `psa_key_slot_set_flags` - writes to attr.flags
+* `psa_key_slot_set_bits_in_flags` - writes to attr.flags
+* `psa_key_slot_clear_bits` - writes to attr.flags
+* `psa_is_key_slot_occupied` - reads attr.type (but see “[Determining whether a key slot is occupied](#determining-whether-a-key-slot-is-occupied)”)
+* `psa_key_slot_get_flags` - reads attr.flags
+
+`psa_crypto_slot_management.c`:
+* `psa_get_and_lock_key_slot_in_memory` - reads attr.id
+* `psa_get_empty_key_slot` - reads attr.lifetime
+* `psa_load_persistent_key_into_slot` - passes attr pointer to psa_load_persistent_key
+* `psa_load_persistent_key` - reads attr.id and passes pointer to psa_parse_key_data_from_storage
+* `psa_parse_key_data_from_storage` - writes to many attributes
+* `psa_get_and_lock_key_slot` - writes to attr.id, attr.lifetime, and attr.policy.usage
+* `psa_purge_key` - reads attr.lifetime, calls psa_wipe_key_slot
+* `mbedtls_psa_get_stats` - reads attr.lifetime, attr.id
+
+`psa_crypto.c`:
+* `psa_get_and_lock_key_slot_with_policy` - reads attr.type, attr.policy.
+* `psa_get_and_lock_transparent_key_slot_with_policy` - reads attr.lifetime
+* `psa_destroy_key` - reads attr.lifetime, attr.id
+* `psa_get_key_attributes` - copies all publicly available attributes of a key
+* `psa_export_key` - copies attributes
+* `psa_export_public_key` - reads attr.type, copies attributes
+* `psa_start_key_creation` - writes to the whole attr structure
+* `psa_validate_optional_attributes` - reads attr.type, attr.bits
+* `psa_import_key` - reads attr.bits
+* `psa_copy_key` - reads attr.bits, attr.type, attr.lifetime, attr.policy
+* `psa_mac_setup` - copies whole attr structure
+* `psa_mac_compute_internal` - copies whole attr structure
+* `psa_verify_internal` - copies whole attr structure
+* `psa_sign_internal` - copies whole attr structure, reads attr.type
+* `psa_assymmetric_encrypt` - reads attr.type
+* `psa_assymetric_decrypt` - reads attr.type
+* `psa_cipher_setup` - copies whole attr structure, reads attr.type
+* `psa_cipher_encrypt` - copies whole attr structure, reads attr.type
+* `psa_cipher_decrypt` - copies whole attr structure, reads attr.type
+* `psa_aead_encrypt` - copies whole attr structure
+* `psa_aead_decrypt` - copies whole attr structure
+* `psa_aead_setup` - copies whole attr structure
+* `psa_generate_derived_key_internal` - reads attr.type, writes to and reads from attr.bits, copies whole attr structure
+* `psa_key_derivation_input_key` - reads attr.type
+* `psa_key_agreement_raw_internal` - reads attr.type and attr.bits
+
+#### Determining whether a key slot is occupied
+
+`psa_is_key_slot_occupied` currently uses the `attr.type` field to determine whether a key slot is occupied. This works because we maintain the invariant that an occupied slot contains key material. With concurrency, it is desirable to allow a key slot to be reserved, but not yet contain key material or even metadata. When creating a key, determining the key type can be costly, for example when loading a persistent key from storage or (not yet implemented) when importing or unwrapping a key using an interface that determines the key type from the data that it parses. So we should not need to hold the global key store lock while the key type is undetermined.
+
+Instead, `psa_is_key_slot_occupied` should use the key identifier to decide whether a slot is occupied. The key identifier is always readily available: when allocating a slot for a persistent key, it's an input of the function that allocates the key slot; when allocating a slot for a volatile key, the identifier is calculated from the choice of slot.
+
+#### Key slot content
+
+Other than what is used to determine the [“key slot state”](#key-slot-state), the contents of a key slot are only accessed as follows:
+
+* Modification during key creation (between `psa_start_key_creation` and `psa_finish_key_creation` or `psa_fail_key_creation`).
+* Destruction in `psa_wipe_key_slot`.
+* Read in many functions, between calls to `psa_lock_key_slot` and `psa_unlock_key_slot`.
+
+**slot->key access:**
+* `psa_allocate_buffer_to_slot` - allocates key.data, sets key.bytes;
+* `psa_copy_key_material_into_slot` - writes to key.data
+* `psa_remove_key_data_from_memory` - writes and reads to/from key data
+* `psa_get_key_attributes` - reads from key data
+* `psa_export_key` - passes key data to psa_driver_wrapper_export_key
+* `psa_export_public_key` - passes key data to psa_driver_wrapper_export_public_key
+* `psa_finish_key_creation` - passes key data to psa_save_persistent_key
+* `psa_validate_optional_attributes` - passes key data and bytes to mbedtls_psa_rsa_load_representation
+* `psa_import_key` - passes key data to psa_driver_wrapper_import_key
+* `psa_copy_key` - passes key data to psa_driver_wrapper_copy_key, psa_copy_key_material_into_slot
+* `psa_mac_setup` - passes key data to psa_driver_wrapper_mac_sign_setup, psa_driver_wrapper_mac_verify_setup
+* `psa_mac_compute_internal` - passes key data to psa_driver_wrapper_mac_compute
+* `psa_sign_internal` - passes key data to psa_driver_wrapper_sign_message, psa_driver_wrapper_sign_hash
+* `psa_verify_internal` - passes key data to psa_driver_wrapper_verify_message, psa_driver_wrapper_verify_hash
+* `psa_asymmetric_encrypt` - passes key data to mbedtls_psa_rsa_load_representation
+* `psa_asymmetric_decrypt` - passes key data to mbedtls_psa_rsa_load_representation
+* `psa_cipher_setup ` - passes key data to psa_driver_wrapper_cipher_encrypt_setup and psa_driver_wrapper_cipher_decrypt_setup
+* `psa_cipher_encrypt` - passes key data to psa_driver_wrapper_cipher_encrypt
+* `psa_cipher_decrypt` - passes key data to psa_driver_wrapper_cipher_decrypt
+* `psa_aead_encrypt` - passes key data to psa_driver_wrapper_aead_encrypt
+* `psa_aead_decrypt` - passes key data to psa_driver_wrapper_aead_decrypt
+* `psa_aead_setup` - passes key data to psa_driver_wrapper_aead_encrypt_setup and psa_driver_wrapper_aead_decrypt_setup
+* `psa_generate_derived_key_internal` - passes key data to psa_driver_wrapper_import_key
+* `psa_key_derivation_input_key` - passes key data to psa_key_derivation_input_internal
+* `psa_key_agreement_raw_internal` - passes key data to mbedtls_psa_ecp_load_representation
+* `psa_generate_key` - passes key data to psa_driver_wrapper_generate_key
+
+### Random generator
+
+The PSA RNG can be accessed both from various PSA functions, and from application code via `mbedtls_psa_get_random`.
+
+With the built-in RNG implementations using `mbedtls_ctr_drbg_context` or `mbedtls_hmac_drbg_context`, querying the RNG with `mbedtls_xxx_drbg_random()` is thread-safe (protected by a mutex inside the RNG implementation), but other operations (init, free, seed) are not.
+
+When `MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG` is enabled, thread safety depends on the implementation.
+
+### Driver resources
+
+Depends on the driver. The PSA driver interface specification does not discuss whether drivers must support concurrent calls.
+
+## Simple global lock strategy
+
+Have a single mutex protecting all accesses to the key store and other global variables. In practice, this means every PSA API function needs to take the lock on entry and release on exit, except for:
+
+* Hash function.
+* Accessors for key attributes and other local structures.
+
+Note that operation functions do need to take the lock, since they need to prevent the destruction of the key.
+
+Note that this does not protect access to the RNG via `mbedtls_psa_get_random`, which is guaranteed to be thread-safe when `MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG` is disabled.
+
+This approach is conceptually simple, but requires extra instrumentation to every function and has bad performance in a multithreaded environment since a slow operation in one thread blocks unrelated operations on other threads.
+
+## Global lock excluding slot content
+
+Have a single mutex protecting all accesses to the key store and other global variables, except that it's ok to access the content of a key slot without taking the lock if one of the following conditions holds:
+
+* The key slot is in a state that guarantees that the thread has exclusive access.
+* The key slot is in a state that guarantees that no other thread can modify the slot content, and the accessing thread is only reading the slot.
+
+Note that a thread must hold the global mutex when it reads or changes a slot's state.
+
+### Slot states
+
+For concurrency purposes, a slot can be in one of three states:
+
+* UNUSED: no thread is currently accessing the slot. It may be occupied by a volatile key or a cached key.
+* WRITING: a thread has exclusive access to the slot. This can only happen in specific circumstances as detailed below.
+* READING: any thread may read from the slot.
+
+A high-level view of state transitions:
+
+* `psa_get_empty_key_slot`: UNUSED → WRITING.
+* `psa_get_and_lock_key_slot_in_memory`: UNUSED or READING → READING. This function only accepts slots in the UNUSED or READING state. A slot with the correct id but in the WRITING state is considered free.
+* `psa_unlock_key_slot`: READING → UNUSED or READING.
+* `psa_finish_key_creation`: WRITING → READING.
+* `psa_fail_key_creation`: WRITING → UNUSED.
+* `psa_wipe_key_slot`: any → UNUSED. If the slot is READING or WRITING on entry, this function must wait until the writer or all readers have finished. (By the way, the WRITING state is possible if `mbedtls_psa_crypto_free` is called while a key creation is in progress.) See [“Destruction of a key in use”](#destruction of a key in use).
+
+The current `state->lock_count` corresponds to the difference between UNUSED and READING: a slot is in use iff its lock count is nonzero, so `lock_count == 0` corresponds to UNUSED and `lock_count != 0` corresponds to READING.
+
+There is currently no indication of when a slot is in the WRITING state. This only happens between a call to `psa_start_key_creation` and a call to one of `psa_finish_key_creation` or `psa_fail_key_creation`. This new state can be conveyed by a new boolean flag, or by setting `lock_count` to `~0`.
+
+### Destruction of a key in use
+
+Problem: a key slot is destroyed (by `psa_wipe_key_slot`) while it's in use (READING or WRITING).
+
+TODO: how do we ensure that? This needs something more sophisticated than mutexes (concurrency number >2)! Even a per-slot mutex isn't enough (we'd need a reader-writer lock).
+
+Solution: after some team discussion, we've decided to rely on a new threading abstraction which mimics C11 (i.e. `mbedtls_fff` where `fff` is the C11 function name, having the same parameters and return type, with default implementations for C11, pthreads and Windows). We'll likely use condition variables in addition to mutexes.
diff --git a/docs/proposed/psa-driver-developer-guide.md b/docs/proposed/psa-driver-developer-guide.md
index d004483..6b207c8 100644
--- a/docs/proposed/psa-driver-developer-guide.md
+++ b/docs/proposed/psa-driver-developer-guide.md
@@ -2,6 +2,7 @@
============================================
**This is a specification of work in progress. The implementation is not yet merged into Mbed TLS.**
+For a description of the current state of drivers Mbed TLS, see our [PSA Cryptoprocessor driver development examples](../psa-driver-example-and-guide.html).
This document describes how to write drivers of cryptoprocessors such as accelerators and secure elements for the PSA cryptography subsystem of Mbed TLS.
diff --git a/docs/proposed/psa-driver-integration-guide.md b/docs/proposed/psa-driver-integration-guide.md
index 3d12ec6..8b3b404 100644
--- a/docs/proposed/psa-driver-integration-guide.md
+++ b/docs/proposed/psa-driver-integration-guide.md
@@ -2,6 +2,7 @@
==================================================
**This is a specification of work in progress. The implementation is not yet merged into Mbed TLS.**
+For a description of the current state of drivers Mbed TLS, see our [PSA Cryptoprocessor driver development examples](../psa-driver-example-and-guide.html).
This document describes how to build Mbed TLS with additional cryptoprocessor drivers that follow the PSA cryptoprocessor driver interface.
diff --git a/docs/proposed/psa-driver-interface.md b/docs/proposed/psa-driver-interface.md
index 41f90c9..1aa55b3 100644
--- a/docs/proposed/psa-driver-interface.md
+++ b/docs/proposed/psa-driver-interface.md
@@ -5,6 +5,8 @@
This specification is work in progress and should be considered to be in a beta stage. There is ongoing work to implement this interface in Mbed TLS, which is the reference implementation of the PSA Cryptography API. At this stage, Arm does not expect major changes, but minor changes are expected based on experience from the first implementation and on external feedback.
+For a practical guide, with a description of the current state of drivers Mbed TLS, see our [PSA Cryptoprocessor driver development examples](../psa-driver-example-and-guide.html).
+
## Introduction
### Purpose of the driver interface
diff --git a/docs/proposed/psa-driver-wrappers-codegen-migration-guide.md b/docs/proposed/psa-driver-wrappers-codegen-migration-guide.md
index 6144aad..67157e5 100644
--- a/docs/proposed/psa-driver-wrappers-codegen-migration-guide.md
+++ b/docs/proposed/psa-driver-wrappers-codegen-migration-guide.md
@@ -1,11 +1,11 @@
Migrating to an auto generated psa_crypto_driver_wrappers.c file
================================================================
-**This is a specification of work in progress. The implementation is not yet merged into Mbed TLS.**
-
This document describes how to migrate to the auto generated psa_crypto_driver_wrappers.c file.
It is meant to give the library user migration guidelines while the Mbed TLS project tides over multiple minor revs of version 1.0, after which this will be merged into psa-driver-interface.md.
+For a practical guide with a description of the current state of drivers Mbed TLS, see our [PSA Cryptoprocessor driver development examples](../psa-driver-example-and-guide.html).
+
## Introduction
The design of the Driver Wrappers code generation is based on the design proposal https://github.com/Mbed-TLS/mbedtls/pull/5067
diff --git a/docs/psa-driver-example-and-guide.md b/docs/psa-driver-example-and-guide.md
index ff66124..ae3c04c 100644
--- a/docs/psa-driver-example-and-guide.md
+++ b/docs/psa-driver-example-and-guide.md
@@ -29,8 +29,8 @@
| Transparent Driver | Opaque Driver |
|---------------------|---------------------|
| `import_key` | `import_key` |
-| `export_key` | `export_key` |
| `export_public_key` | `export_public_key` |
+| | `export_key` |
| | `copy_key` |
| | `get_builtin_key` |
diff --git a/include/mbedtls/build_info.h b/include/mbedtls/build_info.h
index 5b8a40d..985edd2 100644
--- a/include/mbedtls/build_info.h
+++ b/include/mbedtls/build_info.h
@@ -208,6 +208,14 @@
#define MBEDTLS_PK_PARSE_C
#endif
+/* Helper symbol to state that the PK module has support for EC keys. This
+ * can either be provided through the legacy ECP solution or through the
+ * PSA friendly MBEDTLS_PK_USE_PSA_EC_DATA (see pk.h for its description). */
+#if defined(MBEDTLS_ECP_C) || \
+ (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY))
+#define MBEDTLS_PK_HAVE_ECC_KEYS
+#endif /* MBEDTLS_PK_USE_PSA_EC_DATA || MBEDTLS_ECP_C */
+
/* The following blocks make it easier to disable all of TLS,
* or of TLS 1.2 or 1.3 or DTLS, without having to manually disable all
* key exchanges, options and extensions related to them. */
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index 7a87971..3d6353e 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -425,7 +425,7 @@
#endif
#if defined(MBEDTLS_PK_C) && \
- !defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_ECP_LIGHT)
+ !defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_PK_HAVE_ECC_KEYS)
#error "MBEDTLS_PK_C defined, but not all prerequisites"
#endif
@@ -986,15 +986,15 @@
#error "MBEDTLS_VERSION_FEATURES defined, but not all prerequisites"
#endif
-#if defined(MBEDTLS_X509_USE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \
- !defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_PARSE_C) || \
+#if defined(MBEDTLS_X509_USE_C) && \
+ (!defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_PARSE_C) || \
!defined(MBEDTLS_PK_PARSE_C) || \
( !defined(MBEDTLS_MD_C) && !defined(MBEDTLS_USE_PSA_CRYPTO) ) )
#error "MBEDTLS_X509_USE_C defined, but not all prerequisites"
#endif
-#if defined(MBEDTLS_X509_CREATE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \
- !defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_WRITE_C) || \
+#if defined(MBEDTLS_X509_CREATE_C) && \
+ (!defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_WRITE_C) || \
!defined(MBEDTLS_PK_PARSE_C) || \
( !defined(MBEDTLS_MD_C) && !defined(MBEDTLS_USE_PSA_CRYPTO) ) )
#error "MBEDTLS_X509_CREATE_C defined, but not all prerequisites"
@@ -1099,8 +1099,8 @@
#if defined(MBEDTLS_PKCS7_C) && ( ( !defined(MBEDTLS_ASN1_PARSE_C) ) || \
( !defined(MBEDTLS_OID_C) ) || ( !defined(MBEDTLS_PK_PARSE_C) ) || \
- ( !defined(MBEDTLS_X509_CRT_PARSE_C) ) ||\
- ( !defined(MBEDTLS_X509_CRL_PARSE_C) ) || ( !defined(MBEDTLS_BIGNUM_C) ) || \
+ ( !defined(MBEDTLS_X509_CRT_PARSE_C) ) || \
+ ( !defined(MBEDTLS_X509_CRL_PARSE_C) ) || \
( !defined(MBEDTLS_MD_C) ) )
#error "MBEDTLS_PKCS7_C is defined, but not all prerequisites"
#endif
diff --git a/include/mbedtls/constant_time.h b/include/mbedtls/constant_time.h
index 91a9e7f..ebecf35 100644
--- a/include/mbedtls/constant_time.h
+++ b/include/mbedtls/constant_time.h
@@ -23,20 +23,22 @@
#include <stddef.h>
-
/** Constant-time buffer comparison without branches.
*
* This is equivalent to the standard memcmp function, but is likely to be
- * compiled to code using bitwise operation rather than a branch.
+ * compiled to code using bitwise operations rather than a branch, such that
+ * the time taken is constant w.r.t. the data pointed to by \p a and \p b,
+ * and w.r.t. whether \p a and \p b are equal or not. It is not constant-time
+ * w.r.t. \p n .
*
* This function can be used to write constant-time code by replacing branches
* with bit operations using masks.
*
- * \param a Pointer to the first buffer.
- * \param b Pointer to the second buffer.
- * \param n The number of bytes to compare in the buffer.
+ * \param a Pointer to the first buffer, containing at least \p n bytes. May not be NULL.
+ * \param b Pointer to the second buffer, containing at least \p n bytes. May not be NULL.
+ * \param n The number of bytes to compare.
*
- * \return Zero if the content of the two buffer is the same,
+ * \return Zero if the contents of the two buffers are the same,
* otherwise non-zero.
*/
int mbedtls_ct_memcmp(const void *a,
diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h
index 0e678a3..a89d4d2 100644
--- a/include/mbedtls/ecp.h
+++ b/include/mbedtls/ecp.h
@@ -197,6 +197,27 @@
* odd prime as mbedtls_ecp_mul() requires an odd number, and
* mbedtls_ecdsa_sign() requires that it is prime for blinding purposes.
*
+ * The default implementation only initializes \p A without setting it to the
+ * authentic value for curves with <code>A = -3</code>(SECP256R1, etc), in which
+ * case you need to load \p A by yourself when using domain parameters directly,
+ * for example:
+ * \code
+ * mbedtls_mpi_init(&A);
+ * mbedtls_ecp_group_init(&grp);
+ * CHECK_RETURN(mbedtls_ecp_group_load(&grp, grp_id));
+ * if (mbedtls_ecp_group_a_is_minus_3(&grp)) {
+ * CHECK_RETURN(mbedtls_mpi_sub_int(&A, &grp.P, 3));
+ * } else {
+ * CHECK_RETURN(mbedtls_mpi_copy(&A, &grp.A));
+ * }
+ *
+ * do_something_with_a(&A);
+ *
+ * cleanup:
+ * mbedtls_mpi_free(&A);
+ * mbedtls_ecp_group_free(&grp);
+ * \endcode
+ *
* For Montgomery curves, we do not store \p A, but <code>(A + 2) / 4</code>,
* which is the quantity used in the formulas. Additionally, \p nbits is
* not the size of \p N but the required size for private keys.
@@ -223,8 +244,11 @@
typedef struct mbedtls_ecp_group {
mbedtls_ecp_group_id id; /*!< An internal group identifier. */
mbedtls_mpi P; /*!< The prime modulus of the base field. */
- mbedtls_mpi A; /*!< For Short Weierstrass: \p A in the equation. For
- Montgomery curves: <code>(A + 2) / 4</code>. */
+ mbedtls_mpi A; /*!< For Short Weierstrass: \p A in the equation. Note that
+ \p A is not set to the authentic value in some cases.
+ Refer to detailed description of ::mbedtls_ecp_group if
+ using domain parameters in the structure.
+ For Montgomery curves: <code>(A + 2) / 4</code>. */
mbedtls_mpi B; /*!< For Short Weierstrass: \p B in the equation.
For Montgomery curves: unused. */
mbedtls_ecp_point G; /*!< The generator of the subgroup used. */
@@ -992,6 +1016,26 @@
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
/**
+ * \brief This function checks if domain parameter A of the curve is
+ * \c -3.
+ *
+ * \note This function is only defined for short Weierstrass curves.
+ * It may not be included in builds without any short
+ * Weierstrass curve.
+ *
+ * \param grp The ECP group to use.
+ * This must be initialized and have group parameters
+ * set, for example through mbedtls_ecp_group_load().
+ *
+ * \return \c 1 if <code>A = -3</code>.
+ * \return \c 0 Otherwise.
+ */
+static inline int mbedtls_ecp_group_a_is_minus_3(const mbedtls_ecp_group *grp)
+{
+ return grp->A.MBEDTLS_PRIVATE(p) == NULL;
+}
+
+/**
* \brief This function performs multiplication and addition of two
* points by integers: \p R = \p m * \p P + \p n * \p Q
*
diff --git a/include/mbedtls/mbedtls_config.h b/include/mbedtls/mbedtls_config.h
index 7c15382..6a76e88 100644
--- a/include/mbedtls/mbedtls_config.h
+++ b/include/mbedtls/mbedtls_config.h
@@ -1998,8 +1998,15 @@
* If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies
* an alternative header to include instead of include/psa/crypto_config.h.
*
- * This feature is still experimental and is not ready for production since
- * it is not completed.
+ * \warning This option is experimental, in that the set of `PSA_WANT_XXX`
+ * symbols is not completely finalized yet, and the configuration
+ * tooling is not ideally adapted to having two separate configuration
+ * files.
+ * Future minor releases of Mbed TLS may make minor changes to those
+ * symbols, but we will endeavor to provide a transition path.
+ * Nonetheless, this option is considered mature enough to use in
+ * production, as long as you accept that you may need to make
+ * minor changes to psa/crypto_config.h when upgrading Mbed TLS.
*/
//#define MBEDTLS_PSA_CRYPTO_CONFIG
diff --git a/include/mbedtls/pk.h b/include/mbedtls/pk.h
index f56c942..41e980d 100644
--- a/include/mbedtls/pk.h
+++ b/include/mbedtls/pk.h
@@ -173,7 +173,7 @@
/* Internal helper to define which fields in the pk_context structure below
* should be used for EC keys: legacy ecp_keypair or the raw (PSA friendly)
- * format. It should be noticed that this only affect how data is stored, not
+ * format. It should be noticed that this only affects how data is stored, not
* which functions are used for various operations. The overall picture looks
* like this:
* - if USE_PSA is not defined and ECP_C is then use ecp_keypair data structure
@@ -200,6 +200,28 @@
#define MBEDTLS_PK_HAVE_ECC_KEYS
#endif /* MBEDTLS_PK_USE_PSA_EC_DATA || MBEDTLS_ECP_C */
+/* Internal helper to define which fields in the pk_context structure below
+ * should be used for EC keys: legacy ecp_keypair or the raw (PSA friendly)
+ * format. It should be noted that this only affect how data is stored, not
+ * which functions are used for various operations. The overall picture looks
+ * like this:
+ * - if USE_PSA is not defined and ECP_C is then use ecp_keypair data structure
+ * and legacy functions
+ * - if USE_PSA is defined and
+ * - if ECP_C then use ecp_keypair structure, convert data to a PSA friendly
+ * format and use PSA functions
+ * - if !ECP_C then use new raw data and PSA functions directly.
+ *
+ * The main reason for the "intermediate" (USE_PSA + ECP_C) above is that as long
+ * as ECP_C is defined mbedtls_pk_ec() gives the user read/write access to the
+ * ecp_keypair structure inside the pk_context so they can modify it using
+ * ECP functions which are not under the PK module's control.
+ */
+#if defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \
+ !defined(MBEDTLS_ECP_C)
+#define MBEDTLS_PK_USE_PSA_EC_DATA
+#endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_ECP_C */
+
/**
* \brief Types for interfacing with the debug module
*/
diff --git a/include/mbedtls/x509.h b/include/mbedtls/x509.h
index 6e1f5b6..e21356f 100644
--- a/include/mbedtls/x509.h
+++ b/include/mbedtls/x509.h
@@ -503,7 +503,8 @@
mbedtls_asn1_named_data *first);
int mbedtls_x509_write_sig(unsigned char **p, unsigned char *start,
const char *oid, size_t oid_len,
- unsigned char *sig, size_t size);
+ unsigned char *sig, size_t size,
+ mbedtls_pk_type_t pk_alg);
int mbedtls_x509_get_ns_cert_type(unsigned char **p,
const unsigned char *end,
unsigned char *ns_cert_type);
diff --git a/library/.gitignore b/library/.gitignore
index b4dc918..5a29a43 100644
--- a/library/.gitignore
+++ b/library/.gitignore
@@ -2,8 +2,9 @@
*.sln
*.vcxproj
-# Automatically generated files
+###START_GENERATED_FILES###
/error.c
/version_features.c
/ssl_debug_helpers_generated.c
/psa_crypto_driver_wrappers.c
+###END_GENERATED_FILES###
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index f68e9ee..03e48df 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -37,7 +37,6 @@
ecdsa.c
ecjpake.c
ecp.c
- ecp_new.c
ecp_curves.c
ecp_curves_new.c
entropy.c
diff --git a/library/Makefile b/library/Makefile
index fdab4f4..194a847 100644
--- a/library/Makefile
+++ b/library/Makefile
@@ -102,7 +102,6 @@
ecdsa.o \
ecjpake.o \
ecp.o \
- ecp_new.o \
ecp_curves.o \
ecp_curves_new.o \
entropy.o \
diff --git a/library/aes.c b/library/aes.c
index 6d718f4..592ca64 100644
--- a/library/aes.c
+++ b/library/aes.c
@@ -19,7 +19,7 @@
/*
* The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
*
- * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
+ * https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/documents/aes-development/rijndael-ammended.pdf
* http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
*/
diff --git a/library/base64.c b/library/base64.c
index 3eb9e7c..fa22e53 100644
--- a/library/base64.c
+++ b/library/base64.c
@@ -24,6 +24,7 @@
#if defined(MBEDTLS_BASE64_C)
#include "mbedtls/base64.h"
+#include "base64_internal.h"
#include "constant_time_internal.h"
#include <stdint.h>
@@ -33,6 +34,39 @@
#include "mbedtls/platform.h"
#endif /* MBEDTLS_SELF_TEST */
+MBEDTLS_STATIC_TESTABLE
+unsigned char mbedtls_ct_base64_enc_char(unsigned char value)
+{
+ unsigned char digit = 0;
+ /* For each range of values, if value is in that range, mask digit with
+ * the corresponding value. Since value can only be in a single range,
+ * only at most one masking will change digit. */
+ digit |= mbedtls_ct_uchar_in_range_if(0, 25, value, 'A' + value);
+ digit |= mbedtls_ct_uchar_in_range_if(26, 51, value, 'a' + value - 26);
+ digit |= mbedtls_ct_uchar_in_range_if(52, 61, value, '0' + value - 52);
+ digit |= mbedtls_ct_uchar_in_range_if(62, 62, value, '+');
+ digit |= mbedtls_ct_uchar_in_range_if(63, 63, value, '/');
+ return digit;
+}
+
+MBEDTLS_STATIC_TESTABLE
+signed char mbedtls_ct_base64_dec_value(unsigned char c)
+{
+ unsigned char val = 0;
+ /* For each range of digits, if c is in that range, mask val with
+ * the corresponding value. Since c can only be in a single range,
+ * only at most one masking will change val. Set val to one plus
+ * the desired value so that it stays 0 if c is in none of the ranges. */
+ val |= mbedtls_ct_uchar_in_range_if('A', 'Z', c, c - 'A' + 0 + 1);
+ val |= mbedtls_ct_uchar_in_range_if('a', 'z', c, c - 'a' + 26 + 1);
+ val |= mbedtls_ct_uchar_in_range_if('0', '9', c, c - '0' + 52 + 1);
+ val |= mbedtls_ct_uchar_in_range_if('+', '+', c, c - '+' + 62 + 1);
+ val |= mbedtls_ct_uchar_in_range_if('/', '/', c, c - '/' + 63 + 1);
+ /* At this point, val is 0 if c is an invalid digit and v+1 if c is
+ * a digit with the value v. */
+ return val - 1;
+}
+
/*
* Encode a buffer into base64 format
*/
diff --git a/library/base64_internal.h b/library/base64_internal.h
new file mode 100644
index 0000000..f9f56d7
--- /dev/null
+++ b/library/base64_internal.h
@@ -0,0 +1,57 @@
+/**
+ * \file base64_internal.h
+ *
+ * \brief RFC 1521 base64 encoding/decoding: interfaces for invasive testing
+ */
+/*
+ * Copyright The Mbed TLS Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MBEDTLS_BASE64_INTERNAL
+#define MBEDTLS_BASE64_INTERNAL
+
+#include "common.h"
+
+#if defined(MBEDTLS_TEST_HOOKS)
+
+/** Given a value in the range 0..63, return the corresponding Base64 digit.
+ *
+ * The implementation assumes that letters are consecutive (e.g. ASCII
+ * but not EBCDIC).
+ *
+ * \param value A value in the range 0..63.
+ *
+ * \return A base64 digit converted from \p value.
+ */
+unsigned char mbedtls_ct_base64_enc_char(unsigned char value);
+
+/** Given a Base64 digit, return its value.
+ *
+ * If c is not a Base64 digit ('A'..'Z', 'a'..'z', '0'..'9', '+' or '/'),
+ * return -1.
+ *
+ * The implementation assumes that letters are consecutive (e.g. ASCII
+ * but not EBCDIC).
+ *
+ * \param c A base64 digit.
+ *
+ * \return The value of the base64 digit \p c.
+ */
+signed char mbedtls_ct_base64_dec_value(unsigned char c);
+
+#endif /* MBEDTLS_TEST_HOOKS */
+
+#endif /* MBEDTLS_BASE64_INTERNAL */
diff --git a/library/bignum.c b/library/bignum.c
index f2a8641..b1518ed 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -54,6 +54,132 @@
#define MPI_VALIDATE(cond) \
MBEDTLS_INTERNAL_VALIDATE(cond)
+/*
+ * Compare signed values in constant time
+ */
+int mbedtls_mpi_lt_mpi_ct(const mbedtls_mpi *X,
+ const mbedtls_mpi *Y,
+ unsigned *ret)
+{
+ mbedtls_ct_condition_t different_sign, X_is_negative, Y_is_negative, result;
+
+ MPI_VALIDATE_RET(X != NULL);
+ MPI_VALIDATE_RET(Y != NULL);
+ MPI_VALIDATE_RET(ret != NULL);
+
+ if (X->n != Y->n) {
+ return MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
+ }
+
+ /*
+ * Set sign_N to 1 if N >= 0, 0 if N < 0.
+ * We know that N->s == 1 if N >= 0 and N->s == -1 if N < 0.
+ */
+ X_is_negative = mbedtls_ct_bool((X->s & 2) >> 1);
+ Y_is_negative = mbedtls_ct_bool((Y->s & 2) >> 1);
+
+ /*
+ * If the signs are different, then the positive operand is the bigger.
+ * That is if X is negative (X_is_negative == 1), then X < Y is true and it
+ * is false if X is positive (X_is_negative == 0).
+ */
+ different_sign = mbedtls_ct_bool_xor(X_is_negative, Y_is_negative); // non-zero if different sign
+ result = mbedtls_ct_bool_and(different_sign, X_is_negative);
+
+ /*
+ * Assuming signs are the same, compare X and Y. We switch the comparison
+ * order if they are negative so that we get the right result, regardles of
+ * sign.
+ */
+
+ /* This array is used to conditionally swap the pointers in const time */
+ void * const p[2] = { X->p, Y->p };
+ size_t i = mbedtls_ct_size_if_else_0(X_is_negative, 1);
+ mbedtls_ct_condition_t lt = mbedtls_mpi_core_lt_ct(p[i], p[i ^ 1], X->n);
+
+ /*
+ * Store in result iff the signs are the same (i.e., iff different_sign == false). If
+ * the signs differ, result has already been set, so we don't change it.
+ */
+ result = mbedtls_ct_bool_or(result,
+ mbedtls_ct_bool_and(mbedtls_ct_bool_not(different_sign), lt));
+
+ *ret = mbedtls_ct_uint_if_else_0(result, 1);
+
+ return 0;
+}
+
+/*
+ * Conditionally assign X = Y, without leaking information
+ * about whether the assignment was made or not.
+ * (Leaking information about the respective sizes of X and Y is ok however.)
+ */
+#if defined(_MSC_VER) && defined(_M_ARM64) && (_MSC_FULL_VER < 193131103)
+/*
+ * MSVC miscompiles this function if it's inlined prior to Visual Studio 2022 version 17.1. See:
+ * https://developercommunity.visualstudio.com/t/c-compiler-miscompiles-part-of-mbedtls-library-on/1646989
+ */
+__declspec(noinline)
+#endif
+int mbedtls_mpi_safe_cond_assign(mbedtls_mpi *X,
+ const mbedtls_mpi *Y,
+ unsigned char assign)
+{
+ int ret = 0;
+ MPI_VALIDATE_RET(X != NULL);
+ MPI_VALIDATE_RET(Y != NULL);
+
+ MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
+
+ mbedtls_ct_condition_t do_assign = mbedtls_ct_bool(assign);
+
+ X->s = (int) mbedtls_ct_uint_if(do_assign, Y->s, X->s);
+
+ mbedtls_mpi_core_cond_assign(X->p, Y->p, Y->n, do_assign);
+
+ mbedtls_ct_condition_t do_not_assign = mbedtls_ct_bool_not(do_assign);
+ for (size_t i = Y->n; i < X->n; i++) {
+ X->p[i] = mbedtls_ct_mpi_uint_if_else_0(do_not_assign, X->p[i]);
+ }
+
+cleanup:
+ return ret;
+}
+
+/*
+ * Conditionally swap X and Y, without leaking information
+ * about whether the swap was made or not.
+ * Here it is not ok to simply swap the pointers, which would lead to
+ * different memory access patterns when X and Y are used afterwards.
+ */
+int mbedtls_mpi_safe_cond_swap(mbedtls_mpi *X,
+ mbedtls_mpi *Y,
+ unsigned char swap)
+{
+ int ret = 0;
+ int s;
+ MPI_VALIDATE_RET(X != NULL);
+ MPI_VALIDATE_RET(Y != NULL);
+
+ if (X == Y) {
+ return 0;
+ }
+
+ mbedtls_ct_condition_t do_swap = mbedtls_ct_bool(swap);
+
+ MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_grow(Y, X->n));
+
+ s = X->s;
+ X->s = (int) mbedtls_ct_uint_if(do_swap, Y->s, X->s);
+ Y->s = (int) mbedtls_ct_uint_if(do_swap, s, Y->s);
+
+ mbedtls_mpi_core_cond_swap(X->p, Y->p, X->n, do_swap);
+
+cleanup:
+ return ret;
+}
+
/* Implementation that should never be optimized out by the compiler */
#define mbedtls_mpi_zeroize_and_free(v, n) mbedtls_zeroize_and_free(v, ciL * (n))
@@ -258,6 +384,10 @@
return (mbedtls_mpi_uint) 0 - (mbedtls_mpi_uint) z;
}
+/* Convert x to a sign, i.e. to 1, if x is positive, or -1, if x is negative.
+ * This looks awkward but generates smaller code than (x < 0 ? -1 : 1) */
+#define TO_SIGN(x) ((((mbedtls_mpi_uint) x) >> (biL - 1)) * -2 + 1)
+
/*
* Set value from integer
*/
@@ -270,7 +400,7 @@
memset(X->p, 0, X->n * ciL);
X->p[0] = mpi_sint_abs(z);
- X->s = (z < 0) ? -1 : 1;
+ X->s = TO_SIGN(z);
cleanup:
@@ -326,16 +456,35 @@
*/
size_t mbedtls_mpi_lsb(const mbedtls_mpi *X)
{
- size_t i, j, count = 0;
+ size_t i;
MBEDTLS_INTERNAL_VALIDATE_RET(X != NULL, 0);
+#if defined(__has_builtin)
+#if (MBEDTLS_MPI_UINT_MAX == UINT_MAX) && __has_builtin(__builtin_ctz)
+ #define mbedtls_mpi_uint_ctz __builtin_ctz
+#elif (MBEDTLS_MPI_UINT_MAX == ULONG_MAX) && __has_builtin(__builtin_ctzl)
+ #define mbedtls_mpi_uint_ctz __builtin_ctzl
+#elif (MBEDTLS_MPI_UINT_MAX == ULLONG_MAX) && __has_builtin(__builtin_ctzll)
+ #define mbedtls_mpi_uint_ctz __builtin_ctzll
+#endif
+#endif
+
+#if defined(mbedtls_mpi_uint_ctz)
for (i = 0; i < X->n; i++) {
- for (j = 0; j < biL; j++, count++) {
+ if (X->p[i] != 0) {
+ return i * biL + mbedtls_mpi_uint_ctz(X->p[i]);
+ }
+ }
+#else
+ size_t count = 0;
+ for (i = 0; i < X->n; i++) {
+ for (size_t j = 0; j < biL; j++, count++) {
if (((X->p[i] >> j) & 1) != 0) {
return count;
}
}
}
+#endif
return 0;
}
@@ -796,9 +945,8 @@
}
}
- if (i == 0 && j == 0) {
- return 0;
- }
+ /* If i == j == 0, i.e. abs(X) == abs(Y),
+ * we end up returning 0 at the end of the function. */
if (i > j) {
return 1;
@@ -880,7 +1028,7 @@
MPI_VALIDATE_RET(X != NULL);
*p = mpi_sint_abs(z);
- Y.s = (z < 0) ? -1 : 1;
+ Y.s = TO_SIGN(z);
Y.n = 1;
Y.p = p;
@@ -1068,7 +1216,7 @@
MPI_VALIDATE_RET(A != NULL);
p[0] = mpi_sint_abs(b);
- B.s = (b < 0) ? -1 : 1;
+ B.s = TO_SIGN(b);
B.n = 1;
B.p = p;
@@ -1086,7 +1234,7 @@
MPI_VALIDATE_RET(A != NULL);
p[0] = mpi_sint_abs(b);
- B.s = (b < 0) ? -1 : 1;
+ B.s = TO_SIGN(b);
B.n = 1;
B.p = p;
@@ -1436,7 +1584,7 @@
MPI_VALIDATE_RET(A != NULL);
p[0] = mpi_sint_abs(b);
- B.s = (b < 0) ? -1 : 1;
+ B.s = TO_SIGN(b);
B.n = 1;
B.p = p;
@@ -1602,10 +1750,8 @@
for (size_t i = 0; i < T_size; i++) {
MBEDTLS_MPI_CHK(mbedtls_mpi_safe_cond_assign(R, &T[i],
- (unsigned char) mbedtls_ct_size_bool_eq(i,
- idx)));
+ (unsigned char) mbedtls_ct_uint_eq(i, idx)));
}
-
cleanup:
return ret;
}
diff --git a/library/bignum_core.c b/library/bignum_core.c
index 8bf819c..48b640b 100644
--- a/library/bignum_core.c
+++ b/library/bignum_core.c
@@ -144,54 +144,92 @@
/* Whether min <= A, in constant time.
* A_limbs must be at least 1. */
-unsigned mbedtls_mpi_core_uint_le_mpi(mbedtls_mpi_uint min,
- const mbedtls_mpi_uint *A,
- size_t A_limbs)
+mbedtls_ct_condition_t mbedtls_mpi_core_uint_le_mpi(mbedtls_mpi_uint min,
+ const mbedtls_mpi_uint *A,
+ size_t A_limbs)
{
/* min <= least significant limb? */
- unsigned min_le_lsl = 1 ^ mbedtls_ct_mpi_uint_lt(A[0], min);
+ mbedtls_ct_condition_t min_le_lsl = mbedtls_ct_uint_ge(A[0], min);
/* limbs other than the least significant one are all zero? */
- mbedtls_mpi_uint msll_mask = 0;
+ mbedtls_ct_condition_t msll_mask = MBEDTLS_CT_FALSE;
for (size_t i = 1; i < A_limbs; i++) {
- msll_mask |= A[i];
+ msll_mask = mbedtls_ct_bool_or(msll_mask, mbedtls_ct_bool(A[i]));
}
- /* The most significant limbs of A are not all zero iff msll_mask != 0. */
- unsigned msll_nonzero = mbedtls_ct_mpi_uint_mask(msll_mask) & 1;
/* min <= A iff the lowest limb of A is >= min or the other limbs
* are not all zero. */
- return min_le_lsl | msll_nonzero;
+ return mbedtls_ct_bool_or(msll_mask, min_le_lsl);
+}
+
+mbedtls_ct_condition_t mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
+ const mbedtls_mpi_uint *B,
+ size_t limbs)
+{
+ mbedtls_ct_condition_t ret = MBEDTLS_CT_FALSE, cond = MBEDTLS_CT_FALSE, done = MBEDTLS_CT_FALSE;
+
+ for (size_t i = limbs; i > 0; i--) {
+ /*
+ * If B[i - 1] < A[i - 1] then A < B is false and the result must
+ * remain 0.
+ *
+ * Again even if we can make a decision, we just mark the result and
+ * the fact that we are done and continue looping.
+ */
+ cond = mbedtls_ct_uint_lt(B[i - 1], A[i - 1]);
+ done = mbedtls_ct_bool_or(done, cond);
+
+ /*
+ * If A[i - 1] < B[i - 1] then A < B is true.
+ *
+ * Again even if we can make a decision, we just mark the result and
+ * the fact that we are done and continue looping.
+ */
+ cond = mbedtls_ct_uint_lt(A[i - 1], B[i - 1]);
+ ret = mbedtls_ct_bool_or(ret, mbedtls_ct_bool_and(cond, mbedtls_ct_bool_not(done)));
+ done = mbedtls_ct_bool_or(done, cond);
+ }
+
+ /*
+ * If all the limbs were equal, then the numbers are equal, A < B is false
+ * and leaving the result 0 is correct.
+ */
+
+ return ret;
}
void mbedtls_mpi_core_cond_assign(mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
size_t limbs,
- unsigned char assign)
+ mbedtls_ct_condition_t assign)
{
if (X == A) {
return;
}
- mbedtls_ct_mpi_uint_cond_assign(limbs, X, A, assign);
+ /* This function is very performance-sensitive for RSA. For this reason
+ * we have the loop below, instead of calling mbedtls_ct_memcpy_if
+ * (this is more optimal since here we don't have to handle the case where
+ * we copy awkwardly sized data).
+ */
+ for (size_t i = 0; i < limbs; i++) {
+ X[i] = mbedtls_ct_mpi_uint_if(assign, A[i], X[i]);
+ }
}
void mbedtls_mpi_core_cond_swap(mbedtls_mpi_uint *X,
mbedtls_mpi_uint *Y,
size_t limbs,
- unsigned char swap)
+ mbedtls_ct_condition_t swap)
{
if (X == Y) {
return;
}
- /* all-bits 1 if swap is 1, all-bits 0 if swap is 0 */
- mbedtls_mpi_uint limb_mask = mbedtls_ct_mpi_uint_mask(swap);
-
for (size_t i = 0; i < limbs; i++) {
mbedtls_mpi_uint tmp = X[i];
- X[i] = (X[i] & ~limb_mask) | (Y[i] & limb_mask);
- Y[i] = (Y[i] & ~limb_mask) | (tmp & limb_mask);
+ X[i] = mbedtls_ct_mpi_uint_if(swap, Y[i], X[i]);
+ Y[i] = mbedtls_ct_mpi_uint_if(swap, tmp, Y[i]);
}
}
@@ -422,11 +460,10 @@
{
mbedtls_mpi_uint c = 0;
- /* all-bits 0 if cond is 0, all-bits 1 if cond is non-0 */
- const mbedtls_mpi_uint mask = mbedtls_ct_mpi_uint_mask(cond);
+ mbedtls_ct_condition_t do_add = mbedtls_ct_bool(cond);
for (size_t i = 0; i < limbs; i++) {
- mbedtls_mpi_uint add = mask & A[i];
+ mbedtls_mpi_uint add = mbedtls_ct_mpi_uint_if_else_0(do_add, A[i]);
mbedtls_mpi_uint t = c + X[i];
c = (t < X[i]);
t += add;
@@ -568,7 +605,11 @@
* So the correct return value is already in X if (carry ^ borrow) = 0,
* but is in (the lower AN_limbs limbs of) T if (carry ^ borrow) = 1.
*/
- mbedtls_ct_mpi_uint_cond_assign(AN_limbs, X, T, (unsigned char) (carry ^ borrow));
+ mbedtls_ct_memcpy_if(mbedtls_ct_bool(carry ^ borrow),
+ (unsigned char *) X,
+ (unsigned char *) T,
+ NULL,
+ AN_limbs * sizeof(mbedtls_mpi_uint));
}
int mbedtls_mpi_core_get_mont_r2_unsafe(mbedtls_mpi *X,
@@ -593,7 +634,7 @@
size_t index)
{
for (size_t i = 0; i < count; i++, table += limbs) {
- unsigned char assign = mbedtls_ct_size_bool_eq(i, index);
+ mbedtls_ct_condition_t assign = mbedtls_ct_uint_eq(i, index);
mbedtls_mpi_core_cond_assign(dest, table, limbs, assign);
}
}
@@ -633,7 +674,7 @@
int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng)
{
- unsigned ge_lower = 1, lt_upper = 0;
+ mbedtls_ct_condition_t ge_lower = MBEDTLS_CT_TRUE, lt_upper = MBEDTLS_CT_FALSE;
size_t n_bits = mbedtls_mpi_core_bitlen(N, limbs);
size_t n_bytes = (n_bits + 7) / 8;
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
@@ -678,7 +719,7 @@
ge_lower = mbedtls_mpi_core_uint_le_mpi(min, X, limbs);
lt_upper = mbedtls_mpi_core_lt_ct(X, N, limbs);
- } while (ge_lower == 0 || lt_upper == 0);
+ } while (mbedtls_ct_bool_and(ge_lower, lt_upper) == MBEDTLS_CT_FALSE);
cleanup:
return ret;
@@ -686,16 +727,16 @@
static size_t exp_mod_get_window_size(size_t Ebits)
{
- size_t wsize = (Ebits > 671) ? 6 : (Ebits > 239) ? 5 :
- (Ebits > 79) ? 4 : 1;
-
-#if (MBEDTLS_MPI_WINDOW_SIZE < 6)
- if (wsize > MBEDTLS_MPI_WINDOW_SIZE) {
- wsize = MBEDTLS_MPI_WINDOW_SIZE;
- }
+#if MBEDTLS_MPI_WINDOW_SIZE >= 6
+ return (Ebits > 671) ? 6 : (Ebits > 239) ? 5 : (Ebits > 79) ? 4 : 1;
+#elif MBEDTLS_MPI_WINDOW_SIZE == 5
+ return (Ebits > 239) ? 5 : (Ebits > 79) ? 4 : 1;
+#elif MBEDTLS_MPI_WINDOW_SIZE > 1
+ return (Ebits > 79) ? MBEDTLS_MPI_WINDOW_SIZE : 1;
+#else
+ (void) Ebits;
+ return 1;
#endif
-
- return wsize;
}
size_t mbedtls_mpi_core_exp_mod_working_limbs(size_t AN_limbs, size_t E_limbs)
diff --git a/library/bignum_core.h b/library/bignum_core.h
index 21a5a11..e5500f1 100644
--- a/library/bignum_core.h
+++ b/library/bignum_core.h
@@ -86,6 +86,8 @@
#include "mbedtls/bignum.h"
#endif
+#include "constant_time_internal.h"
+
#define ciL (sizeof(mbedtls_mpi_uint)) /** chars in limb */
#define biL (ciL << 3) /** bits in limb */
#define biH (ciL << 2) /** half limb size */
@@ -142,11 +144,29 @@
* \param A_limbs The number of limbs of \p A.
* This must be at least 1.
*
- * \return 1 if \p min is less than or equal to \p A, otherwise 0.
+ * \return MBEDTLS_CT_TRUE if \p min is less than or equal to \p A, otherwise MBEDTLS_CT_FALSE.
*/
-unsigned mbedtls_mpi_core_uint_le_mpi(mbedtls_mpi_uint min,
- const mbedtls_mpi_uint *A,
- size_t A_limbs);
+mbedtls_ct_condition_t mbedtls_mpi_core_uint_le_mpi(mbedtls_mpi_uint min,
+ const mbedtls_mpi_uint *A,
+ size_t A_limbs);
+
+/**
+ * \brief Check if one unsigned MPI is less than another in constant
+ * time.
+ *
+ * \param A The left-hand MPI. This must point to an array of limbs
+ * with the same allocated length as \p B.
+ * \param B The right-hand MPI. This must point to an array of limbs
+ * with the same allocated length as \p A.
+ * \param limbs The number of limbs in \p A and \p B.
+ * This must not be 0.
+ *
+ * \return MBEDTLS_CT_TRUE if \p A is less than \p B.
+ * MBEDTLS_CT_FALSE if \p A is greater than or equal to \p B.
+ */
+mbedtls_ct_condition_t mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
+ const mbedtls_mpi_uint *B,
+ size_t limbs);
/**
* \brief Perform a safe conditional copy of an MPI which doesn't reveal
@@ -158,21 +178,17 @@
* \param[in] A The address of the source MPI. This must be initialized.
* \param limbs The number of limbs of \p A.
* \param assign The condition deciding whether to perform the
- * assignment or not. Must be either 0 or 1:
- * * \c 1: Perform the assignment `X = A`.
- * * \c 0: Keep the original value of \p X.
+ * assignment or not. Callers will need to use
+ * the constant time interface (e.g. `mbedtls_ct_bool()`)
+ * to construct this argument.
*
* \note This function avoids leaking any information about whether
* the assignment was done or not.
- *
- * \warning If \p assign is neither 0 nor 1, the result of this function
- * is indeterminate, and the resulting value in \p X might be
- * neither its original value nor the value in \p A.
*/
void mbedtls_mpi_core_cond_assign(mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
size_t limbs,
- unsigned char assign);
+ mbedtls_ct_condition_t assign);
/**
* \brief Perform a safe conditional swap of two MPIs which doesn't reveal
@@ -184,21 +200,15 @@
* This must be initialized.
* \param limbs The number of limbs of \p X and \p Y.
* \param swap The condition deciding whether to perform
- * the swap or not. Must be either 0 or 1:
- * * \c 1: Swap the values of \p X and \p Y.
- * * \c 0: Keep the original values of \p X and \p Y.
+ * the swap or not.
*
* \note This function avoids leaking any information about whether
* the swap was done or not.
- *
- * \warning If \p swap is neither 0 nor 1, the result of this function
- * is indeterminate, and both \p X and \p Y might end up with
- * values different to either of the original ones.
*/
void mbedtls_mpi_core_cond_swap(mbedtls_mpi_uint *X,
mbedtls_mpi_uint *Y,
size_t limbs,
- unsigned char swap);
+ mbedtls_ct_condition_t swap);
/** Import X from unsigned binary data, little-endian.
*
diff --git a/library/bignum_mod_raw.c b/library/bignum_mod_raw.c
index eff5627..75cf8c4 100644
--- a/library/bignum_mod_raw.c
+++ b/library/bignum_mod_raw.c
@@ -40,7 +40,7 @@
const mbedtls_mpi_mod_modulus *N,
unsigned char assign)
{
- mbedtls_mpi_core_cond_assign(X, A, N->limbs, assign);
+ mbedtls_mpi_core_cond_assign(X, A, N->limbs, mbedtls_ct_bool(assign));
}
void mbedtls_mpi_mod_raw_cond_swap(mbedtls_mpi_uint *X,
@@ -48,7 +48,7 @@
const mbedtls_mpi_mod_modulus *N,
unsigned char swap)
{
- mbedtls_mpi_core_cond_swap(X, Y, N->limbs, swap);
+ mbedtls_mpi_core_cond_swap(X, Y, N->limbs, mbedtls_ct_bool(swap));
}
int mbedtls_mpi_mod_raw_read(mbedtls_mpi_uint *X,
diff --git a/library/constant_time.c b/library/constant_time.c
index 5265005..86cc066 100644
--- a/library/constant_time.c
+++ b/library/constant_time.c
@@ -22,28 +22,15 @@
* might be translated to branches by some compilers on some platforms.
*/
+#include <limits.h>
+
#include "common.h"
#include "constant_time_internal.h"
#include "mbedtls/constant_time.h"
#include "mbedtls/error.h"
#include "mbedtls/platform_util.h"
-#if defined(MBEDTLS_BIGNUM_C)
-#include "mbedtls/bignum.h"
-#include "bignum_core.h"
-#endif
-
-#if defined(MBEDTLS_SSL_TLS_C)
-#include "ssl_misc.h"
-#endif
-
-#if defined(MBEDTLS_RSA_C)
-#include "mbedtls/rsa.h"
-#endif
-
-#if defined(MBEDTLS_BASE64_C)
-#include "constant_time_invasive.h"
-#endif
+#include "../tests/include/test/constant_flow.h"
#include <string.h>
@@ -60,6 +47,15 @@
#define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status)
#endif
+#if !defined(MBEDTLS_CT_ASM)
+/*
+ * Define an object with the value zero, such that the compiler cannot prove that it
+ * has the value zero (because it is volatile, it "may be modified in ways unknown to
+ * the implementation").
+ */
+volatile mbedtls_ct_uint_t mbedtls_ct_zero = 0;
+#endif
+
/*
* Define MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS where assembly is present to
* perform fast unaligned access to volatile data.
@@ -70,15 +66,12 @@
* Some of these definitions could be moved into alignment.h but for now they are
* only used here.
*/
-#if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS) && defined(MBEDTLS_HAVE_ASM)
-#if ((defined(__arm__) || defined(__thumb__) || defined(__thumb2__)) && \
- (UINTPTR_MAX == 0xfffffffful)) || defined(__aarch64__)
+#if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS) && \
+ ((defined(MBEDTLS_CT_ARM_ASM) && (UINTPTR_MAX == 0xfffffffful)) || \
+ defined(MBEDTLS_CT_AARCH64_ASM))
/* We check pointer sizes to avoid issues with them not matching register size requirements */
#define MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS
-#endif
-#endif
-#if defined(MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS)
static inline uint32_t mbedtls_get_unaligned_volatile_uint32(volatile const unsigned char *p)
{
/* This is UB, even where it's safe:
@@ -86,14 +79,17 @@
* so instead the same thing is expressed in assembly below.
*/
uint32_t r;
-#if defined(__arm__) || defined(__thumb__) || defined(__thumb2__)
+#if defined(MBEDTLS_CT_ARM_ASM)
asm volatile ("ldr %0, [%1]" : "=r" (r) : "r" (p) :);
-#elif defined(__aarch64__)
+#elif defined(MBEDTLS_CT_AARCH64_ASM)
asm volatile ("ldr %w0, [%1]" : "=r" (r) : MBEDTLS_ASM_AARCH64_PTR_CONSTRAINT(p) :);
+#else
+#error No assembly defined for mbedtls_get_unaligned_volatile_uint32
#endif
return r;
}
-#endif /* MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS */
+#endif /* defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS) &&
+ (defined(MBEDTLS_CT_ARM_ASM) || defined(MBEDTLS_CT_AARCH64_ASM)) */
int mbedtls_ct_memcmp(const void *a,
const void *b,
@@ -129,336 +125,56 @@
return (int) diff;
}
-unsigned mbedtls_ct_uint_mask(unsigned value)
-{
- /* MSVC has a warning about unary minus on unsigned, but this is
- * well-defined and precisely what we want to do here */
-#if defined(_MSC_VER)
-#pragma warning( push )
-#pragma warning( disable : 4146 )
-#endif
- return -((value | -value) >> (sizeof(value) * 8 - 1));
-#if defined(_MSC_VER)
-#pragma warning( pop )
-#endif
-}
-
-#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
-
-size_t mbedtls_ct_size_mask(size_t value)
-{
- /* MSVC has a warning about unary minus on unsigned integer types,
- * but this is well-defined and precisely what we want to do here. */
-#if defined(_MSC_VER)
-#pragma warning( push )
-#pragma warning( disable : 4146 )
-#endif
- return -((value | -value) >> (sizeof(value) * 8 - 1));
-#if defined(_MSC_VER)
-#pragma warning( pop )
-#endif
-}
-
-#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
-
-#if defined(MBEDTLS_BIGNUM_C)
-
-mbedtls_mpi_uint mbedtls_ct_mpi_uint_mask(mbedtls_mpi_uint value)
-{
- /* MSVC has a warning about unary minus on unsigned, but this is
- * well-defined and precisely what we want to do here */
-#if defined(_MSC_VER)
-#pragma warning( push )
-#pragma warning( disable : 4146 )
-#endif
- return -((value | -value) >> (sizeof(value) * 8 - 1));
-#if defined(_MSC_VER)
-#pragma warning( pop )
-#endif
-}
-
-#endif /* MBEDTLS_BIGNUM_C */
-
-#if defined(MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC)
-
-/** Constant-flow mask generation for "less than" comparison:
- * - if \p x < \p y, return all-bits 1, that is (size_t) -1
- * - otherwise, return all bits 0, that is 0
- *
- * This function can be used to write constant-time code by replacing branches
- * with bit operations using masks.
- *
- * \param x The first value to analyze.
- * \param y The second value to analyze.
- *
- * \return All-bits-one if \p x is less than \p y, otherwise zero.
- */
-static size_t mbedtls_ct_size_mask_lt(size_t x,
- size_t y)
-{
- /* This has the most significant bit set if and only if x < y */
- const size_t sub = x - y;
-
- /* sub1 = (x < y) ? 1 : 0 */
- const size_t sub1 = sub >> (sizeof(sub) * 8 - 1);
-
- /* mask = (x < y) ? 0xff... : 0x00... */
- const size_t mask = mbedtls_ct_size_mask(sub1);
-
- return mask;
-}
-
-size_t mbedtls_ct_size_mask_ge(size_t x,
- size_t y)
-{
- return ~mbedtls_ct_size_mask_lt(x, y);
-}
-
-#endif /* MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC */
-
-#if defined(MBEDTLS_BASE64_C)
-
-/* Return 0xff if low <= c <= high, 0 otherwise.
- *
- * Constant flow with respect to c.
- */
-MBEDTLS_STATIC_TESTABLE
-unsigned char mbedtls_ct_uchar_mask_of_range(unsigned char low,
- unsigned char high,
- unsigned char c)
-{
- /* low_mask is: 0 if low <= c, 0x...ff if low > c */
- unsigned low_mask = ((unsigned) c - low) >> 8;
- /* high_mask is: 0 if c <= high, 0x...ff if c > high */
- unsigned high_mask = ((unsigned) high - c) >> 8;
- return ~(low_mask | high_mask) & 0xff;
-}
-
-#endif /* MBEDTLS_BASE64_C */
-
-unsigned mbedtls_ct_size_bool_eq(size_t x,
- size_t y)
-{
- /* diff = 0 if x == y, non-zero otherwise */
- const size_t diff = x ^ y;
-
- /* MSVC has a warning about unary minus on unsigned integer types,
- * but this is well-defined and precisely what we want to do here. */
-#if defined(_MSC_VER)
-#pragma warning( push )
-#pragma warning( disable : 4146 )
-#endif
-
- /* diff_msb's most significant bit is equal to x != y */
- const size_t diff_msb = (diff | (size_t) -diff);
-
-#if defined(_MSC_VER)
-#pragma warning( pop )
-#endif
-
- /* diff1 = (x != y) ? 1 : 0 */
- const unsigned diff1 = diff_msb >> (sizeof(diff_msb) * 8 - 1);
-
- return 1 ^ diff1;
-}
-
#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)
-/** Constant-flow "greater than" comparison:
- * return x > y
- *
- * This is equivalent to \p x > \p y, but is likely to be compiled
- * to code using bitwise operation rather than a branch.
- *
- * \param x The first value to analyze.
- * \param y The second value to analyze.
- *
- * \return 1 if \p x greater than \p y, otherwise 0.
- */
-static unsigned mbedtls_ct_size_gt(size_t x,
- size_t y)
-{
- /* Return the sign bit (1 for negative) of (y - x). */
- return (y - x) >> (sizeof(size_t) * 8 - 1);
-}
-
-#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */
-
-#if defined(MBEDTLS_BIGNUM_C)
-
-unsigned mbedtls_ct_mpi_uint_lt(const mbedtls_mpi_uint x,
- const mbedtls_mpi_uint y)
-{
- mbedtls_mpi_uint ret;
- mbedtls_mpi_uint cond;
-
- /*
- * Check if the most significant bits (MSB) of the operands are different.
- */
- cond = (x ^ y);
- /*
- * If the MSB are the same then the difference x-y will be negative (and
- * have its MSB set to 1 during conversion to unsigned) if and only if x<y.
- */
- ret = (x - y) & ~cond;
- /*
- * If the MSB are different, then the operand with the MSB of 1 is the
- * bigger. (That is if y has MSB of 1, then x<y is true and it is false if
- * the MSB of y is 0.)
- */
- ret |= y & cond;
-
-
- ret = ret >> (sizeof(mbedtls_mpi_uint) * 8 - 1);
-
- return (unsigned) ret;
-}
-
-#endif /* MBEDTLS_BIGNUM_C */
-
-unsigned mbedtls_ct_uint_if(unsigned condition,
- unsigned if1,
- unsigned if0)
-{
- unsigned mask = mbedtls_ct_uint_mask(condition);
- return (mask & if1) | (~mask & if0);
-}
-
-#if defined(MBEDTLS_BIGNUM_C)
-
-void mbedtls_ct_mpi_uint_cond_assign(size_t n,
- mbedtls_mpi_uint *dest,
- const mbedtls_mpi_uint *src,
- unsigned char condition)
-{
- size_t i;
-
- /* MSVC has a warning about unary minus on unsigned integer types,
- * but this is well-defined and precisely what we want to do here. */
-#if defined(_MSC_VER)
-#pragma warning( push )
-#pragma warning( disable : 4146 )
-#endif
-
- /* all-bits 1 if condition is 1, all-bits 0 if condition is 0 */
- const mbedtls_mpi_uint mask = -condition;
-
-#if defined(_MSC_VER)
-#pragma warning( pop )
-#endif
-
- for (i = 0; i < n; i++) {
- dest[i] = (src[i] & mask) | (dest[i] & ~mask);
- }
-}
-
-#endif /* MBEDTLS_BIGNUM_C */
-
-#if defined(MBEDTLS_BASE64_C)
-
-unsigned char mbedtls_ct_base64_enc_char(unsigned char value)
-{
- unsigned char digit = 0;
- /* For each range of values, if value is in that range, mask digit with
- * the corresponding value. Since value can only be in a single range,
- * only at most one masking will change digit. */
- digit |= mbedtls_ct_uchar_mask_of_range(0, 25, value) & ('A' + value);
- digit |= mbedtls_ct_uchar_mask_of_range(26, 51, value) & ('a' + value - 26);
- digit |= mbedtls_ct_uchar_mask_of_range(52, 61, value) & ('0' + value - 52);
- digit |= mbedtls_ct_uchar_mask_of_range(62, 62, value) & '+';
- digit |= mbedtls_ct_uchar_mask_of_range(63, 63, value) & '/';
- return digit;
-}
-
-signed char mbedtls_ct_base64_dec_value(unsigned char c)
-{
- unsigned char val = 0;
- /* For each range of digits, if c is in that range, mask val with
- * the corresponding value. Since c can only be in a single range,
- * only at most one masking will change val. Set val to one plus
- * the desired value so that it stays 0 if c is in none of the ranges. */
- val |= mbedtls_ct_uchar_mask_of_range('A', 'Z', c) & (c - 'A' + 0 + 1);
- val |= mbedtls_ct_uchar_mask_of_range('a', 'z', c) & (c - 'a' + 26 + 1);
- val |= mbedtls_ct_uchar_mask_of_range('0', '9', c) & (c - '0' + 52 + 1);
- val |= mbedtls_ct_uchar_mask_of_range('+', '+', c) & (c - '+' + 62 + 1);
- val |= mbedtls_ct_uchar_mask_of_range('/', '/', c) & (c - '/' + 63 + 1);
- /* At this point, val is 0 if c is an invalid digit and v+1 if c is
- * a digit with the value v. */
- return val - 1;
-}
-
-#endif /* MBEDTLS_BASE64_C */
-
-#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)
-
-/** Shift some data towards the left inside a buffer.
- *
- * `mbedtls_ct_mem_move_to_left(start, total, offset)` is functionally
- * equivalent to
- * ```
- * memmove(start, start + offset, total - offset);
- * memset(start + offset, 0, total - offset);
- * ```
- * but it strives to use a memory access pattern (and thus total timing)
- * that does not depend on \p offset. This timing independence comes at
- * the expense of performance.
- *
- * \param start Pointer to the start of the buffer.
- * \param total Total size of the buffer.
- * \param offset Offset from which to copy \p total - \p offset bytes.
- */
-static void mbedtls_ct_mem_move_to_left(void *start,
- size_t total,
- size_t offset)
+void mbedtls_ct_memmove_left(void *start, size_t total, size_t offset)
{
volatile unsigned char *buf = start;
- size_t i, n;
- if (total == 0) {
- return;
- }
- for (i = 0; i < total; i++) {
- unsigned no_op = mbedtls_ct_size_gt(total - offset, i);
+ for (size_t i = 0; i < total; i++) {
+ mbedtls_ct_condition_t no_op = mbedtls_ct_uint_gt(total - offset, i);
/* The first `total - offset` passes are a no-op. The last
* `offset` passes shift the data one byte to the left and
* zero out the last byte. */
- for (n = 0; n < total - 1; n++) {
+ for (size_t n = 0; n < total - 1; n++) {
unsigned char current = buf[n];
- unsigned char next = buf[n+1];
+ unsigned char next = buf[n+1];
buf[n] = mbedtls_ct_uint_if(no_op, current, next);
}
- buf[total-1] = mbedtls_ct_uint_if(no_op, buf[total-1], 0);
+ buf[total-1] = mbedtls_ct_uint_if_else_0(no_op, buf[total-1]);
}
}
#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */
-#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
-
-void mbedtls_ct_memcpy_if_eq(unsigned char *dest,
- const unsigned char *src,
- size_t len,
- size_t c1,
- size_t c2)
+void mbedtls_ct_memcpy_if(mbedtls_ct_condition_t condition,
+ unsigned char *dest,
+ const unsigned char *src1,
+ const unsigned char *src2,
+ size_t len)
{
- /* mask = c1 == c2 ? 0xff : 0x00 */
- const size_t equal = mbedtls_ct_size_bool_eq(c1, c2);
+ const uint32_t mask = (uint32_t) condition;
+ const uint32_t not_mask = (uint32_t) ~mbedtls_ct_compiler_opaque(condition);
+
+ /* If src2 is NULL, setup src2 so that we read from the destination address.
+ *
+ * This means that if src2 == NULL && condition is false, the result will be a
+ * no-op because we read from dest and write the same data back into dest.
+ */
+ if (src2 == NULL) {
+ src2 = dest;
+ }
/* dest[i] = c1 == c2 ? src[i] : dest[i] */
size_t i = 0;
#if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS)
- const uint32_t mask32 = (uint32_t) mbedtls_ct_size_mask(equal);
- const unsigned char mask = (unsigned char) mask32 & 0xff;
-
for (; (i + 4) <= len; i += 4) {
- uint32_t a = mbedtls_get_unaligned_uint32(src + i) & mask32;
- uint32_t b = mbedtls_get_unaligned_uint32(dest + i) & ~mask32;
+ uint32_t a = mbedtls_get_unaligned_uint32(src1 + i) & mask;
+ uint32_t b = mbedtls_get_unaligned_uint32(src2 + i) & not_mask;
mbedtls_put_unaligned_uint32(dest + i, a | b);
}
-#else
- const unsigned char mask = (unsigned char) mbedtls_ct_size_mask(equal);
#endif /* MBEDTLS_EFFICIENT_UNALIGNED_ACCESS */
for (; i < len; i++) {
- dest[i] = (src[i] & mask) | (dest[i] & ~mask);
+ dest[i] = (src1[i] & mask) | (src2[i] & not_mask);
}
}
@@ -472,547 +188,27 @@
size_t offsetval;
for (offsetval = offset_min; offsetval <= offset_max; offsetval++) {
- mbedtls_ct_memcpy_if_eq(dest, src + offsetval, len,
- offsetval, offset);
+ mbedtls_ct_memcpy_if(mbedtls_ct_uint_eq(offsetval, offset), dest, src + offsetval, NULL,
+ len);
}
}
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-
-#if defined(PSA_WANT_ALG_SHA_384)
-#define MAX_HASH_BLOCK_LENGTH PSA_HASH_BLOCK_LENGTH(PSA_ALG_SHA_384)
-#elif defined(PSA_WANT_ALG_SHA_256)
-#define MAX_HASH_BLOCK_LENGTH PSA_HASH_BLOCK_LENGTH(PSA_ALG_SHA_256)
-#else /* See check_config.h */
-#define MAX_HASH_BLOCK_LENGTH PSA_HASH_BLOCK_LENGTH(PSA_ALG_SHA_1)
-#endif
-
-int mbedtls_ct_hmac(mbedtls_svc_key_id_t key,
- psa_algorithm_t mac_alg,
- const unsigned char *add_data,
- size_t add_data_len,
- const unsigned char *data,
- size_t data_len_secret,
- size_t min_data_len,
- size_t max_data_len,
- unsigned char *output)
-{
- /*
- * This function breaks the HMAC abstraction and uses psa_hash_clone()
- * extension in order to get constant-flow behaviour.
- *
- * HMAC(msg) is defined as HASH(okey + HASH(ikey + msg)) where + means
- * concatenation, and okey/ikey are the XOR of the key with some fixed bit
- * patterns (see RFC 2104, sec. 2).
- *
- * We'll first compute ikey/okey, then inner_hash = HASH(ikey + msg) by
- * hashing up to minlen, then cloning the context, and for each byte up
- * to maxlen finishing up the hash computation, keeping only the
- * correct result.
- *
- * Then we only need to compute HASH(okey + inner_hash) and we're done.
- */
- psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH(mac_alg);
- const size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg);
- unsigned char key_buf[MAX_HASH_BLOCK_LENGTH];
- const size_t hash_size = PSA_HASH_LENGTH(hash_alg);
- psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
- size_t hash_length;
-
- unsigned char aux_out[PSA_HASH_MAX_SIZE];
- psa_hash_operation_t aux_operation = PSA_HASH_OPERATION_INIT;
- size_t offset;
- psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
-
- size_t mac_key_length;
- size_t i;
-
-#define PSA_CHK(func_call) \
- do { \
- status = (func_call); \
- if (status != PSA_SUCCESS) \
- goto cleanup; \
- } while (0)
-
- /* Export MAC key
- * We assume key length is always exactly the output size
- * which is never more than the block size, thus we use block_size
- * as the key buffer size.
- */
- PSA_CHK(psa_export_key(key, key_buf, block_size, &mac_key_length));
-
- /* Calculate ikey */
- for (i = 0; i < mac_key_length; i++) {
- key_buf[i] = (unsigned char) (key_buf[i] ^ 0x36);
- }
- for (; i < block_size; ++i) {
- key_buf[i] = 0x36;
- }
-
- PSA_CHK(psa_hash_setup(&operation, hash_alg));
-
- /* Now compute inner_hash = HASH(ikey + msg) */
- PSA_CHK(psa_hash_update(&operation, key_buf, block_size));
- PSA_CHK(psa_hash_update(&operation, add_data, add_data_len));
- PSA_CHK(psa_hash_update(&operation, data, min_data_len));
-
- /* Fill the hash buffer in advance with something that is
- * not a valid hash (barring an attack on the hash and
- * deliberately-crafted input), in case the caller doesn't
- * check the return status properly. */
- memset(output, '!', hash_size);
-
- /* For each possible length, compute the hash up to that point */
- for (offset = min_data_len; offset <= max_data_len; offset++) {
- PSA_CHK(psa_hash_clone(&operation, &aux_operation));
- PSA_CHK(psa_hash_finish(&aux_operation, aux_out,
- PSA_HASH_MAX_SIZE, &hash_length));
- /* Keep only the correct inner_hash in the output buffer */
- mbedtls_ct_memcpy_if_eq(output, aux_out, hash_size,
- offset, data_len_secret);
-
- if (offset < max_data_len) {
- PSA_CHK(psa_hash_update(&operation, data + offset, 1));
- }
- }
-
- /* Abort current operation to prepare for final operation */
- PSA_CHK(psa_hash_abort(&operation));
-
- /* Calculate okey */
- for (i = 0; i < mac_key_length; i++) {
- key_buf[i] = (unsigned char) ((key_buf[i] ^ 0x36) ^ 0x5C);
- }
- for (; i < block_size; ++i) {
- key_buf[i] = 0x5C;
- }
-
- /* Now compute HASH(okey + inner_hash) */
- PSA_CHK(psa_hash_setup(&operation, hash_alg));
- PSA_CHK(psa_hash_update(&operation, key_buf, block_size));
- PSA_CHK(psa_hash_update(&operation, output, hash_size));
- PSA_CHK(psa_hash_finish(&operation, output, hash_size, &hash_length));
-
-#undef PSA_CHK
-
-cleanup:
- mbedtls_platform_zeroize(key_buf, MAX_HASH_BLOCK_LENGTH);
- mbedtls_platform_zeroize(aux_out, PSA_HASH_MAX_SIZE);
-
- psa_hash_abort(&operation);
- psa_hash_abort(&aux_operation);
- return PSA_TO_MBEDTLS_ERR(status);
-}
-
-#undef MAX_HASH_BLOCK_LENGTH
-
-#else
-int mbedtls_ct_hmac(mbedtls_md_context_t *ctx,
- const unsigned char *add_data,
- size_t add_data_len,
- const unsigned char *data,
- size_t data_len_secret,
- size_t min_data_len,
- size_t max_data_len,
- unsigned char *output)
-{
- /*
- * This function breaks the HMAC abstraction and uses the md_clone()
- * extension to the MD API in order to get constant-flow behaviour.
- *
- * HMAC(msg) is defined as HASH(okey + HASH(ikey + msg)) where + means
- * concatenation, and okey/ikey are the XOR of the key with some fixed bit
- * patterns (see RFC 2104, sec. 2), which are stored in ctx->hmac_ctx.
- *
- * We'll first compute inner_hash = HASH(ikey + msg) by hashing up to
- * minlen, then cloning the context, and for each byte up to maxlen
- * finishing up the hash computation, keeping only the correct result.
- *
- * Then we only need to compute HASH(okey + inner_hash) and we're done.
- */
- const mbedtls_md_type_t md_alg = mbedtls_md_get_type(ctx->md_info);
- /* TLS 1.2 only supports SHA-384, SHA-256, SHA-1, MD-5,
- * all of which have the same block size except SHA-384. */
- const size_t block_size = md_alg == MBEDTLS_MD_SHA384 ? 128 : 64;
- const unsigned char * const ikey = ctx->hmac_ctx;
- const unsigned char * const okey = ikey + block_size;
- const size_t hash_size = mbedtls_md_get_size(ctx->md_info);
-
- unsigned char aux_out[MBEDTLS_MD_MAX_SIZE];
- mbedtls_md_context_t aux;
- size_t offset;
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-
- mbedtls_md_init(&aux);
-
-#define MD_CHK(func_call) \
- do { \
- ret = (func_call); \
- if (ret != 0) \
- goto cleanup; \
- } while (0)
-
- MD_CHK(mbedtls_md_setup(&aux, ctx->md_info, 0));
-
- /* After hmac_start() of hmac_reset(), ikey has already been hashed,
- * so we can start directly with the message */
- MD_CHK(mbedtls_md_update(ctx, add_data, add_data_len));
- MD_CHK(mbedtls_md_update(ctx, data, min_data_len));
-
- /* Fill the hash buffer in advance with something that is
- * not a valid hash (barring an attack on the hash and
- * deliberately-crafted input), in case the caller doesn't
- * check the return status properly. */
- memset(output, '!', hash_size);
-
- /* For each possible length, compute the hash up to that point */
- for (offset = min_data_len; offset <= max_data_len; offset++) {
- MD_CHK(mbedtls_md_clone(&aux, ctx));
- MD_CHK(mbedtls_md_finish(&aux, aux_out));
- /* Keep only the correct inner_hash in the output buffer */
- mbedtls_ct_memcpy_if_eq(output, aux_out, hash_size,
- offset, data_len_secret);
-
- if (offset < max_data_len) {
- MD_CHK(mbedtls_md_update(ctx, data + offset, 1));
- }
- }
-
- /* The context needs to finish() before it starts() again */
- MD_CHK(mbedtls_md_finish(ctx, aux_out));
-
- /* Now compute HASH(okey + inner_hash) */
- MD_CHK(mbedtls_md_starts(ctx));
- MD_CHK(mbedtls_md_update(ctx, okey, block_size));
- MD_CHK(mbedtls_md_update(ctx, output, hash_size));
- MD_CHK(mbedtls_md_finish(ctx, output));
-
- /* Done, get ready for next time */
- MD_CHK(mbedtls_md_hmac_reset(ctx));
-
-#undef MD_CHK
-
-cleanup:
- mbedtls_md_free(&aux);
- return ret;
-}
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
-#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
-
-#if defined(MBEDTLS_BIGNUM_C)
-
-#define MPI_VALIDATE_RET(cond) \
- MBEDTLS_INTERNAL_VALIDATE_RET(cond, MBEDTLS_ERR_MPI_BAD_INPUT_DATA)
-
-/*
- * Conditionally assign X = Y, without leaking information
- * about whether the assignment was made or not.
- * (Leaking information about the respective sizes of X and Y is ok however.)
- */
-#if defined(_MSC_VER) && defined(_M_ARM64) && (_MSC_FULL_VER < 193131103)
-/*
- * MSVC miscompiles this function if it's inlined prior to Visual Studio 2022 version 17.1. See:
- * https://developercommunity.visualstudio.com/t/c-compiler-miscompiles-part-of-mbedtls-library-on/1646989
- */
-__declspec(noinline)
-#endif
-int mbedtls_mpi_safe_cond_assign(mbedtls_mpi *X,
- const mbedtls_mpi *Y,
- unsigned char assign)
-{
- int ret = 0;
- MPI_VALIDATE_RET(X != NULL);
- MPI_VALIDATE_RET(Y != NULL);
-
- /* all-bits 1 if assign is 1, all-bits 0 if assign is 0 */
- mbedtls_mpi_uint limb_mask = mbedtls_ct_mpi_uint_mask(assign);
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
-
- X->s = (int) mbedtls_ct_uint_if(assign, Y->s, X->s);
-
- mbedtls_mpi_core_cond_assign(X->p, Y->p, Y->n, assign);
-
- for (size_t i = Y->n; i < X->n; i++) {
- X->p[i] &= ~limb_mask;
- }
-
-cleanup:
- return ret;
-}
-
-/*
- * Conditionally swap X and Y, without leaking information
- * about whether the swap was made or not.
- * Here it is not ok to simply swap the pointers, which would lead to
- * different memory access patterns when X and Y are used afterwards.
- */
-int mbedtls_mpi_safe_cond_swap(mbedtls_mpi *X,
- mbedtls_mpi *Y,
- unsigned char swap)
-{
- int ret = 0;
- int s;
- MPI_VALIDATE_RET(X != NULL);
- MPI_VALIDATE_RET(Y != NULL);
-
- if (X == Y) {
- return 0;
- }
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(Y, X->n));
-
- s = X->s;
- X->s = (int) mbedtls_ct_uint_if(swap, Y->s, X->s);
- Y->s = (int) mbedtls_ct_uint_if(swap, s, Y->s);
-
- mbedtls_mpi_core_cond_swap(X->p, Y->p, X->n, swap);
-
-cleanup:
- return ret;
-}
-
-/*
- * Compare unsigned values in constant time
- */
-unsigned mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
- const mbedtls_mpi_uint *B,
- size_t limbs)
-{
- unsigned ret, cond, done;
-
- /* The value of any of these variables is either 0 or 1 for the rest of
- * their scope. */
- ret = cond = done = 0;
-
- for (size_t i = limbs; i > 0; i--) {
- /*
- * If B[i - 1] < A[i - 1] then A < B is false and the result must
- * remain 0.
- *
- * Again even if we can make a decision, we just mark the result and
- * the fact that we are done and continue looping.
- */
- cond = mbedtls_ct_mpi_uint_lt(B[i - 1], A[i - 1]);
- done |= cond;
-
- /*
- * If A[i - 1] < B[i - 1] then A < B is true.
- *
- * Again even if we can make a decision, we just mark the result and
- * the fact that we are done and continue looping.
- */
- cond = mbedtls_ct_mpi_uint_lt(A[i - 1], B[i - 1]);
- ret |= cond & (1 - done);
- done |= cond;
- }
-
- /*
- * If all the limbs were equal, then the numbers are equal, A < B is false
- * and leaving the result 0 is correct.
- */
-
- return ret;
-}
-
-/*
- * Compare signed values in constant time
- */
-int mbedtls_mpi_lt_mpi_ct(const mbedtls_mpi *X,
- const mbedtls_mpi *Y,
- unsigned *ret)
-{
- size_t i;
- /* The value of any of these variables is either 0 or 1 at all times. */
- unsigned cond, done, X_is_negative, Y_is_negative;
-
- MPI_VALIDATE_RET(X != NULL);
- MPI_VALIDATE_RET(Y != NULL);
- MPI_VALIDATE_RET(ret != NULL);
-
- if (X->n != Y->n) {
- return MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
- }
-
- /*
- * Set sign_N to 1 if N >= 0, 0 if N < 0.
- * We know that N->s == 1 if N >= 0 and N->s == -1 if N < 0.
- */
- X_is_negative = (X->s & 2) >> 1;
- Y_is_negative = (Y->s & 2) >> 1;
-
- /*
- * If the signs are different, then the positive operand is the bigger.
- * That is if X is negative (X_is_negative == 1), then X < Y is true and it
- * is false if X is positive (X_is_negative == 0).
- */
- cond = (X_is_negative ^ Y_is_negative);
- *ret = cond & X_is_negative;
-
- /*
- * This is a constant-time function. We might have the result, but we still
- * need to go through the loop. Record if we have the result already.
- */
- done = cond;
-
- for (i = X->n; i > 0; i--) {
- /*
- * If Y->p[i - 1] < X->p[i - 1] then X < Y is true if and only if both
- * X and Y are negative.
- *
- * Again even if we can make a decision, we just mark the result and
- * the fact that we are done and continue looping.
- */
- cond = mbedtls_ct_mpi_uint_lt(Y->p[i - 1], X->p[i - 1]);
- *ret |= cond & (1 - done) & X_is_negative;
- done |= cond;
-
- /*
- * If X->p[i - 1] < Y->p[i - 1] then X < Y is true if and only if both
- * X and Y are positive.
- *
- * Again even if we can make a decision, we just mark the result and
- * the fact that we are done and continue looping.
- */
- cond = mbedtls_ct_mpi_uint_lt(X->p[i - 1], Y->p[i - 1]);
- *ret |= cond & (1 - done) & (1 - X_is_negative);
- done |= cond;
- }
-
- return 0;
-}
-
-#endif /* MBEDTLS_BIGNUM_C */
-
#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)
-int mbedtls_ct_rsaes_pkcs1_v15_unpadding(unsigned char *input,
- size_t ilen,
- unsigned char *output,
- size_t output_max_len,
- size_t *olen)
+void mbedtls_ct_zeroize_if(mbedtls_ct_condition_t condition, void *buf, size_t len)
{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t i, plaintext_max_size;
-
- /* The following variables take sensitive values: their value must
- * not leak into the observable behavior of the function other than
- * the designated outputs (output, olen, return value). Otherwise
- * this would open the execution of the function to
- * side-channel-based variants of the Bleichenbacher padding oracle
- * attack. Potential side channels include overall timing, memory
- * access patterns (especially visible to an adversary who has access
- * to a shared memory cache), and branches (especially visible to
- * an adversary who has access to a shared code cache or to a shared
- * branch predictor). */
- size_t pad_count = 0;
- unsigned bad = 0;
- unsigned char pad_done = 0;
- size_t plaintext_size = 0;
- unsigned output_too_large;
-
- plaintext_max_size = (output_max_len > ilen - 11) ? ilen - 11
- : output_max_len;
-
- /* Check and get padding length in constant time and constant
- * memory trace. The first byte must be 0. */
- bad |= input[0];
-
-
- /* Decode EME-PKCS1-v1_5 padding: 0x00 || 0x02 || PS || 0x00
- * where PS must be at least 8 nonzero bytes. */
- bad |= input[1] ^ MBEDTLS_RSA_CRYPT;
-
- /* Read the whole buffer. Set pad_done to nonzero if we find
- * the 0x00 byte and remember the padding length in pad_count. */
- for (i = 2; i < ilen; i++) {
- pad_done |= ((input[i] | (unsigned char) -input[i]) >> 7) ^ 1;
- pad_count += ((pad_done | (unsigned char) -pad_done) >> 7) ^ 1;
+ uint32_t mask = (uint32_t) ~condition;
+ uint8_t *p = (uint8_t *) buf;
+ size_t i = 0;
+#if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS)
+ for (; (i + 4) <= len; i += 4) {
+ mbedtls_put_unaligned_uint32((void *) (p + i),
+ mbedtls_get_unaligned_uint32((void *) (p + i)) & mask);
}
-
-
- /* If pad_done is still zero, there's no data, only unfinished padding. */
- bad |= mbedtls_ct_uint_if(pad_done, 0, 1);
-
- /* There must be at least 8 bytes of padding. */
- bad |= mbedtls_ct_size_gt(8, pad_count);
-
- /* If the padding is valid, set plaintext_size to the number of
- * remaining bytes after stripping the padding. If the padding
- * is invalid, avoid leaking this fact through the size of the
- * output: use the maximum message size that fits in the output
- * buffer. Do it without branches to avoid leaking the padding
- * validity through timing. RSA keys are small enough that all the
- * size_t values involved fit in unsigned int. */
- plaintext_size = mbedtls_ct_uint_if(
- bad, (unsigned) plaintext_max_size,
- (unsigned) (ilen - pad_count - 3));
-
- /* Set output_too_large to 0 if the plaintext fits in the output
- * buffer and to 1 otherwise. */
- output_too_large = mbedtls_ct_size_gt(plaintext_size,
- plaintext_max_size);
-
- /* Set ret without branches to avoid timing attacks. Return:
- * - INVALID_PADDING if the padding is bad (bad != 0).
- * - OUTPUT_TOO_LARGE if the padding is good but the decrypted
- * plaintext does not fit in the output buffer.
- * - 0 if the padding is correct. */
- ret = -(int) mbedtls_ct_uint_if(
- bad, -MBEDTLS_ERR_RSA_INVALID_PADDING,
- mbedtls_ct_uint_if(output_too_large,
- -MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE,
- 0));
-
- /* If the padding is bad or the plaintext is too large, zero the
- * data that we're about to copy to the output buffer.
- * We need to copy the same amount of data
- * from the same buffer whether the padding is good or not to
- * avoid leaking the padding validity through overall timing or
- * through memory or cache access patterns. */
- bad = mbedtls_ct_uint_mask(bad | output_too_large);
- for (i = 11; i < ilen; i++) {
- input[i] &= ~bad;
+#endif
+ for (; i < len; i++) {
+ p[i] = p[i] & mask;
}
-
- /* If the plaintext is too large, truncate it to the buffer size.
- * Copy anyway to avoid revealing the length through timing, because
- * revealing the length is as bad as revealing the padding validity
- * for a Bleichenbacher attack. */
- plaintext_size = mbedtls_ct_uint_if(output_too_large,
- (unsigned) plaintext_max_size,
- (unsigned) plaintext_size);
-
- /* Move the plaintext to the leftmost position where it can start in
- * the working buffer, i.e. make it start plaintext_max_size from
- * the end of the buffer. Do this with a memory access trace that
- * does not depend on the plaintext size. After this move, the
- * starting location of the plaintext is no longer sensitive
- * information. */
- mbedtls_ct_mem_move_to_left(input + ilen - plaintext_max_size,
- plaintext_max_size,
- plaintext_max_size - plaintext_size);
-
- /* Finally copy the decrypted plaintext plus trailing zeros into the output
- * buffer. If output_max_len is 0, then output may be an invalid pointer
- * and the result of memcpy() would be undefined; prevent undefined
- * behavior making sure to depend only on output_max_len (the size of the
- * user-provided output buffer), which is independent from plaintext
- * length, validity of padding, success of the decryption, and other
- * secrets. */
- if (output_max_len != 0) {
- memcpy(output, input + ilen - plaintext_max_size, plaintext_max_size);
- }
-
- /* Report the amount of data we copied to the output buffer. In case
- * of errors (bad padding or output too large), the value of *olen
- * when this function returns is not specified. Making it equivalent
- * to the good case limits the risks of leaking the padding validity. */
- *olen = plaintext_size;
-
- return ret;
}
-#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */
+#endif /* defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT) */
diff --git a/library/constant_time_impl.h b/library/constant_time_impl.h
new file mode 100644
index 0000000..0c3cde9
--- /dev/null
+++ b/library/constant_time_impl.h
@@ -0,0 +1,306 @@
+/**
+ * Constant-time functions
+ *
+ * For readability, the static inline definitions are here, and
+ * constant_time_internal.h has only the declarations.
+ *
+ * This results in duplicate declarations of the form:
+ * static inline void f() { ... }
+ * static inline void f();
+ * when constant_time_internal.h is included. This appears to behave
+ * exactly as if the declaration-without-definition was not present.
+ *
+ * Copyright The Mbed TLS Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MBEDTLS_CONSTANT_TIME_IMPL_H
+#define MBEDTLS_CONSTANT_TIME_IMPL_H
+
+#include <stddef.h>
+
+#include "common.h"
+
+#if defined(MBEDTLS_BIGNUM_C)
+#include "mbedtls/bignum.h"
+#endif
+
+/* constant_time_impl.h contains all the static inline implementations,
+ * so that constant_time_internal.h is more readable.
+ *
+ * gcc generates warnings about duplicate declarations, so disable this
+ * warning.
+ */
+#ifdef __GNUC__
+ #pragma GCC diagnostic push
+ #pragma GCC diagnostic ignored "-Wredundant-decls"
+#endif
+
+/* Disable asm under Memsan because it confuses Memsan and generates false errors */
+#if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN)
+#define MBEDTLS_CT_NO_ASM
+#elif defined(__has_feature)
+#if __has_feature(memory_sanitizer)
+#define MBEDTLS_CT_NO_ASM
+#endif
+#endif
+
+/* armcc5 --gnu defines __GNUC__ but doesn't support GNU's extended asm */
+#if defined(MBEDTLS_HAVE_ASM) && defined(__GNUC__) && (!defined(__ARMCC_VERSION) || \
+ __ARMCC_VERSION >= 6000000) && !defined(MBEDTLS_CT_NO_ASM)
+#define MBEDTLS_CT_ASM
+#if (defined(__arm__) || defined(__thumb__) || defined(__thumb2__))
+#define MBEDTLS_CT_ARM_ASM
+#elif defined(__aarch64__)
+#define MBEDTLS_CT_AARCH64_ASM
+#endif
+#endif
+
+#define MBEDTLS_CT_SIZE (sizeof(mbedtls_ct_uint_t) * 8)
+
+
+/* ============================================================================
+ * Core const-time primitives
+ */
+
+/* Ensure that the compiler cannot know the value of x (i.e., cannot optimise
+ * based on its value) after this function is called.
+ *
+ * If we are not using assembly, this will be fairly inefficient, so its use
+ * should be minimised.
+ */
+
+#if !defined(MBEDTLS_CT_ASM)
+extern volatile mbedtls_ct_uint_t mbedtls_ct_zero;
+#endif
+
+/**
+ * \brief Ensure that a value cannot be known at compile time.
+ *
+ * \param x The value to hide from the compiler.
+ * \return The same value that was passed in, such that the compiler
+ * cannot prove its value (even for calls of the form
+ * x = mbedtls_ct_compiler_opaque(1), x will be unknown).
+ *
+ * \note This is mainly used in constructing mbedtls_ct_condition_t
+ * values and performing operations over them, to ensure that
+ * there is no way for the compiler to ever know anything about
+ * the value of an mbedtls_ct_condition_t.
+ */
+static inline mbedtls_ct_uint_t mbedtls_ct_compiler_opaque(mbedtls_ct_uint_t x)
+{
+#if defined(MBEDTLS_CT_ASM)
+ asm volatile ("" : [x] "+r" (x) :);
+ return x;
+#else
+ return x ^ mbedtls_ct_zero;
+#endif
+}
+
+/* Convert a number into a condition in constant time. */
+static inline mbedtls_ct_condition_t mbedtls_ct_bool(mbedtls_ct_uint_t x)
+{
+ /*
+ * Define mask-generation code that, as far as possible, will not use branches or conditional instructions.
+ *
+ * For some platforms / type sizes, we define assembly to assure this.
+ *
+ * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into
+ * conditional instructions or branches by trunk clang, gcc, or MSVC v19.
+ */
+ const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
+#if defined(_MSC_VER)
+ /* MSVC has a warning about unary minus on unsigned, but this is
+ * well-defined and precisely what we want to do here */
+#pragma warning( push )
+#pragma warning( disable : 4146 )
+#endif
+ return (mbedtls_ct_condition_t) (((mbedtls_ct_int_t) ((-xo) | -(xo >> 1))) >>
+ (MBEDTLS_CT_SIZE - 1));
+#if defined(_MSC_VER)
+#pragma warning( pop )
+#endif
+}
+
+static inline mbedtls_ct_uint_t mbedtls_ct_if(mbedtls_ct_condition_t condition,
+ mbedtls_ct_uint_t if1,
+ mbedtls_ct_uint_t if0)
+{
+ mbedtls_ct_condition_t not_cond =
+ (mbedtls_ct_condition_t) (~mbedtls_ct_compiler_opaque(condition));
+ return (mbedtls_ct_uint_t) ((condition & if1) | (not_cond & if0));
+}
+
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_lt(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y)
+{
+ /* Ensure that the compiler cannot optimise the following operations over x and y,
+ * even if it knows the value of x and y.
+ */
+ const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
+ const mbedtls_ct_uint_t yo = mbedtls_ct_compiler_opaque(y);
+ /*
+ * Check if the most significant bits (MSB) of the operands are different.
+ * cond is true iff the MSBs differ.
+ */
+ mbedtls_ct_condition_t cond = mbedtls_ct_bool((xo ^ yo) >> (MBEDTLS_CT_SIZE - 1));
+
+ /*
+ * If the MSB are the same then the difference x-y will be negative (and
+ * have its MSB set to 1 during conversion to unsigned) if and only if x<y.
+ *
+ * If the MSB are different, then the operand with the MSB of 1 is the
+ * bigger. (That is if y has MSB of 1, then x<y is true and it is false if
+ * the MSB of y is 0.)
+ */
+
+ // Select either y, or x - y
+ mbedtls_ct_uint_t ret = mbedtls_ct_if(cond, yo, (mbedtls_ct_uint_t) (xo - yo));
+
+ // Extract only the MSB of ret
+ ret = ret >> (MBEDTLS_CT_SIZE - 1);
+
+ // Convert to a condition (i.e., all bits set iff non-zero)
+ return mbedtls_ct_bool(ret);
+}
+
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_ne(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y)
+{
+ /* diff = 0 if x == y, non-zero otherwise */
+ const mbedtls_ct_uint_t diff = mbedtls_ct_compiler_opaque(x) ^ mbedtls_ct_compiler_opaque(y);
+
+ /* all ones if x != y, 0 otherwise */
+ return mbedtls_ct_bool(diff);
+}
+
+static inline unsigned char mbedtls_ct_uchar_in_range_if(unsigned char low,
+ unsigned char high,
+ unsigned char c,
+ unsigned char t)
+{
+ const unsigned char co = (const unsigned char) mbedtls_ct_compiler_opaque(c);
+ const unsigned char to = (const unsigned char) mbedtls_ct_compiler_opaque(t);
+
+ /* low_mask is: 0 if low <= c, 0x...ff if low > c */
+ unsigned low_mask = ((unsigned) co - low) >> 8;
+ /* high_mask is: 0 if c <= high, 0x...ff if c > high */
+ unsigned high_mask = ((unsigned) high - co) >> 8;
+
+ return (unsigned char) (~(low_mask | high_mask)) & to;
+}
+
+
+/* ============================================================================
+ * Everything below here is trivial wrapper functions
+ */
+
+static inline size_t mbedtls_ct_size_if(mbedtls_ct_condition_t condition,
+ size_t if1,
+ size_t if0)
+{
+ return (size_t) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0);
+}
+
+static inline unsigned mbedtls_ct_uint_if(mbedtls_ct_condition_t condition,
+ unsigned if1,
+ unsigned if0)
+{
+ return (unsigned) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0);
+}
+
+#if defined(MBEDTLS_BIGNUM_C)
+
+static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if(mbedtls_ct_condition_t condition,
+ mbedtls_mpi_uint if1,
+ mbedtls_mpi_uint if0)
+{
+ return (mbedtls_mpi_uint) mbedtls_ct_if(condition,
+ (mbedtls_ct_uint_t) if1,
+ (mbedtls_ct_uint_t) if0);
+}
+
+#endif
+
+static inline size_t mbedtls_ct_size_if_else_0(mbedtls_ct_condition_t condition, size_t if1)
+{
+ return (size_t) (condition & if1);
+}
+
+static inline unsigned mbedtls_ct_uint_if_else_0(mbedtls_ct_condition_t condition, unsigned if1)
+{
+ return (unsigned) (condition & if1);
+}
+
+#if defined(MBEDTLS_BIGNUM_C)
+
+static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if_else_0(mbedtls_ct_condition_t condition,
+ mbedtls_mpi_uint if1)
+{
+ return (mbedtls_mpi_uint) (condition & if1);
+}
+
+#endif /* MBEDTLS_BIGNUM_C */
+
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_eq(mbedtls_ct_uint_t x,
+ mbedtls_ct_uint_t y)
+{
+ return ~mbedtls_ct_uint_ne(x, y);
+}
+
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_gt(mbedtls_ct_uint_t x,
+ mbedtls_ct_uint_t y)
+{
+ return mbedtls_ct_uint_lt(y, x);
+}
+
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_ge(mbedtls_ct_uint_t x,
+ mbedtls_ct_uint_t y)
+{
+ return ~mbedtls_ct_uint_lt(x, y);
+}
+
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_le(mbedtls_ct_uint_t x,
+ mbedtls_ct_uint_t y)
+{
+ return ~mbedtls_ct_uint_gt(x, y);
+}
+
+static inline mbedtls_ct_condition_t mbedtls_ct_bool_xor(mbedtls_ct_condition_t x,
+ mbedtls_ct_condition_t y)
+{
+ return (mbedtls_ct_condition_t) (x ^ y);
+}
+
+static inline mbedtls_ct_condition_t mbedtls_ct_bool_and(mbedtls_ct_condition_t x,
+ mbedtls_ct_condition_t y)
+{
+ return (mbedtls_ct_condition_t) (x & y);
+}
+
+static inline mbedtls_ct_condition_t mbedtls_ct_bool_or(mbedtls_ct_condition_t x,
+ mbedtls_ct_condition_t y)
+{
+ return (mbedtls_ct_condition_t) (x | y);
+}
+
+static inline mbedtls_ct_condition_t mbedtls_ct_bool_not(mbedtls_ct_condition_t x)
+{
+ return (mbedtls_ct_condition_t) (~x);
+}
+
+#ifdef __GNUC__
+ #pragma GCC diagnostic pop
+#endif
+
+#endif /* MBEDTLS_CONSTANT_TIME_IMPL_H */
diff --git a/library/constant_time_internal.h b/library/constant_time_internal.h
index c4a32c7..dabf720 100644
--- a/library/constant_time_internal.h
+++ b/library/constant_time_internal.h
@@ -20,224 +20,442 @@
#ifndef MBEDTLS_CONSTANT_TIME_INTERNAL_H
#define MBEDTLS_CONSTANT_TIME_INTERNAL_H
+#include <stdint.h>
+#include <stddef.h>
+
#include "common.h"
#if defined(MBEDTLS_BIGNUM_C)
#include "mbedtls/bignum.h"
#endif
-#if defined(MBEDTLS_SSL_TLS_C)
-#include "ssl_misc.h"
+/* The constant-time interface provides various operations that are likely
+ * to result in constant-time code that does not branch or use conditional
+ * instructions for secret data (for secret pointers, this also applies to
+ * the data pointed to).
+ *
+ * It has three main parts:
+ *
+ * - boolean operations
+ * These are all named mbedtls_ct_<type>_<operation>.
+ * They operate over <type> and return mbedtls_ct_condition_t.
+ * All arguments are considered secret.
+ * example: bool x = y | z => x = mbedtls_ct_bool_or(y, z)
+ * example: bool x = y == z => x = mbedtls_ct_uint_eq(y, z)
+ *
+ * - conditional data selection
+ * These are all named mbedtls_ct_<type>_if and mbedtls_ct_<type>_if_else_0
+ * All arguments are considered secret.
+ * example: size_t a = x ? b : c => a = mbedtls_ct_size_if(x, b, c)
+ * example: unsigned a = x ? b : 0 => a = mbedtls_ct_uint__if_else_0(x, b)
+ *
+ * - block memory operations
+ * Only some arguments are considered secret, as documented for each
+ * function.
+ * example: if (x) memcpy(...) => mbedtls_ct_memcpy_if(x, ...)
+ *
+ * mbedtls_ct_condition_t must be treated as opaque and only created and
+ * manipulated via the functions in this header. The compiler should never
+ * be able to prove anything about its value at compile-time.
+ *
+ * mbedtls_ct_uint_t is an unsigned integer type over which constant time
+ * operations may be performed via the functions in this header. It is as big
+ * as the larger of size_t and mbedtls_mpi_uint, i.e. it is safe to cast
+ * to/from "unsigned int", "size_t", and "mbedtls_mpi_uint" (and any other
+ * not-larger integer types).
+ *
+ * For Arm (32-bit, 64-bit and Thumb), x86 and x86-64, assembly implementations
+ * are used to ensure that the generated code is constant time. For other
+ * architectures, it uses a plain C fallback designed to yield constant-time code
+ * (this has been observed to be constant-time on latest gcc, clang and MSVC
+ * as of May 2023).
+ *
+ * For readability, the static inline definitions are separated out into
+ * constant_time_impl.h.
+ */
+
+#if (SIZE_MAX > 0xffffffffffffffffULL)
+/* Pointer size > 64-bit */
+typedef size_t mbedtls_ct_condition_t;
+typedef size_t mbedtls_ct_uint_t;
+typedef ptrdiff_t mbedtls_ct_int_t;
+#define MBEDTLS_CT_TRUE ((mbedtls_ct_condition_t) mbedtls_ct_compiler_opaque(SIZE_MAX))
+#elif (SIZE_MAX > 0xffffffff) || defined(MBEDTLS_HAVE_INT64)
+/* 32-bit < pointer size <= 64-bit, or 64-bit MPI */
+typedef uint64_t mbedtls_ct_condition_t;
+typedef uint64_t mbedtls_ct_uint_t;
+typedef int64_t mbedtls_ct_int_t;
+#define MBEDTLS_CT_TRUE ((mbedtls_ct_condition_t) mbedtls_ct_compiler_opaque(UINT64_MAX))
+#else
+/* Pointer size <= 32-bit, and no 64-bit MPIs */
+typedef uint32_t mbedtls_ct_condition_t;
+typedef uint32_t mbedtls_ct_uint_t;
+typedef int32_t mbedtls_ct_int_t;
+#define MBEDTLS_CT_TRUE ((mbedtls_ct_condition_t) mbedtls_ct_compiler_opaque(UINT32_MAX))
#endif
+#define MBEDTLS_CT_FALSE ((mbedtls_ct_condition_t) mbedtls_ct_compiler_opaque(0))
-#include <stddef.h>
-
-
-/** Turn a value into a mask:
- * - if \p value == 0, return the all-bits 0 mask, aka 0
- * - otherwise, return the all-bits 1 mask, aka (unsigned) -1
- *
- * This function can be used to write constant-time code by replacing branches
- * with bit operations using masks.
- *
- * \param value The value to analyze.
- *
- * \return Zero if \p value is zero, otherwise all-bits-one.
+/* ============================================================================
+ * Boolean operations
*/
-unsigned mbedtls_ct_uint_mask(unsigned value);
-#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
-
-/** Turn a value into a mask:
- * - if \p value == 0, return the all-bits 0 mask, aka 0
- * - otherwise, return the all-bits 1 mask, aka (size_t) -1
+/** Convert a number into a mbedtls_ct_condition_t.
*
- * This function can be used to write constant-time code by replacing branches
- * with bit operations using masks.
+ * \param x Number to convert.
*
- * \param value The value to analyze.
+ * \return MBEDTLS_CT_TRUE if \p x != 0, or MBEDTLS_CT_FALSE if \p x == 0
*
- * \return Zero if \p value is zero, otherwise all-bits-one.
*/
-size_t mbedtls_ct_size_mask(size_t value);
+static inline mbedtls_ct_condition_t mbedtls_ct_bool(mbedtls_ct_uint_t x);
-#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
-
-#if defined(MBEDTLS_BIGNUM_C)
-
-/** Turn a value into a mask:
- * - if \p value == 0, return the all-bits 0 mask, aka 0
- * - otherwise, return the all-bits 1 mask, aka (mbedtls_mpi_uint) -1
+/** Boolean "not equal" operation.
*
- * This function can be used to write constant-time code by replacing branches
- * with bit operations using masks.
+ * Functionally equivalent to:
*
- * \param value The value to analyze.
- *
- * \return Zero if \p value is zero, otherwise all-bits-one.
- */
-mbedtls_mpi_uint mbedtls_ct_mpi_uint_mask(mbedtls_mpi_uint value);
-
-#endif /* MBEDTLS_BIGNUM_C */
-
-#if defined(MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC)
-
-/** Constant-flow mask generation for "greater or equal" comparison:
- * - if \p x >= \p y, return all-bits 1, that is (size_t) -1
- * - otherwise, return all bits 0, that is 0
- *
- * This function can be used to write constant-time code by replacing branches
- * with bit operations using masks.
+ * \p x != \p y
*
* \param x The first value to analyze.
* \param y The second value to analyze.
*
- * \return All-bits-one if \p x is greater or equal than \p y,
- * otherwise zero.
+ * \return MBEDTLS_CT_TRUE if \p x != \p y, otherwise MBEDTLS_CT_FALSE.
*/
-size_t mbedtls_ct_size_mask_ge(size_t x,
- size_t y);
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_ne(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y);
-#endif /* MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC */
-
-/** Constant-flow boolean "equal" comparison:
- * return x == y
+/** Boolean "equals" operation.
*
- * This is equivalent to \p x == \p y, but is likely to be compiled
- * to code using bitwise operation rather than a branch.
+ * Functionally equivalent to:
+ *
+ * \p x == \p y
*
* \param x The first value to analyze.
* \param y The second value to analyze.
*
- * \return 1 if \p x equals to \p y, otherwise 0.
+ * \return MBEDTLS_CT_TRUE if \p x == \p y, otherwise MBEDTLS_CT_FALSE.
*/
-unsigned mbedtls_ct_size_bool_eq(size_t x,
- size_t y);
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_eq(mbedtls_ct_uint_t x,
+ mbedtls_ct_uint_t y);
-#if defined(MBEDTLS_BIGNUM_C)
-
-/** Decide if an integer is less than the other, without branches.
+/** Boolean "less than" operation.
*
- * This is equivalent to \p x < \p y, but is likely to be compiled
- * to code using bitwise operation rather than a branch.
+ * Functionally equivalent to:
+ *
+ * \p x < \p y
*
* \param x The first value to analyze.
* \param y The second value to analyze.
*
- * \return 1 if \p x is less than \p y, otherwise 0.
+ * \return MBEDTLS_CT_TRUE if \p x < \p y, otherwise MBEDTLS_CT_FALSE.
*/
-unsigned mbedtls_ct_mpi_uint_lt(const mbedtls_mpi_uint x,
- const mbedtls_mpi_uint y);
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_lt(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y);
-/**
- * \brief Check if one unsigned MPI is less than another in constant
- * time.
+/** Boolean "greater than" operation.
*
- * \param A The left-hand MPI. This must point to an array of limbs
- * with the same allocated length as \p B.
- * \param B The right-hand MPI. This must point to an array of limbs
- * with the same allocated length as \p A.
- * \param limbs The number of limbs in \p A and \p B.
- * This must not be 0.
+ * Functionally equivalent to:
*
- * \return The result of the comparison:
- * \c 1 if \p A is less than \p B.
- * \c 0 if \p A is greater than or equal to \p B.
+ * \p x > \p y
+ *
+ * \param x The first value to analyze.
+ * \param y The second value to analyze.
+ *
+ * \return MBEDTLS_CT_TRUE if \p x > \p y, otherwise MBEDTLS_CT_FALSE.
*/
-unsigned mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
- const mbedtls_mpi_uint *B,
- size_t limbs);
-#endif /* MBEDTLS_BIGNUM_C */
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_gt(mbedtls_ct_uint_t x,
+ mbedtls_ct_uint_t y);
-/** Choose between two integer values without branches.
+/** Boolean "greater or equal" operation.
*
- * This is equivalent to `condition ? if1 : if0`, but is likely to be compiled
- * to code using bitwise operation rather than a branch.
+ * Functionally equivalent to:
+ *
+ * \p x >= \p y
+ *
+ * \param x The first value to analyze.
+ * \param y The second value to analyze.
+ *
+ * \return MBEDTLS_CT_TRUE if \p x >= \p y,
+ * otherwise MBEDTLS_CT_FALSE.
+ */
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_ge(mbedtls_ct_uint_t x,
+ mbedtls_ct_uint_t y);
+
+/** Boolean "less than or equal" operation.
+ *
+ * Functionally equivalent to:
+ *
+ * \p x <= \p y
+ *
+ * \param x The first value to analyze.
+ * \param y The second value to analyze.
+ *
+ * \return MBEDTLS_CT_TRUE if \p x <= \p y,
+ * otherwise MBEDTLS_CT_FALSE.
+ */
+static inline mbedtls_ct_condition_t mbedtls_ct_uint_le(mbedtls_ct_uint_t x,
+ mbedtls_ct_uint_t y);
+
+/** Boolean "xor" operation.
+ *
+ * Functionally equivalent to:
+ *
+ * \p x ^ \p y
+ *
+ * \param x The first value to analyze.
+ * \param y The second value to analyze.
+ *
+ * \note This is more efficient than mbedtls_ct_uint_ne if both arguments are
+ * mbedtls_ct_condition_t.
+ *
+ * \return MBEDTLS_CT_TRUE if \p x ^ \p y,
+ * otherwise MBEDTLS_CT_FALSE.
+ */
+static inline mbedtls_ct_condition_t mbedtls_ct_bool_xor(mbedtls_ct_condition_t x,
+ mbedtls_ct_condition_t y);
+
+/** Boolean "and" operation.
+ *
+ * Functionally equivalent to:
+ *
+ * \p x && \p y
+ *
+ * \param x The first value to analyze.
+ * \param y The second value to analyze.
+ *
+ * \return MBEDTLS_CT_TRUE if \p x && \p y,
+ * otherwise MBEDTLS_CT_FALSE.
+ */
+static inline mbedtls_ct_condition_t mbedtls_ct_bool_and(mbedtls_ct_condition_t x,
+ mbedtls_ct_condition_t y);
+
+/** Boolean "or" operation.
+ *
+ * Functionally equivalent to:
+ *
+ * \p x || \p y
+ *
+ * \param x The first value to analyze.
+ * \param y The second value to analyze.
+ *
+ * \return MBEDTLS_CT_TRUE if \p x || \p y,
+ * otherwise MBEDTLS_CT_FALSE.
+ */
+static inline mbedtls_ct_condition_t mbedtls_ct_bool_or(mbedtls_ct_condition_t x,
+ mbedtls_ct_condition_t y);
+
+/** Boolean "not" operation.
+ *
+ * Functionally equivalent to:
+ *
+ * ! \p x
+ *
+ * \param x The value to invert
+ *
+ * \return MBEDTLS_CT_FALSE if \p x, otherwise MBEDTLS_CT_TRUE.
+ */
+static inline mbedtls_ct_condition_t mbedtls_ct_bool_not(mbedtls_ct_condition_t x);
+
+
+/* ============================================================================
+ * Data selection operations
+ */
+
+/** Choose between two size_t values.
+ *
+ * Functionally equivalent to:
+ *
+ * condition ? if1 : if0.
*
* \param condition Condition to test.
- * \param if1 Value to use if \p condition is nonzero.
- * \param if0 Value to use if \p condition is zero.
+ * \param if1 Value to use if \p condition == MBEDTLS_CT_TRUE.
+ * \param if0 Value to use if \p condition == MBEDTLS_CT_FALSE.
*
- * \return \c if1 if \p condition is nonzero, otherwise \c if0.
+ * \return \c if1 if \p condition == MBEDTLS_CT_TRUE, otherwise \c if0.
*/
-unsigned mbedtls_ct_uint_if(unsigned condition,
- unsigned if1,
- unsigned if0);
+static inline size_t mbedtls_ct_size_if(mbedtls_ct_condition_t condition,
+ size_t if1,
+ size_t if0);
+
+/** Choose between two unsigned values.
+ *
+ * Functionally equivalent to:
+ *
+ * condition ? if1 : if0.
+ *
+ * \param condition Condition to test.
+ * \param if1 Value to use if \p condition == MBEDTLS_CT_TRUE.
+ * \param if0 Value to use if \p condition == MBEDTLS_CT_FALSE.
+ *
+ * \return \c if1 if \p condition == MBEDTLS_CT_TRUE, otherwise \c if0.
+ */
+static inline unsigned mbedtls_ct_uint_if(mbedtls_ct_condition_t condition,
+ unsigned if1,
+ unsigned if0);
#if defined(MBEDTLS_BIGNUM_C)
-/** Conditionally assign a value without branches.
+/** Choose between two mbedtls_mpi_uint values.
*
- * This is equivalent to `if ( condition ) dest = src`, but is likely
- * to be compiled to code using bitwise operation rather than a branch.
+ * Functionally equivalent to:
*
- * \param n \p dest and \p src must be arrays of limbs of size n.
- * \param dest The MPI to conditionally assign to. This must point
- * to an initialized MPI.
- * \param src The MPI to be assigned from. This must point to an
- * initialized MPI.
- * \param condition Condition to test, must be 0 or 1.
+ * condition ? if1 : if0.
+ *
+ * \param condition Condition to test.
+ * \param if1 Value to use if \p condition == MBEDTLS_CT_TRUE.
+ * \param if0 Value to use if \p condition == MBEDTLS_CT_FALSE.
+ *
+ * \return \c if1 if \p condition == MBEDTLS_CT_TRUE, otherwise \c if0.
*/
-void mbedtls_ct_mpi_uint_cond_assign(size_t n,
- mbedtls_mpi_uint *dest,
- const mbedtls_mpi_uint *src,
- unsigned char condition);
+static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if(mbedtls_ct_condition_t condition, \
+ mbedtls_mpi_uint if1, \
+ mbedtls_mpi_uint if0);
-#endif /* MBEDTLS_BIGNUM_C */
+#endif
-#if defined(MBEDTLS_BASE64_C)
-
-/** Given a value in the range 0..63, return the corresponding Base64 digit.
+/** Choose between an unsigned value and 0.
*
- * The implementation assumes that letters are consecutive (e.g. ASCII
- * but not EBCDIC).
+ * Functionally equivalent to:
*
- * \param value A value in the range 0..63.
+ * condition ? if1 : 0.
*
- * \return A base64 digit converted from \p value.
+ * Functionally equivalent to mbedtls_ct_uint_if(condition, if1, 0) but
+ * results in smaller code size.
+ *
+ * \param condition Condition to test.
+ * \param if1 Value to use if \p condition == MBEDTLS_CT_TRUE.
+ *
+ * \return \c if1 if \p condition == MBEDTLS_CT_TRUE, otherwise 0.
*/
-unsigned char mbedtls_ct_base64_enc_char(unsigned char value);
+static inline unsigned mbedtls_ct_uint_if_else_0(mbedtls_ct_condition_t condition, unsigned if1);
-/** Given a Base64 digit, return its value.
+/** Choose between a size_t value and 0.
*
- * If c is not a Base64 digit ('A'..'Z', 'a'..'z', '0'..'9', '+' or '/'),
- * return -1.
+ * Functionally equivalent to:
*
- * The implementation assumes that letters are consecutive (e.g. ASCII
- * but not EBCDIC).
+ * condition ? if1 : 0.
*
- * \param c A base64 digit.
+ * Functionally equivalent to mbedtls_ct_size_if(condition, if1, 0) but
+ * results in smaller code size.
*
- * \return The value of the base64 digit \p c.
+ * \param condition Condition to test.
+ * \param if1 Value to use if \p condition == MBEDTLS_CT_TRUE.
+ *
+ * \return \c if1 if \p condition == MBEDTLS_CT_TRUE, otherwise 0.
*/
-signed char mbedtls_ct_base64_dec_value(unsigned char c);
+static inline size_t mbedtls_ct_size_if_else_0(mbedtls_ct_condition_t condition, size_t if1);
-#endif /* MBEDTLS_BASE64_C */
+#if defined(MBEDTLS_BIGNUM_C)
-#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
-
-/** Conditional memcpy without branches.
+/** Choose between an mbedtls_mpi_uint value and 0.
*
- * This is equivalent to `if ( c1 == c2 ) memcpy(dest, src, len)`, but is likely
- * to be compiled to code using bitwise operation rather than a branch.
+ * Functionally equivalent to:
*
- * \param dest The pointer to conditionally copy to.
- * \param src The pointer to copy from. Shouldn't overlap with \p dest.
- * \param len The number of bytes to copy.
- * \param c1 The first value to analyze in the condition.
- * \param c2 The second value to analyze in the condition.
+ * condition ? if1 : 0.
+ *
+ * Functionally equivalent to mbedtls_ct_mpi_uint_if(condition, if1, 0) but
+ * results in smaller code size.
+ *
+ * \param condition Condition to test.
+ * \param if1 Value to use if \p condition == MBEDTLS_CT_TRUE.
+ *
+ * \return \c if1 if \p condition == MBEDTLS_CT_TRUE, otherwise 0.
*/
-void mbedtls_ct_memcpy_if_eq(unsigned char *dest,
- const unsigned char *src,
- size_t len,
- size_t c1, size_t c2);
+static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if_else_0(mbedtls_ct_condition_t condition,
+ mbedtls_mpi_uint if1);
-/** Copy data from a secret position with constant flow.
+#endif
+
+/** Constant-flow char selection
*
- * This function copies \p len bytes from \p src_base + \p offset_secret to \p
- * dst, with a code flow and memory access pattern that does not depend on \p
- * offset_secret, but only on \p offset_min, \p offset_max and \p len.
- * Functionally equivalent to `memcpy(dst, src + offset_secret, len)`.
+ * \param low Secret. Bottom of range
+ * \param high Secret. Top of range
+ * \param c Secret. Value to compare to range
+ * \param t Secret. Value to return, if in range
+ *
+ * \return \p t if \p low <= \p c <= \p high, 0 otherwise.
+ */
+static inline unsigned char mbedtls_ct_uchar_in_range_if(unsigned char low,
+ unsigned char high,
+ unsigned char c,
+ unsigned char t);
+
+
+/* ============================================================================
+ * Block memory operations
+ */
+
+#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)
+
+/** Conditionally set a block of memory to zero.
+ *
+ * Regardless of the condition, every byte will be read once and written to
+ * once.
+ *
+ * \param condition Secret. Condition to test.
+ * \param buf Secret. Pointer to the start of the buffer.
+ * \param len Number of bytes to set to zero.
+ *
+ * \warning Unlike mbedtls_platform_zeroize, this does not have the same guarantees
+ * about not being optimised away if the memory is never read again.
+ */
+void mbedtls_ct_zeroize_if(mbedtls_ct_condition_t condition, void *buf, size_t len);
+
+/** Shift some data towards the left inside a buffer.
+ *
+ * Functionally equivalent to:
+ *
+ * memmove(start, start + offset, total - offset);
+ * memset(start + (total - offset), 0, offset);
+ *
+ * Timing independence comes at the expense of performance.
+ *
+ * \param start Secret. Pointer to the start of the buffer.
+ * \param total Total size of the buffer.
+ * \param offset Secret. Offset from which to copy \p total - \p offset bytes.
+ */
+void mbedtls_ct_memmove_left(void *start,
+ size_t total,
+ size_t offset);
+
+#endif /* defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT) */
+
+/** Conditional memcpy.
+ *
+ * Functionally equivalent to:
+ *
+ * if (condition) {
+ * memcpy(dest, src1, len);
+ * } else {
+ * if (src2 != NULL)
+ * memcpy(dest, src2, len);
+ * }
+ *
+ * It will always read len bytes from src1.
+ * If src2 != NULL, it will always read len bytes from src2.
+ * If src2 == NULL, it will instead read len bytes from dest (as if src2 == dest).
+ *
+ * \param condition The condition
+ * \param dest Secret. Destination pointer.
+ * \param src1 Secret. Pointer to copy from (if \p condition == MBEDTLS_CT_TRUE).
+ * This may be equal to \p dest, but may not overlap in other ways.
+ * \param src2 Secret (contents only - may branch to determine if this parameter is NULL).
+ * Pointer to copy from (if \p condition == MBEDTLS_CT_FALSE and \p src2 is not NULL). May be NULL.
+ * This may be equal to \p dest, but may not overlap it in other ways. It may overlap with \p src1.
+ * \param len Number of bytes to copy.
+ */
+void mbedtls_ct_memcpy_if(mbedtls_ct_condition_t condition,
+ unsigned char *dest,
+ const unsigned char *src1,
+ const unsigned char *src2,
+ size_t len
+ );
+
+/** Copy data from a secret position.
+ *
+ * Functionally equivalent to:
+ *
+ * memcpy(dst, src + offset, len)
+ *
+ * This function copies \p len bytes from \p src_base + \p offset to \p
+ * dst, with a code flow and memory access pattern that does not depend on
+ * \p offset, but only on \p offset_min, \p offset_max and \p len.
*
* \note This function reads from \p dest, but the value that
* is read does not influence the result and this
@@ -246,12 +464,12 @@
* positives from static or dynamic analyzers, especially
* if \p dest is not initialized.
*
- * \param dest The destination buffer. This must point to a writable
+ * \param dest Secret. The destination buffer. This must point to a writable
* buffer of at least \p len bytes.
- * \param src The base of the source buffer. This must point to a
+ * \param src Secret. The base of the source buffer. This must point to a
* readable buffer of at least \p offset_max + \p len
- * bytes. Shouldn't overlap with \p dest.
- * \param offset The offset in the source buffer from which to copy.
+ * bytes. Shouldn't overlap with \p dest
+ * \param offset Secret. The offset in the source buffer from which to copy.
* This must be no less than \p offset_min and no greater
* than \p offset_max.
* \param offset_min The minimal value of \p offset.
@@ -265,99 +483,14 @@
size_t offset_max,
size_t len);
-/** Compute the HMAC of variable-length data with constant flow.
- *
- * This function computes the HMAC of the concatenation of \p add_data and \p
- * data, and does with a code flow and memory access pattern that does not
- * depend on \p data_len_secret, but only on \p min_data_len and \p
- * max_data_len. In particular, this function always reads exactly \p
- * max_data_len bytes from \p data.
- *
- * \param ctx The HMAC context. It must have keys configured
- * with mbedtls_md_hmac_starts() and use one of the
- * following hashes: SHA-384, SHA-256, SHA-1 or MD-5.
- * It is reset using mbedtls_md_hmac_reset() after
- * the computation is complete to prepare for the
- * next computation.
- * \param add_data The first part of the message whose HMAC is being
- * calculated. This must point to a readable buffer
- * of \p add_data_len bytes.
- * \param add_data_len The length of \p add_data in bytes.
- * \param data The buffer containing the second part of the
- * message. This must point to a readable buffer
- * of \p max_data_len bytes.
- * \param data_len_secret The length of the data to process in \p data.
- * This must be no less than \p min_data_len and no
- * greater than \p max_data_len.
- * \param min_data_len The minimal length of the second part of the
- * message, read from \p data.
- * \param max_data_len The maximal length of the second part of the
- * message, read from \p data.
- * \param output The HMAC will be written here. This must point to
- * a writable buffer of sufficient size to hold the
- * HMAC value.
- *
- * \retval 0 on success.
- * \retval #MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED
- * The hardware accelerator failed.
+/* Documented in include/mbedtls/constant_time.h. a and b are secret.
+
+ int mbedtls_ct_memcmp(const void *a,
+ const void *b,
+ size_t n);
*/
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-int mbedtls_ct_hmac(mbedtls_svc_key_id_t key,
- psa_algorithm_t alg,
- const unsigned char *add_data,
- size_t add_data_len,
- const unsigned char *data,
- size_t data_len_secret,
- size_t min_data_len,
- size_t max_data_len,
- unsigned char *output);
-#else
-int mbedtls_ct_hmac(mbedtls_md_context_t *ctx,
- const unsigned char *add_data,
- size_t add_data_len,
- const unsigned char *data,
- size_t data_len_secret,
- size_t min_data_len,
- size_t max_data_len,
- unsigned char *output);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
-
-#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)
-
-/** This function performs the unpadding part of a PKCS#1 v1.5 decryption
- * operation (EME-PKCS1-v1_5 decoding).
- *
- * \note The return value from this function is a sensitive value
- * (this is unusual). #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE shouldn't happen
- * in a well-written application, but 0 vs #MBEDTLS_ERR_RSA_INVALID_PADDING
- * is often a situation that an attacker can provoke and leaking which
- * one is the result is precisely the information the attacker wants.
- *
- * \param input The input buffer which is the payload inside PKCS#1v1.5
- * encryption padding, called the "encoded message EM"
- * by the terminology.
- * \param ilen The length of the payload in the \p input buffer.
- * \param output The buffer for the payload, called "message M" by the
- * PKCS#1 terminology. This must be a writable buffer of
- * length \p output_max_len bytes.
- * \param olen The address at which to store the length of
- * the payload. This must not be \c NULL.
- * \param output_max_len The length in bytes of the output buffer \p output.
- *
- * \return \c 0 on success.
- * \return #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE
- * The output buffer is too small for the unpadded payload.
- * \return #MBEDTLS_ERR_RSA_INVALID_PADDING
- * The input doesn't contain properly formatted padding.
- */
-int mbedtls_ct_rsaes_pkcs1_v15_unpadding(unsigned char *input,
- size_t ilen,
- unsigned char *output,
- size_t output_max_len,
- size_t *olen);
-
-#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */
+/* Include the implementation of static inline functions above. */
+#include "constant_time_impl.h"
#endif /* MBEDTLS_CONSTANT_TIME_INTERNAL_H */
diff --git a/library/constant_time_invasive.h b/library/constant_time_invasive.h
deleted file mode 100644
index c176b28..0000000
--- a/library/constant_time_invasive.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/**
- * \file constant_time_invasive.h
- *
- * \brief Constant-time module: interfaces for invasive testing only.
- *
- * The interfaces in this file are intended for testing purposes only.
- * They SHOULD NOT be made available in library integrations except when
- * building the library for testing.
- */
-/*
- * Copyright The Mbed TLS Contributors
- * SPDX-License-Identifier: Apache-2.0
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef MBEDTLS_CONSTANT_TIME_INVASIVE_H
-#define MBEDTLS_CONSTANT_TIME_INVASIVE_H
-
-#include "common.h"
-
-#if defined(MBEDTLS_TEST_HOOKS)
-
-/** Turn a value into a mask:
- * - if \p low <= \p c <= \p high,
- * return the all-bits 1 mask, aka (unsigned) -1
- * - otherwise, return the all-bits 0 mask, aka 0
- *
- * \param low The value to analyze.
- * \param high The value to analyze.
- * \param c The value to analyze.
- *
- * \return All-bits-one if \p low <= \p c <= \p high, otherwise zero.
- */
-unsigned char mbedtls_ct_uchar_mask_of_range(unsigned char low,
- unsigned char high,
- unsigned char c);
-
-#endif /* MBEDTLS_TEST_HOOKS */
-
-#endif /* MBEDTLS_CONSTANT_TIME_INVASIVE_H */
diff --git a/library/ctr_drbg.c b/library/ctr_drbg.c
index acc4208..fdd753d 100644
--- a/library/ctr_drbg.c
+++ b/library/ctr_drbg.c
@@ -19,7 +19,7 @@
/*
* The NIST SP 800-90 DRBGs are described in the following publication.
*
- * http://csrc.nist.gov/publications/nistpubs/800-90/SP800-90revised_March2007.pdf
+ * https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-90r.pdf
*/
#include "common.h"
diff --git a/library/debug.c b/library/debug.c
index 56bc3f6..0983cb0 100644
--- a/library/debug.c
+++ b/library/debug.c
@@ -144,7 +144,6 @@
debug_send_line(ssl, level, file, line, str);
- idx = 0;
memset(txt, 0, sizeof(txt));
for (i = 0; i < len; i++) {
if (i >= 4096) {
@@ -202,17 +201,54 @@
}
#endif /* MBEDTLS_ECP_LIGHT */
-#if defined(MBEDTLS_BIGNUM_C)
#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
+static void mbedtls_debug_print_ec_coord(const mbedtls_ssl_context *ssl, int level,
+ const char *file, int line, const char *text,
+ const unsigned char *buf, size_t len)
+{
+ char str[DEBUG_BUF_SIZE];
+ size_t i, idx = 0;
+
+ mbedtls_snprintf(str + idx, sizeof(str) - idx, "value of '%s' (%u bits) is:\n",
+ text, (unsigned int) len * 8);
+
+ debug_send_line(ssl, level, file, line, str);
+
+ for (i = 0; i < len; i++) {
+ if (i >= 4096) {
+ break;
+ }
+
+ if (i % 16 == 0) {
+ if (i > 0) {
+ mbedtls_snprintf(str + idx, sizeof(str) - idx, "\n");
+ debug_send_line(ssl, level, file, line, str);
+
+ idx = 0;
+ }
+ }
+
+ idx += mbedtls_snprintf(str + idx, sizeof(str) - idx, " %02x",
+ (unsigned int) buf[i]);
+ }
+
+ if (len > 0) {
+ for (/* i = i */; i % 16 != 0; i++) {
+ idx += mbedtls_snprintf(str + idx, sizeof(str) - idx, " ");
+ }
+
+ mbedtls_snprintf(str + idx, sizeof(str) - idx, "\n");
+ debug_send_line(ssl, level, file, line, str);
+ }
+}
+
void mbedtls_debug_print_psa_ec(const mbedtls_ssl_context *ssl, int level,
const char *file, int line,
const char *text, const mbedtls_pk_context *pk)
{
char str[DEBUG_BUF_SIZE];
- mbedtls_mpi mpi;
- const uint8_t *mpi_start;
- size_t mpi_len;
- int ret;
+ const uint8_t *coord_start;
+ size_t coord_len;
if (NULL == ssl ||
NULL == ssl->conf ||
@@ -223,32 +259,21 @@
/* For the description of pk->pk_raw content please refer to the description
* psa_export_public_key() function. */
- mpi_len = (pk->pub_raw_len - 1)/2;
+ coord_len = (pk->pub_raw_len - 1)/2;
/* X coordinate */
- mbedtls_mpi_init(&mpi);
- mpi_start = pk->pub_raw + 1;
- ret = mbedtls_mpi_read_binary(&mpi, mpi_start, mpi_len);
- if (ret != 0) {
- return;
- }
+ coord_start = pk->pub_raw + 1;
mbedtls_snprintf(str, sizeof(str), "%s(X)", text);
- mbedtls_debug_print_mpi(ssl, level, file, line, str, &mpi);
- mbedtls_mpi_free(&mpi);
+ mbedtls_debug_print_ec_coord(ssl, level, file, line, str, coord_start, coord_len);
/* Y coordinate */
- mbedtls_mpi_init(&mpi);
- mpi_start = mpi_start + mpi_len;
- ret = mbedtls_mpi_read_binary(&mpi, mpi_start, mpi_len);
- if (ret != 0) {
- return;
- }
+ coord_start = coord_start + coord_len;
mbedtls_snprintf(str, sizeof(str), "%s(Y)", text);
- mbedtls_debug_print_mpi(ssl, level, file, line, str, &mpi);
- mbedtls_mpi_free(&mpi);
+ mbedtls_debug_print_ec_coord(ssl, level, file, line, str, coord_start, coord_len);
}
#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
+#if defined(MBEDTLS_BIGNUM_C)
void mbedtls_debug_print_mpi(const mbedtls_ssl_context *ssl, int level,
const char *file, int line,
const char *text, const mbedtls_mpi *X)
@@ -324,19 +349,21 @@
mbedtls_snprintf(name, sizeof(name), "%s%s", text, items[i].name);
name[sizeof(name) - 1] = '\0';
+#if defined(MBEDTLS_RSA_C)
if (items[i].type == MBEDTLS_PK_DEBUG_MPI) {
mbedtls_debug_print_mpi(ssl, level, file, line, name, items[i].value);
} else
+#endif /* MBEDTLS_RSA_C */
#if defined(MBEDTLS_ECP_LIGHT)
if (items[i].type == MBEDTLS_PK_DEBUG_ECP) {
mbedtls_debug_print_ecp(ssl, level, file, line, name, items[i].value);
} else
-#endif
+#endif /* MBEDTLS_ECP_LIGHT */
#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
if (items[i].type == MBEDTLS_PK_DEBUG_PSA_EC) {
mbedtls_debug_print_psa_ec(ssl, level, file, line, name, items[i].value);
} else
-#endif
+#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
{ debug_send_line(ssl, level, file, line,
"should not happen\n"); }
}
diff --git a/library/ecp.c b/library/ecp.c
index 25af631..f9b6672 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -43,8 +43,6 @@
#include "common.h"
-#if !defined(MBEDTLS_ECP_WITH_MPI_UINT)
-
/**
* \brief Function level alternative implementation.
*
@@ -591,11 +589,14 @@
}
if (grp->h != 1) {
- mbedtls_mpi_free(&grp->P);
mbedtls_mpi_free(&grp->A);
mbedtls_mpi_free(&grp->B);
mbedtls_ecp_point_free(&grp->G);
+
+#if !defined(MBEDTLS_ECP_WITH_MPI_UINT)
mbedtls_mpi_free(&grp->N);
+ mbedtls_mpi_free(&grp->P);
+#endif
}
if (!ecp_group_is_static_comb_table(grp) && grp->T != NULL) {
@@ -1254,7 +1255,7 @@
MPI_ECP_SQR(rhs, X);
/* Special case for A = -3 */
- if (grp->A.p == NULL) {
+ if (mbedtls_ecp_group_a_is_minus_3(grp)) {
MPI_ECP_SUB_INT(rhs, rhs, 3);
} else {
MPI_ECP_ADD(rhs, rhs, &grp->A);
@@ -1525,7 +1526,7 @@
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
/* Special case for A = -3 */
- if (grp->A.p == NULL) {
+ if (mbedtls_ecp_group_a_is_minus_3(grp)) {
/* tmp[0] <- M = 3(X + Z^2)(X - Z^2) */
MPI_ECP_SQR(&tmp[1], &P->Z);
MPI_ECP_ADD(&tmp[2], &P->X, &tmp[1]);
@@ -3638,18 +3639,6 @@
#endif /* MBEDTLS_SELF_TEST */
-#if defined(MBEDTLS_TEST_HOOKS)
-
-MBEDTLS_STATIC_TESTABLE
-mbedtls_ecp_variant mbedtls_ecp_get_variant(void)
-{
- return MBEDTLS_ECP_VARIANT_WITH_MPI_STRUCT;
-}
-
-#endif /* MBEDTLS_TEST_HOOKS */
-
#endif /* !MBEDTLS_ECP_ALT */
#endif /* MBEDTLS_ECP_LIGHT */
-
-#endif /* !MBEDTLS_ECP_WITH_MPI_UINT */
diff --git a/library/ecp_curves.c b/library/ecp_curves.c
index 4ea36e3..7b850e5 100644
--- a/library/ecp_curves.c
+++ b/library/ecp_curves.c
@@ -5463,6 +5463,16 @@
}
#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
+#if defined(MBEDTLS_TEST_HOOKS)
+
+MBEDTLS_STATIC_TESTABLE
+mbedtls_ecp_variant mbedtls_ecp_get_variant(void)
+{
+ return MBEDTLS_ECP_VARIANT_WITH_MPI_STRUCT;
+}
+
+#endif /* MBEDTLS_TEST_HOOKS */
+
#endif /* !MBEDTLS_ECP_ALT */
#endif /* MBEDTLS_ECP_LIGHT */
diff --git a/library/ecp_curves_new.c b/library/ecp_curves_new.c
index 9a36016..d431dcf 100644
--- a/library/ecp_curves_new.c
+++ b/library/ecp_curves_new.c
@@ -6039,6 +6039,17 @@
return 0;
}
#endif /* MBEDTLS_TEST_HOOKS */
+
+#if defined(MBEDTLS_TEST_HOOKS)
+
+MBEDTLS_STATIC_TESTABLE
+mbedtls_ecp_variant mbedtls_ecp_get_variant(void)
+{
+ return MBEDTLS_ECP_VARIANT_WITH_MPI_UINT;
+}
+
+#endif /* MBEDTLS_TEST_HOOKS */
+
#endif /* !MBEDTLS_ECP_ALT */
#endif /* MBEDTLS_ECP_LIGHT */
#endif /* MBEDTLS_ECP_WITH_MPI_UINT */
diff --git a/library/ecp_new.c b/library/ecp_new.c
deleted file mode 100644
index 0635d53..0000000
--- a/library/ecp_new.c
+++ /dev/null
@@ -1,3655 +0,0 @@
-/*
- * Elliptic curves over GF(p): generic functions
- *
- * Copyright The Mbed TLS Contributors
- * SPDX-License-Identifier: Apache-2.0
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/*
- * References:
- *
- * SEC1 https://www.secg.org/sec1-v2.pdf
- * GECC = Guide to Elliptic Curve Cryptography - Hankerson, Menezes, Vanstone
- * FIPS 186-3 http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
- * RFC 4492 for the related TLS structures and constants
- * - https://www.rfc-editor.org/rfc/rfc4492
- * RFC 7748 for the Curve448 and Curve25519 curve definitions
- * - https://www.rfc-editor.org/rfc/rfc7748
- *
- * [Curve25519] https://cr.yp.to/ecdh/curve25519-20060209.pdf
- *
- * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis
- * for elliptic curve cryptosystems. In : Cryptographic Hardware and
- * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302.
- * <http://link.springer.com/chapter/10.1007/3-540-48059-5_25>
- *
- * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to
- * render ECC resistant against Side Channel Attacks. IACR Cryptology
- * ePrint Archive, 2004, vol. 2004, p. 342.
- * <http://eprint.iacr.org/2004/342.pdf>
- */
-
-#include "common.h"
-
-#if defined(MBEDTLS_ECP_WITH_MPI_UINT)
-
-/**
- * \brief Function level alternative implementation.
- *
- * The MBEDTLS_ECP_INTERNAL_ALT macro enables alternative implementations to
- * replace certain functions in this module. The alternative implementations are
- * typically hardware accelerators and need to activate the hardware before the
- * computation starts and deactivate it after it finishes. The
- * mbedtls_internal_ecp_init() and mbedtls_internal_ecp_free() functions serve
- * this purpose.
- *
- * To preserve the correct functionality the following conditions must hold:
- *
- * - The alternative implementation must be activated by
- * mbedtls_internal_ecp_init() before any of the replaceable functions is
- * called.
- * - mbedtls_internal_ecp_free() must \b only be called when the alternative
- * implementation is activated.
- * - mbedtls_internal_ecp_init() must \b not be called when the alternative
- * implementation is activated.
- * - Public functions must not return while the alternative implementation is
- * activated.
- * - Replaceable functions are guarded by \c MBEDTLS_ECP_XXX_ALT macros and
- * before calling them an \code if( mbedtls_internal_ecp_grp_capable( grp ) )
- * \endcode ensures that the alternative implementation supports the current
- * group.
- */
-#if defined(MBEDTLS_ECP_INTERNAL_ALT)
-#endif
-
-#if defined(MBEDTLS_ECP_LIGHT)
-
-#include "mbedtls/ecp.h"
-#include "mbedtls/threading.h"
-#include "mbedtls/platform_util.h"
-#include "mbedtls/error.h"
-
-#include "bn_mul.h"
-#include "ecp_invasive.h"
-
-#include <string.h>
-
-#if !defined(MBEDTLS_ECP_ALT)
-
-#include "mbedtls/platform.h"
-
-#include "ecp_internal_alt.h"
-
-#if defined(MBEDTLS_SELF_TEST)
-/*
- * Counts of point addition and doubling, and field multiplications.
- * Used to test resistance of point multiplication to simple timing attacks.
- */
-#if defined(MBEDTLS_ECP_C)
-static unsigned long add_count, dbl_count;
-#endif /* MBEDTLS_ECP_C */
-static unsigned long mul_count;
-#endif
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
-/*
- * Maximum number of "basic operations" to be done in a row.
- *
- * Default value 0 means that ECC operations will not yield.
- * Note that regardless of the value of ecp_max_ops, always at
- * least one step is performed before yielding.
- *
- * Setting ecp_max_ops=1 can be suitable for testing purposes
- * as it will interrupt computation at all possible points.
- */
-static unsigned ecp_max_ops = 0;
-
-/*
- * Set ecp_max_ops
- */
-void mbedtls_ecp_set_max_ops(unsigned max_ops)
-{
- ecp_max_ops = max_ops;
-}
-
-/*
- * Check if restart is enabled
- */
-int mbedtls_ecp_restart_is_enabled(void)
-{
- return ecp_max_ops != 0;
-}
-
-/*
- * Restart sub-context for ecp_mul_comb()
- */
-struct mbedtls_ecp_restart_mul {
- mbedtls_ecp_point R; /* current intermediate result */
- size_t i; /* current index in various loops, 0 outside */
- mbedtls_ecp_point *T; /* table for precomputed points */
- unsigned char T_size; /* number of points in table T */
- enum { /* what were we doing last time we returned? */
- ecp_rsm_init = 0, /* nothing so far, dummy initial state */
- ecp_rsm_pre_dbl, /* precompute 2^n multiples */
- ecp_rsm_pre_norm_dbl, /* normalize precomputed 2^n multiples */
- ecp_rsm_pre_add, /* precompute remaining points by adding */
- ecp_rsm_pre_norm_add, /* normalize all precomputed points */
- ecp_rsm_comb_core, /* ecp_mul_comb_core() */
- ecp_rsm_final_norm, /* do the final normalization */
- } state;
-};
-
-/*
- * Init restart_mul sub-context
- */
-static void ecp_restart_rsm_init(mbedtls_ecp_restart_mul_ctx *ctx)
-{
- mbedtls_ecp_point_init(&ctx->R);
- ctx->i = 0;
- ctx->T = NULL;
- ctx->T_size = 0;
- ctx->state = ecp_rsm_init;
-}
-
-/*
- * Free the components of a restart_mul sub-context
- */
-static void ecp_restart_rsm_free(mbedtls_ecp_restart_mul_ctx *ctx)
-{
- unsigned char i;
-
- if (ctx == NULL) {
- return;
- }
-
- mbedtls_ecp_point_free(&ctx->R);
-
- if (ctx->T != NULL) {
- for (i = 0; i < ctx->T_size; i++) {
- mbedtls_ecp_point_free(ctx->T + i);
- }
- mbedtls_free(ctx->T);
- }
-
- ecp_restart_rsm_init(ctx);
-}
-
-/*
- * Restart context for ecp_muladd()
- */
-struct mbedtls_ecp_restart_muladd {
- mbedtls_ecp_point mP; /* mP value */
- mbedtls_ecp_point R; /* R intermediate result */
- enum { /* what should we do next? */
- ecp_rsma_mul1 = 0, /* first multiplication */
- ecp_rsma_mul2, /* second multiplication */
- ecp_rsma_add, /* addition */
- ecp_rsma_norm, /* normalization */
- } state;
-};
-
-/*
- * Init restart_muladd sub-context
- */
-static void ecp_restart_ma_init(mbedtls_ecp_restart_muladd_ctx *ctx)
-{
- mbedtls_ecp_point_init(&ctx->mP);
- mbedtls_ecp_point_init(&ctx->R);
- ctx->state = ecp_rsma_mul1;
-}
-
-/*
- * Free the components of a restart_muladd sub-context
- */
-static void ecp_restart_ma_free(mbedtls_ecp_restart_muladd_ctx *ctx)
-{
- if (ctx == NULL) {
- return;
- }
-
- mbedtls_ecp_point_free(&ctx->mP);
- mbedtls_ecp_point_free(&ctx->R);
-
- ecp_restart_ma_init(ctx);
-}
-
-/*
- * Initialize a restart context
- */
-void mbedtls_ecp_restart_init(mbedtls_ecp_restart_ctx *ctx)
-{
- ctx->ops_done = 0;
- ctx->depth = 0;
- ctx->rsm = NULL;
- ctx->ma = NULL;
-}
-
-/*
- * Free the components of a restart context
- */
-void mbedtls_ecp_restart_free(mbedtls_ecp_restart_ctx *ctx)
-{
- if (ctx == NULL) {
- return;
- }
-
- ecp_restart_rsm_free(ctx->rsm);
- mbedtls_free(ctx->rsm);
-
- ecp_restart_ma_free(ctx->ma);
- mbedtls_free(ctx->ma);
-
- mbedtls_ecp_restart_init(ctx);
-}
-
-/*
- * Check if we can do the next step
- */
-int mbedtls_ecp_check_budget(const mbedtls_ecp_group *grp,
- mbedtls_ecp_restart_ctx *rs_ctx,
- unsigned ops)
-{
- if (rs_ctx != NULL && ecp_max_ops != 0) {
- /* scale depending on curve size: the chosen reference is 256-bit,
- * and multiplication is quadratic. Round to the closest integer. */
- if (grp->pbits >= 512) {
- ops *= 4;
- } else if (grp->pbits >= 384) {
- ops *= 2;
- }
-
- /* Avoid infinite loops: always allow first step.
- * Because of that, however, it's not generally true
- * that ops_done <= ecp_max_ops, so the check
- * ops_done > ecp_max_ops below is mandatory. */
- if ((rs_ctx->ops_done != 0) &&
- (rs_ctx->ops_done > ecp_max_ops ||
- ops > ecp_max_ops - rs_ctx->ops_done)) {
- return MBEDTLS_ERR_ECP_IN_PROGRESS;
- }
-
- /* update running count */
- rs_ctx->ops_done += ops;
- }
-
- return 0;
-}
-
-/* Call this when entering a function that needs its own sub-context */
-#define ECP_RS_ENTER(SUB) do { \
- /* reset ops count for this call if top-level */ \
- if (rs_ctx != NULL && rs_ctx->depth++ == 0) \
- rs_ctx->ops_done = 0; \
- \
- /* set up our own sub-context if needed */ \
- if (mbedtls_ecp_restart_is_enabled() && \
- rs_ctx != NULL && rs_ctx->SUB == NULL) \
- { \
- rs_ctx->SUB = mbedtls_calloc(1, sizeof(*rs_ctx->SUB)); \
- if (rs_ctx->SUB == NULL) \
- return MBEDTLS_ERR_ECP_ALLOC_FAILED; \
- \
- ecp_restart_## SUB ##_init(rs_ctx->SUB); \
- } \
-} while (0)
-
-/* Call this when leaving a function that needs its own sub-context */
-#define ECP_RS_LEAVE(SUB) do { \
- /* clear our sub-context when not in progress (done or error) */ \
- if (rs_ctx != NULL && rs_ctx->SUB != NULL && \
- ret != MBEDTLS_ERR_ECP_IN_PROGRESS) \
- { \
- ecp_restart_## SUB ##_free(rs_ctx->SUB); \
- mbedtls_free(rs_ctx->SUB); \
- rs_ctx->SUB = NULL; \
- } \
- \
- if (rs_ctx != NULL) \
- rs_ctx->depth--; \
-} while (0)
-
-#else /* MBEDTLS_ECP_RESTARTABLE */
-
-#define ECP_RS_ENTER(sub) (void) rs_ctx;
-#define ECP_RS_LEAVE(sub) (void) rs_ctx;
-
-#endif /* MBEDTLS_ECP_RESTARTABLE */
-
-#if defined(MBEDTLS_ECP_C)
-static void mpi_init_many(mbedtls_mpi *arr, size_t size)
-{
- while (size--) {
- mbedtls_mpi_init(arr++);
- }
-}
-
-static void mpi_free_many(mbedtls_mpi *arr, size_t size)
-{
- while (size--) {
- mbedtls_mpi_free(arr++);
- }
-}
-#endif /* MBEDTLS_ECP_C */
-
-/*
- * List of supported curves:
- * - internal ID
- * - TLS NamedCurve ID (RFC 4492 sec. 5.1.1, RFC 7071 sec. 2, RFC 8446 sec. 4.2.7)
- * - size in bits
- * - readable name
- *
- * Curves are listed in order: largest curves first, and for a given size,
- * fastest curves first.
- *
- * Reminder: update profiles in x509_crt.c and ssl_tls.c when adding a new curve!
- */
-static const mbedtls_ecp_curve_info ecp_supported_curves[] =
-{
-#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
- { MBEDTLS_ECP_DP_SECP521R1, 25, 521, "secp521r1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
- { MBEDTLS_ECP_DP_BP512R1, 28, 512, "brainpoolP512r1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
- { MBEDTLS_ECP_DP_SECP384R1, 24, 384, "secp384r1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
- { MBEDTLS_ECP_DP_BP384R1, 27, 384, "brainpoolP384r1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
- { MBEDTLS_ECP_DP_SECP256R1, 23, 256, "secp256r1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
- { MBEDTLS_ECP_DP_SECP256K1, 22, 256, "secp256k1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
- { MBEDTLS_ECP_DP_BP256R1, 26, 256, "brainpoolP256r1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
- { MBEDTLS_ECP_DP_SECP224R1, 21, 224, "secp224r1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
- { MBEDTLS_ECP_DP_SECP224K1, 20, 224, "secp224k1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
- { MBEDTLS_ECP_DP_SECP192R1, 19, 192, "secp192r1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
- { MBEDTLS_ECP_DP_SECP192K1, 18, 192, "secp192k1" },
-#endif
-#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
- { MBEDTLS_ECP_DP_CURVE25519, 29, 256, "x25519" },
-#endif
-#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
- { MBEDTLS_ECP_DP_CURVE448, 30, 448, "x448" },
-#endif
- { MBEDTLS_ECP_DP_NONE, 0, 0, NULL },
-};
-
-#define ECP_NB_CURVES sizeof(ecp_supported_curves) / \
- sizeof(ecp_supported_curves[0])
-
-static mbedtls_ecp_group_id ecp_supported_grp_id[ECP_NB_CURVES];
-
-/*
- * List of supported curves and associated info
- */
-const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list(void)
-{
- return ecp_supported_curves;
-}
-
-/*
- * List of supported curves, group ID only
- */
-const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list(void)
-{
- static int init_done = 0;
-
- if (!init_done) {
- size_t i = 0;
- const mbedtls_ecp_curve_info *curve_info;
-
- for (curve_info = mbedtls_ecp_curve_list();
- curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
- curve_info++) {
- ecp_supported_grp_id[i++] = curve_info->grp_id;
- }
- ecp_supported_grp_id[i] = MBEDTLS_ECP_DP_NONE;
-
- init_done = 1;
- }
-
- return ecp_supported_grp_id;
-}
-
-/*
- * Get the curve info for the internal identifier
- */
-const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id(mbedtls_ecp_group_id grp_id)
-{
- const mbedtls_ecp_curve_info *curve_info;
-
- for (curve_info = mbedtls_ecp_curve_list();
- curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
- curve_info++) {
- if (curve_info->grp_id == grp_id) {
- return curve_info;
- }
- }
-
- return NULL;
-}
-
-/*
- * Get the curve info from the TLS identifier
- */
-const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id(uint16_t tls_id)
-{
- const mbedtls_ecp_curve_info *curve_info;
-
- for (curve_info = mbedtls_ecp_curve_list();
- curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
- curve_info++) {
- if (curve_info->tls_id == tls_id) {
- return curve_info;
- }
- }
-
- return NULL;
-}
-
-/*
- * Get the curve info from the name
- */
-const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_name(const char *name)
-{
- const mbedtls_ecp_curve_info *curve_info;
-
- if (name == NULL) {
- return NULL;
- }
-
- for (curve_info = mbedtls_ecp_curve_list();
- curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
- curve_info++) {
- if (strcmp(curve_info->name, name) == 0) {
- return curve_info;
- }
- }
-
- return NULL;
-}
-
-/*
- * Get the type of a curve
- */
-mbedtls_ecp_curve_type mbedtls_ecp_get_type(const mbedtls_ecp_group *grp)
-{
- if (grp->G.X.p == NULL) {
- return MBEDTLS_ECP_TYPE_NONE;
- }
-
- if (grp->G.Y.p == NULL) {
- return MBEDTLS_ECP_TYPE_MONTGOMERY;
- } else {
- return MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS;
- }
-}
-
-/*
- * Initialize (the components of) a point
- */
-void mbedtls_ecp_point_init(mbedtls_ecp_point *pt)
-{
- mbedtls_mpi_init(&pt->X);
- mbedtls_mpi_init(&pt->Y);
- mbedtls_mpi_init(&pt->Z);
-}
-
-/*
- * Initialize (the components of) a group
- */
-void mbedtls_ecp_group_init(mbedtls_ecp_group *grp)
-{
- grp->id = MBEDTLS_ECP_DP_NONE;
- mbedtls_mpi_init(&grp->P);
- mbedtls_mpi_init(&grp->A);
- mbedtls_mpi_init(&grp->B);
- mbedtls_ecp_point_init(&grp->G);
- mbedtls_mpi_init(&grp->N);
- grp->pbits = 0;
- grp->nbits = 0;
- grp->h = 0;
- grp->modp = NULL;
- grp->t_pre = NULL;
- grp->t_post = NULL;
- grp->t_data = NULL;
- grp->T = NULL;
- grp->T_size = 0;
-}
-
-/*
- * Initialize (the components of) a key pair
- */
-void mbedtls_ecp_keypair_init(mbedtls_ecp_keypair *key)
-{
- mbedtls_ecp_group_init(&key->grp);
- mbedtls_mpi_init(&key->d);
- mbedtls_ecp_point_init(&key->Q);
-}
-
-/*
- * Unallocate (the components of) a point
- */
-void mbedtls_ecp_point_free(mbedtls_ecp_point *pt)
-{
- if (pt == NULL) {
- return;
- }
-
- mbedtls_mpi_free(&(pt->X));
- mbedtls_mpi_free(&(pt->Y));
- mbedtls_mpi_free(&(pt->Z));
-}
-
-/*
- * Check that the comb table (grp->T) is static initialized.
- */
-static int ecp_group_is_static_comb_table(const mbedtls_ecp_group *grp)
-{
-#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
- return grp->T != NULL && grp->T_size == 0;
-#else
- (void) grp;
- return 0;
-#endif
-}
-
-/*
- * Unallocate (the components of) a group
- */
-void mbedtls_ecp_group_free(mbedtls_ecp_group *grp)
-{
- size_t i;
-
- if (grp == NULL) {
- return;
- }
-
- if (grp->h != 1) {
- mbedtls_mpi_free(&grp->A);
- mbedtls_mpi_free(&grp->B);
- mbedtls_ecp_point_free(&grp->G);
- }
-
- if (!ecp_group_is_static_comb_table(grp) && grp->T != NULL) {
- for (i = 0; i < grp->T_size; i++) {
- mbedtls_ecp_point_free(&grp->T[i]);
- }
- mbedtls_free(grp->T);
- }
-
- mbedtls_platform_zeroize(grp, sizeof(mbedtls_ecp_group));
-}
-
-/*
- * Unallocate (the components of) a key pair
- */
-void mbedtls_ecp_keypair_free(mbedtls_ecp_keypair *key)
-{
- if (key == NULL) {
- return;
- }
-
- mbedtls_ecp_group_free(&key->grp);
- mbedtls_mpi_free(&key->d);
- mbedtls_ecp_point_free(&key->Q);
-}
-
-/*
- * Copy the contents of a point
- */
-int mbedtls_ecp_copy(mbedtls_ecp_point *P, const mbedtls_ecp_point *Q)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&P->X, &Q->X));
- MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&P->Y, &Q->Y));
- MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&P->Z, &Q->Z));
-
-cleanup:
- return ret;
-}
-
-/*
- * Copy the contents of a group object
- */
-int mbedtls_ecp_group_copy(mbedtls_ecp_group *dst, const mbedtls_ecp_group *src)
-{
- return mbedtls_ecp_group_load(dst, src->id);
-}
-
-/*
- * Set point to zero
- */
-int mbedtls_ecp_set_zero(mbedtls_ecp_point *pt)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->X, 1));
- MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->Y, 1));
- MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->Z, 0));
-
-cleanup:
- return ret;
-}
-
-/*
- * Tell if a point is zero
- */
-int mbedtls_ecp_is_zero(mbedtls_ecp_point *pt)
-{
- return mbedtls_mpi_cmp_int(&pt->Z, 0) == 0;
-}
-
-/*
- * Compare two points lazily
- */
-int mbedtls_ecp_point_cmp(const mbedtls_ecp_point *P,
- const mbedtls_ecp_point *Q)
-{
- if (mbedtls_mpi_cmp_mpi(&P->X, &Q->X) == 0 &&
- mbedtls_mpi_cmp_mpi(&P->Y, &Q->Y) == 0 &&
- mbedtls_mpi_cmp_mpi(&P->Z, &Q->Z) == 0) {
- return 0;
- }
-
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
-}
-
-/*
- * Import a non-zero point from ASCII strings
- */
-int mbedtls_ecp_point_read_string(mbedtls_ecp_point *P, int radix,
- const char *x, const char *y)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&P->X, radix, x));
- MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&P->Y, radix, y));
- MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&P->Z, 1));
-
-cleanup:
- return ret;
-}
-
-/*
- * Export a point into unsigned binary data (SEC1 2.3.3 and RFC7748)
- */
-int mbedtls_ecp_point_write_binary(const mbedtls_ecp_group *grp,
- const mbedtls_ecp_point *P,
- int format, size_t *olen,
- unsigned char *buf, size_t buflen)
-{
- int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
- size_t plen;
- if (format != MBEDTLS_ECP_PF_UNCOMPRESSED &&
- format != MBEDTLS_ECP_PF_COMPRESSED) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- plen = mbedtls_mpi_size(&grp->P);
-
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- (void) format; /* Montgomery curves always use the same point format */
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
- *olen = plen;
- if (buflen < *olen) {
- return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
- }
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary_le(&P->X, buf, plen));
- }
-#endif
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
- /*
- * Common case: P == 0
- */
- if (mbedtls_mpi_cmp_int(&P->Z, 0) == 0) {
- if (buflen < 1) {
- return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
- }
-
- buf[0] = 0x00;
- *olen = 1;
-
- return 0;
- }
-
- if (format == MBEDTLS_ECP_PF_UNCOMPRESSED) {
- *olen = 2 * plen + 1;
-
- if (buflen < *olen) {
- return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
- }
-
- buf[0] = 0x04;
- MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&P->X, buf + 1, plen));
- MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&P->Y, buf + 1 + plen, plen));
- } else if (format == MBEDTLS_ECP_PF_COMPRESSED) {
- *olen = plen + 1;
-
- if (buflen < *olen) {
- return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
- }
-
- buf[0] = 0x02 + mbedtls_mpi_get_bit(&P->Y, 0);
- MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&P->X, buf + 1, plen));
- }
- }
-#endif
-
-cleanup:
- return ret;
-}
-
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
-static int mbedtls_ecp_sw_derive_y(const mbedtls_ecp_group *grp,
- const mbedtls_mpi *X,
- mbedtls_mpi *Y,
- int parity_bit);
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-
-/*
- * Import a point from unsigned binary data (SEC1 2.3.4 and RFC7748)
- */
-int mbedtls_ecp_point_read_binary(const mbedtls_ecp_group *grp,
- mbedtls_ecp_point *pt,
- const unsigned char *buf, size_t ilen)
-{
- int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
- size_t plen;
- if (ilen < 1) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- plen = mbedtls_mpi_size(&grp->P);
-
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
- if (plen != ilen) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary_le(&pt->X, buf, plen));
- mbedtls_mpi_free(&pt->Y);
-
- if (grp->id == MBEDTLS_ECP_DP_CURVE25519) {
- /* Set most significant bit to 0 as prescribed in RFC7748 §5 */
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&pt->X, plen * 8 - 1, 0));
- }
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->Z, 1));
- }
-#endif
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
- if (buf[0] == 0x00) {
- if (ilen == 1) {
- return mbedtls_ecp_set_zero(pt);
- } else {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
- }
-
- if (ilen < 1 + plen) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&pt->X, buf + 1, plen));
- MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->Z, 1));
-
- if (buf[0] == 0x04) {
- /* format == MBEDTLS_ECP_PF_UNCOMPRESSED */
- if (ilen != 1 + plen * 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
- return mbedtls_mpi_read_binary(&pt->Y, buf + 1 + plen, plen);
- } else if (buf[0] == 0x02 || buf[0] == 0x03) {
- /* format == MBEDTLS_ECP_PF_COMPRESSED */
- if (ilen != 1 + plen) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
- return mbedtls_ecp_sw_derive_y(grp, &pt->X, &pt->Y,
- (buf[0] & 1));
- } else {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
- }
-#endif
-
-cleanup:
- return ret;
-}
-
-/*
- * Import a point from a TLS ECPoint record (RFC 4492)
- * struct {
- * opaque point <1..2^8-1>;
- * } ECPoint;
- */
-int mbedtls_ecp_tls_read_point(const mbedtls_ecp_group *grp,
- mbedtls_ecp_point *pt,
- const unsigned char **buf, size_t buf_len)
-{
- unsigned char data_len;
- const unsigned char *buf_start;
- /*
- * We must have at least two bytes (1 for length, at least one for data)
- */
- if (buf_len < 2) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- data_len = *(*buf)++;
- if (data_len < 1 || data_len > buf_len - 1) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- /*
- * Save buffer start for read_binary and update buf
- */
- buf_start = *buf;
- *buf += data_len;
-
- return mbedtls_ecp_point_read_binary(grp, pt, buf_start, data_len);
-}
-
-/*
- * Export a point as a TLS ECPoint record (RFC 4492)
- * struct {
- * opaque point <1..2^8-1>;
- * } ECPoint;
- */
-int mbedtls_ecp_tls_write_point(const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt,
- int format, size_t *olen,
- unsigned char *buf, size_t blen)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- if (format != MBEDTLS_ECP_PF_UNCOMPRESSED &&
- format != MBEDTLS_ECP_PF_COMPRESSED) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- /*
- * buffer length must be at least one, for our length byte
- */
- if (blen < 1) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- if ((ret = mbedtls_ecp_point_write_binary(grp, pt, format,
- olen, buf + 1, blen - 1)) != 0) {
- return ret;
- }
-
- /*
- * write length to the first byte and update total length
- */
- buf[0] = (unsigned char) *olen;
- ++*olen;
-
- return 0;
-}
-
-/*
- * Set a group from an ECParameters record (RFC 4492)
- */
-int mbedtls_ecp_tls_read_group(mbedtls_ecp_group *grp,
- const unsigned char **buf, size_t len)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_ecp_group_id grp_id;
- if ((ret = mbedtls_ecp_tls_read_group_id(&grp_id, buf, len)) != 0) {
- return ret;
- }
-
- return mbedtls_ecp_group_load(grp, grp_id);
-}
-
-/*
- * Read a group id from an ECParameters record (RFC 4492) and convert it to
- * mbedtls_ecp_group_id.
- */
-int mbedtls_ecp_tls_read_group_id(mbedtls_ecp_group_id *grp,
- const unsigned char **buf, size_t len)
-{
- uint16_t tls_id;
- const mbedtls_ecp_curve_info *curve_info;
- /*
- * We expect at least three bytes (see below)
- */
- if (len < 3) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- /*
- * First byte is curve_type; only named_curve is handled
- */
- if (*(*buf)++ != MBEDTLS_ECP_TLS_NAMED_CURVE) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- /*
- * Next two bytes are the namedcurve value
- */
- tls_id = *(*buf)++;
- tls_id <<= 8;
- tls_id |= *(*buf)++;
-
- if ((curve_info = mbedtls_ecp_curve_info_from_tls_id(tls_id)) == NULL) {
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
- }
-
- *grp = curve_info->grp_id;
-
- return 0;
-}
-
-/*
- * Write the ECParameters record corresponding to a group (RFC 4492)
- */
-int mbedtls_ecp_tls_write_group(const mbedtls_ecp_group *grp, size_t *olen,
- unsigned char *buf, size_t blen)
-{
- const mbedtls_ecp_curve_info *curve_info;
- if ((curve_info = mbedtls_ecp_curve_info_from_grp_id(grp->id)) == NULL) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- /*
- * We are going to write 3 bytes (see below)
- */
- *olen = 3;
- if (blen < *olen) {
- return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
- }
-
- /*
- * First byte is curve_type, always named_curve
- */
- *buf++ = MBEDTLS_ECP_TLS_NAMED_CURVE;
-
- /*
- * Next two bytes are the namedcurve value
- */
- MBEDTLS_PUT_UINT16_BE(curve_info->tls_id, buf, 0);
-
- return 0;
-}
-
-/*
- * Wrapper around fast quasi-modp functions, with fall-back to mbedtls_mpi_mod_mpi.
- * See the documentation of struct mbedtls_ecp_group.
- *
- * This function is in the critial loop for mbedtls_ecp_mul, so pay attention to perf.
- */
-static int ecp_modp(mbedtls_mpi *N, const mbedtls_ecp_group *grp)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-
- if (grp->modp == NULL) {
- return mbedtls_mpi_mod_mpi(N, N, &grp->P);
- }
-
- /* N->s < 0 is a much faster test, which fails only if N is 0 */
- if ((N->s < 0 && mbedtls_mpi_cmp_int(N, 0) != 0) ||
- mbedtls_mpi_bitlen(N) > 2 * grp->pbits) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- MBEDTLS_MPI_CHK(grp->modp(N));
-
- /* N->s < 0 is a much faster test, which fails only if N is 0 */
- while (N->s < 0 && mbedtls_mpi_cmp_int(N, 0) != 0) {
- MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(N, N, &grp->P));
- }
-
- while (mbedtls_mpi_cmp_mpi(N, &grp->P) >= 0) {
- /* we known P, N and the result are positive */
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_abs(N, N, &grp->P));
- }
-
-cleanup:
- return ret;
-}
-
-/*
- * Fast mod-p functions expect their argument to be in the 0..p^2 range.
- *
- * In order to guarantee that, we need to ensure that operands of
- * mbedtls_mpi_mul_mpi are in the 0..p range. So, after each operation we will
- * bring the result back to this range.
- *
- * The following macros are shortcuts for doing that.
- */
-
-/*
- * Reduce a mbedtls_mpi mod p in-place, general case, to use after mbedtls_mpi_mul_mpi
- */
-#if defined(MBEDTLS_SELF_TEST)
-#define INC_MUL_COUNT mul_count++;
-#else
-#define INC_MUL_COUNT
-#endif
-
-#define MOD_MUL(N) \
- do \
- { \
- MBEDTLS_MPI_CHK(ecp_modp(&(N), grp)); \
- INC_MUL_COUNT \
- } while (0)
-
-static inline int mbedtls_mpi_mul_mod(const mbedtls_ecp_group *grp,
- mbedtls_mpi *X,
- const mbedtls_mpi *A,
- const mbedtls_mpi *B)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(X, A, B));
- MOD_MUL(*X);
-cleanup:
- return ret;
-}
-
-/*
- * Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_sub_mpi
- * N->s < 0 is a very fast test, which fails only if N is 0
- */
-#define MOD_SUB(N) \
- do { \
- while ((N)->s < 0 && mbedtls_mpi_cmp_int((N), 0) != 0) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi((N), (N), &grp->P)); \
- } while (0)
-
-#if (defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) && \
- !(defined(MBEDTLS_ECP_NO_FALLBACK) && \
- defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) && \
- defined(MBEDTLS_ECP_ADD_MIXED_ALT))) || \
- (defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) && \
- !(defined(MBEDTLS_ECP_NO_FALLBACK) && \
- defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)))
-static inline int mbedtls_mpi_sub_mod(const mbedtls_ecp_group *grp,
- mbedtls_mpi *X,
- const mbedtls_mpi *A,
- const mbedtls_mpi *B)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(X, A, B));
- MOD_SUB(X);
-cleanup:
- return ret;
-}
-#endif /* All functions referencing mbedtls_mpi_sub_mod() are alt-implemented without fallback */
-
-/*
- * Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_add_mpi and mbedtls_mpi_mul_int.
- * We known P, N and the result are positive, so sub_abs is correct, and
- * a bit faster.
- */
-#define MOD_ADD(N) \
- while (mbedtls_mpi_cmp_mpi((N), &grp->P) >= 0) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_abs((N), (N), &grp->P))
-
-static inline int mbedtls_mpi_add_mod(const mbedtls_ecp_group *grp,
- mbedtls_mpi *X,
- const mbedtls_mpi *A,
- const mbedtls_mpi *B)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(X, A, B));
- MOD_ADD(X);
-cleanup:
- return ret;
-}
-
-static inline int mbedtls_mpi_mul_int_mod(const mbedtls_ecp_group *grp,
- mbedtls_mpi *X,
- const mbedtls_mpi *A,
- mbedtls_mpi_uint c)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_mul_int(X, A, c));
- MOD_ADD(X);
-cleanup:
- return ret;
-}
-
-static inline int mbedtls_mpi_sub_int_mod(const mbedtls_ecp_group *grp,
- mbedtls_mpi *X,
- const mbedtls_mpi *A,
- mbedtls_mpi_uint c)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(X, A, c));
- MOD_SUB(X);
-cleanup:
- return ret;
-}
-
-#define MPI_ECP_SUB_INT(X, A, c) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int_mod(grp, X, A, c))
-
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) && \
- !(defined(MBEDTLS_ECP_NO_FALLBACK) && \
- defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) && \
- defined(MBEDTLS_ECP_ADD_MIXED_ALT))
-static inline int mbedtls_mpi_shift_l_mod(const mbedtls_ecp_group *grp,
- mbedtls_mpi *X,
- size_t count)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(X, count));
- MOD_ADD(X);
-cleanup:
- return ret;
-}
-#endif \
- /* All functions referencing mbedtls_mpi_shift_l_mod() are alt-implemented without fallback */
-
-/*
- * Macro wrappers around ECP modular arithmetic
- *
- * Currently, these wrappers are defined via the bignum module.
- */
-
-#define MPI_ECP_ADD(X, A, B) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_add_mod(grp, X, A, B))
-
-#define MPI_ECP_SUB(X, A, B) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mod(grp, X, A, B))
-
-#define MPI_ECP_MUL(X, A, B) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mod(grp, X, A, B))
-
-#define MPI_ECP_SQR(X, A) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mod(grp, X, A, A))
-
-#define MPI_ECP_MUL_INT(X, A, c) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_mul_int_mod(grp, X, A, c))
-
-#define MPI_ECP_INV(dst, src) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_inv_mod((dst), (src), &grp->P))
-
-#define MPI_ECP_MOV(X, A) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_copy(X, A))
-
-#define MPI_ECP_SHIFT_L(X, count) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l_mod(grp, X, count))
-
-#define MPI_ECP_LSET(X, c) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_lset(X, c))
-
-#define MPI_ECP_CMP_INT(X, c) \
- mbedtls_mpi_cmp_int(X, c)
-
-#define MPI_ECP_CMP(X, Y) \
- mbedtls_mpi_cmp_mpi(X, Y)
-
-/* Needs f_rng, p_rng to be defined. */
-#define MPI_ECP_RAND(X) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_random((X), 2, &grp->P, f_rng, p_rng))
-
-/* Conditional negation
- * Needs grp and a temporary MPI tmp to be defined. */
-#define MPI_ECP_COND_NEG(X, cond) \
- do \
- { \
- unsigned char nonzero = mbedtls_mpi_cmp_int((X), 0) != 0; \
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&tmp, &grp->P, (X))); \
- MBEDTLS_MPI_CHK(mbedtls_mpi_safe_cond_assign((X), &tmp, \
- nonzero & cond)); \
- } while (0)
-
-#define MPI_ECP_NEG(X) MPI_ECP_COND_NEG((X), 1)
-
-#define MPI_ECP_VALID(X) \
- ((X)->p != NULL)
-
-#define MPI_ECP_COND_ASSIGN(X, Y, cond) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_safe_cond_assign((X), (Y), (cond)))
-
-#define MPI_ECP_COND_SWAP(X, Y, cond) \
- MBEDTLS_MPI_CHK(mbedtls_mpi_safe_cond_swap((X), (Y), (cond)))
-
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
-
-/*
- * Computes the right-hand side of the Short Weierstrass equation
- * RHS = X^3 + A X + B
- */
-static int ecp_sw_rhs(const mbedtls_ecp_group *grp,
- mbedtls_mpi *rhs,
- const mbedtls_mpi *X)
-{
- int ret;
-
- /* Compute X^3 + A X + B as X (X^2 + A) + B */
- MPI_ECP_SQR(rhs, X);
-
- /* Special case for A = -3 */
- if (grp->A.p == NULL) {
- MPI_ECP_SUB_INT(rhs, rhs, 3);
- } else {
- MPI_ECP_ADD(rhs, rhs, &grp->A);
- }
-
- MPI_ECP_MUL(rhs, rhs, X);
- MPI_ECP_ADD(rhs, rhs, &grp->B);
-
-cleanup:
- return ret;
-}
-
-/*
- * Derive Y from X and a parity bit
- */
-static int mbedtls_ecp_sw_derive_y(const mbedtls_ecp_group *grp,
- const mbedtls_mpi *X,
- mbedtls_mpi *Y,
- int parity_bit)
-{
- /* w = y^2 = x^3 + ax + b
- * y = sqrt(w) = w^((p+1)/4) mod p (for prime p where p = 3 mod 4)
- *
- * Note: this method for extracting square root does not validate that w
- * was indeed a square so this function will return garbage in Y if X
- * does not correspond to a point on the curve.
- */
-
- /* Check prerequisite p = 3 mod 4 */
- if (mbedtls_mpi_get_bit(&grp->P, 0) != 1 ||
- mbedtls_mpi_get_bit(&grp->P, 1) != 1) {
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
- }
-
- int ret;
- mbedtls_mpi exp;
- mbedtls_mpi_init(&exp);
-
- /* use Y to store intermediate result, actually w above */
- MBEDTLS_MPI_CHK(ecp_sw_rhs(grp, Y, X));
-
- /* w = y^2 */ /* Y contains y^2 intermediate result */
- /* exp = ((p+1)/4) */
- MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&exp, &grp->P, 1));
- MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&exp, 2));
- /* sqrt(w) = w^((p+1)/4) mod p (for prime p where p = 3 mod 4) */
- MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(Y, Y /*y^2*/, &exp, &grp->P, NULL));
-
- /* check parity bit match or else invert Y */
- /* This quick inversion implementation is valid because Y != 0 for all
- * Short Weierstrass curves supported by mbedtls, as each supported curve
- * has an order that is a large prime, so each supported curve does not
- * have any point of order 2, and a point with Y == 0 would be of order 2 */
- if (mbedtls_mpi_get_bit(Y, 0) != parity_bit) {
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(Y, &grp->P, Y));
- }
-
-cleanup:
-
- mbedtls_mpi_free(&exp);
- return ret;
-}
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-
-#if defined(MBEDTLS_ECP_C)
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
-/*
- * For curves in short Weierstrass form, we do all the internal operations in
- * Jacobian coordinates.
- *
- * For multiplication, we'll use a comb method with countermeasures against
- * SPA, hence timing attacks.
- */
-
-/*
- * Normalize jacobian coordinates so that Z == 0 || Z == 1 (GECC 3.2.1)
- * Cost: 1N := 1I + 3M + 1S
- */
-static int ecp_normalize_jac(const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt)
-{
- if (MPI_ECP_CMP_INT(&pt->Z, 0) == 0) {
- return 0;
- }
-
-#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
- if (mbedtls_internal_ecp_grp_capable(grp)) {
- return mbedtls_internal_ecp_normalize_jac(grp, pt);
- }
-#endif /* MBEDTLS_ECP_NORMALIZE_JAC_ALT */
-
-#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-#else
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_mpi T;
- mbedtls_mpi_init(&T);
-
- MPI_ECP_INV(&T, &pt->Z); /* T <- 1 / Z */
- MPI_ECP_MUL(&pt->Y, &pt->Y, &T); /* Y' <- Y*T = Y / Z */
- MPI_ECP_SQR(&T, &T); /* T <- T^2 = 1 / Z^2 */
- MPI_ECP_MUL(&pt->X, &pt->X, &T); /* X <- X * T = X / Z^2 */
- MPI_ECP_MUL(&pt->Y, &pt->Y, &T); /* Y'' <- Y' * T = Y / Z^3 */
-
- MPI_ECP_LSET(&pt->Z, 1);
-
-cleanup:
-
- mbedtls_mpi_free(&T);
-
- return ret;
-#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) */
-}
-
-/*
- * Normalize jacobian coordinates of an array of (pointers to) points,
- * using Montgomery's trick to perform only one inversion mod P.
- * (See for example Cohen's "A Course in Computational Algebraic Number
- * Theory", Algorithm 10.3.4.)
- *
- * Warning: fails (returning an error) if one of the points is zero!
- * This should never happen, see choice of w in ecp_mul_comb().
- *
- * Cost: 1N(t) := 1I + (6t - 3)M + 1S
- */
-static int ecp_normalize_jac_many(const mbedtls_ecp_group *grp,
- mbedtls_ecp_point *T[], size_t T_size)
-{
- if (T_size < 2) {
- return ecp_normalize_jac(grp, *T);
- }
-
-#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
- if (mbedtls_internal_ecp_grp_capable(grp)) {
- return mbedtls_internal_ecp_normalize_jac_many(grp, T, T_size);
- }
-#endif
-
-#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-#else
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t i;
- mbedtls_mpi *c, t;
-
- if ((c = mbedtls_calloc(T_size, sizeof(mbedtls_mpi))) == NULL) {
- return MBEDTLS_ERR_ECP_ALLOC_FAILED;
- }
-
- mbedtls_mpi_init(&t);
-
- mpi_init_many(c, T_size);
- /*
- * c[i] = Z_0 * ... * Z_i, i = 0,..,n := T_size-1
- */
- MPI_ECP_MOV(&c[0], &T[0]->Z);
- for (i = 1; i < T_size; i++) {
- MPI_ECP_MUL(&c[i], &c[i-1], &T[i]->Z);
- }
-
- /*
- * c[n] = 1 / (Z_0 * ... * Z_n) mod P
- */
- MPI_ECP_INV(&c[T_size-1], &c[T_size-1]);
-
- for (i = T_size - 1;; i--) {
- /* At the start of iteration i (note that i decrements), we have
- * - c[j] = Z_0 * .... * Z_j for j < i,
- * - c[j] = 1 / (Z_0 * .... * Z_j) for j == i,
- *
- * This is maintained via
- * - c[i-1] <- c[i] * Z_i
- *
- * We also derive 1/Z_i = c[i] * c[i-1] for i>0 and use that
- * to do the actual normalization. For i==0, we already have
- * c[0] = 1 / Z_0.
- */
-
- if (i > 0) {
- /* Compute 1/Z_i and establish invariant for the next iteration. */
- MPI_ECP_MUL(&t, &c[i], &c[i-1]);
- MPI_ECP_MUL(&c[i-1], &c[i], &T[i]->Z);
- } else {
- MPI_ECP_MOV(&t, &c[0]);
- }
-
- /* Now t holds 1 / Z_i; normalize as in ecp_normalize_jac() */
- MPI_ECP_MUL(&T[i]->Y, &T[i]->Y, &t);
- MPI_ECP_SQR(&t, &t);
- MPI_ECP_MUL(&T[i]->X, &T[i]->X, &t);
- MPI_ECP_MUL(&T[i]->Y, &T[i]->Y, &t);
-
- /*
- * Post-precessing: reclaim some memory by shrinking coordinates
- * - not storing Z (always 1)
- * - shrinking other coordinates, but still keeping the same number of
- * limbs as P, as otherwise it will too likely be regrown too fast.
- */
- MBEDTLS_MPI_CHK(mbedtls_mpi_shrink(&T[i]->X, grp->P.n));
- MBEDTLS_MPI_CHK(mbedtls_mpi_shrink(&T[i]->Y, grp->P.n));
-
- MPI_ECP_LSET(&T[i]->Z, 1);
-
- if (i == 0) {
- break;
- }
- }
-
-cleanup:
-
- mbedtls_mpi_free(&t);
- mpi_free_many(c, T_size);
- mbedtls_free(c);
-
- return ret;
-#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) */
-}
-
-/*
- * Conditional point inversion: Q -> -Q = (Q.X, -Q.Y, Q.Z) without leak.
- * "inv" must be 0 (don't invert) or 1 (invert) or the result will be invalid
- */
-static int ecp_safe_invert_jac(const mbedtls_ecp_group *grp,
- mbedtls_ecp_point *Q,
- unsigned char inv)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_mpi tmp;
- mbedtls_mpi_init(&tmp);
-
- MPI_ECP_COND_NEG(&Q->Y, inv);
-
-cleanup:
- mbedtls_mpi_free(&tmp);
- return ret;
-}
-
-/*
- * Point doubling R = 2 P, Jacobian coordinates
- *
- * Based on http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-1998-cmo-2 .
- *
- * We follow the variable naming fairly closely. The formula variations that trade a MUL for a SQR
- * (plus a few ADDs) aren't useful as our bignum implementation doesn't distinguish squaring.
- *
- * Standard optimizations are applied when curve parameter A is one of { 0, -3 }.
- *
- * Cost: 1D := 3M + 4S (A == 0)
- * 4M + 4S (A == -3)
- * 3M + 6S + 1a otherwise
- */
-static int ecp_double_jac(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_ecp_point *P,
- mbedtls_mpi tmp[4])
-{
-#if defined(MBEDTLS_SELF_TEST)
- dbl_count++;
-#endif
-
-#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
- if (mbedtls_internal_ecp_grp_capable(grp)) {
- return mbedtls_internal_ecp_double_jac(grp, R, P);
- }
-#endif /* MBEDTLS_ECP_DOUBLE_JAC_ALT */
-
-#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-#else
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-
- /* Special case for A = -3 */
- if (grp->A.p == NULL) {
- /* tmp[0] <- M = 3(X + Z^2)(X - Z^2) */
- MPI_ECP_SQR(&tmp[1], &P->Z);
- MPI_ECP_ADD(&tmp[2], &P->X, &tmp[1]);
- MPI_ECP_SUB(&tmp[3], &P->X, &tmp[1]);
- MPI_ECP_MUL(&tmp[1], &tmp[2], &tmp[3]);
- MPI_ECP_MUL_INT(&tmp[0], &tmp[1], 3);
- } else {
- /* tmp[0] <- M = 3.X^2 + A.Z^4 */
- MPI_ECP_SQR(&tmp[1], &P->X);
- MPI_ECP_MUL_INT(&tmp[0], &tmp[1], 3);
-
- /* Optimize away for "koblitz" curves with A = 0 */
- if (MPI_ECP_CMP_INT(&grp->A, 0) != 0) {
- /* M += A.Z^4 */
- MPI_ECP_SQR(&tmp[1], &P->Z);
- MPI_ECP_SQR(&tmp[2], &tmp[1]);
- MPI_ECP_MUL(&tmp[1], &tmp[2], &grp->A);
- MPI_ECP_ADD(&tmp[0], &tmp[0], &tmp[1]);
- }
- }
-
- /* tmp[1] <- S = 4.X.Y^2 */
- MPI_ECP_SQR(&tmp[2], &P->Y);
- MPI_ECP_SHIFT_L(&tmp[2], 1);
- MPI_ECP_MUL(&tmp[1], &P->X, &tmp[2]);
- MPI_ECP_SHIFT_L(&tmp[1], 1);
-
- /* tmp[3] <- U = 8.Y^4 */
- MPI_ECP_SQR(&tmp[3], &tmp[2]);
- MPI_ECP_SHIFT_L(&tmp[3], 1);
-
- /* tmp[2] <- T = M^2 - 2.S */
- MPI_ECP_SQR(&tmp[2], &tmp[0]);
- MPI_ECP_SUB(&tmp[2], &tmp[2], &tmp[1]);
- MPI_ECP_SUB(&tmp[2], &tmp[2], &tmp[1]);
-
- /* tmp[1] <- S = M(S - T) - U */
- MPI_ECP_SUB(&tmp[1], &tmp[1], &tmp[2]);
- MPI_ECP_MUL(&tmp[1], &tmp[1], &tmp[0]);
- MPI_ECP_SUB(&tmp[1], &tmp[1], &tmp[3]);
-
- /* tmp[3] <- U = 2.Y.Z */
- MPI_ECP_MUL(&tmp[3], &P->Y, &P->Z);
- MPI_ECP_SHIFT_L(&tmp[3], 1);
-
- /* Store results */
- MPI_ECP_MOV(&R->X, &tmp[2]);
- MPI_ECP_MOV(&R->Y, &tmp[1]);
- MPI_ECP_MOV(&R->Z, &tmp[3]);
-
-cleanup:
-
- return ret;
-#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) */
-}
-
-/*
- * Addition: R = P + Q, mixed affine-Jacobian coordinates (GECC 3.22)
- *
- * The coordinates of Q must be normalized (= affine),
- * but those of P don't need to. R is not normalized.
- *
- * P,Q,R may alias, but only at the level of EC points: they must be either
- * equal as pointers, or disjoint (including the coordinate data buffers).
- * Fine-grained aliasing at the level of coordinates is not supported.
- *
- * Special cases: (1) P or Q is zero, (2) R is zero, (3) P == Q.
- * None of these cases can happen as intermediate step in ecp_mul_comb():
- * - at each step, P, Q and R are multiples of the base point, the factor
- * being less than its order, so none of them is zero;
- * - Q is an odd multiple of the base point, P an even multiple,
- * due to the choice of precomputed points in the modified comb method.
- * So branches for these cases do not leak secret information.
- *
- * Cost: 1A := 8M + 3S
- */
-static int ecp_add_mixed(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q,
- mbedtls_mpi tmp[4])
-{
-#if defined(MBEDTLS_SELF_TEST)
- add_count++;
-#endif
-
-#if defined(MBEDTLS_ECP_ADD_MIXED_ALT)
- if (mbedtls_internal_ecp_grp_capable(grp)) {
- return mbedtls_internal_ecp_add_mixed(grp, R, P, Q);
- }
-#endif /* MBEDTLS_ECP_ADD_MIXED_ALT */
-
-#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_ADD_MIXED_ALT)
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-#else
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-
- /* NOTE: Aliasing between input and output is allowed, so one has to make
- * sure that at the point X,Y,Z are written, {P,Q}->{X,Y,Z} are no
- * longer read from. */
- mbedtls_mpi * const X = &R->X;
- mbedtls_mpi * const Y = &R->Y;
- mbedtls_mpi * const Z = &R->Z;
-
- if (!MPI_ECP_VALID(&Q->Z)) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- /*
- * Trivial cases: P == 0 or Q == 0 (case 1)
- */
- if (MPI_ECP_CMP_INT(&P->Z, 0) == 0) {
- return mbedtls_ecp_copy(R, Q);
- }
-
- if (MPI_ECP_CMP_INT(&Q->Z, 0) == 0) {
- return mbedtls_ecp_copy(R, P);
- }
-
- /*
- * Make sure Q coordinates are normalized
- */
- if (MPI_ECP_CMP_INT(&Q->Z, 1) != 0) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- MPI_ECP_SQR(&tmp[0], &P->Z);
- MPI_ECP_MUL(&tmp[1], &tmp[0], &P->Z);
- MPI_ECP_MUL(&tmp[0], &tmp[0], &Q->X);
- MPI_ECP_MUL(&tmp[1], &tmp[1], &Q->Y);
- MPI_ECP_SUB(&tmp[0], &tmp[0], &P->X);
- MPI_ECP_SUB(&tmp[1], &tmp[1], &P->Y);
-
- /* Special cases (2) and (3) */
- if (MPI_ECP_CMP_INT(&tmp[0], 0) == 0) {
- if (MPI_ECP_CMP_INT(&tmp[1], 0) == 0) {
- ret = ecp_double_jac(grp, R, P, tmp);
- goto cleanup;
- } else {
- ret = mbedtls_ecp_set_zero(R);
- goto cleanup;
- }
- }
-
- /* {P,Q}->Z no longer used, so OK to write to Z even if there's aliasing. */
- MPI_ECP_MUL(Z, &P->Z, &tmp[0]);
- MPI_ECP_SQR(&tmp[2], &tmp[0]);
- MPI_ECP_MUL(&tmp[3], &tmp[2], &tmp[0]);
- MPI_ECP_MUL(&tmp[2], &tmp[2], &P->X);
-
- MPI_ECP_MOV(&tmp[0], &tmp[2]);
- MPI_ECP_SHIFT_L(&tmp[0], 1);
-
- /* {P,Q}->X no longer used, so OK to write to X even if there's aliasing. */
- MPI_ECP_SQR(X, &tmp[1]);
- MPI_ECP_SUB(X, X, &tmp[0]);
- MPI_ECP_SUB(X, X, &tmp[3]);
- MPI_ECP_SUB(&tmp[2], &tmp[2], X);
- MPI_ECP_MUL(&tmp[2], &tmp[2], &tmp[1]);
- MPI_ECP_MUL(&tmp[3], &tmp[3], &P->Y);
- /* {P,Q}->Y no longer used, so OK to write to Y even if there's aliasing. */
- MPI_ECP_SUB(Y, &tmp[2], &tmp[3]);
-
-cleanup:
-
- return ret;
-#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_ADD_MIXED_ALT) */
-}
-
-/*
- * Randomize jacobian coordinates:
- * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l
- * This is sort of the reverse operation of ecp_normalize_jac().
- *
- * This countermeasure was first suggested in [2].
- */
-static int ecp_randomize_jac(const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt,
- int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
-{
-#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
- if (mbedtls_internal_ecp_grp_capable(grp)) {
- return mbedtls_internal_ecp_randomize_jac(grp, pt, f_rng, p_rng);
- }
-#endif /* MBEDTLS_ECP_RANDOMIZE_JAC_ALT */
-
-#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-#else
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_mpi l;
-
- mbedtls_mpi_init(&l);
-
- /* Generate l such that 1 < l < p */
- MPI_ECP_RAND(&l);
-
- /* Z' = l * Z */
- MPI_ECP_MUL(&pt->Z, &pt->Z, &l);
-
- /* Y' = l * Y */
- MPI_ECP_MUL(&pt->Y, &pt->Y, &l);
-
- /* X' = l^2 * X */
- MPI_ECP_SQR(&l, &l);
- MPI_ECP_MUL(&pt->X, &pt->X, &l);
-
- /* Y'' = l^2 * Y' = l^3 * Y */
- MPI_ECP_MUL(&pt->Y, &pt->Y, &l);
-
-cleanup:
- mbedtls_mpi_free(&l);
-
- if (ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE) {
- ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
- }
- return ret;
-#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) */
-}
-
-/*
- * Check and define parameters used by the comb method (see below for details)
- */
-#if MBEDTLS_ECP_WINDOW_SIZE < 2 || MBEDTLS_ECP_WINDOW_SIZE > 7
-#error "MBEDTLS_ECP_WINDOW_SIZE out of bounds"
-#endif
-
-/* d = ceil( n / w ) */
-#define COMB_MAX_D (MBEDTLS_ECP_MAX_BITS + 1) / 2
-
-/* number of precomputed points */
-#define COMB_MAX_PRE (1 << (MBEDTLS_ECP_WINDOW_SIZE - 1))
-
-/*
- * Compute the representation of m that will be used with our comb method.
- *
- * The basic comb method is described in GECC 3.44 for example. We use a
- * modified version that provides resistance to SPA by avoiding zero
- * digits in the representation as in [3]. We modify the method further by
- * requiring that all K_i be odd, which has the small cost that our
- * representation uses one more K_i, due to carries, but saves on the size of
- * the precomputed table.
- *
- * Summary of the comb method and its modifications:
- *
- * - The goal is to compute m*P for some w*d-bit integer m.
- *
- * - The basic comb method splits m into the w-bit integers
- * x[0] .. x[d-1] where x[i] consists of the bits in m whose
- * index has residue i modulo d, and computes m * P as
- * S[x[0]] + 2 * S[x[1]] + .. + 2^(d-1) S[x[d-1]], where
- * S[i_{w-1} .. i_0] := i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + i_0 P.
- *
- * - If it happens that, say, x[i+1]=0 (=> S[x[i+1]]=0), one can replace the sum by
- * .. + 2^{i-1} S[x[i-1]] - 2^i S[x[i]] + 2^{i+1} S[x[i]] + 2^{i+2} S[x[i+2]] ..,
- * thereby successively converting it into a form where all summands
- * are nonzero, at the cost of negative summands. This is the basic idea of [3].
- *
- * - More generally, even if x[i+1] != 0, we can first transform the sum as
- * .. - 2^i S[x[i]] + 2^{i+1} ( S[x[i]] + S[x[i+1]] ) + 2^{i+2} S[x[i+2]] ..,
- * and then replace S[x[i]] + S[x[i+1]] = S[x[i] ^ x[i+1]] + 2 S[x[i] & x[i+1]].
- * Performing and iterating this procedure for those x[i] that are even
- * (keeping track of carry), we can transform the original sum into one of the form
- * S[x'[0]] +- 2 S[x'[1]] +- .. +- 2^{d-1} S[x'[d-1]] + 2^d S[x'[d]]
- * with all x'[i] odd. It is therefore only necessary to know S at odd indices,
- * which is why we are only computing half of it in the first place in
- * ecp_precompute_comb and accessing it with index abs(i) / 2 in ecp_select_comb.
- *
- * - For the sake of compactness, only the seven low-order bits of x[i]
- * are used to represent its absolute value (K_i in the paper), and the msb
- * of x[i] encodes the sign (s_i in the paper): it is set if and only if
- * if s_i == -1;
- *
- * Calling conventions:
- * - x is an array of size d + 1
- * - w is the size, ie number of teeth, of the comb, and must be between
- * 2 and 7 (in practice, between 2 and MBEDTLS_ECP_WINDOW_SIZE)
- * - m is the MPI, expected to be odd and such that bitlength(m) <= w * d
- * (the result will be incorrect if these assumptions are not satisfied)
- */
-static void ecp_comb_recode_core(unsigned char x[], size_t d,
- unsigned char w, const mbedtls_mpi *m)
-{
- size_t i, j;
- unsigned char c, cc, adjust;
-
- memset(x, 0, d+1);
-
- /* First get the classical comb values (except for x_d = 0) */
- for (i = 0; i < d; i++) {
- for (j = 0; j < w; j++) {
- x[i] |= mbedtls_mpi_get_bit(m, i + d * j) << j;
- }
- }
-
- /* Now make sure x_1 .. x_d are odd */
- c = 0;
- for (i = 1; i <= d; i++) {
- /* Add carry and update it */
- cc = x[i] & c;
- x[i] = x[i] ^ c;
- c = cc;
-
- /* Adjust if needed, avoiding branches */
- adjust = 1 - (x[i] & 0x01);
- c |= x[i] & (x[i-1] * adjust);
- x[i] = x[i] ^ (x[i-1] * adjust);
- x[i-1] |= adjust << 7;
- }
-}
-
-/*
- * Precompute points for the adapted comb method
- *
- * Assumption: T must be able to hold 2^{w - 1} elements.
- *
- * Operation: If i = i_{w-1} ... i_1 is the binary representation of i,
- * sets T[i] = i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + P.
- *
- * Cost: d(w-1) D + (2^{w-1} - 1) A + 1 N(w-1) + 1 N(2^{w-1} - 1)
- *
- * Note: Even comb values (those where P would be omitted from the
- * sum defining T[i] above) are not needed in our adaption
- * the comb method. See ecp_comb_recode_core().
- *
- * This function currently works in four steps:
- * (1) [dbl] Computation of intermediate T[i] for 2-power values of i
- * (2) [norm_dbl] Normalization of coordinates of these T[i]
- * (3) [add] Computation of all T[i]
- * (4) [norm_add] Normalization of all T[i]
- *
- * Step 1 can be interrupted but not the others; together with the final
- * coordinate normalization they are the largest steps done at once, depending
- * on the window size. Here are operation counts for P-256:
- *
- * step (2) (3) (4)
- * w = 5 142 165 208
- * w = 4 136 77 160
- * w = 3 130 33 136
- * w = 2 124 11 124
- *
- * So if ECC operations are blocking for too long even with a low max_ops
- * value, it's useful to set MBEDTLS_ECP_WINDOW_SIZE to a lower value in order
- * to minimize maximum blocking time.
- */
-static int ecp_precompute_comb(const mbedtls_ecp_group *grp,
- mbedtls_ecp_point T[], const mbedtls_ecp_point *P,
- unsigned char w, size_t d,
- mbedtls_ecp_restart_ctx *rs_ctx)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- unsigned char i;
- size_t j = 0;
- const unsigned char T_size = 1U << (w - 1);
- mbedtls_ecp_point *cur, *TT[COMB_MAX_PRE - 1] = { NULL };
-
- mbedtls_mpi tmp[4];
-
- mpi_init_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi));
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL) {
- if (rs_ctx->rsm->state == ecp_rsm_pre_dbl) {
- goto dbl;
- }
- if (rs_ctx->rsm->state == ecp_rsm_pre_norm_dbl) {
- goto norm_dbl;
- }
- if (rs_ctx->rsm->state == ecp_rsm_pre_add) {
- goto add;
- }
- if (rs_ctx->rsm->state == ecp_rsm_pre_norm_add) {
- goto norm_add;
- }
- }
-#else
- (void) rs_ctx;
-#endif
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL) {
- rs_ctx->rsm->state = ecp_rsm_pre_dbl;
-
- /* initial state for the loop */
- rs_ctx->rsm->i = 0;
- }
-
-dbl:
-#endif
- /*
- * Set T[0] = P and
- * T[2^{l-1}] = 2^{dl} P for l = 1 .. w-1 (this is not the final value)
- */
- MBEDTLS_MPI_CHK(mbedtls_ecp_copy(&T[0], P));
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0) {
- j = rs_ctx->rsm->i;
- } else
-#endif
- j = 0;
-
- for (; j < d * (w - 1); j++) {
- MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_DBL);
-
- i = 1U << (j / d);
- cur = T + i;
-
- if (j % d == 0) {
- MBEDTLS_MPI_CHK(mbedtls_ecp_copy(cur, T + (i >> 1)));
- }
-
- MBEDTLS_MPI_CHK(ecp_double_jac(grp, cur, cur, tmp));
- }
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL) {
- rs_ctx->rsm->state = ecp_rsm_pre_norm_dbl;
- }
-
-norm_dbl:
-#endif
- /*
- * Normalize current elements in T to allow them to be used in
- * ecp_add_mixed() below, which requires one normalized input.
- *
- * As T has holes, use an auxiliary array of pointers to elements in T.
- *
- */
- j = 0;
- for (i = 1; i < T_size; i <<= 1) {
- TT[j++] = T + i;
- }
-
- MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_INV + 6 * j - 2);
-
- MBEDTLS_MPI_CHK(ecp_normalize_jac_many(grp, TT, j));
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL) {
- rs_ctx->rsm->state = ecp_rsm_pre_add;
- }
-
-add:
-#endif
- /*
- * Compute the remaining ones using the minimal number of additions
- * Be careful to update T[2^l] only after using it!
- */
- MBEDTLS_ECP_BUDGET((T_size - 1) * MBEDTLS_ECP_OPS_ADD);
-
- for (i = 1; i < T_size; i <<= 1) {
- j = i;
- while (j--) {
- MBEDTLS_MPI_CHK(ecp_add_mixed(grp, &T[i + j], &T[j], &T[i], tmp));
- }
- }
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL) {
- rs_ctx->rsm->state = ecp_rsm_pre_norm_add;
- }
-
-norm_add:
-#endif
- /*
- * Normalize final elements in T. Even though there are no holes now, we
- * still need the auxiliary array for homogeneity with the previous
- * call. Also, skip T[0] which is already normalised, being a copy of P.
- */
- for (j = 0; j + 1 < T_size; j++) {
- TT[j] = T + j + 1;
- }
-
- MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_INV + 6 * j - 2);
-
- MBEDTLS_MPI_CHK(ecp_normalize_jac_many(grp, TT, j));
-
- /* Free Z coordinate (=1 after normalization) to save RAM.
- * This makes T[i] invalid as mbedtls_ecp_points, but this is OK
- * since from this point onwards, they are only accessed indirectly
- * via the getter function ecp_select_comb() which does set the
- * target's Z coordinate to 1. */
- for (i = 0; i < T_size; i++) {
- mbedtls_mpi_free(&T[i].Z);
- }
-
-cleanup:
-
- mpi_free_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi));
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL &&
- ret == MBEDTLS_ERR_ECP_IN_PROGRESS) {
- if (rs_ctx->rsm->state == ecp_rsm_pre_dbl) {
- rs_ctx->rsm->i = j;
- }
- }
-#endif
-
- return ret;
-}
-
-/*
- * Select precomputed point: R = sign(i) * T[ abs(i) / 2 ]
- *
- * See ecp_comb_recode_core() for background
- */
-static int ecp_select_comb(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_ecp_point T[], unsigned char T_size,
- unsigned char i)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- unsigned char ii, j;
-
- /* Ignore the "sign" bit and scale down */
- ii = (i & 0x7Fu) >> 1;
-
- /* Read the whole table to thwart cache-based timing attacks */
- for (j = 0; j < T_size; j++) {
- MPI_ECP_COND_ASSIGN(&R->X, &T[j].X, j == ii);
- MPI_ECP_COND_ASSIGN(&R->Y, &T[j].Y, j == ii);
- }
-
- /* Safely invert result if i is "negative" */
- MBEDTLS_MPI_CHK(ecp_safe_invert_jac(grp, R, i >> 7));
-
- MPI_ECP_LSET(&R->Z, 1);
-
-cleanup:
- return ret;
-}
-
-/*
- * Core multiplication algorithm for the (modified) comb method.
- * This part is actually common with the basic comb method (GECC 3.44)
- *
- * Cost: d A + d D + 1 R
- */
-static int ecp_mul_comb_core(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_ecp_point T[], unsigned char T_size,
- const unsigned char x[], size_t d,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng,
- mbedtls_ecp_restart_ctx *rs_ctx)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_ecp_point Txi;
- mbedtls_mpi tmp[4];
- size_t i;
-
- mbedtls_ecp_point_init(&Txi);
- mpi_init_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi));
-
-#if !defined(MBEDTLS_ECP_RESTARTABLE)
- (void) rs_ctx;
-#endif
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL &&
- rs_ctx->rsm->state != ecp_rsm_comb_core) {
- rs_ctx->rsm->i = 0;
- rs_ctx->rsm->state = ecp_rsm_comb_core;
- }
-
- /* new 'if' instead of nested for the sake of the 'else' branch */
- if (rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0) {
- /* restore current index (R already pointing to rs_ctx->rsm->R) */
- i = rs_ctx->rsm->i;
- } else
-#endif
- {
- /* Start with a non-zero point and randomize its coordinates */
- i = d;
- MBEDTLS_MPI_CHK(ecp_select_comb(grp, R, T, T_size, x[i]));
- if (f_rng != 0) {
- MBEDTLS_MPI_CHK(ecp_randomize_jac(grp, R, f_rng, p_rng));
- }
- }
-
- while (i != 0) {
- MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_DBL + MBEDTLS_ECP_OPS_ADD);
- --i;
-
- MBEDTLS_MPI_CHK(ecp_double_jac(grp, R, R, tmp));
- MBEDTLS_MPI_CHK(ecp_select_comb(grp, &Txi, T, T_size, x[i]));
- MBEDTLS_MPI_CHK(ecp_add_mixed(grp, R, R, &Txi, tmp));
- }
-
-cleanup:
-
- mbedtls_ecp_point_free(&Txi);
- mpi_free_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi));
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL &&
- ret == MBEDTLS_ERR_ECP_IN_PROGRESS) {
- rs_ctx->rsm->i = i;
- /* no need to save R, already pointing to rs_ctx->rsm->R */
- }
-#endif
-
- return ret;
-}
-
-/*
- * Recode the scalar to get constant-time comb multiplication
- *
- * As the actual scalar recoding needs an odd scalar as a starting point,
- * this wrapper ensures that by replacing m by N - m if necessary, and
- * informs the caller that the result of multiplication will be negated.
- *
- * This works because we only support large prime order for Short Weierstrass
- * curves, so N is always odd hence either m or N - m is.
- *
- * See ecp_comb_recode_core() for background.
- */
-static int ecp_comb_recode_scalar(const mbedtls_ecp_group *grp,
- const mbedtls_mpi *m,
- unsigned char k[COMB_MAX_D + 1],
- size_t d,
- unsigned char w,
- unsigned char *parity_trick)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_mpi M, mm;
-
- mbedtls_mpi_init(&M);
- mbedtls_mpi_init(&mm);
-
- /* N is always odd (see above), just make extra sure */
- if (mbedtls_mpi_get_bit(&grp->N, 0) != 1) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- /* do we need the parity trick? */
- *parity_trick = (mbedtls_mpi_get_bit(m, 0) == 0);
-
- /* execute parity fix in constant time */
- MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&M, m));
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&mm, &grp->N, m));
- MBEDTLS_MPI_CHK(mbedtls_mpi_safe_cond_assign(&M, &mm, *parity_trick));
-
- /* actual scalar recoding */
- ecp_comb_recode_core(k, d, w, &M);
-
-cleanup:
- mbedtls_mpi_free(&mm);
- mbedtls_mpi_free(&M);
-
- return ret;
-}
-
-/*
- * Perform comb multiplication (for short Weierstrass curves)
- * once the auxiliary table has been pre-computed.
- *
- * Scalar recoding may use a parity trick that makes us compute -m * P,
- * if that is the case we'll need to recover m * P at the end.
- */
-static int ecp_mul_comb_after_precomp(const mbedtls_ecp_group *grp,
- mbedtls_ecp_point *R,
- const mbedtls_mpi *m,
- const mbedtls_ecp_point *T,
- unsigned char T_size,
- unsigned char w,
- size_t d,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng,
- mbedtls_ecp_restart_ctx *rs_ctx)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- unsigned char parity_trick;
- unsigned char k[COMB_MAX_D + 1];
- mbedtls_ecp_point *RR = R;
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL) {
- RR = &rs_ctx->rsm->R;
-
- if (rs_ctx->rsm->state == ecp_rsm_final_norm) {
- goto final_norm;
- }
- }
-#endif
-
- MBEDTLS_MPI_CHK(ecp_comb_recode_scalar(grp, m, k, d, w,
- &parity_trick));
- MBEDTLS_MPI_CHK(ecp_mul_comb_core(grp, RR, T, T_size, k, d,
- f_rng, p_rng, rs_ctx));
- MBEDTLS_MPI_CHK(ecp_safe_invert_jac(grp, RR, parity_trick));
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL) {
- rs_ctx->rsm->state = ecp_rsm_final_norm;
- }
-
-final_norm:
- MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_INV);
-#endif
- /*
- * Knowledge of the jacobian coordinates may leak the last few bits of the
- * scalar [1], and since our MPI implementation isn't constant-flow,
- * inversion (used for coordinate normalization) may leak the full value
- * of its input via side-channels [2].
- *
- * [1] https://eprint.iacr.org/2003/191
- * [2] https://eprint.iacr.org/2020/055
- *
- * Avoid the leak by randomizing coordinates before we normalize them.
- */
- if (f_rng != 0) {
- MBEDTLS_MPI_CHK(ecp_randomize_jac(grp, RR, f_rng, p_rng));
- }
-
- MBEDTLS_MPI_CHK(ecp_normalize_jac(grp, RR));
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL) {
- MBEDTLS_MPI_CHK(mbedtls_ecp_copy(R, RR));
- }
-#endif
-
-cleanup:
- return ret;
-}
-
-/*
- * Pick window size based on curve size and whether we optimize for base point
- */
-static unsigned char ecp_pick_window_size(const mbedtls_ecp_group *grp,
- unsigned char p_eq_g)
-{
- unsigned char w;
-
- /*
- * Minimize the number of multiplications, that is minimize
- * 10 * d * w + 18 * 2^(w-1) + 11 * d + 7 * w, with d = ceil( nbits / w )
- * (see costs of the various parts, with 1S = 1M)
- */
- w = grp->nbits >= 384 ? 5 : 4;
-
- /*
- * If P == G, pre-compute a bit more, since this may be re-used later.
- * Just adding one avoids upping the cost of the first mul too much,
- * and the memory cost too.
- */
- if (p_eq_g) {
- w++;
- }
-
- /*
- * If static comb table may not be used (!p_eq_g) or static comb table does
- * not exists, make sure w is within bounds.
- * (The last test is useful only for very small curves in the test suite.)
- *
- * The user reduces MBEDTLS_ECP_WINDOW_SIZE does not changes the size of
- * static comb table, because the size of static comb table is fixed when
- * it is generated.
- */
-#if (MBEDTLS_ECP_WINDOW_SIZE < 6)
- if ((!p_eq_g || !ecp_group_is_static_comb_table(grp)) && w > MBEDTLS_ECP_WINDOW_SIZE) {
- w = MBEDTLS_ECP_WINDOW_SIZE;
- }
-#endif
- if (w >= grp->nbits) {
- w = 2;
- }
-
- return w;
-}
-
-/*
- * Multiplication using the comb method - for curves in short Weierstrass form
- *
- * This function is mainly responsible for administrative work:
- * - managing the restart context if enabled
- * - managing the table of precomputed points (passed between the below two
- * functions): allocation, computation, ownership transfer, freeing.
- *
- * It delegates the actual arithmetic work to:
- * ecp_precompute_comb() and ecp_mul_comb_with_precomp()
- *
- * See comments on ecp_comb_recode_core() regarding the computation strategy.
- */
-static int ecp_mul_comb(mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_mpi *m, const mbedtls_ecp_point *P,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng,
- mbedtls_ecp_restart_ctx *rs_ctx)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- unsigned char w, p_eq_g, i;
- size_t d;
- unsigned char T_size = 0, T_ok = 0;
- mbedtls_ecp_point *T = NULL;
-
- ECP_RS_ENTER(rsm);
-
- /* Is P the base point ? */
-#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
- p_eq_g = (MPI_ECP_CMP(&P->Y, &grp->G.Y) == 0 &&
- MPI_ECP_CMP(&P->X, &grp->G.X) == 0);
-#else
- p_eq_g = 0;
-#endif
-
- /* Pick window size and deduce related sizes */
- w = ecp_pick_window_size(grp, p_eq_g);
- T_size = 1U << (w - 1);
- d = (grp->nbits + w - 1) / w;
-
- /* Pre-computed table: do we have it already for the base point? */
- if (p_eq_g && grp->T != NULL) {
- /* second pointer to the same table, will be deleted on exit */
- T = grp->T;
- T_ok = 1;
- } else
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- /* Pre-computed table: do we have one in progress? complete? */
- if (rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->T != NULL) {
- /* transfer ownership of T from rsm to local function */
- T = rs_ctx->rsm->T;
- rs_ctx->rsm->T = NULL;
- rs_ctx->rsm->T_size = 0;
-
- /* This effectively jumps to the call to mul_comb_after_precomp() */
- T_ok = rs_ctx->rsm->state >= ecp_rsm_comb_core;
- } else
-#endif
- /* Allocate table if we didn't have any */
- {
- T = mbedtls_calloc(T_size, sizeof(mbedtls_ecp_point));
- if (T == NULL) {
- ret = MBEDTLS_ERR_ECP_ALLOC_FAILED;
- goto cleanup;
- }
-
- for (i = 0; i < T_size; i++) {
- mbedtls_ecp_point_init(&T[i]);
- }
-
- T_ok = 0;
- }
-
- /* Compute table (or finish computing it) if not done already */
- if (!T_ok) {
- MBEDTLS_MPI_CHK(ecp_precompute_comb(grp, T, P, w, d, rs_ctx));
-
- if (p_eq_g) {
- /* almost transfer ownership of T to the group, but keep a copy of
- * the pointer to use for calling the next function more easily */
- grp->T = T;
- grp->T_size = T_size;
- }
- }
-
- /* Actual comb multiplication using precomputed points */
- MBEDTLS_MPI_CHK(ecp_mul_comb_after_precomp(grp, R, m,
- T, T_size, w, d,
- f_rng, p_rng, rs_ctx));
-
-cleanup:
-
- /* does T belong to the group? */
- if (T == grp->T) {
- T = NULL;
- }
-
- /* does T belong to the restart context? */
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->rsm != NULL && ret == MBEDTLS_ERR_ECP_IN_PROGRESS && T != NULL) {
- /* transfer ownership of T from local function to rsm */
- rs_ctx->rsm->T_size = T_size;
- rs_ctx->rsm->T = T;
- T = NULL;
- }
-#endif
-
- /* did T belong to us? then let's destroy it! */
- if (T != NULL) {
- for (i = 0; i < T_size; i++) {
- mbedtls_ecp_point_free(&T[i]);
- }
- mbedtls_free(T);
- }
-
- /* prevent caller from using invalid value */
- int should_free_R = (ret != 0);
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- /* don't free R while in progress in case R == P */
- if (ret == MBEDTLS_ERR_ECP_IN_PROGRESS) {
- should_free_R = 0;
- }
-#endif
- if (should_free_R) {
- mbedtls_ecp_point_free(R);
- }
-
- ECP_RS_LEAVE(rsm);
-
- return ret;
-}
-
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
-/*
- * For Montgomery curves, we do all the internal arithmetic in projective
- * coordinates. Import/export of points uses only the x coordinates, which is
- * internally represented as X / Z.
- *
- * For scalar multiplication, we'll use a Montgomery ladder.
- */
-
-/*
- * Normalize Montgomery x/z coordinates: X = X/Z, Z = 1
- * Cost: 1M + 1I
- */
-static int ecp_normalize_mxz(const mbedtls_ecp_group *grp, mbedtls_ecp_point *P)
-{
-#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
- if (mbedtls_internal_ecp_grp_capable(grp)) {
- return mbedtls_internal_ecp_normalize_mxz(grp, P);
- }
-#endif /* MBEDTLS_ECP_NORMALIZE_MXZ_ALT */
-
-#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-#else
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- MPI_ECP_INV(&P->Z, &P->Z);
- MPI_ECP_MUL(&P->X, &P->X, &P->Z);
- MPI_ECP_LSET(&P->Z, 1);
-
-cleanup:
- return ret;
-#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) */
-}
-
-/*
- * Randomize projective x/z coordinates:
- * (X, Z) -> (l X, l Z) for random l
- * This is sort of the reverse operation of ecp_normalize_mxz().
- *
- * This countermeasure was first suggested in [2].
- * Cost: 2M
- */
-static int ecp_randomize_mxz(const mbedtls_ecp_group *grp, mbedtls_ecp_point *P,
- int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
-{
-#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
- if (mbedtls_internal_ecp_grp_capable(grp)) {
- return mbedtls_internal_ecp_randomize_mxz(grp, P, f_rng, p_rng);
- }
-#endif /* MBEDTLS_ECP_RANDOMIZE_MXZ_ALT */
-
-#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-#else
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_mpi l;
- mbedtls_mpi_init(&l);
-
- /* Generate l such that 1 < l < p */
- MPI_ECP_RAND(&l);
-
- MPI_ECP_MUL(&P->X, &P->X, &l);
- MPI_ECP_MUL(&P->Z, &P->Z, &l);
-
-cleanup:
- mbedtls_mpi_free(&l);
-
- if (ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE) {
- ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
- }
- return ret;
-#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) */
-}
-
-/*
- * Double-and-add: R = 2P, S = P + Q, with d = X(P - Q),
- * for Montgomery curves in x/z coordinates.
- *
- * http://www.hyperelliptic.org/EFD/g1p/auto-code/montgom/xz/ladder/mladd-1987-m.op3
- * with
- * d = X1
- * P = (X2, Z2)
- * Q = (X3, Z3)
- * R = (X4, Z4)
- * S = (X5, Z5)
- * and eliminating temporary variables tO, ..., t4.
- *
- * Cost: 5M + 4S
- */
-static int ecp_double_add_mxz(const mbedtls_ecp_group *grp,
- mbedtls_ecp_point *R, mbedtls_ecp_point *S,
- const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q,
- const mbedtls_mpi *d,
- mbedtls_mpi T[4])
-{
-#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
- if (mbedtls_internal_ecp_grp_capable(grp)) {
- return mbedtls_internal_ecp_double_add_mxz(grp, R, S, P, Q, d);
- }
-#endif /* MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT */
-
-#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-#else
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-
- MPI_ECP_ADD(&T[0], &P->X, &P->Z); /* Pp := PX + PZ */
- MPI_ECP_SUB(&T[1], &P->X, &P->Z); /* Pm := PX - PZ */
- MPI_ECP_ADD(&T[2], &Q->X, &Q->Z); /* Qp := QX + XZ */
- MPI_ECP_SUB(&T[3], &Q->X, &Q->Z); /* Qm := QX - QZ */
- MPI_ECP_MUL(&T[3], &T[3], &T[0]); /* Qm * Pp */
- MPI_ECP_MUL(&T[2], &T[2], &T[1]); /* Qp * Pm */
- MPI_ECP_SQR(&T[0], &T[0]); /* Pp^2 */
- MPI_ECP_SQR(&T[1], &T[1]); /* Pm^2 */
- MPI_ECP_MUL(&R->X, &T[0], &T[1]); /* Pp^2 * Pm^2 */
- MPI_ECP_SUB(&T[0], &T[0], &T[1]); /* Pp^2 - Pm^2 */
- MPI_ECP_MUL(&R->Z, &grp->A, &T[0]); /* A * (Pp^2 - Pm^2) */
- MPI_ECP_ADD(&R->Z, &T[1], &R->Z); /* [ A * (Pp^2-Pm^2) ] + Pm^2 */
- MPI_ECP_ADD(&S->X, &T[3], &T[2]); /* Qm*Pp + Qp*Pm */
- MPI_ECP_SQR(&S->X, &S->X); /* (Qm*Pp + Qp*Pm)^2 */
- MPI_ECP_SUB(&S->Z, &T[3], &T[2]); /* Qm*Pp - Qp*Pm */
- MPI_ECP_SQR(&S->Z, &S->Z); /* (Qm*Pp - Qp*Pm)^2 */
- MPI_ECP_MUL(&S->Z, d, &S->Z); /* d * ( Qm*Pp - Qp*Pm )^2 */
- MPI_ECP_MUL(&R->Z, &T[0], &R->Z); /* [A*(Pp^2-Pm^2)+Pm^2]*(Pp^2-Pm^2) */
-
-cleanup:
-
- return ret;
-#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) */
-}
-
-/*
- * Multiplication with Montgomery ladder in x/z coordinates,
- * for curves in Montgomery form
- */
-static int ecp_mul_mxz(mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_mpi *m, const mbedtls_ecp_point *P,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t i;
- unsigned char b;
- mbedtls_ecp_point RP;
- mbedtls_mpi PX;
- mbedtls_mpi tmp[4];
- mbedtls_ecp_point_init(&RP); mbedtls_mpi_init(&PX);
-
- mpi_init_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi));
-
- if (f_rng == NULL) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- /* Save PX and read from P before writing to R, in case P == R */
- MPI_ECP_MOV(&PX, &P->X);
- MBEDTLS_MPI_CHK(mbedtls_ecp_copy(&RP, P));
-
- /* Set R to zero in modified x/z coordinates */
- MPI_ECP_LSET(&R->X, 1);
- MPI_ECP_LSET(&R->Z, 0);
- mbedtls_mpi_free(&R->Y);
-
- /* RP.X might be slightly larger than P, so reduce it */
- MOD_ADD(&RP.X);
-
- /* Randomize coordinates of the starting point */
- MBEDTLS_MPI_CHK(ecp_randomize_mxz(grp, &RP, f_rng, p_rng));
-
- /* Loop invariant: R = result so far, RP = R + P */
- i = grp->nbits + 1; /* one past the (zero-based) required msb for private keys */
- while (i-- > 0) {
- b = mbedtls_mpi_get_bit(m, i);
- /*
- * if (b) R = 2R + P else R = 2R,
- * which is:
- * if (b) double_add( RP, R, RP, R )
- * else double_add( R, RP, R, RP )
- * but using safe conditional swaps to avoid leaks
- */
- MPI_ECP_COND_SWAP(&R->X, &RP.X, b);
- MPI_ECP_COND_SWAP(&R->Z, &RP.Z, b);
- MBEDTLS_MPI_CHK(ecp_double_add_mxz(grp, R, &RP, R, &RP, &PX, tmp));
- MPI_ECP_COND_SWAP(&R->X, &RP.X, b);
- MPI_ECP_COND_SWAP(&R->Z, &RP.Z, b);
- }
-
- /*
- * Knowledge of the projective coordinates may leak the last few bits of the
- * scalar [1], and since our MPI implementation isn't constant-flow,
- * inversion (used for coordinate normalization) may leak the full value
- * of its input via side-channels [2].
- *
- * [1] https://eprint.iacr.org/2003/191
- * [2] https://eprint.iacr.org/2020/055
- *
- * Avoid the leak by randomizing coordinates before we normalize them.
- */
- MBEDTLS_MPI_CHK(ecp_randomize_mxz(grp, R, f_rng, p_rng));
- MBEDTLS_MPI_CHK(ecp_normalize_mxz(grp, R));
-
-cleanup:
- mbedtls_ecp_point_free(&RP); mbedtls_mpi_free(&PX);
-
- mpi_free_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi));
- return ret;
-}
-
-#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
-
-/*
- * Restartable multiplication R = m * P
- *
- * This internal function can be called without an RNG in case where we know
- * the inputs are not sensitive.
- */
-static int ecp_mul_restartable_internal(mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_mpi *m, const mbedtls_ecp_point *P,
- int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
- mbedtls_ecp_restart_ctx *rs_ctx)
-{
- int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
-#if defined(MBEDTLS_ECP_INTERNAL_ALT)
- char is_grp_capable = 0;
-#endif
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- /* reset ops count for this call if top-level */
- if (rs_ctx != NULL && rs_ctx->depth++ == 0) {
- rs_ctx->ops_done = 0;
- }
-#else
- (void) rs_ctx;
-#endif
-
-#if defined(MBEDTLS_ECP_INTERNAL_ALT)
- if ((is_grp_capable = mbedtls_internal_ecp_grp_capable(grp))) {
- MBEDTLS_MPI_CHK(mbedtls_internal_ecp_init(grp));
- }
-#endif /* MBEDTLS_ECP_INTERNAL_ALT */
-
- int restarting = 0;
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- restarting = (rs_ctx != NULL && rs_ctx->rsm != NULL);
-#endif
- /* skip argument check when restarting */
- if (!restarting) {
- /* check_privkey is free */
- MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_CHK);
-
- /* Common sanity checks */
- MBEDTLS_MPI_CHK(mbedtls_ecp_check_privkey(grp, m));
- MBEDTLS_MPI_CHK(mbedtls_ecp_check_pubkey(grp, P));
- }
-
- ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
- MBEDTLS_MPI_CHK(ecp_mul_mxz(grp, R, m, P, f_rng, p_rng));
- }
-#endif
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
- MBEDTLS_MPI_CHK(ecp_mul_comb(grp, R, m, P, f_rng, p_rng, rs_ctx));
- }
-#endif
-
-cleanup:
-
-#if defined(MBEDTLS_ECP_INTERNAL_ALT)
- if (is_grp_capable) {
- mbedtls_internal_ecp_free(grp);
- }
-#endif /* MBEDTLS_ECP_INTERNAL_ALT */
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL) {
- rs_ctx->depth--;
- }
-#endif
-
- return ret;
-}
-
-/*
- * Restartable multiplication R = m * P
- */
-int mbedtls_ecp_mul_restartable(mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_mpi *m, const mbedtls_ecp_point *P,
- int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
- mbedtls_ecp_restart_ctx *rs_ctx)
-{
- if (f_rng == NULL) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- return ecp_mul_restartable_internal(grp, R, m, P, f_rng, p_rng, rs_ctx);
-}
-
-/*
- * Multiplication R = m * P
- */
-int mbedtls_ecp_mul(mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_mpi *m, const mbedtls_ecp_point *P,
- int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
-{
- return mbedtls_ecp_mul_restartable(grp, R, m, P, f_rng, p_rng, NULL);
-}
-#endif /* MBEDTLS_ECP_C */
-
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
-/*
- * Check that an affine point is valid as a public key,
- * short weierstrass curves (SEC1 3.2.3.1)
- */
-static int ecp_check_pubkey_sw(const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_mpi YY, RHS;
-
- /* pt coordinates must be normalized for our checks */
- if (mbedtls_mpi_cmp_int(&pt->X, 0) < 0 ||
- mbedtls_mpi_cmp_int(&pt->Y, 0) < 0 ||
- mbedtls_mpi_cmp_mpi(&pt->X, &grp->P) >= 0 ||
- mbedtls_mpi_cmp_mpi(&pt->Y, &grp->P) >= 0) {
- return MBEDTLS_ERR_ECP_INVALID_KEY;
- }
-
- mbedtls_mpi_init(&YY); mbedtls_mpi_init(&RHS);
-
- /*
- * YY = Y^2
- * RHS = X^3 + A X + B
- */
- MPI_ECP_SQR(&YY, &pt->Y);
- MBEDTLS_MPI_CHK(ecp_sw_rhs(grp, &RHS, &pt->X));
-
- if (MPI_ECP_CMP(&YY, &RHS) != 0) {
- ret = MBEDTLS_ERR_ECP_INVALID_KEY;
- }
-
-cleanup:
-
- mbedtls_mpi_free(&YY); mbedtls_mpi_free(&RHS);
-
- return ret;
-}
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-
-#if defined(MBEDTLS_ECP_C)
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
-/*
- * R = m * P with shortcuts for m == 0, m == 1 and m == -1
- * NOT constant-time - ONLY for short Weierstrass!
- */
-static int mbedtls_ecp_mul_shortcuts(mbedtls_ecp_group *grp,
- mbedtls_ecp_point *R,
- const mbedtls_mpi *m,
- const mbedtls_ecp_point *P,
- mbedtls_ecp_restart_ctx *rs_ctx)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_mpi tmp;
- mbedtls_mpi_init(&tmp);
-
- if (mbedtls_mpi_cmp_int(m, 0) == 0) {
- MBEDTLS_MPI_CHK(mbedtls_ecp_check_pubkey(grp, P));
- MBEDTLS_MPI_CHK(mbedtls_ecp_set_zero(R));
- } else if (mbedtls_mpi_cmp_int(m, 1) == 0) {
- MBEDTLS_MPI_CHK(mbedtls_ecp_check_pubkey(grp, P));
- MBEDTLS_MPI_CHK(mbedtls_ecp_copy(R, P));
- } else if (mbedtls_mpi_cmp_int(m, -1) == 0) {
- MBEDTLS_MPI_CHK(mbedtls_ecp_check_pubkey(grp, P));
- MBEDTLS_MPI_CHK(mbedtls_ecp_copy(R, P));
- MPI_ECP_NEG(&R->Y);
- } else {
- MBEDTLS_MPI_CHK(ecp_mul_restartable_internal(grp, R, m, P,
- NULL, NULL, rs_ctx));
- }
-
-cleanup:
- mbedtls_mpi_free(&tmp);
-
- return ret;
-}
-
-/*
- * Restartable linear combination
- * NOT constant-time
- */
-int mbedtls_ecp_muladd_restartable(
- mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_mpi *m, const mbedtls_ecp_point *P,
- const mbedtls_mpi *n, const mbedtls_ecp_point *Q,
- mbedtls_ecp_restart_ctx *rs_ctx)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_ecp_point mP;
- mbedtls_ecp_point *pmP = &mP;
- mbedtls_ecp_point *pR = R;
- mbedtls_mpi tmp[4];
-#if defined(MBEDTLS_ECP_INTERNAL_ALT)
- char is_grp_capable = 0;
-#endif
- if (mbedtls_ecp_get_type(grp) != MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
- return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
- }
-
- mbedtls_ecp_point_init(&mP);
- mpi_init_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi));
-
- ECP_RS_ENTER(ma);
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->ma != NULL) {
- /* redirect intermediate results to restart context */
- pmP = &rs_ctx->ma->mP;
- pR = &rs_ctx->ma->R;
-
- /* jump to next operation */
- if (rs_ctx->ma->state == ecp_rsma_mul2) {
- goto mul2;
- }
- if (rs_ctx->ma->state == ecp_rsma_add) {
- goto add;
- }
- if (rs_ctx->ma->state == ecp_rsma_norm) {
- goto norm;
- }
- }
-#endif /* MBEDTLS_ECP_RESTARTABLE */
-
- MBEDTLS_MPI_CHK(mbedtls_ecp_mul_shortcuts(grp, pmP, m, P, rs_ctx));
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->ma != NULL) {
- rs_ctx->ma->state = ecp_rsma_mul2;
- }
-
-mul2:
-#endif
- MBEDTLS_MPI_CHK(mbedtls_ecp_mul_shortcuts(grp, pR, n, Q, rs_ctx));
-
-#if defined(MBEDTLS_ECP_INTERNAL_ALT)
- if ((is_grp_capable = mbedtls_internal_ecp_grp_capable(grp))) {
- MBEDTLS_MPI_CHK(mbedtls_internal_ecp_init(grp));
- }
-#endif /* MBEDTLS_ECP_INTERNAL_ALT */
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->ma != NULL) {
- rs_ctx->ma->state = ecp_rsma_add;
- }
-
-add:
-#endif
- MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_ADD);
- MBEDTLS_MPI_CHK(ecp_add_mixed(grp, pR, pmP, pR, tmp));
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->ma != NULL) {
- rs_ctx->ma->state = ecp_rsma_norm;
- }
-
-norm:
-#endif
- MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_INV);
- MBEDTLS_MPI_CHK(ecp_normalize_jac(grp, pR));
-
-#if defined(MBEDTLS_ECP_RESTARTABLE)
- if (rs_ctx != NULL && rs_ctx->ma != NULL) {
- MBEDTLS_MPI_CHK(mbedtls_ecp_copy(R, pR));
- }
-#endif
-
-cleanup:
-
- mpi_free_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi));
-
-#if defined(MBEDTLS_ECP_INTERNAL_ALT)
- if (is_grp_capable) {
- mbedtls_internal_ecp_free(grp);
- }
-#endif /* MBEDTLS_ECP_INTERNAL_ALT */
-
- mbedtls_ecp_point_free(&mP);
-
- ECP_RS_LEAVE(ma);
-
- return ret;
-}
-
-/*
- * Linear combination
- * NOT constant-time
- */
-int mbedtls_ecp_muladd(mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
- const mbedtls_mpi *m, const mbedtls_ecp_point *P,
- const mbedtls_mpi *n, const mbedtls_ecp_point *Q)
-{
- return mbedtls_ecp_muladd_restartable(grp, R, m, P, n, Q, NULL);
-}
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-#endif /* MBEDTLS_ECP_C */
-
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
-#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
-#define ECP_MPI_INIT(_p, _n) { .p = (mbedtls_mpi_uint *) (_p), .s = 1, .n = (_n) }
-#define ECP_MPI_INIT_ARRAY(x) \
- ECP_MPI_INIT(x, sizeof(x) / sizeof(mbedtls_mpi_uint))
-/*
- * Constants for the two points other than 0, 1, -1 (mod p) in
- * https://cr.yp.to/ecdh.html#validate
- * See ecp_check_pubkey_x25519().
- */
-static const mbedtls_mpi_uint x25519_bad_point_1[] = {
- MBEDTLS_BYTES_TO_T_UINT_8(0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae),
- MBEDTLS_BYTES_TO_T_UINT_8(0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a),
- MBEDTLS_BYTES_TO_T_UINT_8(0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd),
- MBEDTLS_BYTES_TO_T_UINT_8(0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00),
-};
-static const mbedtls_mpi_uint x25519_bad_point_2[] = {
- MBEDTLS_BYTES_TO_T_UINT_8(0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24),
- MBEDTLS_BYTES_TO_T_UINT_8(0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b),
- MBEDTLS_BYTES_TO_T_UINT_8(0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86),
- MBEDTLS_BYTES_TO_T_UINT_8(0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57),
-};
-static const mbedtls_mpi ecp_x25519_bad_point_1 = ECP_MPI_INIT_ARRAY(
- x25519_bad_point_1);
-static const mbedtls_mpi ecp_x25519_bad_point_2 = ECP_MPI_INIT_ARRAY(
- x25519_bad_point_2);
-#endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
-
-/*
- * Check that the input point is not one of the low-order points.
- * This is recommended by the "May the Fourth" paper:
- * https://eprint.iacr.org/2017/806.pdf
- * Those points are never sent by an honest peer.
- */
-static int ecp_check_bad_points_mx(const mbedtls_mpi *X, const mbedtls_mpi *P,
- const mbedtls_ecp_group_id grp_id)
-{
- int ret;
- mbedtls_mpi XmP;
-
- mbedtls_mpi_init(&XmP);
-
- /* Reduce X mod P so that we only need to check values less than P.
- * We know X < 2^256 so we can proceed by subtraction. */
- MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&XmP, X));
- while (mbedtls_mpi_cmp_mpi(&XmP, P) >= 0) {
- MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&XmP, &XmP, P));
- }
-
- /* Check against the known bad values that are less than P. For Curve448
- * these are 0, 1 and -1. For Curve25519 we check the values less than P
- * from the following list: https://cr.yp.to/ecdh.html#validate */
- if (mbedtls_mpi_cmp_int(&XmP, 1) <= 0) { /* takes care of 0 and 1 */
- ret = MBEDTLS_ERR_ECP_INVALID_KEY;
- goto cleanup;
- }
-
-#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
- if (grp_id == MBEDTLS_ECP_DP_CURVE25519) {
- if (mbedtls_mpi_cmp_mpi(&XmP, &ecp_x25519_bad_point_1) == 0) {
- ret = MBEDTLS_ERR_ECP_INVALID_KEY;
- goto cleanup;
- }
-
- if (mbedtls_mpi_cmp_mpi(&XmP, &ecp_x25519_bad_point_2) == 0) {
- ret = MBEDTLS_ERR_ECP_INVALID_KEY;
- goto cleanup;
- }
- }
-#else
- (void) grp_id;
-#endif
-
- /* Final check: check if XmP + 1 is P (final because it changes XmP!) */
- MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&XmP, &XmP, 1));
- if (mbedtls_mpi_cmp_mpi(&XmP, P) == 0) {
- ret = MBEDTLS_ERR_ECP_INVALID_KEY;
- goto cleanup;
- }
-
- ret = 0;
-
-cleanup:
- mbedtls_mpi_free(&XmP);
-
- return ret;
-}
-
-/*
- * Check validity of a public key for Montgomery curves with x-only schemes
- */
-static int ecp_check_pubkey_mx(const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt)
-{
- /* [Curve25519 p. 5] Just check X is the correct number of bytes */
- /* Allow any public value, if it's too big then we'll just reduce it mod p
- * (RFC 7748 sec. 5 para. 3). */
- if (mbedtls_mpi_size(&pt->X) > (grp->nbits + 7) / 8) {
- return MBEDTLS_ERR_ECP_INVALID_KEY;
- }
-
- /* Implicit in all standards (as they don't consider negative numbers):
- * X must be non-negative. This is normally ensured by the way it's
- * encoded for transmission, but let's be extra sure. */
- if (mbedtls_mpi_cmp_int(&pt->X, 0) < 0) {
- return MBEDTLS_ERR_ECP_INVALID_KEY;
- }
-
- return ecp_check_bad_points_mx(&pt->X, &grp->P, grp->id);
-}
-#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
-
-/*
- * Check that a point is valid as a public key
- */
-int mbedtls_ecp_check_pubkey(const mbedtls_ecp_group *grp,
- const mbedtls_ecp_point *pt)
-{
- /* Must use affine coordinates */
- if (mbedtls_mpi_cmp_int(&pt->Z, 1) != 0) {
- return MBEDTLS_ERR_ECP_INVALID_KEY;
- }
-
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
- return ecp_check_pubkey_mx(grp, pt);
- }
-#endif
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
- return ecp_check_pubkey_sw(grp, pt);
- }
-#endif
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
-}
-
-/*
- * Check that an mbedtls_mpi is valid as a private key
- */
-int mbedtls_ecp_check_privkey(const mbedtls_ecp_group *grp,
- const mbedtls_mpi *d)
-{
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
- /* see RFC 7748 sec. 5 para. 5 */
- if (mbedtls_mpi_get_bit(d, 0) != 0 ||
- mbedtls_mpi_get_bit(d, 1) != 0 ||
- mbedtls_mpi_bitlen(d) - 1 != grp->nbits) { /* mbedtls_mpi_bitlen is one-based! */
- return MBEDTLS_ERR_ECP_INVALID_KEY;
- }
-
- /* see [Curve25519] page 5 */
- if (grp->nbits == 254 && mbedtls_mpi_get_bit(d, 2) != 0) {
- return MBEDTLS_ERR_ECP_INVALID_KEY;
- }
-
- return 0;
- }
-#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
- /* see SEC1 3.2 */
- if (mbedtls_mpi_cmp_int(d, 1) < 0 ||
- mbedtls_mpi_cmp_mpi(d, &grp->N) >= 0) {
- return MBEDTLS_ERR_ECP_INVALID_KEY;
- } else {
- return 0;
- }
- }
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
-}
-
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
-MBEDTLS_STATIC_TESTABLE
-int mbedtls_ecp_gen_privkey_mx(size_t high_bit,
- mbedtls_mpi *d,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng)
-{
- int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- size_t n_random_bytes = high_bit / 8 + 1;
-
- /* [Curve25519] page 5 */
- /* Generate a (high_bit+1)-bit random number by generating just enough
- * random bytes, then shifting out extra bits from the top (necessary
- * when (high_bit+1) is not a multiple of 8). */
- MBEDTLS_MPI_CHK(mbedtls_mpi_fill_random(d, n_random_bytes,
- f_rng, p_rng));
- MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(d, 8 * n_random_bytes - high_bit - 1));
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(d, high_bit, 1));
-
- /* Make sure the last two bits are unset for Curve448, three bits for
- Curve25519 */
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(d, 0, 0));
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(d, 1, 0));
- if (high_bit == 254) {
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(d, 2, 0));
- }
-
-cleanup:
- return ret;
-}
-#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
-
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
-static int mbedtls_ecp_gen_privkey_sw(
- const mbedtls_mpi *N, mbedtls_mpi *d,
- int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
-{
- int ret = mbedtls_mpi_random(d, 1, N, f_rng, p_rng);
- switch (ret) {
- case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
- return MBEDTLS_ERR_ECP_RANDOM_FAILED;
- default:
- return ret;
- }
-}
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-
-/*
- * Generate a private key
- */
-int mbedtls_ecp_gen_privkey(const mbedtls_ecp_group *grp,
- mbedtls_mpi *d,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng)
-{
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
- return mbedtls_ecp_gen_privkey_mx(grp->nbits, d, f_rng, p_rng);
- }
-#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
-
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
- return mbedtls_ecp_gen_privkey_sw(&grp->N, d, f_rng, p_rng);
- }
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
-}
-
-#if defined(MBEDTLS_ECP_C)
-/*
- * Generate a keypair with configurable base point
- */
-int mbedtls_ecp_gen_keypair_base(mbedtls_ecp_group *grp,
- const mbedtls_ecp_point *G,
- mbedtls_mpi *d, mbedtls_ecp_point *Q,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- MBEDTLS_MPI_CHK(mbedtls_ecp_gen_privkey(grp, d, f_rng, p_rng));
- MBEDTLS_MPI_CHK(mbedtls_ecp_mul(grp, Q, d, G, f_rng, p_rng));
-
-cleanup:
- return ret;
-}
-
-/*
- * Generate key pair, wrapper for conventional base point
- */
-int mbedtls_ecp_gen_keypair(mbedtls_ecp_group *grp,
- mbedtls_mpi *d, mbedtls_ecp_point *Q,
- int (*f_rng)(void *, unsigned char *, size_t),
- void *p_rng)
-{
- return mbedtls_ecp_gen_keypair_base(grp, &grp->G, d, Q, f_rng, p_rng);
-}
-
-/*
- * Generate a keypair, prettier wrapper
- */
-int mbedtls_ecp_gen_key(mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
- int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- if ((ret = mbedtls_ecp_group_load(&key->grp, grp_id)) != 0) {
- return ret;
- }
-
- return mbedtls_ecp_gen_keypair(&key->grp, &key->d, &key->Q, f_rng, p_rng);
-}
-#endif /* MBEDTLS_ECP_C */
-
-#define ECP_CURVE25519_KEY_SIZE 32
-#define ECP_CURVE448_KEY_SIZE 56
-/*
- * Read a private key.
- */
-int mbedtls_ecp_read_key(mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
- const unsigned char *buf, size_t buflen)
-{
- int ret = 0;
-
- if ((ret = mbedtls_ecp_group_load(&key->grp, grp_id)) != 0) {
- return ret;
- }
-
- ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
- /*
- * Mask the key as mandated by RFC7748 for Curve25519 and Curve448.
- */
- if (grp_id == MBEDTLS_ECP_DP_CURVE25519) {
- if (buflen != ECP_CURVE25519_KEY_SIZE) {
- return MBEDTLS_ERR_ECP_INVALID_KEY;
- }
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary_le(&key->d, buf, buflen));
-
- /* Set the three least significant bits to 0 */
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 0, 0));
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 1, 0));
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 2, 0));
-
- /* Set the most significant bit to 0 */
- MBEDTLS_MPI_CHK(
- mbedtls_mpi_set_bit(&key->d,
- ECP_CURVE25519_KEY_SIZE * 8 - 1, 0)
- );
-
- /* Set the second most significant bit to 1 */
- MBEDTLS_MPI_CHK(
- mbedtls_mpi_set_bit(&key->d,
- ECP_CURVE25519_KEY_SIZE * 8 - 2, 1)
- );
- } else if (grp_id == MBEDTLS_ECP_DP_CURVE448) {
- if (buflen != ECP_CURVE448_KEY_SIZE) {
- return MBEDTLS_ERR_ECP_INVALID_KEY;
- }
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary_le(&key->d, buf, buflen));
-
- /* Set the two least significant bits to 0 */
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 0, 0));
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 1, 0));
-
- /* Set the most significant bit to 1 */
- MBEDTLS_MPI_CHK(
- mbedtls_mpi_set_bit(&key->d,
- ECP_CURVE448_KEY_SIZE * 8 - 1, 1)
- );
- }
- }
-
-#endif
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
- MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&key->d, buf, buflen));
-
- MBEDTLS_MPI_CHK(mbedtls_ecp_check_privkey(&key->grp, &key->d));
- }
-
-#endif
-cleanup:
-
- if (ret != 0) {
- mbedtls_mpi_free(&key->d);
- }
-
- return ret;
-}
-
-/*
- * Write a private key.
- */
-int mbedtls_ecp_write_key(mbedtls_ecp_keypair *key,
- unsigned char *buf, size_t buflen)
-{
- int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
-
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
- if (key->grp.id == MBEDTLS_ECP_DP_CURVE25519) {
- if (buflen < ECP_CURVE25519_KEY_SIZE) {
- return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
- }
-
- } else if (key->grp.id == MBEDTLS_ECP_DP_CURVE448) {
- if (buflen < ECP_CURVE448_KEY_SIZE) {
- return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
- }
- }
- MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary_le(&key->d, buf, buflen));
- }
-#endif
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
- MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&key->d, buf, buflen));
- }
-
-#endif
-cleanup:
-
- return ret;
-}
-
-#if defined(MBEDTLS_ECP_C)
-/*
- * Check a public-private key pair
- */
-int mbedtls_ecp_check_pub_priv(
- const mbedtls_ecp_keypair *pub, const mbedtls_ecp_keypair *prv,
- int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_ecp_point Q;
- mbedtls_ecp_group grp;
- if (pub->grp.id == MBEDTLS_ECP_DP_NONE ||
- pub->grp.id != prv->grp.id ||
- mbedtls_mpi_cmp_mpi(&pub->Q.X, &prv->Q.X) ||
- mbedtls_mpi_cmp_mpi(&pub->Q.Y, &prv->Q.Y) ||
- mbedtls_mpi_cmp_mpi(&pub->Q.Z, &prv->Q.Z)) {
- return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- }
-
- mbedtls_ecp_point_init(&Q);
- mbedtls_ecp_group_init(&grp);
-
- /* mbedtls_ecp_mul() needs a non-const group... */
- mbedtls_ecp_group_copy(&grp, &prv->grp);
-
- /* Also checks d is valid */
- MBEDTLS_MPI_CHK(mbedtls_ecp_mul(&grp, &Q, &prv->d, &prv->grp.G, f_rng, p_rng));
-
- if (mbedtls_mpi_cmp_mpi(&Q.X, &prv->Q.X) ||
- mbedtls_mpi_cmp_mpi(&Q.Y, &prv->Q.Y) ||
- mbedtls_mpi_cmp_mpi(&Q.Z, &prv->Q.Z)) {
- ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
- goto cleanup;
- }
-
-cleanup:
- mbedtls_ecp_point_free(&Q);
- mbedtls_ecp_group_free(&grp);
-
- return ret;
-}
-#endif /* MBEDTLS_ECP_C */
-
-/*
- * Export generic key-pair parameters.
- */
-int mbedtls_ecp_export(const mbedtls_ecp_keypair *key, mbedtls_ecp_group *grp,
- mbedtls_mpi *d, mbedtls_ecp_point *Q)
-{
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-
- if ((ret = mbedtls_ecp_group_copy(grp, &key->grp)) != 0) {
- return ret;
- }
-
- if ((ret = mbedtls_mpi_copy(d, &key->d)) != 0) {
- return ret;
- }
-
- if ((ret = mbedtls_ecp_copy(Q, &key->Q)) != 0) {
- return ret;
- }
-
- return 0;
-}
-
-#if defined(MBEDTLS_SELF_TEST)
-
-#if defined(MBEDTLS_ECP_C)
-/*
- * PRNG for test - !!!INSECURE NEVER USE IN PRODUCTION!!!
- *
- * This is the linear congruential generator from numerical recipes,
- * except we only use the low byte as the output. See
- * https://en.wikipedia.org/wiki/Linear_congruential_generator#Parameters_in_common_use
- */
-static int self_test_rng(void *ctx, unsigned char *out, size_t len)
-{
- static uint32_t state = 42;
-
- (void) ctx;
-
- for (size_t i = 0; i < len; i++) {
- state = state * 1664525u + 1013904223u;
- out[i] = (unsigned char) state;
- }
-
- return 0;
-}
-
-/* Adjust the exponent to be a valid private point for the specified curve.
- * This is sometimes necessary because we use a single set of exponents
- * for all curves but the validity of values depends on the curve. */
-static int self_test_adjust_exponent(const mbedtls_ecp_group *grp,
- mbedtls_mpi *m)
-{
- int ret = 0;
- switch (grp->id) {
- /* If Curve25519 is available, then that's what we use for the
- * Montgomery test, so we don't need the adjustment code. */
-#if !defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
-#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
- case MBEDTLS_ECP_DP_CURVE448:
- /* Move highest bit from 254 to N-1. Setting bit N-1 is
- * necessary to enforce the highest-bit-set constraint. */
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(m, 254, 0));
- MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(m, grp->nbits, 1));
- /* Copy second-highest bit from 253 to N-2. This is not
- * necessary but improves the test variety a bit. */
- MBEDTLS_MPI_CHK(
- mbedtls_mpi_set_bit(m, grp->nbits - 1,
- mbedtls_mpi_get_bit(m, 253)));
- break;
-#endif
-#endif /* ! defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) */
- default:
- /* Non-Montgomery curves and Curve25519 need no adjustment. */
- (void) grp;
- (void) m;
- goto cleanup;
- }
-cleanup:
- return ret;
-}
-
-/* Calculate R = m.P for each m in exponents. Check that the number of
- * basic operations doesn't depend on the value of m. */
-static int self_test_point(int verbose,
- mbedtls_ecp_group *grp,
- mbedtls_ecp_point *R,
- mbedtls_mpi *m,
- const mbedtls_ecp_point *P,
- const char *const *exponents,
- size_t n_exponents)
-{
- int ret = 0;
- size_t i = 0;
- unsigned long add_c_prev, dbl_c_prev, mul_c_prev;
- add_count = 0;
- dbl_count = 0;
- mul_count = 0;
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(m, 16, exponents[0]));
- MBEDTLS_MPI_CHK(self_test_adjust_exponent(grp, m));
- MBEDTLS_MPI_CHK(mbedtls_ecp_mul(grp, R, m, P, self_test_rng, NULL));
-
- for (i = 1; i < n_exponents; i++) {
- add_c_prev = add_count;
- dbl_c_prev = dbl_count;
- mul_c_prev = mul_count;
- add_count = 0;
- dbl_count = 0;
- mul_count = 0;
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(m, 16, exponents[i]));
- MBEDTLS_MPI_CHK(self_test_adjust_exponent(grp, m));
- MBEDTLS_MPI_CHK(mbedtls_ecp_mul(grp, R, m, P, self_test_rng, NULL));
-
- if (add_count != add_c_prev ||
- dbl_count != dbl_c_prev ||
- mul_count != mul_c_prev) {
- ret = 1;
- break;
- }
- }
-
-cleanup:
- if (verbose != 0) {
- if (ret != 0) {
- mbedtls_printf("failed (%u)\n", (unsigned int) i);
- } else {
- mbedtls_printf("passed\n");
- }
- }
- return ret;
-}
-#endif /* MBEDTLS_ECP_C */
-
-/*
- * Checkup routine
- */
-int mbedtls_ecp_self_test(int verbose)
-{
-#if defined(MBEDTLS_ECP_C)
- int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- mbedtls_ecp_group grp;
- mbedtls_ecp_point R, P;
- mbedtls_mpi m;
-
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- /* Exponents especially adapted for secp192k1, which has the lowest
- * order n of all supported curves (secp192r1 is in a slightly larger
- * field but the order of its base point is slightly smaller). */
- const char *sw_exponents[] =
- {
- "000000000000000000000000000000000000000000000001", /* one */
- "FFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8C", /* n - 1 */
- "5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25", /* random */
- "400000000000000000000000000000000000000000000000", /* one and zeros */
- "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", /* all ones */
- "555555555555555555555555555555555555555555555555", /* 101010... */
- };
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- const char *m_exponents[] =
- {
- /* Valid private values for Curve25519. In a build with Curve448
- * but not Curve25519, they will be adjusted in
- * self_test_adjust_exponent(). */
- "4000000000000000000000000000000000000000000000000000000000000000",
- "5C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C30",
- "5715ECCE24583F7A7023C24164390586842E816D7280A49EF6DF4EAE6B280BF8",
- "41A2B017516F6D254E1F002BCCBADD54BE30F8CEC737A0E912B4963B6BA74460",
- "5555555555555555555555555555555555555555555555555555555555555550",
- "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8",
- };
-#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
-
- mbedtls_ecp_group_init(&grp);
- mbedtls_ecp_point_init(&R);
- mbedtls_ecp_point_init(&P);
- mbedtls_mpi_init(&m);
-
-#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
- /* Use secp192r1 if available, or any available curve */
-#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
- MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP192R1));
-#else
- MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&grp, mbedtls_ecp_curve_list()->grp_id));
-#endif
-
- if (verbose != 0) {
- mbedtls_printf(" ECP SW test #1 (constant op_count, base point G): ");
- }
- /* Do a dummy multiplication first to trigger precomputation */
- MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&m, 2));
- MBEDTLS_MPI_CHK(mbedtls_ecp_mul(&grp, &P, &m, &grp.G, self_test_rng, NULL));
- ret = self_test_point(verbose,
- &grp, &R, &m, &grp.G,
- sw_exponents,
- sizeof(sw_exponents) / sizeof(sw_exponents[0]));
- if (ret != 0) {
- goto cleanup;
- }
-
- if (verbose != 0) {
- mbedtls_printf(" ECP SW test #2 (constant op_count, other point): ");
- }
- /* We computed P = 2G last time, use it */
- ret = self_test_point(verbose,
- &grp, &R, &m, &P,
- sw_exponents,
- sizeof(sw_exponents) / sizeof(sw_exponents[0]));
- if (ret != 0) {
- goto cleanup;
- }
-
- mbedtls_ecp_group_free(&grp);
- mbedtls_ecp_point_free(&R);
-#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
-
-#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
- if (verbose != 0) {
- mbedtls_printf(" ECP Montgomery test (constant op_count): ");
- }
-#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
- MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_CURVE25519));
-#elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
- MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_CURVE448));
-#else
-#error "MBEDTLS_ECP_MONTGOMERY_ENABLED is defined, but no curve is supported for self-test"
-#endif
- ret = self_test_point(verbose,
- &grp, &R, &m, &grp.G,
- m_exponents,
- sizeof(m_exponents) / sizeof(m_exponents[0]));
- if (ret != 0) {
- goto cleanup;
- }
-#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
-
-cleanup:
-
- if (ret < 0 && verbose != 0) {
- mbedtls_printf("Unexpected error, return code = %08X\n", (unsigned int) ret);
- }
-
- mbedtls_ecp_group_free(&grp);
- mbedtls_ecp_point_free(&R);
- mbedtls_ecp_point_free(&P);
- mbedtls_mpi_free(&m);
-
- if (verbose != 0) {
- mbedtls_printf("\n");
- }
-
- return ret;
-#else /* MBEDTLS_ECP_C */
- (void) verbose;
- return 0;
-#endif /* MBEDTLS_ECP_C */
-}
-
-#endif /* MBEDTLS_SELF_TEST */
-
-#if defined(MBEDTLS_TEST_HOOKS)
-
-MBEDTLS_STATIC_TESTABLE
-mbedtls_ecp_variant mbedtls_ecp_get_variant()
-{
- return MBEDTLS_ECP_VARIANT_WITH_MPI_UINT;
-}
-
-#endif /* MBEDTLS_TEST_HOOKS */
-
-#endif /* !MBEDTLS_ECP_ALT */
-
-#endif /* MBEDTLS_ECP_LIGHT */
-
-#endif /* MBEDTLS_ECP_WITH_MPI_UINT */
diff --git a/library/pkparse.c b/library/pkparse.c
index f03ace2..fe01a11 100644
--- a/library/pkparse.c
+++ b/library/pkparse.c
@@ -34,9 +34,6 @@
#include "mbedtls/rsa.h"
#endif
#include "mbedtls/ecp.h"
-#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECP_C)
-#include "pkwrite.h"
-#endif
#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
#include "pk_internal.h"
#endif
diff --git a/library/pkwrite.c b/library/pkwrite.c
index 4ec0b81..439428c 100644
--- a/library/pkwrite.c
+++ b/library/pkwrite.c
@@ -165,7 +165,7 @@
const mbedtls_pk_context *pk)
{
size_t len = 0;
- uint8_t buf[PSA_EXPORT_KEY_PAIR_MAX_SIZE];
+ uint8_t buf[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE];
if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_OPAQUE) {
if (psa_export_public_key(pk->priv_id, buf, sizeof(buf), &len) != PSA_SUCCESS) {
diff --git a/library/pkwrite.h b/library/pkwrite.h
index aa2f17b..8cfa64b 100644
--- a/library/pkwrite.h
+++ b/library/pkwrite.h
@@ -27,6 +27,10 @@
#include "mbedtls/pk.h"
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+#include "psa/crypto.h"
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
+
/*
* Max sizes of key per types. Shown as tag + len (+ content).
*/
@@ -74,6 +78,19 @@
#endif /* MBEDTLS_RSA_C */
#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
+
+/* Find the maximum number of bytes necessary to store an EC point. When USE_PSA
+ * is defined this means looking for the maximum between PSA and built-in
+ * supported curves. */
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+#define MBEDTLS_PK_MAX_ECC_BYTES (PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS) > \
+ MBEDTLS_ECP_MAX_BYTES ? \
+ PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS) : \
+ MBEDTLS_ECP_MAX_BYTES)
+#else /* MBEDTLS_USE_PSA_CRYPTO */
+#define MBEDTLS_PK_MAX_ECC_BYTES MBEDTLS_ECP_MAX_BYTES
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
+
/*
* EC public keys:
* SubjectPublicKeyInfo ::= SEQUENCE { 1 + 2
@@ -85,7 +102,7 @@
* + 2 * ECP_MAX (coords) [1]
* }
*/
-#define MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES (30 + 2 * MBEDTLS_ECP_MAX_BYTES)
+#define MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES (30 + 2 * MBEDTLS_PK_MAX_ECC_BYTES)
/*
* EC private keys:
@@ -96,7 +113,7 @@
* publicKey [1] BIT STRING OPTIONAL 1 + 2 + [1] above
* }
*/
-#define MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES (29 + 3 * MBEDTLS_ECP_MAX_BYTES)
+#define MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES (29 + 3 * MBEDTLS_PK_MAX_ECC_BYTES)
#else /* MBEDTLS_PK_HAVE_ECC_KEYS */
diff --git a/library/rsa.c b/library/rsa.c
index ad49796..d0782f5 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -56,6 +56,164 @@
#include "mbedtls/platform.h"
+
+#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)
+
+/** This function performs the unpadding part of a PKCS#1 v1.5 decryption
+ * operation (EME-PKCS1-v1_5 decoding).
+ *
+ * \note The return value from this function is a sensitive value
+ * (this is unusual). #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE shouldn't happen
+ * in a well-written application, but 0 vs #MBEDTLS_ERR_RSA_INVALID_PADDING
+ * is often a situation that an attacker can provoke and leaking which
+ * one is the result is precisely the information the attacker wants.
+ *
+ * \param input The input buffer which is the payload inside PKCS#1v1.5
+ * encryption padding, called the "encoded message EM"
+ * by the terminology.
+ * \param ilen The length of the payload in the \p input buffer.
+ * \param output The buffer for the payload, called "message M" by the
+ * PKCS#1 terminology. This must be a writable buffer of
+ * length \p output_max_len bytes.
+ * \param olen The address at which to store the length of
+ * the payload. This must not be \c NULL.
+ * \param output_max_len The length in bytes of the output buffer \p output.
+ *
+ * \return \c 0 on success.
+ * \return #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE
+ * The output buffer is too small for the unpadded payload.
+ * \return #MBEDTLS_ERR_RSA_INVALID_PADDING
+ * The input doesn't contain properly formatted padding.
+ */
+static int mbedtls_ct_rsaes_pkcs1_v15_unpadding(unsigned char *input,
+ size_t ilen,
+ unsigned char *output,
+ size_t output_max_len,
+ size_t *olen)
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ size_t i, plaintext_max_size;
+
+ /* The following variables take sensitive values: their value must
+ * not leak into the observable behavior of the function other than
+ * the designated outputs (output, olen, return value). Otherwise
+ * this would open the execution of the function to
+ * side-channel-based variants of the Bleichenbacher padding oracle
+ * attack. Potential side channels include overall timing, memory
+ * access patterns (especially visible to an adversary who has access
+ * to a shared memory cache), and branches (especially visible to
+ * an adversary who has access to a shared code cache or to a shared
+ * branch predictor). */
+ size_t pad_count = 0;
+ mbedtls_ct_condition_t bad;
+ mbedtls_ct_condition_t pad_done;
+ size_t plaintext_size = 0;
+ mbedtls_ct_condition_t output_too_large;
+
+ plaintext_max_size = (output_max_len > ilen - 11) ? ilen - 11
+ : output_max_len;
+
+ /* Check and get padding length in constant time and constant
+ * memory trace. The first byte must be 0. */
+ bad = mbedtls_ct_bool(input[0]);
+
+
+ /* Decode EME-PKCS1-v1_5 padding: 0x00 || 0x02 || PS || 0x00
+ * where PS must be at least 8 nonzero bytes. */
+ bad = mbedtls_ct_bool_or(bad, mbedtls_ct_uint_ne(input[1], MBEDTLS_RSA_CRYPT));
+
+ /* Read the whole buffer. Set pad_done to nonzero if we find
+ * the 0x00 byte and remember the padding length in pad_count. */
+ pad_done = MBEDTLS_CT_FALSE;
+ for (i = 2; i < ilen; i++) {
+ mbedtls_ct_condition_t found = mbedtls_ct_uint_eq(input[i], 0);
+ pad_done = mbedtls_ct_bool_or(pad_done, found);
+ pad_count += mbedtls_ct_uint_if_else_0(mbedtls_ct_bool_not(pad_done), 1);
+ }
+
+ /* If pad_done is still zero, there's no data, only unfinished padding. */
+ bad = mbedtls_ct_bool_or(bad, mbedtls_ct_bool_not(pad_done));
+
+ /* There must be at least 8 bytes of padding. */
+ bad = mbedtls_ct_bool_or(bad, mbedtls_ct_uint_gt(8, pad_count));
+
+ /* If the padding is valid, set plaintext_size to the number of
+ * remaining bytes after stripping the padding. If the padding
+ * is invalid, avoid leaking this fact through the size of the
+ * output: use the maximum message size that fits in the output
+ * buffer. Do it without branches to avoid leaking the padding
+ * validity through timing. RSA keys are small enough that all the
+ * size_t values involved fit in unsigned int. */
+ plaintext_size = mbedtls_ct_uint_if(
+ bad, (unsigned) plaintext_max_size,
+ (unsigned) (ilen - pad_count - 3));
+
+ /* Set output_too_large to 0 if the plaintext fits in the output
+ * buffer and to 1 otherwise. */
+ output_too_large = mbedtls_ct_uint_gt(plaintext_size,
+ plaintext_max_size);
+
+ /* Set ret without branches to avoid timing attacks. Return:
+ * - INVALID_PADDING if the padding is bad (bad != 0).
+ * - OUTPUT_TOO_LARGE if the padding is good but the decrypted
+ * plaintext does not fit in the output buffer.
+ * - 0 if the padding is correct. */
+ ret = -(int) mbedtls_ct_uint_if(
+ bad,
+ (unsigned) (-(MBEDTLS_ERR_RSA_INVALID_PADDING)),
+ mbedtls_ct_uint_if_else_0(
+ output_too_large,
+ (unsigned) (-(MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE)))
+ );
+
+ /* If the padding is bad or the plaintext is too large, zero the
+ * data that we're about to copy to the output buffer.
+ * We need to copy the same amount of data
+ * from the same buffer whether the padding is good or not to
+ * avoid leaking the padding validity through overall timing or
+ * through memory or cache access patterns. */
+ mbedtls_ct_zeroize_if(mbedtls_ct_bool_or(bad, output_too_large), input + 11, ilen - 11);
+
+ /* If the plaintext is too large, truncate it to the buffer size.
+ * Copy anyway to avoid revealing the length through timing, because
+ * revealing the length is as bad as revealing the padding validity
+ * for a Bleichenbacher attack. */
+ plaintext_size = mbedtls_ct_uint_if(output_too_large,
+ (unsigned) plaintext_max_size,
+ (unsigned) plaintext_size);
+
+ /* Move the plaintext to the leftmost position where it can start in
+ * the working buffer, i.e. make it start plaintext_max_size from
+ * the end of the buffer. Do this with a memory access trace that
+ * does not depend on the plaintext size. After this move, the
+ * starting location of the plaintext is no longer sensitive
+ * information. */
+ mbedtls_ct_memmove_left(input + ilen - plaintext_max_size,
+ plaintext_max_size,
+ plaintext_max_size - plaintext_size);
+
+ /* Finally copy the decrypted plaintext plus trailing zeros into the output
+ * buffer. If output_max_len is 0, then output may be an invalid pointer
+ * and the result of memcpy() would be undefined; prevent undefined
+ * behavior making sure to depend only on output_max_len (the size of the
+ * user-provided output buffer), which is independent from plaintext
+ * length, validity of padding, success of the decryption, and other
+ * secrets. */
+ if (output_max_len != 0) {
+ memcpy(output, input + ilen - plaintext_max_size, plaintext_max_size);
+ }
+
+ /* Report the amount of data we copied to the output buffer. In case
+ * of errors (bad padding or output too large), the value of *olen
+ * when this function returns is not specified. Making it equivalent
+ * to the good case limits the risks of leaking the padding validity. */
+ *olen = plaintext_size;
+
+ return ret;
+}
+
+#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */
+
#if !defined(MBEDTLS_RSA_ALT)
int mbedtls_rsa_import(mbedtls_rsa_context *ctx,
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index f4264fb..8a709e4 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -2796,4 +2796,64 @@
int mbedtls_ssl_tls13_finalize_client_hello(mbedtls_ssl_context *ssl);
#endif
+#if defined(MBEDTLS_TEST_HOOKS) && defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
+
+/** Compute the HMAC of variable-length data with constant flow.
+ *
+ * This function computes the HMAC of the concatenation of \p add_data and \p
+ * data, and does with a code flow and memory access pattern that does not
+ * depend on \p data_len_secret, but only on \p min_data_len and \p
+ * max_data_len. In particular, this function always reads exactly \p
+ * max_data_len bytes from \p data.
+ *
+ * \param ctx The HMAC context. It must have keys configured
+ * with mbedtls_md_hmac_starts() and use one of the
+ * following hashes: SHA-384, SHA-256, SHA-1 or MD-5.
+ * It is reset using mbedtls_md_hmac_reset() after
+ * the computation is complete to prepare for the
+ * next computation.
+ * \param add_data The first part of the message whose HMAC is being
+ * calculated. This must point to a readable buffer
+ * of \p add_data_len bytes.
+ * \param add_data_len The length of \p add_data in bytes.
+ * \param data The buffer containing the second part of the
+ * message. This must point to a readable buffer
+ * of \p max_data_len bytes.
+ * \param data_len_secret The length of the data to process in \p data.
+ * This must be no less than \p min_data_len and no
+ * greater than \p max_data_len.
+ * \param min_data_len The minimal length of the second part of the
+ * message, read from \p data.
+ * \param max_data_len The maximal length of the second part of the
+ * message, read from \p data.
+ * \param output The HMAC will be written here. This must point to
+ * a writable buffer of sufficient size to hold the
+ * HMAC value.
+ *
+ * \retval 0 on success.
+ * \retval #MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED
+ * The hardware accelerator failed.
+ */
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+int mbedtls_ct_hmac(mbedtls_svc_key_id_t key,
+ psa_algorithm_t mac_alg,
+ const unsigned char *add_data,
+ size_t add_data_len,
+ const unsigned char *data,
+ size_t data_len_secret,
+ size_t min_data_len,
+ size_t max_data_len,
+ unsigned char *output);
+#else
+int mbedtls_ct_hmac(mbedtls_md_context_t *ctx,
+ const unsigned char *add_data,
+ size_t add_data_len,
+ const unsigned char *data,
+ size_t data_len_secret,
+ size_t min_data_len,
+ size_t max_data_len,
+ unsigned char *output);
+#endif /* defined(MBEDTLS_USE_PSA_CRYPTO) */
+#endif /* MBEDTLS_TEST_HOOKS && defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) */
+
#endif /* ssl_misc.h */
diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index e36a653..c8ffc1e 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -60,6 +60,234 @@
#define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status)
#endif
+#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
+
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+
+#if defined(PSA_WANT_ALG_SHA_384)
+#define MAX_HASH_BLOCK_LENGTH PSA_HASH_BLOCK_LENGTH(PSA_ALG_SHA_384)
+#elif defined(PSA_WANT_ALG_SHA_256)
+#define MAX_HASH_BLOCK_LENGTH PSA_HASH_BLOCK_LENGTH(PSA_ALG_SHA_256)
+#else /* See check_config.h */
+#define MAX_HASH_BLOCK_LENGTH PSA_HASH_BLOCK_LENGTH(PSA_ALG_SHA_1)
+#endif
+
+MBEDTLS_STATIC_TESTABLE
+int mbedtls_ct_hmac(mbedtls_svc_key_id_t key,
+ psa_algorithm_t mac_alg,
+ const unsigned char *add_data,
+ size_t add_data_len,
+ const unsigned char *data,
+ size_t data_len_secret,
+ size_t min_data_len,
+ size_t max_data_len,
+ unsigned char *output)
+{
+ /*
+ * This function breaks the HMAC abstraction and uses psa_hash_clone()
+ * extension in order to get constant-flow behaviour.
+ *
+ * HMAC(msg) is defined as HASH(okey + HASH(ikey + msg)) where + means
+ * concatenation, and okey/ikey are the XOR of the key with some fixed bit
+ * patterns (see RFC 2104, sec. 2).
+ *
+ * We'll first compute ikey/okey, then inner_hash = HASH(ikey + msg) by
+ * hashing up to minlen, then cloning the context, and for each byte up
+ * to maxlen finishing up the hash computation, keeping only the
+ * correct result.
+ *
+ * Then we only need to compute HASH(okey + inner_hash) and we're done.
+ */
+ psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH(mac_alg);
+ const size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg);
+ unsigned char key_buf[MAX_HASH_BLOCK_LENGTH];
+ const size_t hash_size = PSA_HASH_LENGTH(hash_alg);
+ psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
+ size_t hash_length;
+
+ unsigned char aux_out[PSA_HASH_MAX_SIZE];
+ psa_hash_operation_t aux_operation = PSA_HASH_OPERATION_INIT;
+ size_t offset;
+ psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+
+ size_t mac_key_length;
+ size_t i;
+
+#define PSA_CHK(func_call) \
+ do { \
+ status = (func_call); \
+ if (status != PSA_SUCCESS) \
+ goto cleanup; \
+ } while (0)
+
+ /* Export MAC key
+ * We assume key length is always exactly the output size
+ * which is never more than the block size, thus we use block_size
+ * as the key buffer size.
+ */
+ PSA_CHK(psa_export_key(key, key_buf, block_size, &mac_key_length));
+
+ /* Calculate ikey */
+ for (i = 0; i < mac_key_length; i++) {
+ key_buf[i] = (unsigned char) (key_buf[i] ^ 0x36);
+ }
+ for (; i < block_size; ++i) {
+ key_buf[i] = 0x36;
+ }
+
+ PSA_CHK(psa_hash_setup(&operation, hash_alg));
+
+ /* Now compute inner_hash = HASH(ikey + msg) */
+ PSA_CHK(psa_hash_update(&operation, key_buf, block_size));
+ PSA_CHK(psa_hash_update(&operation, add_data, add_data_len));
+ PSA_CHK(psa_hash_update(&operation, data, min_data_len));
+
+ /* Fill the hash buffer in advance with something that is
+ * not a valid hash (barring an attack on the hash and
+ * deliberately-crafted input), in case the caller doesn't
+ * check the return status properly. */
+ memset(output, '!', hash_size);
+
+ /* For each possible length, compute the hash up to that point */
+ for (offset = min_data_len; offset <= max_data_len; offset++) {
+ PSA_CHK(psa_hash_clone(&operation, &aux_operation));
+ PSA_CHK(psa_hash_finish(&aux_operation, aux_out,
+ PSA_HASH_MAX_SIZE, &hash_length));
+ /* Keep only the correct inner_hash in the output buffer */
+ mbedtls_ct_memcpy_if(mbedtls_ct_uint_eq(offset, data_len_secret),
+ output, aux_out, NULL, hash_size);
+
+ if (offset < max_data_len) {
+ PSA_CHK(psa_hash_update(&operation, data + offset, 1));
+ }
+ }
+
+ /* Abort current operation to prepare for final operation */
+ PSA_CHK(psa_hash_abort(&operation));
+
+ /* Calculate okey */
+ for (i = 0; i < mac_key_length; i++) {
+ key_buf[i] = (unsigned char) ((key_buf[i] ^ 0x36) ^ 0x5C);
+ }
+ for (; i < block_size; ++i) {
+ key_buf[i] = 0x5C;
+ }
+
+ /* Now compute HASH(okey + inner_hash) */
+ PSA_CHK(psa_hash_setup(&operation, hash_alg));
+ PSA_CHK(psa_hash_update(&operation, key_buf, block_size));
+ PSA_CHK(psa_hash_update(&operation, output, hash_size));
+ PSA_CHK(psa_hash_finish(&operation, output, hash_size, &hash_length));
+
+#undef PSA_CHK
+
+cleanup:
+ mbedtls_platform_zeroize(key_buf, MAX_HASH_BLOCK_LENGTH);
+ mbedtls_platform_zeroize(aux_out, PSA_HASH_MAX_SIZE);
+
+ psa_hash_abort(&operation);
+ psa_hash_abort(&aux_operation);
+ return PSA_TO_MBEDTLS_ERR(status);
+}
+
+#undef MAX_HASH_BLOCK_LENGTH
+
+#else
+MBEDTLS_STATIC_TESTABLE
+int mbedtls_ct_hmac(mbedtls_md_context_t *ctx,
+ const unsigned char *add_data,
+ size_t add_data_len,
+ const unsigned char *data,
+ size_t data_len_secret,
+ size_t min_data_len,
+ size_t max_data_len,
+ unsigned char *output)
+{
+ /*
+ * This function breaks the HMAC abstraction and uses the md_clone()
+ * extension to the MD API in order to get constant-flow behaviour.
+ *
+ * HMAC(msg) is defined as HASH(okey + HASH(ikey + msg)) where + means
+ * concatenation, and okey/ikey are the XOR of the key with some fixed bit
+ * patterns (see RFC 2104, sec. 2), which are stored in ctx->hmac_ctx.
+ *
+ * We'll first compute inner_hash = HASH(ikey + msg) by hashing up to
+ * minlen, then cloning the context, and for each byte up to maxlen
+ * finishing up the hash computation, keeping only the correct result.
+ *
+ * Then we only need to compute HASH(okey + inner_hash) and we're done.
+ */
+ const mbedtls_md_type_t md_alg = mbedtls_md_get_type(ctx->md_info);
+ /* TLS 1.2 only supports SHA-384, SHA-256, SHA-1, MD-5,
+ * all of which have the same block size except SHA-384. */
+ const size_t block_size = md_alg == MBEDTLS_MD_SHA384 ? 128 : 64;
+ const unsigned char * const ikey = ctx->hmac_ctx;
+ const unsigned char * const okey = ikey + block_size;
+ const size_t hash_size = mbedtls_md_get_size(ctx->md_info);
+
+ unsigned char aux_out[MBEDTLS_MD_MAX_SIZE];
+ mbedtls_md_context_t aux;
+ size_t offset;
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+
+ mbedtls_md_init(&aux);
+
+#define MD_CHK(func_call) \
+ do { \
+ ret = (func_call); \
+ if (ret != 0) \
+ goto cleanup; \
+ } while (0)
+
+ MD_CHK(mbedtls_md_setup(&aux, ctx->md_info, 0));
+
+ /* After hmac_start() of hmac_reset(), ikey has already been hashed,
+ * so we can start directly with the message */
+ MD_CHK(mbedtls_md_update(ctx, add_data, add_data_len));
+ MD_CHK(mbedtls_md_update(ctx, data, min_data_len));
+
+ /* Fill the hash buffer in advance with something that is
+ * not a valid hash (barring an attack on the hash and
+ * deliberately-crafted input), in case the caller doesn't
+ * check the return status properly. */
+ memset(output, '!', hash_size);
+
+ /* For each possible length, compute the hash up to that point */
+ for (offset = min_data_len; offset <= max_data_len; offset++) {
+ MD_CHK(mbedtls_md_clone(&aux, ctx));
+ MD_CHK(mbedtls_md_finish(&aux, aux_out));
+ /* Keep only the correct inner_hash in the output buffer */
+ mbedtls_ct_memcpy_if(mbedtls_ct_uint_eq(offset, data_len_secret),
+ output, aux_out, NULL, hash_size);
+
+ if (offset < max_data_len) {
+ MD_CHK(mbedtls_md_update(ctx, data + offset, 1));
+ }
+ }
+
+ /* The context needs to finish() before it starts() again */
+ MD_CHK(mbedtls_md_finish(ctx, aux_out));
+
+ /* Now compute HASH(okey + inner_hash) */
+ MD_CHK(mbedtls_md_starts(ctx));
+ MD_CHK(mbedtls_md_update(ctx, okey, block_size));
+ MD_CHK(mbedtls_md_update(ctx, output, hash_size));
+ MD_CHK(mbedtls_md_finish(ctx, output));
+
+ /* Done, get ready for next time */
+ MD_CHK(mbedtls_md_hmac_reset(ctx));
+
+#undef MD_CHK
+
+cleanup:
+ mbedtls_md_free(&aux);
+ return ret;
+}
+
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
+
+#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
+
static uint32_t ssl_get_hs_total_len(mbedtls_ssl_context const *ssl);
/*
@@ -1690,11 +1918,11 @@
padlen = data[rec->data_len - 1];
if (auth_done == 1) {
- const size_t mask = mbedtls_ct_size_mask_ge(
+ const mbedtls_ct_condition_t ge = mbedtls_ct_uint_ge(
rec->data_len,
padlen + 1);
- correct &= mask;
- padlen &= mask;
+ correct = mbedtls_ct_size_if_else_0(ge, correct);
+ padlen = mbedtls_ct_size_if_else_0(ge, padlen);
} else {
#if defined(MBEDTLS_SSL_DEBUG_ALL)
if (rec->data_len < transform->maclen + padlen + 1) {
@@ -1706,12 +1934,11 @@
padlen + 1));
}
#endif
-
- const size_t mask = mbedtls_ct_size_mask_ge(
+ const mbedtls_ct_condition_t ge = mbedtls_ct_uint_ge(
rec->data_len,
transform->maclen + padlen + 1);
- correct &= mask;
- padlen &= mask;
+ correct = mbedtls_ct_size_if_else_0(ge, correct);
+ padlen = mbedtls_ct_size_if_else_0(ge, padlen);
}
padlen++;
@@ -1740,19 +1967,20 @@
/* pad_count += (idx >= padding_idx) &&
* (check[idx] == padlen - 1);
*/
- const size_t mask = mbedtls_ct_size_mask_ge(idx, padding_idx);
- const size_t equal = mbedtls_ct_size_bool_eq(check[idx],
- padlen - 1);
- pad_count += mask & equal;
+ const mbedtls_ct_condition_t a = mbedtls_ct_uint_ge(idx, padding_idx);
+ size_t increment = mbedtls_ct_size_if_else_0(a, 1);
+ const mbedtls_ct_condition_t b = mbedtls_ct_uint_eq(check[idx], padlen - 1);
+ increment = mbedtls_ct_size_if_else_0(b, increment);
+ pad_count += increment;
}
- correct &= mbedtls_ct_size_bool_eq(pad_count, padlen);
+ correct = mbedtls_ct_size_if_else_0(mbedtls_ct_uint_eq(pad_count, padlen), padlen);
#if defined(MBEDTLS_SSL_DEBUG_ALL)
if (padlen > 0 && correct == 0) {
MBEDTLS_SSL_DEBUG_MSG(1, ("bad padding byte detected"));
}
#endif
- padlen &= mbedtls_ct_size_mask(correct);
+ padlen = mbedtls_ct_size_if_else_0(mbedtls_ct_bool(correct), padlen);
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c
index 9b992d6..34ac091 100644
--- a/library/ssl_tls12_server.c
+++ b/library/ssl_tls12_server.c
@@ -3506,9 +3506,8 @@
unsigned char *pms = ssl->handshake->premaster + pms_offset;
unsigned char ver[2];
unsigned char fake_pms[48], peer_pms[48];
- unsigned char mask;
- size_t i, peer_pmslen;
- unsigned int diff;
+ size_t peer_pmslen;
+ mbedtls_ct_condition_t diff;
/* In case of a failure in decryption, the decryption may write less than
* 2 bytes of output, but we always read the first two bytes. It doesn't
@@ -3537,13 +3536,10 @@
/* Avoid data-dependent branches while checking for invalid
* padding, to protect against timing-based Bleichenbacher-type
* attacks. */
- diff = (unsigned int) ret;
- diff |= peer_pmslen ^ 48;
- diff |= peer_pms[0] ^ ver[0];
- diff |= peer_pms[1] ^ ver[1];
-
- /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
- mask = mbedtls_ct_uint_mask(diff);
+ diff = mbedtls_ct_bool(ret);
+ diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pmslen, 48));
+ diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[0], ver[0]));
+ diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[1], ver[1]));
/*
* Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
@@ -3562,7 +3558,7 @@
}
#if defined(MBEDTLS_SSL_DEBUG_ALL)
- if (diff != 0) {
+ if (diff != MBEDTLS_CT_FALSE) {
MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
}
#endif
@@ -3576,9 +3572,7 @@
/* Set pms to either the true or the fake PMS, without
* data-dependent branches. */
- for (i = 0; i < ssl->handshake->pmslen; i++) {
- pms[i] = (mask & fake_pms[i]) | ((~mask) & peer_pms[i]);
- }
+ mbedtls_ct_memcpy_if(diff, pms, fake_pms, peer_pms, ssl->handshake->pmslen);
return 0;
}
diff --git a/library/x509_create.c b/library/x509_create.c
index cdfc82a..bd772d3 100644
--- a/library/x509_create.c
+++ b/library/x509_create.c
@@ -285,9 +285,11 @@
int mbedtls_x509_write_sig(unsigned char **p, unsigned char *start,
const char *oid, size_t oid_len,
- unsigned char *sig, size_t size)
+ unsigned char *sig, size_t size,
+ mbedtls_pk_type_t pk_alg)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ int write_null_par;
size_t len = 0;
if (*p < start || (size_t) (*p - start) < size) {
@@ -310,8 +312,19 @@
// Write OID
//
- MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_algorithm_identifier(p, start, oid,
- oid_len, 0));
+ if (pk_alg == MBEDTLS_PK_ECDSA) {
+ /*
+ * The AlgorithmIdentifier's parameters field must be absent for DSA/ECDSA signature
+ * algorithms, see https://www.rfc-editor.org/rfc/rfc5480#page-17 and
+ * https://www.rfc-editor.org/rfc/rfc5758#section-3.
+ */
+ write_null_par = 0;
+ } else {
+ write_null_par = 1;
+ }
+ MBEDTLS_ASN1_CHK_ADD(len,
+ mbedtls_asn1_write_algorithm_identifier_ext(p, start, oid, oid_len,
+ 0, write_null_par));
return (int) len;
}
diff --git a/library/x509write_crt.c b/library/x509write_crt.c
index bcee4dc..3586a3c 100644
--- a/library/x509write_crt.c
+++ b/library/x509write_crt.c
@@ -577,6 +577,7 @@
size_t sub_len = 0, pub_len = 0, sig_and_oid_len = 0, sig_len;
size_t len = 0;
mbedtls_pk_type_t pk_alg;
+ int write_sig_null_par;
/*
* Prepare data to be signed at the end of the target buffer
@@ -668,9 +669,20 @@
/*
* Signature ::= AlgorithmIdentifier
*/
+ if (pk_alg == MBEDTLS_PK_ECDSA) {
+ /*
+ * The AlgorithmIdentifier's parameters field must be absent for DSA/ECDSA signature
+ * algorithms, see https://www.rfc-editor.org/rfc/rfc5480#page-17 and
+ * https://www.rfc-editor.org/rfc/rfc5758#section-3.
+ */
+ write_sig_null_par = 0;
+ } else {
+ write_sig_null_par = 1;
+ }
MBEDTLS_ASN1_CHK_ADD(len,
- mbedtls_asn1_write_algorithm_identifier(&c, buf,
- sig_oid, strlen(sig_oid), 0));
+ mbedtls_asn1_write_algorithm_identifier_ext(&c, buf,
+ sig_oid, strlen(sig_oid),
+ 0, write_sig_null_par));
/*
* Serial ::= INTEGER
@@ -762,8 +774,8 @@
* into the CRT buffer. */
c2 = buf + size;
MBEDTLS_ASN1_CHK_ADD(sig_and_oid_len, mbedtls_x509_write_sig(&c2, c,
- sig_oid, sig_oid_len, sig,
- sig_len));
+ sig_oid, sig_oid_len,
+ sig, sig_len, pk_alg));
/*
* Memory layout after this step:
diff --git a/library/x509write_csr.c b/library/x509write_csr.c
index b67cdde..5d3d176 100644
--- a/library/x509write_csr.c
+++ b/library/x509write_csr.c
@@ -363,7 +363,7 @@
c2 = buf + size;
MBEDTLS_ASN1_CHK_ADD(sig_and_oid_len,
mbedtls_x509_write_sig(&c2, buf + len, sig_oid, sig_oid_len,
- sig, sig_len));
+ sig, sig_len, pk_alg));
/*
* Compact the space between the CSR data and signature by moving the
diff --git a/programs/.gitignore b/programs/.gitignore
index d11db9e..a641c31 100644
--- a/programs/.gitignore
+++ b/programs/.gitignore
@@ -5,10 +5,6 @@
*.sln
*.vcxproj
-# Generated source files
-/psa/psa_constant_names_generated.c
-/test/query_config.c
-
aes/crypt_and_hash
cipher/cipher_aead_demo
hash/generic_sum
@@ -75,5 +71,11 @@
x509/load_roots
x509/req_app
+###START_GENERATED_FILES###
+# Generated source files
+/psa/psa_constant_names_generated.c
+/test/query_config.c
+
# Generated data files
pkey/keyfile.key
+###END_GENERATED_FILES###
diff --git a/programs/pkey/gen_key.c b/programs/pkey/gen_key.c
index 9bee275..99e8850 100644
--- a/programs/pkey/gen_key.c
+++ b/programs/pkey/gen_key.c
@@ -180,7 +180,9 @@
char buf[1024];
int i;
char *p, *q;
+#if defined(MBEDTLS_RSA_C)
mbedtls_mpi N, P, Q, D, E, DP, DQ, QP;
+#endif /* MBEDTLS_RSA_C */
mbedtls_entropy_context entropy;
mbedtls_ctr_drbg_context ctr_drbg;
const char *pers = "gen_key";
@@ -191,10 +193,11 @@
/*
* Set to sane values
*/
-
+#if defined(MBEDTLS_RSA_C)
mbedtls_mpi_init(&N); mbedtls_mpi_init(&P); mbedtls_mpi_init(&Q);
mbedtls_mpi_init(&D); mbedtls_mpi_init(&E); mbedtls_mpi_init(&DP);
mbedtls_mpi_init(&DQ); mbedtls_mpi_init(&QP);
+#endif /* MBEDTLS_RSA_C */
mbedtls_pk_init(&key);
mbedtls_ctr_drbg_init(&ctr_drbg);
@@ -409,9 +412,11 @@
#endif
}
+#if defined(MBEDTLS_RSA_C)
mbedtls_mpi_free(&N); mbedtls_mpi_free(&P); mbedtls_mpi_free(&Q);
mbedtls_mpi_free(&D); mbedtls_mpi_free(&E); mbedtls_mpi_free(&DP);
mbedtls_mpi_free(&DQ); mbedtls_mpi_free(&QP);
+#endif /* MBEDTLS_RSA_C */
mbedtls_pk_free(&key);
mbedtls_ctr_drbg_free(&ctr_drbg);
diff --git a/programs/pkey/key_app_writer.c b/programs/pkey/key_app_writer.c
index e8f3e85..179094c 100644
--- a/programs/pkey/key_app_writer.c
+++ b/programs/pkey/key_app_writer.c
@@ -203,7 +203,9 @@
mbedtls_ctr_drbg_context ctr_drbg;
mbedtls_pk_context key;
+#if defined(MBEDTLS_RSA_C)
mbedtls_mpi N, P, Q, D, E, DP, DQ, QP;
+#endif /* MBEDTLS_RSA_C */
/*
* Set to sane values
@@ -225,9 +227,11 @@
}
#endif /* MBEDTLS_USE_PSA_CRYPTO */
+#if defined(MBEDTLS_RSA_C)
mbedtls_mpi_init(&N); mbedtls_mpi_init(&P); mbedtls_mpi_init(&Q);
mbedtls_mpi_init(&D); mbedtls_mpi_init(&E); mbedtls_mpi_init(&DP);
mbedtls_mpi_init(&DQ); mbedtls_mpi_init(&QP);
+#endif /* MBEDTLS_RSA_C */
if (argc < 2) {
usage:
@@ -423,9 +427,11 @@
#endif
}
+#if defined(MBEDTLS_RSA_C)
mbedtls_mpi_free(&N); mbedtls_mpi_free(&P); mbedtls_mpi_free(&Q);
mbedtls_mpi_free(&D); mbedtls_mpi_free(&E); mbedtls_mpi_free(&DP);
mbedtls_mpi_free(&DQ); mbedtls_mpi_free(&QP);
+#endif /* MBEDTLS_RSA_C */
mbedtls_pk_free(&key);
diff --git a/scripts/data_files/driver_jsons/mbedtls_test_transparent_driver.json b/scripts/data_files/driver_jsons/mbedtls_test_transparent_driver.json
index 9eb259f..b9b2d68 100644
--- a/scripts/data_files/driver_jsons/mbedtls_test_transparent_driver.json
+++ b/scripts/data_files/driver_jsons/mbedtls_test_transparent_driver.json
@@ -7,7 +7,7 @@
{
"_comment": "The Mbed TLS transparent driver supports import key/export key",
"mbedtls/c_condition": "defined(PSA_CRYPTO_DRIVER_TEST)",
- "entry_points": ["import_key", "export_key"],
+ "entry_points": ["import_key"],
"fallback": true
},
{
diff --git a/scripts/gitignore_patch.sh b/scripts/gitignore_patch.sh
new file mode 100755
index 0000000..74ec66c
--- /dev/null
+++ b/scripts/gitignore_patch.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Purpose
+#
+# For adapting gitignore files for releases so generated files can be included.
+#
+# Usage: gitignore_add_generated_files.sh [ -h | --help ] etc
+#
+
+set -eu
+
+print_usage()
+{
+ echo "Usage: $0"
+ echo -e " -h|--help\t\tPrint this help."
+ echo -e " -i|--ignore\t\tAdd generated files to the gitignores."
+ echo -e " -u|--unignore\t\tRemove generated files from the gitignores."
+}
+
+if [[ $# -eq 0 ]]; then
+ print_usage
+ exit 1
+elif [[ $# -ge 2 ]]; then
+ echo "Too many arguments!"
+ exit 1
+fi
+
+case "$1" in
+ -i | --ignore)
+ IGNORE=true
+ ;;
+ -u | --uignore)
+ IGNORE=false
+ ;;
+ -h | --help | "")
+ print_usage
+ exit 1
+ ;;
+ *)
+ echo "Unknown argument: $1"
+ echo "run '$0 --help' for options"
+ exit 1
+esac
+
+GITIGNORES=$(find . -name ".gitignore")
+for GITIGNORE in $GITIGNORES; do
+ if $IGNORE; then
+ sed -i '/###START_COMMENTED_GENERATED_FILES###/,/###END_COMMENTED_GENERATED_FILES###/s/^# //' $GITIGNORE
+ sed -i 's/###START_COMMENTED_GENERATED_FILES###/###START_GENERATED_FILES###/' $GITIGNORE
+ sed -i 's/###END_COMMENTED_GENERATED_FILES###/###END_GENERATED_FILES###/' $GITIGNORE
+ else
+ sed -i '/###START_GENERATED_FILES###/,/###END_GENERATED_FILES###/s/^/# /' $GITIGNORE
+ sed -i 's/###START_GENERATED_FILES###/###START_COMMENTED_GENERATED_FILES###/' $GITIGNORE
+ sed -i 's/###END_GENERATED_FILES###/###END_COMMENTED_GENERATED_FILES###/' $GITIGNORE
+ fi
+done
diff --git a/scripts/mbedtls_dev/bignum_core.py b/scripts/mbedtls_dev/bignum_core.py
index ff3fd23..563492b 100644
--- a/scripts/mbedtls_dev/bignum_core.py
+++ b/scripts/mbedtls_dev/bignum_core.py
@@ -21,6 +21,7 @@
from . import test_case
from . import test_data_generation
from . import bignum_common
+from .bignum_data import ADD_SUB_DATA
class BignumCoreTarget(test_data_generation.BaseTarget):
#pylint: disable=abstract-method, too-few-public-methods
@@ -176,6 +177,7 @@
test_function = "mpi_core_add_and_add_if"
test_name = "mpi_core_add_and_add_if"
input_style = "arch_split"
+ input_values = ADD_SUB_DATA
unique_combinations_only = True
def result(self) -> List[str]:
@@ -196,6 +198,7 @@
symbol = "-"
test_function = "mpi_core_sub"
test_name = "mbedtls_mpi_core_sub"
+ input_values = ADD_SUB_DATA
def result(self) -> List[str]:
if self.int_a >= self.int_b:
diff --git a/scripts/mbedtls_dev/bignum_data.py b/scripts/mbedtls_dev/bignum_data.py
index 0a48e53..897e319 100644
--- a/scripts/mbedtls_dev/bignum_data.py
+++ b/scripts/mbedtls_dev/bignum_data.py
@@ -106,6 +106,29 @@
RANDOM_1024_BIT_SEED_4_NO2, # largest (not a prime)
]
+ADD_SUB_DATA = [
+ "0", "1", "3", "f", "fe", "ff", "100", "ff00",
+ "fffe", "ffff", "10000", # 2^16 - 1, 2^16, 2^16 + 1
+ "fffffffe", "ffffffff", "100000000", # 2^32 - 1, 2^32, 2^32 + 1
+ "1f7f7f7f7f7f7f",
+ "8000000000000000", "fefefefefefefefe",
+ "fffffffffffffffe", "ffffffffffffffff", "10000000000000000", # 2^64 - 1, 2^64, 2^64 + 1
+ "1234567890abcdef0",
+ "fffffffffffffffffffffffe",
+ "ffffffffffffffffffffffff",
+ "1000000000000000000000000",
+ "fffffffffffffffffefefefefefefefe",
+ "fffffffffffffffffffffffffffffffe",
+ "ffffffffffffffffffffffffffffffff",
+ "100000000000000000000000000000000",
+ "1234567890abcdef01234567890abcdef0",
+ "fffffffffffffffffffffffffffffffffffffffffffffffffefefefefefefefe",
+ "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe",
+ "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+ "10000000000000000000000000000000000000000000000000000000000000000",
+ "1234567890abcdef01234567890abcdef01234567890abcdef01234567890abcdef0",
+ ]
+
# Only odd moduli are present as in the new bignum code only odd moduli are
# supported for now.
MODULI_DEFAULT = [
diff --git a/tests/.gitignore b/tests/.gitignore
index 6db65d1..973ebb5 100644
--- a/tests/.gitignore
+++ b/tests/.gitignore
@@ -1,11 +1,6 @@
*.sln
*.vcxproj
-# Generated source files
-/suites/*.generated.data
-/suites/test_suite_psa_crypto_storage_format.v[0-9]*.data
-/suites/test_suite_psa_crypto_storage_format.current.data
-
*.log
/test_suite*
data_files/mpi_write
@@ -20,3 +15,10 @@
src/libmbed*
libtestdriver1/*
+
+###START_GENERATED_FILES###
+# Generated source files
+/suites/*.generated.data
+/suites/test_suite_psa_crypto_storage_format.v[0-9]*.data
+/suites/test_suite_psa_crypto_storage_format.current.data
+###END_GENERATED_FILES###
diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile
index eff44d8..5230a30 100644
--- a/tests/data_files/Makefile
+++ b/tests/data_files/Makefile
@@ -1385,7 +1385,7 @@
# The use of 'Server 1' in the DN is intentional here, as the DN is hardcoded in the x509_write test suite.'
server5.req.ku.sha1: server5.key
- $(MBEDTLS_CERT_REQ) output_file=$@ filename=$< key_usage=digital_signature,non_repudiation subject_name="C=NL,O=PolarSSL,CN=PolarSSL Server 1" md=SHA1
+ $(OPENSSL) req -key $< -out $@ -new -nodes -subj "/C=NL/O=PolarSSL/CN=PolarSSL Server 1" -sha1 -addext keyUsage=digitalSignature,nonRepudiation
all_final += server5.req.ku.sha1
# server6*
diff --git a/tests/data_files/Readme-x509.txt b/tests/data_files/Readme-x509.txt
index 84c775f..82f93d2 100644
--- a/tests/data_files/Readme-x509.txt
+++ b/tests/data_files/Readme-x509.txt
@@ -76,6 +76,10 @@
-badsign.crt: S5 with corrupted signature
-expired.crt: S5 with "not after" date in the past
-future.crt: S5 with "not before" date in the future
+ -non-compliant.crt: S5, RFC non-compliant
+ (with forbidden EC algorithm identifier NULL parameter)
+ generated by (before fix):
+ cert_write subject_key=server5.key subject_name="CN=Test EC RFC non-compliant" issuer_crt=test-ca2.crt issuer_key=test-ca2.key
-selfsigned.crt: Self-signed cert with S5 key
-ss-expired.crt: Self-signed cert with S5 key, expired
-ss-forgeca.crt: Copy of test-int-ca3 self-signed with S5 key
diff --git a/tests/data_files/parse_input/server5-non-compliant.crt b/tests/data_files/parse_input/server5-non-compliant.crt
new file mode 100644
index 0000000..abea17d
--- /dev/null
+++ b/tests/data_files/parse_input/server5-non-compliant.crt
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBwjCCAUagAwIBAgIBATAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw
+DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe
+Fw0wMTAxMDEwMDAwMDBaFw0zMDEyMzEyMzU5NTlaMCQxIjAgBgNVBAMMGVRlc3Qg
+RUMgUkZDIG5vbi1jb21wbGlhbnQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ3
+zFbZdgkeWnI+x1kt/yBu7nz5BpF00K0UtfdoIllikk7lANgjEf/qL9I0XV0WvYqI
+wmt3DVXNiioO+gHItO3/o00wSzAJBgNVHRMEAjAAMB0GA1UdDgQWBBRQYaWP1AfZ
+14IBDOVlf4xjRqcTvjAfBgNVHSMEGDAWgBSdbSAkSQE/K8t4tRm8fiTJ2/s2fDAM
+BggqhkjOPQQDAgUAA2gAMGUCMAJ3J/DooFSaBG2OhzyWai32q6INDZfoS2bToSKf
+gy6hbJiIX/G9eFts5+BJQ3QpjgIxALRmIgdR91BDdqpeF5JCmhgjbfbgMQ7mrMeS
+ZGfNyFyjS75QnIA6nKryQmgPXo+sCQ==
+-----END CERTIFICATE-----
diff --git a/tests/data_files/server5.req.ku.sha1 b/tests/data_files/server5.req.ku.sha1
index 3281c94..c73a0e2 100644
--- a/tests/data_files/server5.req.ku.sha1
+++ b/tests/data_files/server5.req.ku.sha1
@@ -1,8 +1,8 @@
-----BEGIN CERTIFICATE REQUEST-----
-MIIBFjCBvAIBADA8MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGjAY
+MIIBFDCBvAIBADA8MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGjAY
BgNVBAMMEVBvbGFyU1NMIFNlcnZlciAxMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
QgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO5QDYIxH/6i/SNF1d
Fr2KiMJrdw1VzYoqDvoByLTt/6AeMBwGCSqGSIb3DQEJDjEPMA0wCwYDVR0PBAQD
-AgbAMAsGByqGSM49BAEFAANIADBFAiEAnIKF+xKk0iEuN4MHd4FZWNvrznLQgkeg
-2n8ejjreTzcCIAH34z2TycuMpWQRhpV+YT988pBWR67LAg7REyZnjSAB
+AgbAMAkGByqGSM49BAEDSAAwRQIhAJyChfsSpNIhLjeDB3eBWVjb685y0IJHoNp/
+Ho463k83AiAB9+M9k8nLjKVkEYaVfmE/fPKQVkeuywIO0RMmZ40gAQ==
-----END CERTIFICATE REQUEST-----
diff --git a/tests/include/test/macros.h b/tests/include/test/macros.h
index c61f4fd..7edc991 100644
--- a/tests/include/test/macros.h
+++ b/tests/include/test/macros.h
@@ -61,6 +61,16 @@
} \
} while (0)
+/** This macro asserts fails the test with given output message.
+ *
+ * \param MESSAGE The message to be outputed on assertion
+ */
+#define TEST_FAIL(MESSAGE) \
+ do { \
+ mbedtls_test_fail(MESSAGE, __LINE__, __FILE__); \
+ goto exit; \
+ } while (0)
+
/** Evaluate two integer expressions and fail the test case if they have
* different values.
*
@@ -107,52 +117,52 @@
* The allocated memory will be filled with zeros.
*
* You must set \p pointer to \c NULL before calling this macro and
- * put `mbedtls_free( pointer )` in the test's cleanup code.
+ * put `mbedtls_free(pointer)` in the test's cleanup code.
*
- * If \p length is zero, the resulting \p pointer will be \c NULL.
+ * If \p item_count is zero, the resulting \p pointer will be \c NULL.
* This is usually what we want in tests since API functions are
* supposed to accept null pointers when a buffer size is zero.
*
* This macro expands to an instruction, not an expression.
* It may jump to the \c exit label.
*
- * \param pointer An lvalue where the address of the allocated buffer
- * will be stored.
- * This expression may be evaluated multiple times.
- * \param length Number of elements to allocate.
- * This expression may be evaluated multiple times.
+ * \param pointer An lvalue where the address of the allocated buffer
+ * will be stored.
+ * This expression may be evaluated multiple times.
+ * \param item_count Number of elements to allocate.
+ * This expression may be evaluated multiple times.
*
*/
-#define ASSERT_ALLOC(pointer, length) \
- do \
- { \
- TEST_ASSERT((pointer) == NULL); \
- if ((length) != 0) \
- { \
- (pointer) = mbedtls_calloc(sizeof(*(pointer)), \
- (length)); \
- TEST_ASSERT((pointer) != NULL); \
- } \
- } \
- while (0)
+#define TEST_CALLOC(pointer, item_count) \
+ do { \
+ TEST_ASSERT((pointer) == NULL); \
+ if ((item_count) != 0) { \
+ (pointer) = mbedtls_calloc(sizeof(*(pointer)), \
+ (item_count)); \
+ TEST_ASSERT((pointer) != NULL); \
+ } \
+ } while (0)
+
+/* For backwards compatibility */
+#define ASSERT_ALLOC(pointer, item_count) TEST_CALLOC(pointer, item_count)
/** Allocate memory dynamically. If the allocation fails, skip the test case.
*
- * This macro behaves like #ASSERT_ALLOC, except that if the allocation
+ * This macro behaves like #TEST_CALLOC, except that if the allocation
* fails, it marks the test as skipped rather than failed.
*/
-#define ASSERT_ALLOC_WEAK(pointer, length) \
- do \
- { \
- TEST_ASSERT((pointer) == NULL); \
- if ((length) != 0) \
- { \
- (pointer) = mbedtls_calloc(sizeof(*(pointer)), \
- (length)); \
- TEST_ASSUME((pointer) != NULL); \
- } \
- } \
- while (0)
+#define TEST_CALLOC_OR_SKIP(pointer, item_count) \
+ do { \
+ TEST_ASSERT((pointer) == NULL); \
+ if ((item_count) != 0) { \
+ (pointer) = mbedtls_calloc(sizeof(*(pointer)), \
+ (item_count)); \
+ TEST_ASSUME((pointer) != NULL); \
+ } \
+ } while (0)
+
+/* For backwards compatibility */
+#define ASSERT_ALLOC_WEAK(pointer, item_count) TEST_CALLOC_OR_SKIP(pointer, item_count)
/** Compare two buffers and fail the test case if they differ.
*
@@ -166,14 +176,16 @@
* \param size2 Size of the second buffer in bytes.
* This expression may be evaluated multiple times.
*/
-#define ASSERT_COMPARE(p1, size1, p2, size2) \
- do \
- { \
+#define TEST_MEMORY_COMPARE(p1, size1, p2, size2) \
+ do { \
TEST_EQUAL((size1), (size2)); \
- if ((size1) != 0) \
- TEST_ASSERT(memcmp((p1), (p2), (size1)) == 0); \
- } \
- while (0)
+ if ((size1) != 0) { \
+ TEST_ASSERT(memcmp((p1), (p2), (size1)) == 0); \
+ } \
+ } while (0)
+
+/* For backwards compatibility */
+#define ASSERT_COMPARE(p1, size1, p2, size2) TEST_MEMORY_COMPARE(p1, size1, p2, size2)
/**
* \brief This macro tests the expression passed to it and skips the
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 2db2f40..ed62b96 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -1772,9 +1772,7 @@
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
scripts/config.py unset MBEDTLS_ECJPAKE_C
# Disable all curves
- for c in $(sed -n 's/#define \(MBEDTLS_ECP_DP_[0-9A-Z_a-z]*_ENABLED\).*/\1/p' <"$CONFIG_H"); do
- scripts/config.py unset "$c"
- done
+ scripts/config.py unset-all "MBEDTLS_ECP_DP_[0-9A-Z_a-z]*_ENABLED"
scripts/config.py set MBEDTLS_ECP_DP_CURVE25519_ENABLED
make CFLAGS="$ASAN_CFLAGS -O2" LDFLAGS="$ASAN_CFLAGS"
@@ -2535,8 +2533,6 @@
# start with full config for maximum coverage (also enables USE_PSA)
helper_libtestdriver1_adjust_config "full"
- # enable support for drivers and configuring PSA-only algorithms
- scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
if [ "$DRIVER_ONLY" -eq 1 ]; then
# Disable modules that are accelerated
scripts/config.py unset MBEDTLS_ECDSA_C
@@ -2626,6 +2622,140 @@
tests/ssl-opt.sh
}
+# This function is really similar to config_psa_crypto_no_ecp_at_all() above so
+# its description is basically the same. The main difference in this case is
+# that when the EC built-in implementation is disabled, then also Bignum module
+# and its dependencies are disabled as well.
+#
+# This is the common helper between:
+# - component_test_psa_crypto_config_accel_ecc_no_bignum
+# - component_test_psa_crypto_config_reference_ecc_no_bignum
+config_psa_crypto_config_accel_ecc_no_bignum() {
+ DRIVER_ONLY="$1"
+ # start with full config for maximum coverage (also enables USE_PSA),
+ # but keep TLS and key exchanges disabled
+ helper_libtestdriver1_adjust_config "full"
+ scripts/config.py unset MBEDTLS_SSL_TLS_C
+
+ if [ "$DRIVER_ONLY" -eq 1 ]; then
+ # Disable modules that are accelerated
+ scripts/config.py unset MBEDTLS_ECDSA_C
+ scripts/config.py unset MBEDTLS_ECDH_C
+ scripts/config.py unset MBEDTLS_ECJPAKE_C
+ # Disable ECP module (entirely)
+ scripts/config.py unset MBEDTLS_ECP_C
+ # Also disable bignum
+ scripts/config.py unset MBEDTLS_BIGNUM_C
+ fi
+
+ # Disable all the features that auto-enable ECP_LIGHT (see build_info.h)
+ scripts/config.py unset MBEDTLS_PK_PARSE_EC_EXTENDED
+ scripts/config.py unset MBEDTLS_PK_PARSE_EC_COMPRESSED
+ scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
+
+ # RSA support is intentionally disabled on this test because RSA_C depends
+ # on BIGNUM_C.
+ scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_RSA_[0-9A-Z_a-z]*"
+ scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_ALG_RSA_[0-9A-Z_a-z]*"
+ scripts/config.py unset MBEDTLS_RSA_C
+ scripts/config.py unset MBEDTLS_PKCS1_V15
+ scripts/config.py unset MBEDTLS_PKCS1_V21
+ scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT
+ # Also disable key exchanges that depend on RSA
+ scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
+ scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
+ scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
+ scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+ scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
+
+ # Disable FFDH because it also depends on BIGNUM.
+ scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_FFDH
+ scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_DH_[0-9A-Z_a-z]*"
+ scripts/config.py unset MBEDTLS_DHM_C
+ # Also disable key exchanges that depend on FFDH
+ scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
+ scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
+
+ # Restartable feature is not yet supported by PSA. Once it will in
+ # the future, the following line could be removed (see issues
+ # 6061, 6332 and following ones)
+ scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
+}
+
+# Build and test a configuration where driver accelerates all EC algs while
+# all support and dependencies from ECP and ECP_LIGHT are removed on the library
+# side.
+#
+# Keep in sync with component_test_psa_crypto_config_reference_ecc_no_bignum()
+component_test_psa_crypto_config_accel_ecc_no_bignum () {
+ msg "build: full + accelerated EC algs + USE_PSA - ECP"
+
+ # Algorithms and key types to accelerate
+ loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
+ ALG_ECDH \
+ ALG_JPAKE \
+ KEY_TYPE_ECC_KEY_PAIR_BASIC \
+ KEY_TYPE_ECC_KEY_PAIR_IMPORT \
+ KEY_TYPE_ECC_KEY_PAIR_EXPORT \
+ KEY_TYPE_ECC_KEY_PAIR_GENERATE \
+ KEY_TYPE_ECC_PUBLIC_KEY"
+
+ # Configure
+ # ---------
+
+ # Set common configurations between library's and driver's builds
+ config_psa_crypto_config_accel_ecc_no_bignum 1
+
+ # Build
+ # -----
+
+ # Things we wanted supported in libtestdriver1, but not accelerated in the main library:
+ # SHA-1 and all SHA-2 variants, as they are used by ECDSA deterministic.
+ loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512"
+
+ helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
+
+ helper_libtestdriver1_make_main "$loc_accel_list"
+
+ # Make sure any built-in EC alg was not re-enabled by accident (additive config)
+ not grep mbedtls_ecdsa_ library/ecdsa.o
+ not grep mbedtls_ecdh_ library/ecdh.o
+ not grep mbedtls_ecjpake_ library/ecjpake.o
+ # Also ensure that ECP, RSA, DHM or BIGNUM modules were not re-enabled
+ not grep mbedtls_ecp_ library/ecp.o
+ not grep mbedtls_rsa_ library/rsa.o
+ not grep mbedtls_dhm_ library/dhm.o
+ not grep mbedtls_mpi_ library/bignum.o
+
+ # Run the tests
+ # -------------
+
+ msg "test suites: full + accelerated EC algs + USE_PSA - ECP"
+ make test
+
+ # The following will be enabled in #7756
+ #msg "ssl-opt: full + accelerated EC algs + USE_PSA - ECP"
+ #tests/ssl-opt.sh
+}
+
+# Reference function used for driver's coverage analysis in analyze_outcomes.py
+# in conjunction with component_test_psa_crypto_config_accel_ecc_no_bignum().
+# Keep in sync with its accelerated counterpart.
+component_test_psa_crypto_config_reference_ecc_no_bignum () {
+ msg "build: full + non accelerated EC algs + USE_PSA"
+
+ config_psa_crypto_config_accel_ecc_no_bignum 0
+
+ make
+
+ msg "test suites: full + non accelerated EC algs + USE_PSA"
+ make test
+
+ # The following will be enabled in #7756
+ #msg "ssl-opt: full + non accelerated EC algs + USE_PSA"
+ #tests/ssl-opt.sh
+}
+
# Helper function used in:
# - component_test_psa_crypto_config_accel_all_curves_except_p192
# - component_test_psa_crypto_config_accel_all_curves_except_x25519
@@ -2667,14 +2797,8 @@
scripts/config.py unset MBEDTLS_PKCS1_V21
scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT
# Disable RSA on the PSA side too
- scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
- scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT
- scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT
- scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
- scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
- for ALG in $(sed -n 's/^#define \(PSA_WANT_ALG_RSA_[0-9A-Z_a-z]*\).*/\1/p' <"$CRYPTO_CONFIG_H"); do
- scripts/config.py -f "$CRYPTO_CONFIG_H" unset $ALG
- done
+ scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_RSA_[0-9A-Z_a-z]*"
+ scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_ALG_RSA_[0-9A-Z_a-z]*"
# Also disable key exchanges that depend on RSA
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
@@ -2683,9 +2807,7 @@
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
# Explicitly disable all SW implementation for elliptic curves
- for CURVE in $(sed -n 's/#define \(MBEDTLS_ECP_DP_[0-9A-Z_a-z]*_ENABLED\).*/\1/p' <"$CONFIG_H"); do
- scripts/config.py unset "$CURVE"
- done
+ scripts/config.py unset-all "MBEDTLS_ECP_DP_[0-9A-Z_a-z]*_ENABLED"
# Just leave SW implementation for the specified curve for allowing to
# build with ECP_C.
scripts/config.py set $BUILTIN_CURVE
diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py
index f3a14a9..ee51513 100755
--- a/tests/scripts/analyze_outcomes.py
+++ b/tests/scripts/analyze_outcomes.py
@@ -310,6 +310,89 @@
}
}
},
+ 'analyze_driver_vs_reference_no_bignum': {
+ 'test_function': do_analyze_driver_vs_reference,
+ 'args': {
+ 'component_ref': 'test_psa_crypto_config_reference_ecc_no_bignum',
+ 'component_driver': 'test_psa_crypto_config_accel_ecc_no_bignum',
+ 'ignored_suites': [
+ # Ignore test suites for the modules that are disabled in the
+ # accelerated test case.
+ 'ecp',
+ 'ecdsa',
+ 'ecdh',
+ 'ecjpake',
+ 'bignum_core',
+ 'bignum_random',
+ 'bignum_mod',
+ 'bignum_mod_raw',
+ 'bignum.generated',
+ 'bignum.misc',
+ ],
+ 'ignored_tests': {
+ 'test_suite_random': [
+ 'PSA classic wrapper: ECDSA signature (SECP256R1)',
+ ],
+ 'test_suite_psa_crypto': [
+ 'PSA key derivation: HKDF-SHA-256 -> ECC secp256r1',
+ 'PSA key derivation: HKDF-SHA-256 -> ECC secp256r1 (1 redraw)',
+ 'PSA key derivation: HKDF-SHA-256 -> ECC secp256r1, exercise ECDSA',
+ 'PSA key derivation: HKDF-SHA-256 -> ECC secp384r1',
+ 'PSA key derivation: HKDF-SHA-256 -> ECC secp521r1 #0',
+ 'PSA key derivation: HKDF-SHA-256 -> ECC secp521r1 #1',
+ 'PSA key derivation: bits=7 invalid for ECC BRAINPOOL_P_R1 (ECC enabled)',
+ 'PSA key derivation: bits=7 invalid for ECC SECP_K1 (ECC enabled)',
+ 'PSA key derivation: bits=7 invalid for ECC SECP_R1 (ECC enabled)',
+ 'PSA key derivation: bits=7 invalid for ECC SECP_R2 (ECC enabled)',
+ 'PSA key derivation: bits=7 invalid for ECC SECT_K1 (ECC enabled)',
+ 'PSA key derivation: bits=7 invalid for ECC SECT_R1 (ECC enabled)',
+ 'PSA key derivation: bits=7 invalid for ECC SECT_R2 (ECC enabled)',
+ ],
+ 'test_suite_pkparse': [
+ # See the description provided above in the
+ # analyze_driver_vs_reference_no_ecp_at_all component.
+ 'Parse EC Key #10a (SEC1 PEM, secp384r1, compressed)',
+ 'Parse EC Key #11a (SEC1 PEM, secp521r1, compressed)',
+ 'Parse EC Key #12a (SEC1 PEM, bp256r1, compressed)',
+ 'Parse EC Key #13a (SEC1 PEM, bp384r1, compressed)',
+ 'Parse EC Key #14a (SEC1 PEM, bp512r1, compressed)',
+ 'Parse EC Key #2a (SEC1 PEM, secp192r1, compressed)',
+ 'Parse EC Key #8a (SEC1 PEM, secp224r1, compressed)',
+ 'Parse EC Key #9a (SEC1 PEM, secp256r1, compressed)',
+ 'Parse Public EC Key #2a (RFC 5480, PEM, secp192r1, compressed)',
+ 'Parse Public EC Key #3a (RFC 5480, secp224r1, compressed)',
+ 'Parse Public EC Key #4a (RFC 5480, secp256r1, compressed)',
+ 'Parse Public EC Key #5a (RFC 5480, secp384r1, compressed)',
+ 'Parse Public EC Key #6a (RFC 5480, secp521r1, compressed)',
+ 'Parse Public EC Key #7a (RFC 5480, brainpoolP256r1, compressed)',
+ 'Parse Public EC Key #8a (RFC 5480, brainpoolP384r1, compressed)',
+ 'Parse Public EC Key #9a (RFC 5480, brainpoolP512r1, compressed)',
+ ],
+ 'test_suite_asn1parse': [
+ # This test depends on BIGNUM_C
+ 'INTEGER too large for mpi',
+ ],
+ 'test_suite_asn1write': [
+ # Following tests depends on BIGNUM_C
+ 'ASN.1 Write mpi 0 (1 limb)',
+ 'ASN.1 Write mpi 0 (null)',
+ 'ASN.1 Write mpi 0x100',
+ 'ASN.1 Write mpi 0x7f',
+ 'ASN.1 Write mpi 0x7f with leading 0 limb',
+ 'ASN.1 Write mpi 0x80',
+ 'ASN.1 Write mpi 0x80 with leading 0 limb',
+ 'ASN.1 Write mpi 0xff',
+ 'ASN.1 Write mpi 1',
+ 'ASN.1 Write mpi, 127*8 bits',
+ 'ASN.1 Write mpi, 127*8+1 bits',
+ 'ASN.1 Write mpi, 127*8-1 bits',
+ 'ASN.1 Write mpi, 255*8 bits',
+ 'ASN.1 Write mpi, 255*8-1 bits',
+ 'ASN.1 Write mpi, 256*8-1 bits',
+ ],
+ }
+ }
+ },
'analyze_driver_vs_reference_ffdh_alg': {
'test_function': do_analyze_driver_vs_reference,
'args': {
diff --git a/tests/src/psa_exercise_key.c b/tests/src/psa_exercise_key.c
index 7f93496..9ff408c 100644
--- a/tests/src/psa_exercise_key.c
+++ b/tests/src/psa_exercise_key.c
@@ -309,7 +309,7 @@
hash_alg = KNOWN_SUPPORTED_HASH_ALG;
alg ^= PSA_ALG_ANY_HASH ^ hash_alg;
#else
- TEST_ASSERT(!"No hash algorithm for hash-and-sign testing");
+ TEST_FAIL("No hash algorithm for hash-and-sign testing");
#endif
}
@@ -438,7 +438,7 @@
PSA_KEY_DERIVATION_INPUT_LABEL,
input2, input2_length));
} else {
- TEST_ASSERT(!"Key derivation algorithm not supported");
+ TEST_FAIL("Key derivation algorithm not supported");
}
if (capacity != SIZE_MAX) {
@@ -506,7 +506,7 @@
key_bits = psa_get_key_bits(&attributes);
public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(private_key_type);
public_key_length = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_key_type, key_bits);
- ASSERT_ALLOC(public_key, public_key_length);
+ TEST_CALLOC(public_key, public_key_length);
PSA_ASSERT(psa_export_public_key(key, public_key, public_key_length,
&public_key_length));
@@ -548,7 +548,7 @@
key_bits = psa_get_key_bits(&attributes);
public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(private_key_type);
public_key_length = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_key_type, key_bits);
- ASSERT_ALLOC(public_key, public_key_length);
+ TEST_CALLOC(public_key, public_key_length);
PSA_ASSERT(psa_export_public_key(key,
public_key, public_key_length,
&public_key_length));
@@ -798,7 +798,7 @@
PSA_EXPORT_PUBLIC_KEY_MAX_SIZE);
} else {
(void) exported;
- TEST_ASSERT(!"Sanity check not implemented for this key type");
+ TEST_FAIL("Sanity check not implemented for this key type");
}
#if defined(MBEDTLS_DES_C)
@@ -838,7 +838,7 @@
exported_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
psa_get_key_type(&attributes),
psa_get_key_bits(&attributes));
- ASSERT_ALLOC(exported, exported_size);
+ TEST_CALLOC(exported, exported_size);
if ((usage & PSA_KEY_USAGE_EXPORT) == 0 &&
!PSA_KEY_TYPE_IS_PUBLIC_KEY(psa_get_key_type(&attributes))) {
@@ -881,7 +881,7 @@
exported_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
psa_get_key_type(&attributes),
psa_get_key_bits(&attributes));
- ASSERT_ALLOC(exported, exported_size);
+ TEST_CALLOC(exported, exported_size);
TEST_EQUAL(psa_export_public_key(key, exported,
exported_size, &exported_length),
@@ -894,7 +894,7 @@
psa_get_key_type(&attributes));
exported_size = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_type,
psa_get_key_bits(&attributes));
- ASSERT_ALLOC(exported, exported_size);
+ TEST_CALLOC(exported, exported_size);
PSA_ASSERT(psa_export_public_key(key,
exported, exported_size,
@@ -943,7 +943,7 @@
} else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
ok = exercise_key_agreement_key(key, usage, alg);
} else {
- TEST_ASSERT(!"No code to exercise this category of algorithm");
+ TEST_FAIL("No code to exercise this category of algorithm");
}
ok = ok && exercise_export_key(key, usage);
diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c
index dcde919..9144d85 100644
--- a/tests/src/test_helpers/ssl_helpers.c
+++ b/tests/src/test_helpers/ssl_helpers.c
@@ -91,7 +91,7 @@
opts->resize_buffers = 1;
#if defined(MBEDTLS_SSL_CACHE_C)
opts->cache = NULL;
- ASSERT_ALLOC(opts->cache, 1);
+ TEST_CALLOC(opts->cache, 1);
mbedtls_ssl_cache_init(opts->cache);
#if defined(MBEDTLS_HAVE_TIME)
TEST_EQUAL(mbedtls_ssl_cache_get_timeout(opts->cache),
@@ -627,9 +627,9 @@
}
cert = &(ep->cert);
- ASSERT_ALLOC(cert->ca_cert, 1);
- ASSERT_ALLOC(cert->cert, 1);
- ASSERT_ALLOC(cert->pkey, 1);
+ TEST_CALLOC(cert->ca_cert, 1);
+ TEST_CALLOC(cert->cert, 1);
+ TEST_CALLOC(cert->pkey, 1);
mbedtls_x509_crt_init(cert->ca_cert);
mbedtls_x509_crt_init(cert->cert);
@@ -1759,8 +1759,8 @@
break;
default:
- TEST_ASSERT(
- !"Version check not implemented for this protocol version");
+ TEST_FAIL(
+ "Version check not implemented for this protocol version");
}
return 1;
diff --git a/tests/suites/test_suite_aes.function b/tests/suites/test_suite_aes.function
index 363a5fd..d495b49 100644
--- a/tests/suites/test_suite_aes.function
+++ b/tests/suites/test_suite_aes.function
@@ -38,13 +38,13 @@
// Encrypt with copied context
TEST_ASSERT(mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT,
plaintext, output) == 0);
- ASSERT_COMPARE(ciphertext, 16, output, 16);
+ TEST_MEMORY_COMPARE(ciphertext, 16, output, 16);
mbedtls_aes_free(enc);
// Decrypt with copied context
TEST_ASSERT(mbedtls_aes_crypt_ecb(dec, MBEDTLS_AES_DECRYPT,
ciphertext, output) == 0);
- ASSERT_COMPARE(plaintext, 16, output, 16);
+ TEST_MEMORY_COMPARE(plaintext, 16, output, 16);
mbedtls_aes_free(dec);
return 1;
@@ -545,9 +545,9 @@
struct align1 *dec1 = NULL;
/* All peak alignment */
- ASSERT_ALLOC(src0, 1);
- ASSERT_ALLOC(enc0, 1);
- ASSERT_ALLOC(dec0, 1);
+ TEST_CALLOC(src0, 1);
+ TEST_CALLOC(enc0, 1);
+ TEST_CALLOC(dec0, 1);
if (!test_copy(key, &src0->ctx, &enc0->ctx, &dec0->ctx)) {
goto exit;
}
@@ -559,9 +559,9 @@
dec0 = NULL;
/* Original shifted */
- ASSERT_ALLOC(src1, 1);
- ASSERT_ALLOC(enc0, 1);
- ASSERT_ALLOC(dec0, 1);
+ TEST_CALLOC(src1, 1);
+ TEST_CALLOC(enc0, 1);
+ TEST_CALLOC(dec0, 1);
if (!test_copy(key, &src1->ctx, &enc0->ctx, &dec0->ctx)) {
goto exit;
}
@@ -573,9 +573,9 @@
dec0 = NULL;
/* Copies shifted */
- ASSERT_ALLOC(src0, 1);
- ASSERT_ALLOC(enc1, 1);
- ASSERT_ALLOC(dec1, 1);
+ TEST_CALLOC(src0, 1);
+ TEST_CALLOC(enc1, 1);
+ TEST_CALLOC(dec1, 1);
if (!test_copy(key, &src0->ctx, &enc1->ctx, &dec1->ctx)) {
goto exit;
}
@@ -587,9 +587,9 @@
dec1 = NULL;
/* Source and copies shifted */
- ASSERT_ALLOC(src1, 1);
- ASSERT_ALLOC(enc1, 1);
- ASSERT_ALLOC(dec1, 1);
+ TEST_CALLOC(src1, 1);
+ TEST_CALLOC(enc1, 1);
+ TEST_CALLOC(dec1, 1);
if (!test_copy(key, &src1->ctx, &enc1->ctx, &dec1->ctx)) {
goto exit;
}
diff --git a/tests/suites/test_suite_alignment.function b/tests/suites/test_suite_alignment.function
index eefbaa5..842101f 100644
--- a/tests/suites/test_suite_alignment.function
+++ b/tests/suites/test_suite_alignment.function
@@ -121,7 +121,7 @@
r = MBEDTLS_BSWAP64(input);
break;
default:
- TEST_ASSERT(!"size must be 16, 32 or 64");
+ TEST_FAIL("size must be 16, 32 or 64");
}
TEST_EQUAL(r, expected);
diff --git a/tests/suites/test_suite_aria.function b/tests/suites/test_suite_aria.function
index 9e4db2c..579dddf 100644
--- a/tests/suites/test_suite_aria.function
+++ b/tests/suites/test_suite_aria.function
@@ -77,8 +77,8 @@
output + i) == 0);
}
- ASSERT_COMPARE(output, expected_output->len,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, expected_output->len,
+ expected_output->x, expected_output->len);
}
exit:
@@ -105,8 +105,8 @@
output + i) == 0);
}
- ASSERT_COMPARE(output, expected_output->len,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, expected_output->len,
+ expected_output->x, expected_output->len);
}
exit:
@@ -130,8 +130,8 @@
src_str->len, iv_str->x, src_str->x,
output) == cbc_result);
if (cbc_result == 0) {
- ASSERT_COMPARE(output, expected_output->len,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, expected_output->len,
+ expected_output->x, expected_output->len);
}
exit:
@@ -155,8 +155,8 @@
src_str->len, iv_str->x, src_str->x,
output) == cbc_result);
if (cbc_result == 0) {
- ASSERT_COMPARE(output, expected_output->len,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, expected_output->len,
+ expected_output->x, expected_output->len);
}
exit:
@@ -182,8 +182,8 @@
iv_str->x, src_str->x, output)
== result);
- ASSERT_COMPARE(output, expected_output->len,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, expected_output->len,
+ expected_output->x, expected_output->len);
exit:
mbedtls_aria_free(&ctx);
@@ -208,8 +208,8 @@
iv_str->x, src_str->x, output)
== result);
- ASSERT_COMPARE(output, expected_output->len,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, expected_output->len,
+ expected_output->x, expected_output->len);
exit:
mbedtls_aria_free(&ctx);
@@ -234,8 +234,8 @@
iv_str->x, blk, src_str->x, output)
== result);
- ASSERT_COMPARE(output, expected_output->len,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, expected_output->len,
+ expected_output->x, expected_output->len);
exit:
mbedtls_aria_free(&ctx);
@@ -260,8 +260,8 @@
iv_str->x, blk, src_str->x, output)
== result);
- ASSERT_COMPARE(output, expected_output->len,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, expected_output->len,
+ expected_output->x, expected_output->len);
exit:
mbedtls_aria_free(&ctx);
diff --git a/tests/suites/test_suite_asn1parse.function b/tests/suites/test_suite_asn1parse.function
index e1a26b7..01a091b 100644
--- a/tests/suites/test_suite_asn1parse.function
+++ b/tests/suites/test_suite_asn1parse.function
@@ -135,11 +135,11 @@
/* Allocate a new buffer of exactly the length to parse each time.
* This gives memory sanitizers a chance to catch buffer overreads. */
if (buffer_size == 0) {
- ASSERT_ALLOC(buf, 1);
+ TEST_CALLOC(buf, 1);
end = buf + 1;
p = end;
} else {
- ASSERT_ALLOC_WEAK(buf, buffer_size);
+ TEST_CALLOC_OR_SKIP(buf, buffer_size);
if (buffer_size > input->len) {
memcpy(buf, input->x, input->len);
memset(buf + input->len, 'A', buffer_size - input->len);
@@ -247,7 +247,7 @@
mbedtls_test_set_step(buffer_size);
/* Allocate a new buffer of exactly the length to parse each time.
* This gives memory sanitizers a chance to catch buffer overreads. */
- ASSERT_ALLOC(buf, buffer_size);
+ TEST_CALLOC(buf, buffer_size);
memcpy(buf, input->x, buffer_size);
p = buf;
ret = nested_parse(&p, buf + buffer_size);
@@ -506,7 +506,7 @@
mbedtls_mpi_init(&actual_mpi);
- ASSERT_ALLOC(buf, size);
+ TEST_CALLOC(buf, size);
buf[0] = 0x02; /* tag: INTEGER */
buf[1] = 0x84; /* 4-octet length */
buf[2] = (too_many_octets >> 24) & 0xff;
@@ -729,10 +729,10 @@
{ { 0x06, 0, NULL }, { 0, 0, NULL }, NULL, 0 };
if (with_oid) {
- ASSERT_ALLOC(head.oid.p, 1);
+ TEST_CALLOC(head.oid.p, 1);
}
if (with_val) {
- ASSERT_ALLOC(head.val.p, 1);
+ TEST_CALLOC(head.val.p, 1);
}
if (with_next) {
head.next = &next;
@@ -758,7 +758,7 @@
for (i = 0; i < length; i++) {
mbedtls_asn1_named_data *new = NULL;
- ASSERT_ALLOC(new, 1);
+ TEST_CALLOC(new, 1);
new->next = head;
head = new;
}
diff --git a/tests/suites/test_suite_asn1write.function b/tests/suites/test_suite_asn1write.function
index ce0d0f3..469b971 100644
--- a/tests/suites/test_suite_asn1write.function
+++ b/tests/suites/test_suite_asn1write.function
@@ -17,7 +17,7 @@
mbedtls_test_set_step(data->size);
mbedtls_free(data->output);
data->output = NULL;
- ASSERT_ALLOC(data->output, data->size == 0 ? 1 : data->size);
+ TEST_CALLOC(data->output, data->size == 0 ? 1 : data->size);
data->end = data->output + data->size;
data->p = data->end;
data->start = data->end - data->size;
@@ -37,8 +37,8 @@
TEST_EQUAL(ret, data->end - data->p);
TEST_ASSERT(data->p >= data->start);
TEST_ASSERT(data->p <= data->end);
- ASSERT_COMPARE(data->p, (size_t) (data->end - data->p),
- expected->x, expected->len);
+ TEST_MEMORY_COMPARE(data->p, (size_t) (data->end - data->p),
+ expected->x, expected->len);
}
ok = 1;
@@ -296,7 +296,7 @@
size_t len_complete = data_len + par_len;
unsigned char expected_params_tag;
size_t expected_params_len;
- ASSERT_ALLOC(buf_complete, len_complete);
+ TEST_CALLOC(buf_complete, len_complete);
unsigned char *end_complete = buf_complete + len_complete;
memcpy(buf_complete, data.p, data_len);
if (par_len == 0) {
@@ -316,13 +316,13 @@
buf_complete[data_len + 2] = (unsigned char) (expected_params_len >> 8);
buf_complete[data_len + 3] = (unsigned char) (expected_params_len);
} else {
- TEST_ASSERT(!"Bad test data: invalid length of ASN.1 element");
+ TEST_FAIL("Bad test data: invalid length of ASN.1 element");
}
unsigned char *p = buf_complete;
TEST_EQUAL(mbedtls_asn1_get_alg(&p, end_complete,
&alg, ¶ms), 0);
TEST_EQUAL(alg.tag, MBEDTLS_ASN1_OID);
- ASSERT_COMPARE(alg.p, alg.len, oid->x, oid->len);
+ TEST_MEMORY_COMPARE(alg.p, alg.len, oid->x, oid->len);
TEST_EQUAL(params.tag, expected_params_tag);
TEST_EQUAL(params.len, expected_params_len);
mbedtls_free(buf_complete);
@@ -404,7 +404,7 @@
TEST_ASSERT(bitstring->len >= byte_length);
#if defined(MBEDTLS_ASN1_PARSE_C)
- ASSERT_ALLOC(masked_bitstring, byte_length);
+ TEST_CALLOC(masked_bitstring, byte_length);
if (byte_length != 0) {
memcpy(masked_bitstring, bitstring->x, byte_length);
if (bits % 8 != 0) {
@@ -440,8 +440,8 @@
mbedtls_asn1_bitstring read = { 0, 0, NULL };
TEST_EQUAL(mbedtls_asn1_get_bitstring(&data.p, data.end,
&read), 0);
- ASSERT_COMPARE(read.p, read.len,
- masked_bitstring, byte_length);
+ TEST_MEMORY_COMPARE(read.p, read.len,
+ masked_bitstring, byte_length);
TEST_EQUAL(read.unused_bits, 8 * byte_length - value_bits);
}
#endif /* MBEDTLS_ASN1_PARSE_C */
@@ -477,7 +477,7 @@
}
pointers[ARRAY_LENGTH(nd)] = NULL;
for (i = 0; i < ARRAY_LENGTH(nd); i++) {
- ASSERT_ALLOC(nd[i].oid.p, oid[i]->len);
+ TEST_CALLOC(nd[i].oid.p, oid[i]->len);
memcpy(nd[i].oid.p, oid[i]->x, oid[i]->len);
nd[i].oid.len = oid[i]->len;
nd[i].next = pointers[i+1];
@@ -529,7 +529,7 @@
unsigned char *new_val = (unsigned char *) "new value";
if (old_len != 0) {
- ASSERT_ALLOC(nd.val.p, (size_t) old_len);
+ TEST_CALLOC(nd.val.p, (size_t) old_len);
old_val = nd.val.p;
nd.val.len = old_len;
memset(old_val, 'x', old_len);
@@ -545,8 +545,8 @@
TEST_ASSERT(found == head);
if (new_val != NULL) {
- ASSERT_COMPARE(found->val.p, found->val.len,
- new_val, (size_t) new_len);
+ TEST_MEMORY_COMPARE(found->val.p, found->val.len,
+ new_val, (size_t) new_len);
}
if (new_len == 0) {
TEST_ASSERT(found->val.p == NULL);
@@ -580,15 +580,15 @@
TEST_ASSERT(found != NULL);
TEST_ASSERT(found == head);
TEST_ASSERT(found->oid.p != oid);
- ASSERT_COMPARE(found->oid.p, found->oid.len, oid, oid_len);
+ TEST_MEMORY_COMPARE(found->oid.p, found->oid.len, oid, oid_len);
if (new_len == 0) {
TEST_ASSERT(found->val.p == NULL);
} else if (new_val == NULL) {
TEST_ASSERT(found->val.p != NULL);
} else {
TEST_ASSERT(found->val.p != new_val);
- ASSERT_COMPARE(found->val.p, found->val.len,
- new_val, (size_t) new_len);
+ TEST_MEMORY_COMPARE(found->val.p, found->val.len,
+ new_val, (size_t) new_len);
}
exit:
diff --git a/tests/suites/test_suite_base64.data b/tests/suites/test_suite_base64.data
index 5556668..3999e73 100644
--- a/tests/suites/test_suite_base64.data
+++ b/tests/suites/test_suite_base64.data
@@ -1,27 +1,3 @@
-mask_of_range empty (1..0)
-mask_of_range:1:0
-
-mask_of_range empty (255..0)
-mask_of_range:255:0
-
-mask_of_range empty (42..7)
-mask_of_range:42:7
-
-mask_of_range 0..0
-mask_of_range:0:0
-
-mask_of_range 42..42
-mask_of_range:42:42
-
-mask_of_range 255..255
-mask_of_range:255:255
-
-mask_of_range 0..255
-mask_of_range:0:255
-
-mask_of_range 'A'..'Z'
-mask_of_range:65:90
-
enc_char (all digits)
enc_chars:
diff --git a/tests/suites/test_suite_base64.function b/tests/suites/test_suite_base64.function
index ce6bd42..e351ad8 100644
--- a/tests/suites/test_suite_base64.function
+++ b/tests/suites/test_suite_base64.function
@@ -1,7 +1,7 @@
/* BEGIN_HEADER */
#include "mbedtls/base64.h"
+#include "base64_internal.h"
#include "constant_time_internal.h"
-#include "constant_time_invasive.h"
#include <test/constant_flow.h>
#if defined(MBEDTLS_TEST_HOOKS)
@@ -17,26 +17,6 @@
*/
/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
-void mask_of_range(int low_arg, int high_arg)
-{
- unsigned char low = low_arg, high = high_arg;
- unsigned c;
- for (c = 0; c <= 0xff; c++) {
- mbedtls_test_set_step(c);
- TEST_CF_SECRET(&c, sizeof(c));
- unsigned char m = mbedtls_ct_uchar_mask_of_range(low, high, c);
- TEST_CF_PUBLIC(&c, sizeof(c));
- TEST_CF_PUBLIC(&m, sizeof(m));
- if (low <= c && c <= high) {
- TEST_EQUAL(m, 0xff);
- } else {
- TEST_EQUAL(m, 0);
- }
- }
-}
-/* END_CASE */
-
-/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
void enc_chars()
{
for (unsigned value = 0; value < 64; value++) {
diff --git a/tests/suites/test_suite_bignum.function b/tests/suites/test_suite_bignum.function
index 7f858e5..c90f1bb 100644
--- a/tests/suites/test_suite_bignum.function
+++ b/tests/suites/test_suite_bignum.function
@@ -438,7 +438,7 @@
TEST_ASSERT(mbedtls_mpi_lt_mpi_ct(&X, &Y, &ret) == input_err);
if (input_err == 0) {
- TEST_ASSERT(ret == input_uret);
+ TEST_EQUAL(ret, input_uret);
}
exit:
@@ -834,7 +834,7 @@
} else if (strcmp(result_comparison, "!=") == 0) {
TEST_ASSERT(mbedtls_mpi_cmp_mpi(&Z, &A) != 0);
} else {
- TEST_ASSERT("unknown operator" == 0);
+ TEST_FAIL("unknown operator");
}
exit:
diff --git a/tests/suites/test_suite_bignum_core.function b/tests/suites/test_suite_bignum_core.function
index 81a3a45..db84d62 100644
--- a/tests/suites/test_suite_bignum_core.function
+++ b/tests/suites/test_suite_bignum_core.function
@@ -34,45 +34,45 @@
/* A + B => correct result and carry */
TEST_EQUAL(carry, mbedtls_mpi_core_add(X, A, B, limbs));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* A + B; alias output and first operand => correct result and carry */
memcpy(X, A, bytes);
TEST_EQUAL(carry, mbedtls_mpi_core_add(X, X, B, limbs));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* A + B; alias output and second operand => correct result and carry */
memcpy(X, B, bytes);
TEST_EQUAL(carry, mbedtls_mpi_core_add(X, A, X, limbs));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
if (memcmp(A, B, bytes) == 0) {
/* A == B, so test where A and B are aliased */
/* A + A => correct result and carry */
TEST_EQUAL(carry, mbedtls_mpi_core_add(X, A, A, limbs));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* A + A, output aliased to both operands => correct result and carry */
memcpy(X, A, bytes);
TEST_EQUAL(carry, mbedtls_mpi_core_add(X, X, X, limbs));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
} else {
/* A != B, so test B + A */
/* B + A => correct result and carry */
TEST_EQUAL(carry, mbedtls_mpi_core_add(X, B, A, limbs));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* B + A; alias output and first operand => correct result and carry */
memcpy(X, B, bytes);
TEST_EQUAL(carry, mbedtls_mpi_core_add(X, X, A, limbs));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* B + A; alias output and second operand => correct result and carry */
memcpy(X, A, bytes);
TEST_EQUAL(carry, mbedtls_mpi_core_add(X, B, X, limbs));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
}
ret = 1;
@@ -111,11 +111,11 @@
/* cond = 0 => X unchanged, no carry */
memcpy(X, A, bytes);
TEST_EQUAL(0, mbedtls_mpi_core_add_if(X, B, limbs, 0));
- ASSERT_COMPARE(X, bytes, A, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, A, bytes);
/* cond = 1 => correct result and carry */
TEST_EQUAL(carry, mbedtls_mpi_core_add_if(X, B, limbs, 1));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
if (memcmp(A, B, bytes) == 0) {
/* A == B, so test where A and B are aliased */
@@ -123,22 +123,22 @@
/* cond = 0 => X unchanged, no carry */
memcpy(X, B, bytes);
TEST_EQUAL(0, mbedtls_mpi_core_add_if(X, X, limbs, 0));
- ASSERT_COMPARE(X, bytes, B, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, B, bytes);
/* cond = 1 => correct result and carry */
TEST_EQUAL(carry, mbedtls_mpi_core_add_if(X, X, limbs, 1));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
} else {
/* A != B, so test B + A */
/* cond = 0 => d unchanged, no carry */
memcpy(X, B, bytes);
TEST_EQUAL(0, mbedtls_mpi_core_add_if(X, A, limbs, 0));
- ASSERT_COMPARE(X, bytes, B, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, B, bytes);
/* cond = 1 => correct result and carry */
TEST_EQUAL(carry, mbedtls_mpi_core_add_if(X, A, limbs, 1));
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
}
ret = 1;
@@ -358,7 +358,7 @@
TEST_CF_SECRET(Y, X_limbs * sizeof(mbedtls_mpi_uint));
ret = mbedtls_mpi_core_lt_ct(X, Y, X_limbs);
- TEST_EQUAL(ret, exp_ret);
+ TEST_EQUAL(!!ret, exp_ret);
exit:
mbedtls_free(X);
@@ -384,25 +384,25 @@
TEST_CF_SECRET(A, A_limbs * sizeof(*A));
- TEST_EQUAL(mbedtls_mpi_core_uint_le_mpi(0, A, A_limbs), 1);
- TEST_EQUAL(mbedtls_mpi_core_uint_le_mpi(A[0], A, A_limbs), 1);
+ TEST_EQUAL(!!mbedtls_mpi_core_uint_le_mpi(0, A, A_limbs), 1);
+ TEST_EQUAL(!!mbedtls_mpi_core_uint_le_mpi(A[0], A, A_limbs), 1);
if (is_large) {
- TEST_EQUAL(mbedtls_mpi_core_uint_le_mpi(A[0] + 1,
- A, A_limbs), 1);
- TEST_EQUAL(mbedtls_mpi_core_uint_le_mpi((mbedtls_mpi_uint) (-1) >> 1,
- A, A_limbs), 1);
- TEST_EQUAL(mbedtls_mpi_core_uint_le_mpi((mbedtls_mpi_uint) (-1),
- A, A_limbs), 1);
+ TEST_EQUAL(!!mbedtls_mpi_core_uint_le_mpi(A[0] + 1,
+ A, A_limbs), 1);
+ TEST_EQUAL(!!mbedtls_mpi_core_uint_le_mpi((mbedtls_mpi_uint) (-1) >> 1,
+ A, A_limbs), 1);
+ TEST_EQUAL(!!mbedtls_mpi_core_uint_le_mpi((mbedtls_mpi_uint) (-1),
+ A, A_limbs), 1);
} else {
- TEST_EQUAL(mbedtls_mpi_core_uint_le_mpi(A[0] + 1,
- A, A_limbs),
+ TEST_EQUAL(!!mbedtls_mpi_core_uint_le_mpi(A[0] + 1,
+ A, A_limbs),
A[0] + 1 <= A[0]);
- TEST_EQUAL(mbedtls_mpi_core_uint_le_mpi((mbedtls_mpi_uint) (-1) >> 1,
- A, A_limbs),
+ TEST_EQUAL(!!mbedtls_mpi_core_uint_le_mpi((mbedtls_mpi_uint) (-1) >> 1,
+ A, A_limbs),
(mbedtls_mpi_uint) (-1) >> 1 <= A[0]);
- TEST_EQUAL(mbedtls_mpi_core_uint_le_mpi((mbedtls_mpi_uint) (-1),
- A, A_limbs),
+ TEST_EQUAL(!!mbedtls_mpi_core_uint_le_mpi((mbedtls_mpi_uint) (-1),
+ A, A_limbs),
(mbedtls_mpi_uint) (-1) <= A[0]);
}
@@ -447,7 +447,7 @@
TEST_CF_SECRET(X, bytes);
TEST_CF_SECRET(Y, bytes);
- mbedtls_mpi_core_cond_assign(X, Y, copy_limbs, 1);
+ mbedtls_mpi_core_cond_assign(X, Y, copy_limbs, mbedtls_ct_bool(1));
TEST_CF_PUBLIC(X, bytes);
TEST_CF_PUBLIC(Y, bytes);
@@ -458,10 +458,10 @@
TEST_CF_PUBLIC(X, bytes);
TEST_CF_PUBLIC(Y, bytes);
- ASSERT_COMPARE(X, copy_bytes, Y, copy_bytes);
+ TEST_MEMORY_COMPARE(X, copy_bytes, Y, copy_bytes);
TEST_ASSERT(memcmp(X, Y, bytes) != 0);
} else {
- ASSERT_COMPARE(X, bytes, Y, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, Y, bytes);
}
exit:
@@ -493,10 +493,10 @@
TEST_EQUAL(limbs_X, limbs_Y);
TEST_ASSERT(copy_limbs <= limbs);
- ASSERT_ALLOC(X, limbs);
+ TEST_CALLOC(X, limbs);
memcpy(X, tmp_X, bytes);
- ASSERT_ALLOC(Y, limbs);
+ TEST_CALLOC(Y, limbs);
memcpy(Y, tmp_Y, bytes);
/* condition is false */
@@ -508,14 +508,14 @@
TEST_CF_PUBLIC(X, bytes);
TEST_CF_PUBLIC(Y, bytes);
- ASSERT_COMPARE(X, bytes, tmp_X, bytes);
- ASSERT_COMPARE(Y, bytes, tmp_Y, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, tmp_X, bytes);
+ TEST_MEMORY_COMPARE(Y, bytes, tmp_Y, bytes);
/* condition is true */
TEST_CF_SECRET(X, bytes);
TEST_CF_SECRET(Y, bytes);
- mbedtls_mpi_core_cond_swap(X, Y, copy_limbs, 1);
+ mbedtls_mpi_core_cond_swap(X, Y, copy_limbs, mbedtls_ct_bool(1));
TEST_CF_PUBLIC(X, bytes);
TEST_CF_PUBLIC(Y, bytes);
@@ -523,15 +523,15 @@
/* Check if the given length is copied even it is smaller
than the length of the given MPIs. */
if (copy_limbs < limbs) {
- ASSERT_COMPARE(X, copy_bytes, tmp_Y, copy_bytes);
- ASSERT_COMPARE(Y, copy_bytes, tmp_X, copy_bytes);
+ TEST_MEMORY_COMPARE(X, copy_bytes, tmp_Y, copy_bytes);
+ TEST_MEMORY_COMPARE(Y, copy_bytes, tmp_X, copy_bytes);
TEST_ASSERT(memcmp(X, tmp_X, bytes) != 0);
TEST_ASSERT(memcmp(X, tmp_Y, bytes) != 0);
TEST_ASSERT(memcmp(Y, tmp_X, bytes) != 0);
TEST_ASSERT(memcmp(Y, tmp_Y, bytes) != 0);
} else {
- ASSERT_COMPARE(X, bytes, tmp_Y, bytes);
- ASSERT_COMPARE(Y, bytes, tmp_X, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, tmp_Y, bytes);
+ TEST_MEMORY_COMPARE(Y, bytes, tmp_X, bytes);
}
exit:
@@ -554,7 +554,7 @@
TEST_EQUAL(limbs, n);
mbedtls_mpi_core_shift_r(X, limbs, count);
- ASSERT_COMPARE(X, limbs * ciL, Y, limbs * ciL);
+ TEST_MEMORY_COMPARE(X, limbs * ciL, Y, limbs * ciL);
exit:
mbedtls_free(X);
@@ -574,7 +574,7 @@
TEST_EQUAL(limbs, n);
mbedtls_mpi_core_shift_l(X, limbs, count);
- ASSERT_COMPARE(X, limbs * ciL, Y, limbs * ciL);
+ TEST_MEMORY_COMPARE(X, limbs * ciL, Y, limbs * ciL);
exit:
mbedtls_free(X);
@@ -601,7 +601,7 @@
TEST_EQUAL(A_limbs, S_limbs);
size_t limbs = A_limbs;
- ASSERT_ALLOC(X, limbs);
+ TEST_CALLOC(X, limbs);
TEST_ASSERT(mpi_core_verify_add(A, B, limbs, S, carry, X));
TEST_ASSERT(mpi_core_verify_add_if(A, B, limbs, S, carry, X));
@@ -646,15 +646,15 @@
/* Now let's get arrays of mbedtls_mpi_uints, rather than MPI structures */
- /* ASSERT_ALLOC() uses calloc() under the hood, so these do get zeroed */
- ASSERT_ALLOC(a, bytes);
- ASSERT_ALLOC(b, bytes);
- ASSERT_ALLOC(x, bytes);
- ASSERT_ALLOC(r, bytes);
+ /* TEST_CALLOC() uses calloc() under the hood, so these do get zeroed */
+ TEST_CALLOC(a, bytes);
+ TEST_CALLOC(b, bytes);
+ TEST_CALLOC(x, bytes);
+ TEST_CALLOC(r, bytes);
/* Populate the arrays. As the mbedtls_mpi_uint[]s in mbedtls_mpis (and as
* processed by mbedtls_mpi_core_sub()) are little endian, we can just
- * copy what we have as long as MSBs are 0 (which they are from ASSERT_ALLOC())
+ * copy what we have as long as MSBs are 0 (which they are from TEST_CALLOC())
*/
memcpy(a, A.p, A.n * sizeof(mbedtls_mpi_uint));
memcpy(b, B.p, B.n * sizeof(mbedtls_mpi_uint));
@@ -664,7 +664,7 @@
TEST_EQUAL(carry, mbedtls_mpi_core_sub(r, a, b, limbs));
/* 1b) r = a - b => we should get the correct result */
- ASSERT_COMPARE(r, bytes, x, bytes);
+ TEST_MEMORY_COMPARE(r, bytes, x, bytes);
/* 2 and 3 test "r may be aliased to a or b" */
/* 2a) r = a; r -= b => we should get the correct carry (use r to avoid clobbering a) */
@@ -672,20 +672,20 @@
TEST_EQUAL(carry, mbedtls_mpi_core_sub(r, r, b, limbs));
/* 2b) r -= b => we should get the correct result */
- ASSERT_COMPARE(r, bytes, x, bytes);
+ TEST_MEMORY_COMPARE(r, bytes, x, bytes);
/* 3a) r = b; r = a - r => we should get the correct carry (use r to avoid clobbering b) */
memcpy(r, b, bytes);
TEST_EQUAL(carry, mbedtls_mpi_core_sub(r, a, r, limbs));
/* 3b) r = a - b => we should get the correct result */
- ASSERT_COMPARE(r, bytes, x, bytes);
+ TEST_MEMORY_COMPARE(r, bytes, x, bytes);
/* 4 tests "r may be aliased to [...] both" */
if (A.n == B.n && memcmp(A.p, B.p, bytes) == 0) {
memcpy(r, b, bytes);
TEST_EQUAL(carry, mbedtls_mpi_core_sub(r, r, r, limbs));
- ASSERT_COMPARE(r, bytes, x, bytes);
+ TEST_MEMORY_COMPARE(r, bytes, x, bytes);
}
exit:
@@ -759,13 +759,13 @@
/* Now let's get arrays of mbedtls_mpi_uints, rather than MPI structures */
- /* ASSERT_ALLOC() uses calloc() under the hood, so these do get zeroed */
- ASSERT_ALLOC(a, bytes);
- ASSERT_ALLOC(x, bytes);
+ /* TEST_CALLOC() uses calloc() under the hood, so these do get zeroed */
+ TEST_CALLOC(a, bytes);
+ TEST_CALLOC(x, bytes);
/* Populate the arrays. As the mbedtls_mpi_uint[]s in mbedtls_mpis (and as
* processed by mbedtls_mpi_core_mla()) are little endian, we can just
- * copy what we have as long as MSBs are 0 (which they are from ASSERT_ALLOC()).
+ * copy what we have as long as MSBs are 0 (which they are from TEST_CALLOC()).
*/
memcpy(a, A.p, A.n * sizeof(mbedtls_mpi_uint));
memcpy(x, X->p, X->n * sizeof(mbedtls_mpi_uint));
@@ -774,13 +774,13 @@
TEST_EQUAL(mbedtls_mpi_core_mla(a, limbs, B.p, B.n, *S.p), *cy->p);
/* 1b) A += B * s => we should get the correct result */
- ASSERT_COMPARE(a, bytes, x, bytes);
+ TEST_MEMORY_COMPARE(a, bytes, x, bytes);
if (A.n == B.n && memcmp(A.p, B.p, bytes) == 0) {
/* Check when A and B are aliased */
memcpy(a, A.p, A.n * sizeof(mbedtls_mpi_uint));
TEST_EQUAL(mbedtls_mpi_core_mla(a, limbs, a, limbs, *S.p), *cy->p);
- ASSERT_COMPARE(a, bytes, x, bytes);
+ TEST_MEMORY_COMPARE(a, bytes, x, bytes);
}
exit:
@@ -890,14 +890,14 @@
mbedtls_mpi_core_montmul(R.p, A.p, B.p, B.n, N.p, N.n, mm, T.p);
size_t bytes = N.n * sizeof(mbedtls_mpi_uint);
- ASSERT_COMPARE(R.p, bytes, X->p, bytes);
+ TEST_MEMORY_COMPARE(R.p, bytes, X->p, bytes);
/* The output (R, above) may be aliased to A - use R to save the value of A */
memcpy(R.p, A.p, bytes);
mbedtls_mpi_core_montmul(A.p, A.p, B.p, B.n, N.p, N.n, mm, T.p);
- ASSERT_COMPARE(A.p, bytes, X->p, bytes);
+ TEST_MEMORY_COMPARE(A.p, bytes, X->p, bytes);
memcpy(A.p, R.p, bytes); /* restore A */
@@ -906,7 +906,7 @@
memcpy(R.p, N.p, bytes);
mbedtls_mpi_core_montmul(N.p, A.p, B.p, B.n, N.p, N.n, mm, T.p);
- ASSERT_COMPARE(N.p, bytes, X->p, bytes);
+ TEST_MEMORY_COMPARE(N.p, bytes, X->p, bytes);
memcpy(N.p, R.p, bytes);
@@ -917,7 +917,7 @@
* don't bother with yet another test with only A and B aliased */
mbedtls_mpi_core_montmul(B.p, B.p, B.p, B.n, N.p, N.n, mm, T.p);
- ASSERT_COMPARE(B.p, bytes, X->p, bytes);
+ TEST_MEMORY_COMPARE(B.p, bytes, X->p, bytes);
memcpy(B.p, A.p, bytes); /* restore B from equal value A */
}
@@ -925,7 +925,7 @@
/* The output may be aliased to B - last test, so we don't save B */
mbedtls_mpi_core_montmul(B.p, A.p, B.p, B.n, N.p, N.n, mm, T.p);
- ASSERT_COMPARE(B.p, bytes, X->p, bytes);
+ TEST_MEMORY_COMPARE(B.p, bytes, X->p, bytes);
}
exit:
@@ -1017,8 +1017,8 @@
mbedtls_mpi_uint *table = NULL;
mbedtls_mpi_uint *dest = NULL;
- ASSERT_ALLOC(table, limbs * count);
- ASSERT_ALLOC(dest, limbs);
+ TEST_CALLOC(table, limbs * count);
+ TEST_CALLOC(dest, limbs);
/*
* Fill the table with a unique counter so that differences are easily
@@ -1046,8 +1046,8 @@
TEST_CF_PUBLIC(dest, limbs * sizeof(*dest));
TEST_CF_PUBLIC(table, count * limbs * sizeof(*table));
- ASSERT_COMPARE(dest, limbs * sizeof(*dest),
- current, limbs * sizeof(*current));
+ TEST_MEMORY_COMPARE(dest, limbs * sizeof(*dest),
+ current, limbs * sizeof(*current));
TEST_CF_PUBLIC(&i, sizeof(i));
}
@@ -1070,7 +1070,7 @@
int ret;
/* Prepare an RNG with known output, limited to rng_bytes. */
- ASSERT_ALLOC(rnd_data, rng_bytes);
+ TEST_CALLOC(rnd_data, rng_bytes);
TEST_EQUAL(0, mbedtls_test_rnd_std_rand(NULL, rnd_data, rng_bytes));
rnd_info.buf = rnd_data;
@@ -1078,7 +1078,7 @@
* extra_limbs may be negative but the total limb count must be positive.
* Fill the MPI with the byte value in before. */
TEST_LE_U(1, X_limbs);
- ASSERT_ALLOC(X, X_limbs);
+ TEST_CALLOC(X, X_limbs);
memset(X, before, X_limbs * sizeof(*X));
ret = mbedtls_mpi_core_fill_random(X, X_limbs, wanted_bytes,
@@ -1128,14 +1128,14 @@
const size_t X_limbs = A_limbs + B_limbs;
const size_t X_bytes = X_limbs * sizeof(mbedtls_mpi_uint);
- ASSERT_ALLOC(X, X_limbs);
+ TEST_CALLOC(X, X_limbs);
const size_t A_bytes = A_limbs * sizeof(mbedtls_mpi_uint);
- ASSERT_ALLOC(A_orig, A_limbs);
+ TEST_CALLOC(A_orig, A_limbs);
memcpy(A_orig, A, A_bytes);
const size_t B_bytes = B_limbs * sizeof(mbedtls_mpi_uint);
- ASSERT_ALLOC(B_orig, B_limbs);
+ TEST_CALLOC(B_orig, B_limbs);
memcpy(B_orig, B, B_bytes);
/* Set result to something that is unlikely to be correct */
@@ -1143,24 +1143,24 @@
/* 1. X = A * B - result should be correct, A and B unchanged */
mbedtls_mpi_core_mul(X, A, A_limbs, B, B_limbs);
- ASSERT_COMPARE(X, X_bytes, R, X_bytes);
- ASSERT_COMPARE(A, A_bytes, A_orig, A_bytes);
- ASSERT_COMPARE(B, B_bytes, B_orig, B_bytes);
+ TEST_MEMORY_COMPARE(X, X_bytes, R, X_bytes);
+ TEST_MEMORY_COMPARE(A, A_bytes, A_orig, A_bytes);
+ TEST_MEMORY_COMPARE(B, B_bytes, B_orig, B_bytes);
/* 2. A == B: alias A and B - result should be correct, A and B unchanged */
if (A_bytes == B_bytes && memcmp(A, B, A_bytes) == 0) {
memset(X, '!', X_bytes);
mbedtls_mpi_core_mul(X, A, A_limbs, A, A_limbs);
- ASSERT_COMPARE(X, X_bytes, R, X_bytes);
- ASSERT_COMPARE(A, A_bytes, A_orig, A_bytes);
+ TEST_MEMORY_COMPARE(X, X_bytes, R, X_bytes);
+ TEST_MEMORY_COMPARE(A, A_bytes, A_orig, A_bytes);
}
/* 3. X = B * A - result should be correct, A and B unchanged */
else {
memset(X, '!', X_bytes);
mbedtls_mpi_core_mul(X, B, B_limbs, A, A_limbs);
- ASSERT_COMPARE(X, X_bytes, R, X_bytes);
- ASSERT_COMPARE(A, A_bytes, A_orig, A_bytes);
- ASSERT_COMPARE(B, B_bytes, B_orig, B_bytes);
+ TEST_MEMORY_COMPARE(X, X_bytes, R, X_bytes);
+ TEST_MEMORY_COMPARE(A, A_bytes, A_orig, A_bytes);
+ TEST_MEMORY_COMPARE(B, B_bytes, B_orig, B_bytes);
}
exit:
@@ -1195,7 +1195,7 @@
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&E, &E_limbs, input_E));
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&N, &N_limbs, input_N));
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&X, &X_limbs, input_X));
- ASSERT_ALLOC(Y, N_limbs);
+ TEST_CALLOC(Y, N_limbs);
TEST_EQUAL(A_limbs, N_limbs);
TEST_EQUAL(X_limbs, N_limbs);
@@ -1227,7 +1227,7 @@
TEST_LE_U(mbedtls_mpi_core_montmul_working_limbs(N_limbs),
working_limbs);
- ASSERT_ALLOC(T, working_limbs);
+ TEST_CALLOC(T, working_limbs);
mbedtls_mpi_core_exp_mod(Y, A, N, N_limbs, E, E_limbs, R2, T);
@@ -1277,10 +1277,11 @@
TEST_EQUAL(A_limbs, X_limbs);
size_t limbs = A_limbs;
- ASSERT_ALLOC(R, limbs);
+ TEST_CALLOC(R, limbs);
#define TEST_COMPARE_CORE_MPIS(A, B, limbs) \
- ASSERT_COMPARE(A, (limbs) * sizeof(mbedtls_mpi_uint), B, (limbs) * sizeof(mbedtls_mpi_uint))
+ TEST_MEMORY_COMPARE(A, (limbs) * sizeof(mbedtls_mpi_uint), \
+ B, (limbs) * sizeof(mbedtls_mpi_uint))
/* 1. R = A - b. Result and borrow should be correct */
TEST_EQUAL(mbedtls_mpi_core_sub_int(R, A, B[0], limbs), borrow);
diff --git a/tests/suites/test_suite_bignum_mod.function b/tests/suites/test_suite_bignum_mod.function
index 4edc0b9..7015284 100644
--- a/tests/suites/test_suite_bignum_mod.function
+++ b/tests/suites/test_suite_bignum_mod.function
@@ -7,8 +7,8 @@
#include "test/constant_flow.h"
#define TEST_COMPARE_MPI_RESIDUES(a, b) \
- ASSERT_COMPARE((a).p, (a).limbs * sizeof(mbedtls_mpi_uint), \
- (b).p, (b).limbs * sizeof(mbedtls_mpi_uint))
+ TEST_MEMORY_COMPARE((a).p, (a).limbs * sizeof(mbedtls_mpi_uint), \
+ (b).p, (b).limbs * sizeof(mbedtls_mpi_uint))
static int test_read_residue(mbedtls_mpi_mod_residue *r,
const mbedtls_mpi_mod_modulus *m,
@@ -123,47 +123,47 @@
TEST_EQUAL(rB.limbs, limbs);
TEST_EQUAL(rR.limbs, limbs);
- ASSERT_ALLOC(X, limbs);
+ TEST_CALLOC(X, limbs);
TEST_EQUAL(mbedtls_mpi_mod_residue_setup(&rX, &m, X, limbs), 0);
TEST_EQUAL(mbedtls_mpi_mod_mul(&rX, &rA, &rB, &m), 0);
- ASSERT_COMPARE(rX.p, bytes, rR.p, bytes);
+ TEST_MEMORY_COMPARE(rX.p, bytes, rR.p, bytes);
/* alias X to A */
memcpy(rX.p, rA.p, bytes);
TEST_EQUAL(mbedtls_mpi_mod_mul(&rX, &rX, &rB, &m), 0);
- ASSERT_COMPARE(rX.p, bytes, rR.p, bytes);
+ TEST_MEMORY_COMPARE(rX.p, bytes, rR.p, bytes);
/* alias X to B */
memcpy(rX.p, rB.p, bytes);
TEST_EQUAL(mbedtls_mpi_mod_mul(&rX, &rA, &rX, &m), 0);
- ASSERT_COMPARE(rX.p, bytes, rR.p, bytes);
+ TEST_MEMORY_COMPARE(rX.p, bytes, rR.p, bytes);
/* A == B: alias A and B */
if (memcmp(rA.p, rB.p, bytes) == 0) {
TEST_EQUAL(mbedtls_mpi_mod_mul(&rX, &rA, &rA, &m), 0);
- ASSERT_COMPARE(rX.p, bytes, rR.p, bytes);
+ TEST_MEMORY_COMPARE(rX.p, bytes, rR.p, bytes);
/* X, A, B all aliased together */
memcpy(rX.p, rA.p, bytes);
TEST_EQUAL(mbedtls_mpi_mod_mul(&rX, &rX, &rX, &m), 0);
- ASSERT_COMPARE(rX.p, bytes, rR.p, bytes);
+ TEST_MEMORY_COMPARE(rX.p, bytes, rR.p, bytes);
}
/* A != B: test B * A */
else {
TEST_EQUAL(mbedtls_mpi_mod_mul(&rX, &rB, &rA, &m), 0);
- ASSERT_COMPARE(rX.p, bytes, rR.p, bytes);
+ TEST_MEMORY_COMPARE(rX.p, bytes, rR.p, bytes);
/* B * A: alias X to A */
memcpy(rX.p, rA.p, bytes);
TEST_EQUAL(mbedtls_mpi_mod_mul(&rX, &rB, &rX, &m), 0);
- ASSERT_COMPARE(rX.p, bytes, rR.p, bytes);
+ TEST_MEMORY_COMPARE(rX.p, bytes, rR.p, bytes);
/* B + A: alias X to B */
memcpy(rX.p, rB.p, bytes);
TEST_EQUAL(mbedtls_mpi_mod_mul(&rX, &rX, &rA, &m), 0);
- ASSERT_COMPARE(rX.p, bytes, rR.p, bytes);
+ TEST_MEMORY_COMPARE(rX.p, bytes, rR.p, bytes);
}
exit:
@@ -206,7 +206,7 @@
const size_t limbs = m.limbs;
- ASSERT_ALLOC(X, limbs);
+ TEST_CALLOC(X, limbs);
TEST_EQUAL(mbedtls_mpi_mod_residue_setup(&rX, &m, X, limbs), 0);
rX.limbs = rR.limbs;
@@ -259,7 +259,7 @@
if (expected_ret == 0) {
/* Negative test with too many limbs in output */
- ASSERT_ALLOC(X_raw, limbs + 1);
+ TEST_CALLOC(X_raw, limbs + 1);
x.p = X_raw;
x.limbs = limbs + 1;
@@ -271,7 +271,7 @@
/* Negative test with too few limbs in output */
if (limbs > 1) {
- ASSERT_ALLOC(X_raw, limbs - 1);
+ TEST_CALLOC(X_raw, limbs - 1);
x.p = X_raw;
x.limbs = limbs - 1;
@@ -286,7 +286,7 @@
* manually-written test cases with expected_ret != 0. */
}
- ASSERT_ALLOC(X_raw, limbs);
+ TEST_CALLOC(X_raw, limbs);
TEST_EQUAL(0, mbedtls_mpi_mod_residue_setup(&x, &m, X_raw, limbs));
@@ -358,7 +358,7 @@
size_t limbs = N.limbs;
size_t bytes = limbs * sizeof(*X_raw);
- ASSERT_ALLOC(X_raw, limbs);
+ TEST_CALLOC(X_raw, limbs);
TEST_EQUAL(0, mbedtls_mpi_mod_residue_setup(&x, &N, X_raw, limbs));
@@ -408,7 +408,7 @@
size_t limbs = N.limbs;
size_t bytes = limbs * sizeof(*X_raw);
- ASSERT_ALLOC(X_raw, limbs);
+ TEST_CALLOC(X_raw, limbs);
TEST_EQUAL(0, mbedtls_mpi_mod_residue_setup(&x, &N, X_raw, limbs));
@@ -462,7 +462,7 @@
if (expected_ret == 0) {
/* Negative test with too many limbs in output */
- ASSERT_ALLOC(X_raw, limbs + 1);
+ TEST_CALLOC(X_raw, limbs + 1);
x.p = X_raw;
x.limbs = limbs + 1;
@@ -474,7 +474,7 @@
/* Negative test with too few limbs in output */
if (limbs > 1) {
- ASSERT_ALLOC(X_raw, limbs - 1);
+ TEST_CALLOC(X_raw, limbs - 1);
x.p = X_raw;
x.limbs = limbs - 1;
@@ -490,7 +490,7 @@
}
/* Allocate correct number of limbs for X_raw */
- ASSERT_ALLOC(X_raw, limbs);
+ TEST_CALLOC(X_raw, limbs);
TEST_EQUAL(0, mbedtls_mpi_mod_residue_setup(&x, &m, X_raw, limbs));
@@ -582,7 +582,7 @@
size_t n_limbs;
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&N, &n_limbs, input_N));
size_t r_limbs = n_limbs;
- ASSERT_ALLOC(R, r_limbs);
+ TEST_CALLOC(R, r_limbs);
/* modulus->p == NULL || residue->p == NULL ( m has not been set-up ) */
TEST_EQUAL(MBEDTLS_ERR_MPI_BAD_INPUT_DATA,
@@ -658,8 +658,8 @@
a_bytes = input_A->len;
/* Allocate the memory for intermediate data structures */
- ASSERT_ALLOC(R, n_bytes);
- ASSERT_ALLOC(R_COPY, n_bytes);
+ TEST_CALLOC(R, n_bytes);
+ TEST_CALLOC(R_COPY, n_bytes);
/* Test that input's size is not greater to modulo's */
TEST_LE_U(a_bytes, n_bytes);
@@ -698,14 +698,14 @@
obuf_sizes[2] = a_bytes + 8;
for (size_t i = 0; i < obuf_sizes_len; i++) {
- ASSERT_ALLOC(obuf, obuf_sizes[i]);
+ TEST_CALLOC(obuf, obuf_sizes[i]);
TEST_EQUAL(0, mbedtls_mpi_mod_write(&r, &m, obuf, obuf_sizes[i], endian));
/* Make sure that writing didn't corrupt the value of r */
- ASSERT_COMPARE(r.p, r.limbs, r_copy.p, r_copy.limbs);
+ TEST_MEMORY_COMPARE(r.p, r.limbs, r_copy.p, r_copy.limbs);
/* Set up reference output for checking the result */
- ASSERT_ALLOC(ref_buf, obuf_sizes[i]);
+ TEST_CALLOC(ref_buf, obuf_sizes[i]);
switch (endian) {
case MBEDTLS_MPI_MOD_EXT_REP_LE:
memcpy(ref_buf, input_A->x, a_bytes_trimmed);
@@ -723,7 +723,7 @@
}
/* Check the result */
- ASSERT_COMPARE(obuf, obuf_sizes[i], ref_buf, obuf_sizes[i]);
+ TEST_MEMORY_COMPARE(obuf, obuf_sizes[i], ref_buf, obuf_sizes[i]);
mbedtls_free(ref_buf);
ref_buf = NULL;
diff --git a/tests/suites/test_suite_bignum_mod_raw.function b/tests/suites/test_suite_bignum_mod_raw.function
index b67ac51..6b953f5 100644
--- a/tests/suites/test_suite_bignum_mod_raw.function
+++ b/tests/suites/test_suite_bignum_mod_raw.function
@@ -133,7 +133,7 @@
TEST_EQUAL(limbs_X, limbs_Y);
TEST_ASSERT(copy_limbs <= limbs);
- ASSERT_ALLOC(buff_m, copy_limbs);
+ TEST_CALLOC(buff_m, copy_limbs);
memset(buff_m, 0xFF, copy_limbs);
TEST_EQUAL(mbedtls_mpi_mod_modulus_setup(
&m, buff_m, copy_limbs), 0);
@@ -161,10 +161,10 @@
/* Check if the given length is copied even it is smaller
than the length of the given MPIs. */
if (copy_limbs < limbs) {
- ASSERT_COMPARE(X, copy_bytes, Y, copy_bytes);
+ TEST_MEMORY_COMPARE(X, copy_bytes, Y, copy_bytes);
TEST_ASSERT(memcmp(X, Y, bytes) != 0);
} else {
- ASSERT_COMPARE(X, bytes, Y, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, Y, bytes);
}
exit:
@@ -203,15 +203,15 @@
TEST_EQUAL(limbs_X, limbs_Y);
TEST_ASSERT(copy_limbs <= limbs);
- ASSERT_ALLOC(buff_m, copy_limbs);
+ TEST_CALLOC(buff_m, copy_limbs);
memset(buff_m, 0xFF, copy_limbs);
TEST_EQUAL(mbedtls_mpi_mod_modulus_setup(
&m, buff_m, copy_limbs), 0);
- ASSERT_ALLOC(X, limbs);
+ TEST_CALLOC(X, limbs);
memcpy(X, tmp_X, bytes);
- ASSERT_ALLOC(Y, bytes);
+ TEST_CALLOC(Y, bytes);
memcpy(Y, tmp_Y, bytes);
/* condition is false */
@@ -223,8 +223,8 @@
TEST_CF_PUBLIC(X, bytes);
TEST_CF_PUBLIC(Y, bytes);
- ASSERT_COMPARE(X, bytes, tmp_X, bytes);
- ASSERT_COMPARE(Y, bytes, tmp_Y, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, tmp_X, bytes);
+ TEST_MEMORY_COMPARE(Y, bytes, tmp_Y, bytes);
/* condition is true */
TEST_CF_SECRET(X, bytes);
@@ -238,15 +238,15 @@
/* Check if the given length is copied even it is smaller
than the length of the given MPIs. */
if (copy_limbs < limbs) {
- ASSERT_COMPARE(X, copy_bytes, tmp_Y, copy_bytes);
- ASSERT_COMPARE(Y, copy_bytes, tmp_X, copy_bytes);
+ TEST_MEMORY_COMPARE(X, copy_bytes, tmp_Y, copy_bytes);
+ TEST_MEMORY_COMPARE(Y, copy_bytes, tmp_X, copy_bytes);
TEST_ASSERT(memcmp(X, tmp_X, bytes) != 0);
TEST_ASSERT(memcmp(X, tmp_Y, bytes) != 0);
TEST_ASSERT(memcmp(Y, tmp_X, bytes) != 0);
TEST_ASSERT(memcmp(Y, tmp_Y, bytes) != 0);
} else {
- ASSERT_COMPARE(X, bytes, tmp_Y, bytes);
- ASSERT_COMPARE(Y, bytes, tmp_X, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, tmp_Y, bytes);
+ TEST_MEMORY_COMPARE(Y, bytes, tmp_X, bytes);
}
exit:
@@ -291,33 +291,33 @@
TEST_EQUAL(limbs_B, limbs);
TEST_EQUAL(limbs_res, limbs);
- ASSERT_ALLOC(X, limbs);
+ TEST_CALLOC(X, limbs);
TEST_EQUAL(mbedtls_mpi_mod_modulus_setup(
&m, N, limbs), 0);
mbedtls_mpi_mod_raw_sub(X, A, B, &m);
- ASSERT_COMPARE(X, bytes, res, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, res, bytes);
/* alias X to A */
memcpy(X, A, bytes);
mbedtls_mpi_mod_raw_sub(X, X, B, &m);
- ASSERT_COMPARE(X, bytes, res, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, res, bytes);
/* alias X to B */
memcpy(X, B, bytes);
mbedtls_mpi_mod_raw_sub(X, A, X, &m);
- ASSERT_COMPARE(X, bytes, res, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, res, bytes);
/* A == B: alias A and B */
if (memcmp(A, B, bytes) == 0) {
mbedtls_mpi_mod_raw_sub(X, A, A, &m);
- ASSERT_COMPARE(X, bytes, res, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, res, bytes);
/* X, A, B all aliased together */
memcpy(X, A, bytes);
mbedtls_mpi_mod_raw_sub(X, X, X, &m);
- ASSERT_COMPARE(X, bytes, res, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, res, bytes);
}
exit:
mbedtls_free(A);
@@ -356,7 +356,7 @@
TEST_EQUAL(limbs_X, limbs);
TEST_EQUAL(limbs_res, limbs);
- ASSERT_ALLOC(tmp, limbs);
+ TEST_CALLOC(tmp, limbs);
memcpy(tmp, X, bytes);
/* Check that 0 <= X < 2N */
@@ -367,7 +367,7 @@
&m, N, limbs), 0);
mbedtls_mpi_mod_raw_fix_quasi_reduction(X, &m);
- ASSERT_COMPARE(X, bytes, res, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, res, bytes);
exit:
mbedtls_free(X);
@@ -411,51 +411,51 @@
TEST_EQUAL(limbs_B, limbs);
TEST_EQUAL(limbs_R, limbs);
- ASSERT_ALLOC(X, limbs);
+ TEST_CALLOC(X, limbs);
TEST_EQUAL(mbedtls_mpi_mod_modulus_setup(
&m, N, limbs), 0);
const size_t limbs_T = limbs * 2 + 1;
- ASSERT_ALLOC(T, limbs_T);
+ TEST_CALLOC(T, limbs_T);
mbedtls_mpi_mod_raw_mul(X, A, B, &m, T);
- ASSERT_COMPARE(X, bytes, R, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, R, bytes);
/* alias X to A */
memcpy(X, A, bytes);
mbedtls_mpi_mod_raw_mul(X, X, B, &m, T);
- ASSERT_COMPARE(X, bytes, R, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, R, bytes);
/* alias X to B */
memcpy(X, B, bytes);
mbedtls_mpi_mod_raw_mul(X, A, X, &m, T);
- ASSERT_COMPARE(X, bytes, R, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, R, bytes);
/* A == B: alias A and B */
if (memcmp(A, B, bytes) == 0) {
mbedtls_mpi_mod_raw_mul(X, A, A, &m, T);
- ASSERT_COMPARE(X, bytes, R, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, R, bytes);
/* X, A, B all aliased together */
memcpy(X, A, bytes);
mbedtls_mpi_mod_raw_mul(X, X, X, &m, T);
- ASSERT_COMPARE(X, bytes, R, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, R, bytes);
}
/* A != B: test B * A */
else {
mbedtls_mpi_mod_raw_mul(X, B, A, &m, T);
- ASSERT_COMPARE(X, bytes, R, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, R, bytes);
/* B * A: alias X to A */
memcpy(X, A, bytes);
mbedtls_mpi_mod_raw_mul(X, B, X, &m, T);
- ASSERT_COMPARE(X, bytes, R, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, R, bytes);
/* B + A: alias X to B */
memcpy(X, B, bytes);
mbedtls_mpi_mod_raw_mul(X, X, A, &m, T);
- ASSERT_COMPARE(X, bytes, R, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, R, bytes);
}
exit:
@@ -489,7 +489,7 @@
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&A, &A_limbs, input_A));
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&N, &N_limbs, input_N));
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&X, &X_limbs, input_X));
- ASSERT_ALLOC(Y, N_limbs);
+ TEST_CALLOC(Y, N_limbs);
TEST_EQUAL(A_limbs, N_limbs);
TEST_EQUAL(X_limbs, N_limbs);
@@ -519,7 +519,7 @@
TEST_LE_U(mbedtls_mpi_core_montmul_working_limbs(N_limbs),
working_limbs);
- ASSERT_ALLOC(T, working_limbs);
+ TEST_CALLOC(T, working_limbs);
mbedtls_mpi_mod_raw_inv_prime(Y, A, N, N_limbs, R2, T);
@@ -571,52 +571,52 @@
TEST_EQUAL(B_limbs, limbs);
TEST_EQUAL(S_limbs, limbs);
- ASSERT_ALLOC(X, limbs);
+ TEST_CALLOC(X, limbs);
TEST_EQUAL(mbedtls_mpi_mod_modulus_setup(
&m, N, limbs), 0);
/* A + B => Correct result */
mbedtls_mpi_mod_raw_add(X, A, B, &m);
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* A + B: alias X to A => Correct result */
memcpy(X, A, bytes);
mbedtls_mpi_mod_raw_add(X, X, B, &m);
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* A + B: alias X to B => Correct result */
memcpy(X, B, bytes);
mbedtls_mpi_mod_raw_add(X, A, X, &m);
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
if (memcmp(A, B, bytes) == 0) {
/* A == B: alias A and B */
/* A + A => Correct result */
mbedtls_mpi_mod_raw_add(X, A, A, &m);
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* A + A: X, A, B all aliased together => Correct result */
memcpy(X, A, bytes);
mbedtls_mpi_mod_raw_add(X, X, X, &m);
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
} else {
/* A != B: test B + A */
/* B + A => Correct result */
mbedtls_mpi_mod_raw_add(X, B, A, &m);
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* B + A: alias X to A => Correct result */
memcpy(X, A, bytes);
mbedtls_mpi_mod_raw_add(X, B, X, &m);
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
/* B + A: alias X to B => Correct result */
memcpy(X, B, bytes);
mbedtls_mpi_mod_raw_add(X, X, A, &m);
- ASSERT_COMPARE(X, bytes, S, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, S, bytes);
}
exit:
@@ -647,8 +647,8 @@
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&X, &X_limbs, input_X));
TEST_EQUAL(0, mbedtls_mpi_mod_raw_canonical_to_modulus_rep(A, &N));
- ASSERT_COMPARE(A, A_limbs * sizeof(mbedtls_mpi_uint),
- X, X_limbs * sizeof(mbedtls_mpi_uint));
+ TEST_MEMORY_COMPARE(A, A_limbs * sizeof(mbedtls_mpi_uint),
+ X, X_limbs * sizeof(mbedtls_mpi_uint));
exit:
mbedtls_test_mpi_mod_modulus_free_with_limbs(&N);
@@ -674,8 +674,8 @@
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&X, &X_limbs, input_X));
TEST_EQUAL(0, mbedtls_mpi_mod_raw_modulus_to_canonical_rep(A, &N));
- ASSERT_COMPARE(A, A_limbs * sizeof(mbedtls_mpi_uint),
- X, X_limbs * sizeof(mbedtls_mpi_uint));
+ TEST_MEMORY_COMPARE(A, A_limbs * sizeof(mbedtls_mpi_uint),
+ X, X_limbs * sizeof(mbedtls_mpi_uint));
exit:
mbedtls_test_mpi_mod_modulus_free_with_limbs(&N);
@@ -718,25 +718,25 @@
/* It has separate output, and requires temporary working storage */
size_t temp_limbs = mbedtls_mpi_core_montmul_working_limbs(limbs);
- ASSERT_ALLOC(T, temp_limbs);
- ASSERT_ALLOC(R, limbs);
+ TEST_CALLOC(T, temp_limbs);
+ TEST_CALLOC(R, limbs);
mbedtls_mpi_core_to_mont_rep(R, A, N, n_limbs,
m.rep.mont.mm, m.rep.mont.rr, T);
/* Test that the low-level function gives the required value */
- ASSERT_COMPARE(R, bytes, X, bytes);
+ TEST_MEMORY_COMPARE(R, bytes, X, bytes);
/* Test when output is aliased to input */
memcpy(R, A, bytes);
mbedtls_mpi_core_to_mont_rep(R, R, N, n_limbs,
m.rep.mont.mm, m.rep.mont.rr, T);
- ASSERT_COMPARE(R, bytes, X, bytes);
+ TEST_MEMORY_COMPARE(R, bytes, X, bytes);
/* 2. Test higher-level cannonical to Montgomery conversion */
TEST_EQUAL(0, mbedtls_mpi_mod_raw_to_mont_rep(A, &m));
/* The result matches expected value */
- ASSERT_COMPARE(A, bytes, X, bytes);
+ TEST_MEMORY_COMPARE(A, bytes, X, bytes);
exit:
mbedtls_mpi_mod_modulus_free(&m);
@@ -782,25 +782,25 @@
/* It has separate output, and requires temporary working storage */
size_t temp_limbs = mbedtls_mpi_core_montmul_working_limbs(limbs);
- ASSERT_ALLOC(T, temp_limbs);
- ASSERT_ALLOC(R, limbs);
+ TEST_CALLOC(T, temp_limbs);
+ TEST_CALLOC(R, limbs);
mbedtls_mpi_core_from_mont_rep(R, A, N, n_limbs,
m.rep.mont.mm, T);
/* Test that the low-level function gives the required value */
- ASSERT_COMPARE(R, bytes, X, bytes);
+ TEST_MEMORY_COMPARE(R, bytes, X, bytes);
/* Test when output is aliased to input */
memcpy(R, A, bytes);
mbedtls_mpi_core_from_mont_rep(R, R, N, n_limbs,
m.rep.mont.mm, T);
- ASSERT_COMPARE(R, bytes, X, bytes);
+ TEST_MEMORY_COMPARE(R, bytes, X, bytes);
/* 2. Test higher-level Montgomery to cannonical conversion */
TEST_EQUAL(0, mbedtls_mpi_mod_raw_from_mont_rep(A, &m));
/* The result matches expected value */
- ASSERT_COMPARE(A, bytes, X, bytes);
+ TEST_MEMORY_COMPARE(A, bytes, X, bytes);
exit:
mbedtls_mpi_mod_modulus_free(&m);
@@ -834,26 +834,26 @@
TEST_EQUAL(x_limbs, n_limbs);
bytes = n_limbs * sizeof(mbedtls_mpi_uint);
- ASSERT_ALLOC(R, n_limbs);
- ASSERT_ALLOC(Z, n_limbs);
+ TEST_CALLOC(R, n_limbs);
+ TEST_CALLOC(Z, n_limbs);
TEST_EQUAL(0, mbedtls_mpi_mod_modulus_setup(&m, N, n_limbs));
/* Neg( A == 0 ) => Zero result */
mbedtls_mpi_mod_raw_neg(R, Z, &m);
- ASSERT_COMPARE(R, bytes, Z, bytes);
+ TEST_MEMORY_COMPARE(R, bytes, Z, bytes);
/* Neg( A == N ) => Zero result */
mbedtls_mpi_mod_raw_neg(R, N, &m);
- ASSERT_COMPARE(R, bytes, Z, bytes);
+ TEST_MEMORY_COMPARE(R, bytes, Z, bytes);
/* Neg( A ) => Correct result */
mbedtls_mpi_mod_raw_neg(R, A, &m);
- ASSERT_COMPARE(R, bytes, X, bytes);
+ TEST_MEMORY_COMPARE(R, bytes, X, bytes);
/* Neg( A ): alias A to R => Correct result */
mbedtls_mpi_mod_raw_neg(A, A, &m);
- ASSERT_COMPARE(A, bytes, X, bytes);
+ TEST_MEMORY_COMPARE(A, bytes, X, bytes);
exit:
mbedtls_mpi_mod_modulus_free(&m);
mbedtls_free(N);
diff --git a/tests/suites/test_suite_bignum_random.function b/tests/suites/test_suite_bignum_random.function
index 34221a7..6e533bc 100644
--- a/tests/suites/test_suite_bignum_random.function
+++ b/tests/suites/test_suite_bignum_random.function
@@ -124,9 +124,9 @@
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&upper_bound, &limbs,
bound_bytes));
- ASSERT_ALLOC(lower_bound, limbs);
+ TEST_CALLOC(lower_bound, limbs);
lower_bound[0] = min;
- ASSERT_ALLOC(result, limbs);
+ TEST_CALLOC(result, limbs);
TEST_EQUAL(expected_ret,
mbedtls_mpi_core_random(result, min, upper_bound, limbs,
@@ -134,7 +134,7 @@
if (expected_ret == 0) {
TEST_EQUAL(0, mbedtls_mpi_core_lt_ct(result, lower_bound, limbs));
- TEST_EQUAL(1, mbedtls_mpi_core_lt_ct(result, upper_bound, limbs));
+ TEST_ASSERT(0 != mbedtls_mpi_core_lt_ct(result, upper_bound, limbs));
}
exit:
@@ -159,7 +159,7 @@
TEST_EQUAL(0, mbedtls_test_read_mpi(&max_legacy, max_hex));
size_t limbs = max_legacy.n;
- ASSERT_ALLOC(R_core, limbs);
+ TEST_CALLOC(R_core, limbs);
/* Call the legacy function and the core function with the same random
* stream. */
@@ -174,16 +174,16 @@
* same number, with the same limb count. */
TEST_EQUAL(core_ret, legacy_ret);
if (core_ret == 0) {
- ASSERT_COMPARE(R_core, limbs * ciL,
- R_legacy.p, R_legacy.n * ciL);
+ TEST_MEMORY_COMPARE(R_core, limbs * ciL,
+ R_legacy.p, R_legacy.n * ciL);
}
/* Also check that they have consumed the RNG in the same way. */
/* This may theoretically fail on rare platforms with padding in
* the structure! If this is a problem in practice, change to a
* field-by-field comparison. */
- ASSERT_COMPARE(&rnd_core, sizeof(rnd_core),
- &rnd_legacy, sizeof(rnd_legacy));
+ TEST_MEMORY_COMPARE(&rnd_core, sizeof(rnd_core),
+ &rnd_legacy, sizeof(rnd_legacy));
exit:
mbedtls_mpi_free(&max_legacy);
@@ -209,9 +209,9 @@
mbedtls_mpi_mod_modulus_init(&N);
TEST_EQUAL(mbedtls_test_read_mpi_modulus(&N, max_hex, rep), 0);
- ASSERT_ALLOC(R_core, N.limbs);
- ASSERT_ALLOC(R_mod_raw, N.limbs);
- ASSERT_ALLOC(R_mod_digits, N.limbs);
+ TEST_CALLOC(R_core, N.limbs);
+ TEST_CALLOC(R_mod_raw, N.limbs);
+ TEST_CALLOC(R_mod_digits, N.limbs);
TEST_EQUAL(mbedtls_mpi_mod_residue_setup(&R_mod, &N,
R_mod_digits, N.limbs),
0);
@@ -237,22 +237,22 @@
if (core_ret == 0) {
TEST_EQUAL(mbedtls_mpi_mod_raw_modulus_to_canonical_rep(R_mod_raw, &N),
0);
- ASSERT_COMPARE(R_core, N.limbs * ciL,
- R_mod_raw, N.limbs * ciL);
+ TEST_MEMORY_COMPARE(R_core, N.limbs * ciL,
+ R_mod_raw, N.limbs * ciL);
TEST_EQUAL(mbedtls_mpi_mod_raw_modulus_to_canonical_rep(R_mod_digits, &N),
0);
- ASSERT_COMPARE(R_core, N.limbs * ciL,
- R_mod_digits, N.limbs * ciL);
+ TEST_MEMORY_COMPARE(R_core, N.limbs * ciL,
+ R_mod_digits, N.limbs * ciL);
}
/* Also check that they have consumed the RNG in the same way. */
/* This may theoretically fail on rare platforms with padding in
* the structure! If this is a problem in practice, change to a
* field-by-field comparison. */
- ASSERT_COMPARE(&rnd_core, sizeof(rnd_core),
- &rnd_mod_raw, sizeof(rnd_mod_raw));
- ASSERT_COMPARE(&rnd_core, sizeof(rnd_core),
- &rnd_mod, sizeof(rnd_mod));
+ TEST_MEMORY_COMPARE(&rnd_core, sizeof(rnd_core),
+ &rnd_mod_raw, sizeof(rnd_mod_raw));
+ TEST_MEMORY_COMPARE(&rnd_core, sizeof(rnd_core),
+ &rnd_mod, sizeof(rnd_mod));
exit:
mbedtls_test_mpi_mod_modulus_free_with_limbs(&N);
@@ -287,7 +287,7 @@
TEST_EQUAL(0, mbedtls_test_read_mpi_core(&upper_bound, &limbs,
bound_hex));
- ASSERT_ALLOC(result, limbs);
+ TEST_CALLOC(result, limbs);
n_bits = mbedtls_mpi_core_bitlen(upper_bound, limbs);
/* Consider a bound "small" if it's less than 2^5. This value is chosen
@@ -302,7 +302,7 @@
full_stats = 0;
stats_len = n_bits;
}
- ASSERT_ALLOC(stats, stats_len);
+ TEST_CALLOC(stats, stats_len);
for (i = 0; i < (size_t) iterations; i++) {
mbedtls_test_set_step(i);
@@ -340,7 +340,7 @@
}
} else {
bound_bytes.len = limbs * sizeof(mbedtls_mpi_uint);
- ASSERT_ALLOC(bound_bytes.x, bound_bytes.len);
+ TEST_CALLOC(bound_bytes.x, bound_bytes.len);
mbedtls_mpi_core_write_be(upper_bound, limbs,
bound_bytes.x, bound_bytes.len);
int statistically_safe_all_the_way =
@@ -416,7 +416,7 @@
MBEDTLS_MPI_MOD_REP_OPT_RED),
0);
size_t result_limbs = N.limbs + result_limbs_delta;
- ASSERT_ALLOC(result_digits, result_limbs);
+ TEST_CALLOC(result_digits, result_limbs);
/* Build a reside that might not match the modulus, to test that
* the library function rejects that as expected. */
mbedtls_mpi_mod_residue result = { result_digits, result_limbs };
@@ -429,8 +429,7 @@
* size as the modulus, otherwise it's a mistake in the test data. */
TEST_EQUAL(result_limbs, N.limbs);
/* Sanity check: check that the result is in range */
- TEST_EQUAL(mbedtls_mpi_core_lt_ct(result_digits, N.p, N.limbs),
- 1);
+ TEST_ASSERT(0 != mbedtls_mpi_core_lt_ct(result_digits, N.p, N.limbs));
/* Check result >= min (changes result) */
TEST_EQUAL(mbedtls_mpi_core_sub_int(result_digits, result_digits, min,
result_limbs),
@@ -444,8 +443,7 @@
mbedtls_test_rnd_std_rand, NULL),
expected_ret);
if (expected_ret == 0) {
- TEST_EQUAL(mbedtls_mpi_core_lt_ct(result_digits, N.p, N.limbs),
- 1);
+ TEST_ASSERT(0 != mbedtls_mpi_core_lt_ct(result_digits, N.p, N.limbs));
TEST_EQUAL(mbedtls_mpi_core_sub_int(result_digits, result.p, min,
result_limbs),
0);
diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function
index 8c5e6ab..5aaaaa2 100644
--- a/tests/suites/test_suite_ccm.function
+++ b/tests/suites/test_suite_ccm.function
@@ -32,25 +32,25 @@
/* Allocate a tight buffer for each update call. This way, if the function
* tries to write beyond the advertised required buffer size, this will
* count as an overflow for memory sanitizers and static checkers. */
- ASSERT_ALLOC(output, n1);
+ TEST_CALLOC(output, n1);
olen = 0xdeadbeef;
TEST_EQUAL(0, mbedtls_ccm_update(ctx, input->x, n1, output, n1, &olen));
TEST_EQUAL(n1, olen);
- ASSERT_COMPARE(output, olen, expected_output->x, n1);
+ TEST_MEMORY_COMPARE(output, olen, expected_output->x, n1);
mbedtls_free(output);
output = NULL;
- ASSERT_ALLOC(output, n2);
+ TEST_CALLOC(output, n2);
olen = 0xdeadbeef;
TEST_EQUAL(0, mbedtls_ccm_update(ctx, input->x + n1, n2, output, n2, &olen));
TEST_EQUAL(n2, olen);
- ASSERT_COMPARE(output, olen, expected_output->x + n1, n2);
+ TEST_MEMORY_COMPARE(output, olen, expected_output->x + n1, n2);
mbedtls_free(output);
output = NULL;
- ASSERT_ALLOC(output, tag->len);
+ TEST_CALLOC(output, tag->len);
TEST_EQUAL(0, mbedtls_ccm_finish(ctx, output, tag->len));
- ASSERT_COMPARE(output, tag->len, tag->x, tag->len);
+ TEST_MEMORY_COMPARE(output, tag->len, tag->x, tag->len);
mbedtls_free(output);
output = NULL;
@@ -107,7 +107,7 @@
mbedtls_ccm_init(&ctx);
- ASSERT_ALLOC_WEAK(add, add_len);
+ TEST_CALLOC_OR_SKIP(add, add_len);
memset(key, 0, sizeof(key));
memset(msg, 0, sizeof(msg));
memset(iv, 0, sizeof(iv));
@@ -190,13 +190,13 @@
const uint8_t *expected_tag = result->x + msg->len;
/* Prepare input/output message buffer */
- ASSERT_ALLOC(io_msg_buf, msg->len);
+ TEST_CALLOC(io_msg_buf, msg->len);
if (msg->len != 0) {
memcpy(io_msg_buf, msg->x, msg->len);
}
/* Prepare tag buffer */
- ASSERT_ALLOC(tag_buf, expected_tag_len);
+ TEST_CALLOC(tag_buf, expected_tag_len);
mbedtls_ccm_init(&ctx);
TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
@@ -204,8 +204,8 @@
TEST_EQUAL(mbedtls_ccm_encrypt_and_tag(&ctx, msg->len, iv->x, iv->len, add->x, add->len,
io_msg_buf, io_msg_buf, tag_buf, expected_tag_len), 0);
- ASSERT_COMPARE(io_msg_buf, msg->len, result->x, msg->len);
- ASSERT_COMPARE(tag_buf, expected_tag_len, expected_tag, expected_tag_len);
+ TEST_MEMORY_COMPARE(io_msg_buf, msg->len, result->x, msg->len);
+ TEST_MEMORY_COMPARE(tag_buf, expected_tag_len, expected_tag, expected_tag_len);
/* Prepare data_t structures for multipart testing */
const data_t encrypted_expected = { .x = result->x,
@@ -246,10 +246,10 @@
TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, msg->len, 0));
- ASSERT_ALLOC(output, msg->len);
+ TEST_CALLOC(output, msg->len);
TEST_EQUAL(0, mbedtls_ccm_update(&ctx, msg->x, msg->len, output, msg->len, &olen));
TEST_EQUAL(result->len, olen);
- ASSERT_COMPARE(output, olen, result->x, result->len);
+ TEST_MEMORY_COMPARE(output, olen, result->x, result->len);
TEST_EQUAL(0, mbedtls_ccm_finish(&ctx, NULL, 0));
exit:
@@ -272,7 +272,7 @@
/* Prepare input/output message buffer */
uint8_t *io_msg_buf = NULL;
- ASSERT_ALLOC(io_msg_buf, expected_msg_len);
+ TEST_CALLOC(io_msg_buf, expected_msg_len);
if (expected_msg_len) {
memcpy(io_msg_buf, msg->x, expected_msg_len);
}
@@ -285,7 +285,7 @@
result);
if (result == 0) {
- ASSERT_COMPARE(io_msg_buf, expected_msg_len, expected_msg->x, expected_msg_len);
+ TEST_MEMORY_COMPARE(io_msg_buf, expected_msg_len, expected_msg->x, expected_msg_len);
/* Prepare data_t structures for multipart testing */
const data_t encrypted = { .x = msg->x,
@@ -344,16 +344,16 @@
}
/* Prepare input/output message buffer */
- ASSERT_ALLOC(io_msg_buf, msg->len);
+ TEST_CALLOC(io_msg_buf, msg->len);
if (msg->len) {
memcpy(io_msg_buf, msg->x, msg->len);
}
/* Prepare tag buffer */
if (expected_tag_len == 0) {
- ASSERT_ALLOC(tag_buf, 16);
+ TEST_CALLOC(tag_buf, 16);
} else {
- ASSERT_ALLOC(tag_buf, expected_tag_len);
+ TEST_CALLOC(tag_buf, expected_tag_len);
}
/* Calculate iv */
@@ -372,8 +372,8 @@
add->x, add->len, io_msg_buf,
io_msg_buf, tag_buf, expected_tag_len), output_ret);
- ASSERT_COMPARE(io_msg_buf, msg->len, expected_result->x, msg->len);
- ASSERT_COMPARE(tag_buf, expected_tag_len, expected_tag, expected_tag_len);
+ TEST_MEMORY_COMPARE(io_msg_buf, msg->len, expected_result->x, msg->len);
+ TEST_MEMORY_COMPARE(tag_buf, expected_tag_len, expected_tag, expected_tag_len);
if (output_ret == 0) {
const data_t iv_data = { .x = iv,
@@ -429,7 +429,7 @@
/* Prepare input/output message buffer */
uint8_t *io_msg_buf = NULL;
- ASSERT_ALLOC(io_msg_buf, expected_msg_len);
+ TEST_CALLOC(io_msg_buf, expected_msg_len);
if (expected_msg_len) {
memcpy(io_msg_buf, msg->x, expected_msg_len);
}
@@ -450,7 +450,7 @@
add->x, add->len, io_msg_buf, io_msg_buf,
expected_tag, expected_tag_len), output_ret);
- ASSERT_COMPARE(io_msg_buf, expected_msg_len, expected_result->x, expected_msg_len);
+ TEST_MEMORY_COMPARE(io_msg_buf, expected_msg_len, expected_result->x, expected_msg_len);
if (output_ret == 0) {
const data_t iv_data = { .x = iv,
@@ -500,17 +500,17 @@
TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, msg->len, tag->len));
- ASSERT_ALLOC(output, result->len);
+ TEST_CALLOC(output, result->len);
olen = 0xdeadbeef;
TEST_EQUAL(0, mbedtls_ccm_update(&ctx, msg->x, msg->len, output, result->len, &olen));
TEST_EQUAL(result->len, olen);
- ASSERT_COMPARE(output, olen, result->x, result->len);
+ TEST_MEMORY_COMPARE(output, olen, result->x, result->len);
mbedtls_free(output);
output = NULL;
- ASSERT_ALLOC(output, tag->len);
+ TEST_CALLOC(output, tag->len);
TEST_EQUAL(0, mbedtls_ccm_finish(&ctx, output, tag->len));
- ASSERT_COMPARE(output, tag->len, tag->x, tag->len);
+ TEST_MEMORY_COMPARE(output, tag->len, tag->x, tag->len);
mbedtls_free(output);
output = NULL;
@@ -536,9 +536,9 @@
TEST_EQUAL(0, mbedtls_ccm_update_ad(&ctx, add->x, add->len));
- ASSERT_ALLOC(output, tag->len);
+ TEST_CALLOC(output, tag->len);
TEST_EQUAL(0, mbedtls_ccm_finish(&ctx, output, tag->len));
- ASSERT_COMPARE(output, tag->len, tag->x, tag->len);
+ TEST_MEMORY_COMPARE(output, tag->len, tag->x, tag->len);
mbedtls_free(output);
output = NULL;
@@ -607,7 +607,7 @@
TEST_EQUAL(0, mbedtls_ccm_update_ad(&ctx, add->x, add->len));
- ASSERT_ALLOC(output, msg->len);
+ TEST_CALLOC(output, msg->len);
olen = 0xdeadbeef;
TEST_EQUAL(MBEDTLS_ERR_CCM_BAD_INPUT,
mbedtls_ccm_update(&ctx, msg->x, msg->len, output, msg->len, &olen));
@@ -633,7 +633,7 @@
TEST_EQUAL(0, mbedtls_ccm_update_ad(&ctx, add->x, add->len - 1));
- ASSERT_ALLOC(output, 16);
+ TEST_CALLOC(output, 16);
TEST_EQUAL(MBEDTLS_ERR_CCM_BAD_INPUT, mbedtls_ccm_finish(&ctx, output, 16));
exit:
@@ -713,7 +713,7 @@
TEST_EQUAL(0, mbedtls_ccm_update_ad(&ctx, add->x, add->len));
- ASSERT_ALLOC(output, msg->len);
+ TEST_CALLOC(output, msg->len);
TEST_EQUAL(MBEDTLS_ERR_CCM_BAD_INPUT, \
mbedtls_ccm_update(&ctx, msg->x, msg->len, output, msg->len, &olen));
exit:
@@ -740,13 +740,13 @@
TEST_EQUAL(0, mbedtls_ccm_update_ad(&ctx, add->x, add->len));
- ASSERT_ALLOC(output, msg->len);
+ TEST_CALLOC(output, msg->len);
olen = 0xdeadbeef;
TEST_EQUAL(0, mbedtls_ccm_update(&ctx, msg->x, msg->len - 1, output, msg->len, &olen));
mbedtls_free(output);
output = NULL;
- ASSERT_ALLOC(output, 16);
+ TEST_CALLOC(output, 16);
TEST_EQUAL(MBEDTLS_ERR_CCM_BAD_INPUT, mbedtls_ccm_finish(&ctx, output, 16));
exit:
@@ -774,7 +774,7 @@
TEST_EQUAL(0, mbedtls_ccm_update_ad(&ctx, add->x, add->len));
- ASSERT_ALLOC(output, msg->len);
+ TEST_CALLOC(output, msg->len);
// pass full text
TEST_EQUAL(0, mbedtls_ccm_update(&ctx, msg->x, msg->len, output, msg->len, &olen));
// pass 1 extra byte
@@ -809,7 +809,7 @@
TEST_EQUAL(0, mbedtls_ccm_update_ad(&ctx, add->x, add->len));
- ASSERT_ALLOC(output, msg->len + 1);
+ TEST_CALLOC(output, msg->len + 1);
// pass incomplete text
TEST_EQUAL(0, mbedtls_ccm_update(&ctx, msg->x, msg->len - 1, output, msg->len + 1, &olen));
// pass 2 extra bytes (1 missing byte from previous incomplete pass, and 1 unexpected byte)
@@ -836,7 +836,7 @@
// They are not a part of this test
TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 16, 16, 16));
- ASSERT_ALLOC(output, 16);
+ TEST_CALLOC(output, 16);
TEST_EQUAL(MBEDTLS_ERR_CCM_BAD_INPUT, mbedtls_ccm_finish(&ctx, output, 16));
exit:
diff --git a/tests/suites/test_suite_chacha20.function b/tests/suites/test_suite_chacha20.function
index 1a7e676..d6b67e1 100644
--- a/tests/suites/test_suite_chacha20.function
+++ b/tests/suites/test_suite_chacha20.function
@@ -29,8 +29,8 @@
TEST_ASSERT(mbedtls_chacha20_crypt(key_str->x, nonce_str->x, counter, src_str->len, src_str->x,
output) == 0);
- ASSERT_COMPARE(output, expected_output_str->len,
- expected_output_str->x, expected_output_str->len);
+ TEST_MEMORY_COMPARE(output, expected_output_str->len,
+ expected_output_str->x, expected_output_str->len);
/*
* Test the streaming API
@@ -44,8 +44,8 @@
memset(output, 0x00, sizeof(output));
TEST_ASSERT(mbedtls_chacha20_update(&ctx, src_str->len, src_str->x, output) == 0);
- ASSERT_COMPARE(output, expected_output_str->len,
- expected_output_str->x, expected_output_str->len);
+ TEST_MEMORY_COMPARE(output, expected_output_str->len,
+ expected_output_str->x, expected_output_str->len);
/*
* Test the streaming API again, piecewise
@@ -60,8 +60,8 @@
TEST_ASSERT(mbedtls_chacha20_update(&ctx, src_str->len - 1,
src_str->x + 1, output + 1) == 0);
- ASSERT_COMPARE(output, expected_output_str->len,
- expected_output_str->x, expected_output_str->len);
+ TEST_MEMORY_COMPARE(output, expected_output_str->len,
+ expected_output_str->x, expected_output_str->len);
mbedtls_chacha20_free(&ctx);
}
diff --git a/tests/suites/test_suite_cipher.function b/tests/suites/test_suite_cipher.function
index aa2849b..40907ad 100644
--- a/tests/suites/test_suite_cipher.function
+++ b/tests/suites/test_suite_cipher.function
@@ -583,7 +583,7 @@
iv_len = 12;
}
- ASSERT_ALLOC(iv, iv_len);
+ TEST_CALLOC(iv, iv_len);
memset(iv, 0, iv_len);
TEST_ASSERT(sizeof(key) * 8 >= mbedtls_cipher_info_get_key_bitlen(cipher_info));
@@ -905,7 +905,7 @@
* (we need the tag appended to the ciphertext)
*/
cipher_plus_tag_len = cipher->len + tag->len;
- ASSERT_ALLOC(cipher_plus_tag, cipher_plus_tag_len);
+ TEST_CALLOC(cipher_plus_tag, cipher_plus_tag_len);
memcpy(cipher_plus_tag, cipher->x, cipher->len);
memcpy(cipher_plus_tag + cipher->len, tag->x, tag->len);
@@ -923,7 +923,7 @@
* Try decrypting to a buffer that's 1B too small
*/
if (decrypt_buf_len != 0) {
- ASSERT_ALLOC(decrypt_buf, decrypt_buf_len - 1);
+ TEST_CALLOC(decrypt_buf, decrypt_buf_len - 1);
outlen = 0;
ret = mbedtls_cipher_auth_decrypt_ext(&ctx, iv->x, iv->len,
@@ -938,7 +938,7 @@
/*
* Authenticate and decrypt, and check result
*/
- ASSERT_ALLOC(decrypt_buf, decrypt_buf_len);
+ TEST_CALLOC(decrypt_buf, decrypt_buf_len);
outlen = 0;
ret = mbedtls_cipher_auth_decrypt_ext(&ctx, iv->x, iv->len,
@@ -950,7 +950,7 @@
TEST_ASSERT(buffer_is_all_zero(decrypt_buf, decrypt_buf_len));
} else {
TEST_ASSERT(ret == 0);
- ASSERT_COMPARE(decrypt_buf, outlen, clear->x, clear->len);
+ TEST_MEMORY_COMPARE(decrypt_buf, outlen, clear->x, clear->len);
}
mbedtls_free(decrypt_buf);
@@ -981,7 +981,7 @@
/*
* Try encrypting with an output buffer that's 1B too small
*/
- ASSERT_ALLOC(encrypt_buf, encrypt_buf_len - 1);
+ TEST_CALLOC(encrypt_buf, encrypt_buf_len - 1);
outlen = 0;
ret = mbedtls_cipher_auth_encrypt_ext(&ctx, iv->x, iv->len,
@@ -995,7 +995,7 @@
/*
* Encrypt and check the result
*/
- ASSERT_ALLOC(encrypt_buf, encrypt_buf_len);
+ TEST_CALLOC(encrypt_buf, encrypt_buf_len);
outlen = 0;
ret = mbedtls_cipher_auth_encrypt_ext(&ctx, iv->x, iv->len,
diff --git a/tests/suites/test_suite_common.function b/tests/suites/test_suite_common.function
index dd0b2d5..a583e46 100644
--- a/tests/suites/test_suite_common.function
+++ b/tests/suites/test_suite_common.function
@@ -17,10 +17,10 @@
{
size_t n = (size_t) len;
unsigned char *a = NULL, *b = NULL, *r1 = NULL, *r2 = NULL;
- ASSERT_ALLOC(a, n + 1);
- ASSERT_ALLOC(b, n + 1);
- ASSERT_ALLOC(r1, n + 1);
- ASSERT_ALLOC(r2, n + 1);
+ TEST_CALLOC(a, n + 1);
+ TEST_CALLOC(b, n + 1);
+ TEST_CALLOC(r1, n + 1);
+ TEST_CALLOC(r2, n + 1);
/* Test non-overlapping */
fill_arrays(a, b, r1, r2, n);
@@ -28,7 +28,7 @@
r1[i] = a[i] ^ b[i];
}
mbedtls_xor(r2, a, b, n);
- ASSERT_COMPARE(r1, n, r2, n);
+ TEST_MEMORY_COMPARE(r1, n, r2, n);
/* Test r == a */
fill_arrays(a, b, r1, r2, n);
@@ -36,7 +36,7 @@
r1[i] = r1[i] ^ b[i];
}
mbedtls_xor(r2, r2, b, n);
- ASSERT_COMPARE(r1, n, r2, n);
+ TEST_MEMORY_COMPARE(r1, n, r2, n);
/* Test r == b */
fill_arrays(a, b, r1, r2, n);
@@ -44,7 +44,7 @@
r1[i] = a[i] ^ r1[i];
}
mbedtls_xor(r2, a, r2, n);
- ASSERT_COMPARE(r1, n, r2, n);
+ TEST_MEMORY_COMPARE(r1, n, r2, n);
/* Test a == b */
fill_arrays(a, b, r1, r2, n);
@@ -52,7 +52,7 @@
r1[i] = a[i] ^ a[i];
}
mbedtls_xor(r2, a, a, n);
- ASSERT_COMPARE(r1, n, r2, n);
+ TEST_MEMORY_COMPARE(r1, n, r2, n);
/* Test a == b == r */
fill_arrays(a, b, r1, r2, n);
@@ -60,7 +60,7 @@
r1[i] = r1[i] ^ r1[i];
}
mbedtls_xor(r2, r2, r2, n);
- ASSERT_COMPARE(r1, n, r2, n);
+ TEST_MEMORY_COMPARE(r1, n, r2, n);
/* Test non-word-aligned buffers, for all combinations of alignedness */
for (int i = 0; i < 7; i++) {
@@ -71,7 +71,7 @@
r1[j + r_off] = a[j + a_off] ^ b[j + b_off];
}
mbedtls_xor(r2 + r_off, a + a_off, b + b_off, n);
- ASSERT_COMPARE(r1 + r_off, n, r2 + r_off, n);
+ TEST_MEMORY_COMPARE(r1 + r_off, n, r2 + r_off, n);
}
exit:
mbedtls_free(a);
diff --git a/tests/suites/test_suite_constant_time.data b/tests/suites/test_suite_constant_time.data
index 91a25fa..1b0b964 100644
--- a/tests/suites/test_suite_constant_time.data
+++ b/tests/suites/test_suite_constant_time.data
@@ -1,14 +1,14 @@
# these are the numbers we'd get with an empty plaintext and truncated HMAC
Constant-flow memcpy from offset: small
-ssl_cf_memcpy_offset:0:5:10
+mbedtls_ct_memcpy_offset:0:5:10
# we could get this with 255-bytes plaintext and untruncated SHA-256
Constant-flow memcpy from offset: medium
-ssl_cf_memcpy_offset:0:255:32
+mbedtls_ct_memcpy_offset:0:255:32
# we could get this with 255-bytes plaintext and untruncated SHA-384
Constant-flow memcpy from offset: large
-ssl_cf_memcpy_offset:100:339:48
+mbedtls_ct_memcpy_offset:100:339:48
mbedtls_ct_memcmp NULL
mbedtls_ct_memcmp_null
@@ -91,47 +91,611 @@
mbedtls_ct_memcmp len 17 offset 3
mbedtls_ct_memcmp:-1:17:3
-mbedtls_ct_memcpy_if_eq len 1 offset 0
-mbedtls_ct_memcpy_if_eq:1:1:0
+mbedtls_ct_memcpy_if len 1 offset 0
+mbedtls_ct_memcpy_if:1:1:0
-mbedtls_ct_memcpy_if_eq len 1 offset 1
-mbedtls_ct_memcpy_if_eq:1:1:1
+mbedtls_ct_memcpy_if len 1 offset 1
+mbedtls_ct_memcpy_if:1:1:1
-mbedtls_ct_memcpy_if_eq len 4 offset 0
-mbedtls_ct_memcpy_if_eq:1:1:0
+mbedtls_ct_memcpy_if len 4 offset 0
+mbedtls_ct_memcpy_if:1:1:0
-mbedtls_ct_memcpy_if_eq len 4 offset 1
-mbedtls_ct_memcpy_if_eq:1:1:1
+mbedtls_ct_memcpy_if len 4 offset 1
+mbedtls_ct_memcpy_if:1:1:1
-mbedtls_ct_memcpy_if_eq len 4 offset 2
-mbedtls_ct_memcpy_if_eq:1:1:2
+mbedtls_ct_memcpy_if len 4 offset 2
+mbedtls_ct_memcpy_if:1:1:2
-mbedtls_ct_memcpy_if_eq len 4 offset 3
-mbedtls_ct_memcpy_if_eq:1:1:3
+mbedtls_ct_memcpy_if len 4 offset 3
+mbedtls_ct_memcpy_if:1:1:3
-mbedtls_ct_memcpy_if_eq len 15 offset 0
-mbedtls_ct_memcpy_if_eq:1:15:0
+mbedtls_ct_memcpy_if len 15 offset 0
+mbedtls_ct_memcpy_if:1:15:0
-mbedtls_ct_memcpy_if_eq len 15 offset 1
-mbedtls_ct_memcpy_if_eq:1:15:1
+mbedtls_ct_memcpy_if len 15 offset 1
+mbedtls_ct_memcpy_if:1:15:1
-mbedtls_ct_memcpy_if_eq len 16 offset 0
-mbedtls_ct_memcpy_if_eq:1:16:0
+mbedtls_ct_memcpy_if len 16 offset 0
+mbedtls_ct_memcpy_if:1:16:0
-mbedtls_ct_memcpy_if_eq len 16 offset 1
-mbedtls_ct_memcpy_if_eq:1:16:1
+mbedtls_ct_memcpy_if len 16 offset 1
+mbedtls_ct_memcpy_if:1:16:1
-mbedtls_ct_memcpy_if_eq len 17 offset 0
-mbedtls_ct_memcpy_if_eq:1:17:0
+mbedtls_ct_memcpy_if len 17 offset 0
+mbedtls_ct_memcpy_if:1:17:0
-mbedtls_ct_memcpy_if_eq len 17 offset 1
-mbedtls_ct_memcpy_if_eq:1:17:1
+mbedtls_ct_memcpy_if len 17 offset 1
+mbedtls_ct_memcpy_if:1:17:1
-mbedtls_ct_memcpy_if_eq len 0 not eq
-mbedtls_ct_memcpy_if_eq:0:17:0
+mbedtls_ct_memcpy_if len 0 not eq
+mbedtls_ct_memcpy_if:0:17:0
-mbedtls_ct_memcpy_if_eq len 5 offset 1 not eq
-mbedtls_ct_memcpy_if_eq:0:5:1
+mbedtls_ct_memcpy_if len 5 offset 1 not eq
+mbedtls_ct_memcpy_if:0:5:1
-mbedtls_ct_memcpy_if_eq len 17 offset 3 not eq
-mbedtls_ct_memcpy_if_eq:0:17:3
+mbedtls_ct_memcpy_if len 17 offset 3 not eq
+mbedtls_ct_memcpy_if:0:17:3
+
+mbedtls_ct_bool 0
+mbedtls_ct_bool:"0x0"
+
+mbedtls_ct_bool 1
+mbedtls_ct_bool:"0x1"
+
+mbedtls_ct_bool 4
+mbedtls_ct_bool:"0x4"
+
+mbedtls_ct_bool 0xfffffff
+mbedtls_ct_bool:"0xfffffff"
+
+mbedtls_ct_bool 0x7fffffff
+mbedtls_ct_bool:"0x7fffffff"
+
+mbedtls_ct_bool 0xfffffffe
+mbedtls_ct_bool:"0xfffffffe"
+
+mbedtls_ct_bool 0xffffffff
+mbedtls_ct_bool:"0xffffffff"
+
+mbedtls_ct_bool 0x0fffffffffffffff
+mbedtls_ct_bool:"0x0fffffffffffffff"
+
+mbedtls_ct_bool 0x7fffffffffffffff
+mbedtls_ct_bool:"0x7fffffffffffffff"
+
+mbedtls_ct_bool 0xffffffffffffffff
+mbedtls_ct_bool:"0xffffffffffffffff"
+
+mbedtls_ct_bool_xxx 0x0 0x0
+mbedtls_ct_bool_xxx:"0x0":"0x0"
+
+mbedtls_ct_bool_xxx 0x0 0x1
+mbedtls_ct_bool_xxx:"0x0":"0x1"
+
+mbedtls_ct_bool_xxx 0x0 0x7fffffff
+mbedtls_ct_bool_xxx:"0x0":"0x7fffffff"
+
+mbedtls_ct_bool_xxx 0x0 0xffffffff
+mbedtls_ct_bool_xxx:"0x0":"0xffffffff"
+
+mbedtls_ct_bool_xxx 0x0 0x7fffffffffffffff
+mbedtls_ct_bool_xxx:"0x0":"0x7fffffffffffffff"
+
+mbedtls_ct_bool_xxx 0x0 0xffffffffffffffff
+mbedtls_ct_bool_xxx:"0x0":"0xffffffffffffffff"
+
+mbedtls_ct_bool_xxx 0x1 0x0
+mbedtls_ct_bool_xxx:"0x1":"0x0"
+
+mbedtls_ct_bool_xxx 0x1 0x1
+mbedtls_ct_bool_xxx:"0x1":"0x1"
+
+mbedtls_ct_bool_xxx 0x1 0x7fffffff
+mbedtls_ct_bool_xxx:"0x1":"0x7fffffff"
+
+mbedtls_ct_bool_xxx 0x1 0xffffffff
+mbedtls_ct_bool_xxx:"0x1":"0xffffffff"
+
+mbedtls_ct_bool_xxx 0x1 0x7fffffffffffffff
+mbedtls_ct_bool_xxx:"0x1":"0x7fffffffffffffff"
+
+mbedtls_ct_bool_xxx 0x1 0xffffffffffffffff
+mbedtls_ct_bool_xxx:"0x1":"0xffffffffffffffff"
+
+mbedtls_ct_bool_xxx 0x7fffffff 0x0
+mbedtls_ct_bool_xxx:"0x7fffffff":"0x0"
+
+mbedtls_ct_bool_xxx 0x7fffffff 0x1
+mbedtls_ct_bool_xxx:"0x7fffffff":"0x1"
+
+mbedtls_ct_bool_xxx 0x7fffffff 0x7fffffff
+mbedtls_ct_bool_xxx:"0x7fffffff":"0x7fffffff"
+
+mbedtls_ct_bool_xxx 0x7fffffff 0xffffffff
+mbedtls_ct_bool_xxx:"0x7fffffff":"0xffffffff"
+
+mbedtls_ct_bool_xxx 0x7fffffff 0x7fffffffffffffff
+mbedtls_ct_bool_xxx:"0x7fffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_bool_xxx 0x7fffffff 0xffffffffffffffff
+mbedtls_ct_bool_xxx:"0x7fffffff":"0xffffffffffffffff"
+
+mbedtls_ct_bool_xxx 0xffffffff 0x0
+mbedtls_ct_bool_xxx:"0xffffffff":"0x0"
+
+mbedtls_ct_bool_xxx 0xffffffff 0x1
+mbedtls_ct_bool_xxx:"0xffffffff":"0x1"
+
+mbedtls_ct_bool_xxx 0xffffffff 0x7fffffff
+mbedtls_ct_bool_xxx:"0xffffffff":"0x7fffffff"
+
+mbedtls_ct_bool_xxx 0xffffffff 0xffffffff
+mbedtls_ct_bool_xxx:"0xffffffff":"0xffffffff"
+
+mbedtls_ct_bool_xxx 0xffffffff 0x7fffffffffffffff
+mbedtls_ct_bool_xxx:"0xffffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_bool_xxx 0xffffffff 0xffffffffffffffff
+mbedtls_ct_bool_xxx:"0xffffffff":"0xffffffffffffffff"
+
+mbedtls_ct_bool_xxx 0x7fffffffffffffff 0x0
+mbedtls_ct_bool_xxx:"0x7fffffffffffffff":"0x0"
+
+mbedtls_ct_bool_xxx 0x7fffffffffffffff 0x1
+mbedtls_ct_bool_xxx:"0x7fffffffffffffff":"0x1"
+
+mbedtls_ct_bool_xxx 0x7fffffffffffffff 0x7fffffff
+mbedtls_ct_bool_xxx:"0x7fffffffffffffff":"0x7fffffff"
+
+mbedtls_ct_bool_xxx 0x7fffffffffffffff 0xffffffff
+mbedtls_ct_bool_xxx:"0x7fffffffffffffff":"0xffffffff"
+
+mbedtls_ct_bool_xxx 0x7fffffffffffffff 0x7fffffffffffffff
+mbedtls_ct_bool_xxx:"0x7fffffffffffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_bool_xxx 0x7fffffffffffffff 0xffffffffffffffff
+mbedtls_ct_bool_xxx:"0x7fffffffffffffff":"0xffffffffffffffff"
+
+mbedtls_ct_bool_xxx 0xffffffffffffffff 0x0
+mbedtls_ct_bool_xxx:"0xffffffffffffffff":"0x0"
+
+mbedtls_ct_bool_xxx 0xffffffffffffffff 0x1
+mbedtls_ct_bool_xxx:"0xffffffffffffffff":"0x1"
+
+mbedtls_ct_bool_xxx 0xffffffffffffffff 0x7fffffff
+mbedtls_ct_bool_xxx:"0xffffffffffffffff":"0x7fffffff"
+
+mbedtls_ct_bool_xxx 0xffffffffffffffff 0xffffffff
+mbedtls_ct_bool_xxx:"0xffffffffffffffff":"0xffffffff"
+
+mbedtls_ct_bool_xxx 0xffffffffffffffff 0x7fffffffffffffff
+mbedtls_ct_bool_xxx:"0xffffffffffffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_bool_xxx 0xffffffffffffffff 0xffffffffffffffff
+mbedtls_ct_bool_xxx:"0xffffffffffffffff":"0xffffffffffffffff"
+
+mbedtls_ct_bool_xxx 138 256
+mbedtls_ct_bool_xxx:"138":"256"
+
+mbedtls_ct_bool_xxx 256 138
+mbedtls_ct_bool_xxx:"256":"138"
+
+mbedtls_ct_bool_xxx 6 6
+mbedtls_ct_bool_xxx:"0x6":"0x6"
+
+mbedtls_ct_uchar_in_range_if 0 0 0
+mbedtls_ct_uchar_in_range_if:0:0:0
+
+mbedtls_ct_uchar_in_range_if 0 0 100
+mbedtls_ct_uchar_in_range_if:0:0:100
+
+mbedtls_ct_uchar_in_range_if 0 0 255
+mbedtls_ct_uchar_in_range_if:0:0:255
+
+mbedtls_ct_uchar_in_range_if 0 65 0
+mbedtls_ct_uchar_in_range_if:0:65:0
+
+mbedtls_ct_uchar_in_range_if 0 65 100
+mbedtls_ct_uchar_in_range_if:0:65:100
+
+mbedtls_ct_uchar_in_range_if 0 65 255
+mbedtls_ct_uchar_in_range_if:0:65:255
+
+mbedtls_ct_uchar_in_range_if 0 90 0
+mbedtls_ct_uchar_in_range_if:0:90:0
+
+mbedtls_ct_uchar_in_range_if 0 90 100
+mbedtls_ct_uchar_in_range_if:0:90:100
+
+mbedtls_ct_uchar_in_range_if 0 90 255
+mbedtls_ct_uchar_in_range_if:0:90:255
+
+mbedtls_ct_uchar_in_range_if 0 255 0
+mbedtls_ct_uchar_in_range_if:0:255:0
+
+mbedtls_ct_uchar_in_range_if 0 255 100
+mbedtls_ct_uchar_in_range_if:0:255:100
+
+mbedtls_ct_uchar_in_range_if 0 255 255
+mbedtls_ct_uchar_in_range_if:0:255:255
+
+mbedtls_ct_uchar_in_range_if 65 0 0
+mbedtls_ct_uchar_in_range_if:65:0:0
+
+mbedtls_ct_uchar_in_range_if 65 0 100
+mbedtls_ct_uchar_in_range_if:65:0:100
+
+mbedtls_ct_uchar_in_range_if 65 0 255
+mbedtls_ct_uchar_in_range_if:65:0:255
+
+mbedtls_ct_uchar_in_range_if 65 65 0
+mbedtls_ct_uchar_in_range_if:65:65:0
+
+mbedtls_ct_uchar_in_range_if 65 65 100
+mbedtls_ct_uchar_in_range_if:65:65:100
+
+mbedtls_ct_uchar_in_range_if 65 65 255
+mbedtls_ct_uchar_in_range_if:65:65:255
+
+mbedtls_ct_uchar_in_range_if 65 90 0
+mbedtls_ct_uchar_in_range_if:65:90:0
+
+mbedtls_ct_uchar_in_range_if 65 90 100
+mbedtls_ct_uchar_in_range_if:65:90:100
+
+mbedtls_ct_uchar_in_range_if 65 90 255
+mbedtls_ct_uchar_in_range_if:65:90:255
+
+mbedtls_ct_uchar_in_range_if 65 255 0
+mbedtls_ct_uchar_in_range_if:65:255:0
+
+mbedtls_ct_uchar_in_range_if 65 255 100
+mbedtls_ct_uchar_in_range_if:65:255:100
+
+mbedtls_ct_uchar_in_range_if 65 255 255
+mbedtls_ct_uchar_in_range_if:65:255:255
+
+mbedtls_ct_uchar_in_range_if 90 0 0
+mbedtls_ct_uchar_in_range_if:90:0:0
+
+mbedtls_ct_uchar_in_range_if 90 0 100
+mbedtls_ct_uchar_in_range_if:90:0:100
+
+mbedtls_ct_uchar_in_range_if 90 0 255
+mbedtls_ct_uchar_in_range_if:90:0:255
+
+mbedtls_ct_uchar_in_range_if 90 65 0
+mbedtls_ct_uchar_in_range_if:90:65:0
+
+mbedtls_ct_uchar_in_range_if 90 65 100
+mbedtls_ct_uchar_in_range_if:90:65:100
+
+mbedtls_ct_uchar_in_range_if 90 65 255
+mbedtls_ct_uchar_in_range_if:90:65:255
+
+mbedtls_ct_uchar_in_range_if 90 90 0
+mbedtls_ct_uchar_in_range_if:90:90:0
+
+mbedtls_ct_uchar_in_range_if 90 90 100
+mbedtls_ct_uchar_in_range_if:90:90:100
+
+mbedtls_ct_uchar_in_range_if 90 90 255
+mbedtls_ct_uchar_in_range_if:90:90:255
+
+mbedtls_ct_uchar_in_range_if 90 255 0
+mbedtls_ct_uchar_in_range_if:90:255:0
+
+mbedtls_ct_uchar_in_range_if 90 255 100
+mbedtls_ct_uchar_in_range_if:90:255:100
+
+mbedtls_ct_uchar_in_range_if 90 255 255
+mbedtls_ct_uchar_in_range_if:90:255:255
+
+mbedtls_ct_uchar_in_range_if 255 0 0
+mbedtls_ct_uchar_in_range_if:255:0:0
+
+mbedtls_ct_uchar_in_range_if 255 0 100
+mbedtls_ct_uchar_in_range_if:255:0:100
+
+mbedtls_ct_uchar_in_range_if 255 0 255
+mbedtls_ct_uchar_in_range_if:255:0:255
+
+mbedtls_ct_uchar_in_range_if 255 65 0
+mbedtls_ct_uchar_in_range_if:255:65:0
+
+mbedtls_ct_uchar_in_range_if 255 65 100
+mbedtls_ct_uchar_in_range_if:255:65:100
+
+mbedtls_ct_uchar_in_range_if 255 65 255
+mbedtls_ct_uchar_in_range_if:255:65:255
+
+mbedtls_ct_uchar_in_range_if 255 90 0
+mbedtls_ct_uchar_in_range_if:255:90:0
+
+mbedtls_ct_uchar_in_range_if 255 90 100
+mbedtls_ct_uchar_in_range_if:255:90:100
+
+mbedtls_ct_uchar_in_range_if 255 90 255
+mbedtls_ct_uchar_in_range_if:255:90:255
+
+mbedtls_ct_uchar_in_range_if 255 255 0
+mbedtls_ct_uchar_in_range_if:255:255:0
+
+mbedtls_ct_uchar_in_range_if 255 255 100
+mbedtls_ct_uchar_in_range_if:255:255:100
+
+mbedtls_ct_uchar_in_range_if 255 255 255
+mbedtls_ct_uchar_in_range_if:255:255:255
+
+mbedtls_ct_if 0x0 0x0 0x0
+mbedtls_ct_if:"0x0":"0x0":"0x0"
+
+mbedtls_ct_if 0x0 0x0 0x1
+mbedtls_ct_if:"0x0":"0x0":"0x1"
+
+mbedtls_ct_if 0x0 0x0 0x7fffffff
+mbedtls_ct_if:"0x0":"0x0":"0x7fffffff"
+
+mbedtls_ct_if 0x0 0x0 0xffffffff
+mbedtls_ct_if:"0x0":"0x0":"0xffffffff"
+
+mbedtls_ct_if 0x0 0x0 0x7fffffffffffffff
+mbedtls_ct_if:"0x0":"0x0":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0x0 0x0 0xffffffffffffffff
+mbedtls_ct_if:"0x0":"0x0":"0xffffffffffffffff"
+
+mbedtls_ct_if 0x0 0x1 0x0
+mbedtls_ct_if:"0x0":"0x1":"0x0"
+
+mbedtls_ct_if 0x0 0x1 0x1
+mbedtls_ct_if:"0x0":"0x1":"0x1"
+
+mbedtls_ct_if 0x0 0x1 0x7fffffff
+mbedtls_ct_if:"0x0":"0x1":"0x7fffffff"
+
+mbedtls_ct_if 0x0 0x1 0xffffffff
+mbedtls_ct_if:"0x0":"0x1":"0xffffffff"
+
+mbedtls_ct_if 0x0 0x1 0x7fffffffffffffff
+mbedtls_ct_if:"0x0":"0x1":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0x0 0x1 0xffffffffffffffff
+mbedtls_ct_if:"0x0":"0x1":"0xffffffffffffffff"
+
+mbedtls_ct_if 0x0 0x7fffffff 0x0
+mbedtls_ct_if:"0x0":"0x7fffffff":"0x0"
+
+mbedtls_ct_if 0x0 0x7fffffff 0x1
+mbedtls_ct_if:"0x0":"0x7fffffff":"0x1"
+
+mbedtls_ct_if 0x0 0x7fffffff 0x7fffffff
+mbedtls_ct_if:"0x0":"0x7fffffff":"0x7fffffff"
+
+mbedtls_ct_if 0x0 0x7fffffff 0xffffffff
+mbedtls_ct_if:"0x0":"0x7fffffff":"0xffffffff"
+
+mbedtls_ct_if 0x0 0x7fffffff 0x7fffffffffffffff
+mbedtls_ct_if:"0x0":"0x7fffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0x0 0x7fffffff 0xffffffffffffffff
+mbedtls_ct_if:"0x0":"0x7fffffff":"0xffffffffffffffff"
+
+mbedtls_ct_if 0x0 0xffffffff 0x0
+mbedtls_ct_if:"0x0":"0xffffffff":"0x0"
+
+mbedtls_ct_if 0x0 0xffffffff 0x1
+mbedtls_ct_if:"0x0":"0xffffffff":"0x1"
+
+mbedtls_ct_if 0x0 0xffffffff 0x7fffffff
+mbedtls_ct_if:"0x0":"0xffffffff":"0x7fffffff"
+
+mbedtls_ct_if 0x0 0xffffffff 0xffffffff
+mbedtls_ct_if:"0x0":"0xffffffff":"0xffffffff"
+
+mbedtls_ct_if 0x0 0xffffffff 0x7fffffffffffffff
+mbedtls_ct_if:"0x0":"0xffffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0x0 0xffffffff 0xffffffffffffffff
+mbedtls_ct_if:"0x0":"0xffffffff":"0xffffffffffffffff"
+
+mbedtls_ct_if 0x0 0x7fffffffffffffff 0x0
+mbedtls_ct_if:"0x0":"0x7fffffffffffffff":"0x0"
+
+mbedtls_ct_if 0x0 0x7fffffffffffffff 0x1
+mbedtls_ct_if:"0x0":"0x7fffffffffffffff":"0x1"
+
+mbedtls_ct_if 0x0 0x7fffffffffffffff 0x7fffffff
+mbedtls_ct_if:"0x0":"0x7fffffffffffffff":"0x7fffffff"
+
+mbedtls_ct_if 0x0 0x7fffffffffffffff 0xffffffff
+mbedtls_ct_if:"0x0":"0x7fffffffffffffff":"0xffffffff"
+
+mbedtls_ct_if 0x0 0x7fffffffffffffff 0x7fffffffffffffff
+mbedtls_ct_if:"0x0":"0x7fffffffffffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0x0 0x7fffffffffffffff 0xffffffffffffffff
+mbedtls_ct_if:"0x0":"0x7fffffffffffffff":"0xffffffffffffffff"
+
+mbedtls_ct_if 0x0 0xffffffffffffffff 0x0
+mbedtls_ct_if:"0x0":"0xffffffffffffffff":"0x0"
+
+mbedtls_ct_if 0x0 0xffffffffffffffff 0x1
+mbedtls_ct_if:"0x0":"0xffffffffffffffff":"0x1"
+
+mbedtls_ct_if 0x0 0xffffffffffffffff 0x7fffffff
+mbedtls_ct_if:"0x0":"0xffffffffffffffff":"0x7fffffff"
+
+mbedtls_ct_if 0x0 0xffffffffffffffff 0xffffffff
+mbedtls_ct_if:"0x0":"0xffffffffffffffff":"0xffffffff"
+
+mbedtls_ct_if 0x0 0xffffffffffffffff 0x7fffffffffffffff
+mbedtls_ct_if:"0x0":"0xffffffffffffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0x0 0xffffffffffffffff 0xffffffffffffffff
+mbedtls_ct_if:"0x0":"0xffffffffffffffff":"0xffffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x0 0x0
+mbedtls_ct_if:"0xffffffffffffffff":"0x0":"0x0"
+
+mbedtls_ct_if 0xffffffffffffffff 0x0 0x1
+mbedtls_ct_if:"0xffffffffffffffff":"0x0":"0x1"
+
+mbedtls_ct_if 0xffffffffffffffff 0x0 0x7fffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x0":"0x7fffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x0 0xffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x0":"0xffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x0 0x7fffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x0":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x0 0xffffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x0":"0xffffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x1 0x0
+mbedtls_ct_if:"0xffffffffffffffff":"0x1":"0x0"
+
+mbedtls_ct_if 0xffffffffffffffff 0x1 0x1
+mbedtls_ct_if:"0xffffffffffffffff":"0x1":"0x1"
+
+mbedtls_ct_if 0xffffffffffffffff 0x1 0x7fffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x1":"0x7fffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x1 0xffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x1":"0xffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x1 0x7fffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x1":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x1 0xffffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x1":"0xffffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffff 0x0
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffff":"0x0"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffff 0x1
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffff":"0x1"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffff 0x7fffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffff":"0x7fffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffff 0xffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffff":"0xffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffff 0x7fffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffff 0xffffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffff":"0xffffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffff 0x0
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffff":"0x0"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffff 0x1
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffff":"0x1"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffff 0x7fffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffff":"0x7fffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffff 0xffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffff":"0xffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffff 0x7fffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffff 0xffffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffff":"0xffffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffffffffffff 0x0
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffffffffffff":"0x0"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffffffffffff 0x1
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffffffffffff":"0x1"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffffffffffff 0x7fffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffffffffffff":"0x7fffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffffffffffff 0xffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffffffffffff":"0xffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffffffffffff 0x7fffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffffffffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0x7fffffffffffffff 0xffffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0x7fffffffffffffff":"0xffffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffffffffffff 0x0
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffffffffffff":"0x0"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffffffffffff 0x1
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffffffffffff":"0x1"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffffffffffff 0x7fffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffffffffffff":"0x7fffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffffffffffff 0xffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffffffffffff":"0xffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffffffffffff 0x7fffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffffffffffff":"0x7fffffffffffffff"
+
+mbedtls_ct_if 0xffffffffffffffff 0xffffffffffffffff 0xffffffffffffffff
+mbedtls_ct_if:"0xffffffffffffffff":"0xffffffffffffffff":"0xffffffffffffffff"
+
+mbedtls_ct_zeroize_if 0x0 0
+mbedtls_ct_zeroize_if:"0x0":0
+
+mbedtls_ct_zeroize_if 0x0 1
+mbedtls_ct_zeroize_if:"0x0":1
+
+mbedtls_ct_zeroize_if 0x0 1024
+mbedtls_ct_zeroize_if:"0x0":1024
+
+mbedtls_ct_zeroize_if 0xffffffffffffffff 0
+mbedtls_ct_zeroize_if:"0xffffffffffffffff":0
+
+mbedtls_ct_zeroize_if 0xffffffffffffffff 1
+mbedtls_ct_zeroize_if:"0xffffffffffffffff":1
+
+mbedtls_ct_zeroize_if 0xffffffffffffffff 4
+mbedtls_ct_zeroize_if:"0xffffffffffffffff":4
+
+mbedtls_ct_zeroize_if 0xffffffffffffffff 5
+mbedtls_ct_zeroize_if:"0xffffffffffffffff":5
+
+mbedtls_ct_zeroize_if 0xffffffffffffffff 7
+mbedtls_ct_zeroize_if:"0xffffffffffffffff":7
+
+mbedtls_ct_zeroize_if 0xffffffffffffffff 8
+mbedtls_ct_zeroize_if:"0xffffffffffffffff":8
+
+mbedtls_ct_zeroize_if 0xffffffffffffffff 9
+mbedtls_ct_zeroize_if:"0xffffffffffffffff":9
+
+mbedtls_ct_zeroize_if 0xffffffffffffffff 1024
+mbedtls_ct_zeroize_if:"0xffffffffffffffff":1024
+
+mbedtls_ct_memmove_left 0 0
+mbedtls_ct_memmove_left:0:0
+
+mbedtls_ct_memmove_left 1 0
+mbedtls_ct_memmove_left:1:0
+
+mbedtls_ct_memmove_left 1 1
+mbedtls_ct_memmove_left:1:1
+
+mbedtls_ct_memmove_left 16 0
+mbedtls_ct_memmove_left:16:0
+
+mbedtls_ct_memmove_left 16 1
+mbedtls_ct_memmove_left:16:1
+
+mbedtls_ct_memmove_left 16 4
+mbedtls_ct_memmove_left:16:4
+
+mbedtls_ct_memmove_left 16 15
+mbedtls_ct_memmove_left:16:15
+
+mbedtls_ct_memmove_left 16 16
+mbedtls_ct_memmove_left:16:16
diff --git a/tests/suites/test_suite_constant_time.function b/tests/suites/test_suite_constant_time.function
index a2bf396..0e2cfdc 100644
--- a/tests/suites/test_suite_constant_time.function
+++ b/tests/suites/test_suite_constant_time.function
@@ -8,9 +8,15 @@
* under MSan or Valgrind will detect a non-constant-time implementation.
*/
+#include <stdio.h>
+
+#include <limits.h>
+#include <stdlib.h>
+#include <errno.h>
+
+#include <mbedtls/bignum.h>
#include <mbedtls/constant_time.h>
#include <constant_time_internal.h>
-#include <constant_time_invasive.h>
#include <test/constant_flow.h>
/* END_HEADER */
@@ -26,14 +32,152 @@
/* END_CASE */
/* BEGIN_CASE */
+void mbedtls_ct_bool(char *input)
+{
+ mbedtls_ct_uint_t v = (mbedtls_ct_uint_t) strtoull(input, NULL, 16);
+ TEST_ASSERT(errno == 0);
+
+ mbedtls_ct_condition_t expected = (v != 0) ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_CF_SECRET(&v, sizeof(v));
+ TEST_EQUAL(mbedtls_ct_bool(v), expected);
+ TEST_CF_PUBLIC(&v, sizeof(v));
+}
+/* END_CASE */
+
+/* BEGIN_CASE */
+void mbedtls_ct_bool_xxx(char *x_str, char *y_str)
+{
+ mbedtls_ct_uint_t x = strtoull(x_str, NULL, 0);
+ mbedtls_ct_uint_t y = strtoull(y_str, NULL, 0);
+
+ mbedtls_ct_uint_t x1 = x;
+ mbedtls_ct_uint_t y1 = y;
+
+ TEST_CF_SECRET(&x, sizeof(x));
+ TEST_CF_SECRET(&y, sizeof(y));
+
+ mbedtls_ct_condition_t expected = x1 ? MBEDTLS_CT_FALSE : MBEDTLS_CT_TRUE;
+ TEST_EQUAL(mbedtls_ct_bool_not(mbedtls_ct_bool(x)), expected);
+
+ expected = x1 != y1 ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_EQUAL(mbedtls_ct_uint_ne(x, y), expected);
+
+ expected = x1 == y1 ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_EQUAL(mbedtls_ct_uint_eq(x, y), expected);
+
+ expected = x1 > y1 ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_EQUAL(mbedtls_ct_uint_gt(x, y), expected);
+
+ expected = x1 < y1 ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_EQUAL(mbedtls_ct_uint_lt(x, y), expected);
+
+ expected = x1 >= y1 ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_EQUAL(mbedtls_ct_uint_ge(x, y), expected);
+
+ expected = x1 <= y1 ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_EQUAL(mbedtls_ct_uint_le(x, y), expected);
+
+ expected = (!!x1) ^ (!!y1) ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_EQUAL(mbedtls_ct_bool_xor(mbedtls_ct_bool(x), mbedtls_ct_bool(y)), expected);
+
+ expected = (!!x1) && (!!y1) ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_EQUAL(mbedtls_ct_bool_and(mbedtls_ct_bool(x), mbedtls_ct_bool(y)), expected);
+
+ expected = (!!x1) || (!!y1) ? MBEDTLS_CT_TRUE : MBEDTLS_CT_FALSE;
+ TEST_EQUAL(mbedtls_ct_bool_or(mbedtls_ct_bool(x), mbedtls_ct_bool(y)), expected);
+
+ TEST_CF_PUBLIC(&x, sizeof(x));
+ TEST_CF_PUBLIC(&y, sizeof(y));
+}
+/* END_CASE */
+
+/* BEGIN_CASE depends_on:MBEDTLS_BASE64_C */
+void mbedtls_ct_uchar_in_range_if(int li, int hi, int ti)
+{
+ unsigned char l = li, h = hi, t = ti;
+
+ for (unsigned x = 0; x <= 255; x++) {
+ unsigned char expected = (x >= l) && (x <= h) ? t : 0;
+
+ TEST_CF_SECRET(&x, sizeof(x));
+ TEST_CF_SECRET(&l, sizeof(l));
+ TEST_CF_SECRET(&h, sizeof(h));
+ TEST_CF_SECRET(&t, sizeof(t));
+
+ TEST_EQUAL(mbedtls_ct_uchar_in_range_if(l, h, (unsigned char) x, t), expected);
+
+ TEST_CF_PUBLIC(&x, sizeof(x));
+ TEST_CF_PUBLIC(&l, sizeof(l));
+ TEST_CF_PUBLIC(&h, sizeof(h));
+ TEST_CF_PUBLIC(&t, sizeof(t));
+ }
+}
+/* END_CASE */
+
+/* BEGIN_CASE */
+void mbedtls_ct_if(char *c_str, char *t_str, char *f_str)
+{
+ mbedtls_ct_condition_t c = mbedtls_ct_bool(strtoull(c_str, NULL, 16));
+ mbedtls_ct_uint_t t = (mbedtls_ct_uint_t) strtoull(t_str, NULL, 16);
+ mbedtls_ct_uint_t f = (mbedtls_ct_uint_t) strtoull(f_str, NULL, 16);
+
+ mbedtls_ct_uint_t expected = c ? t : f;
+ mbedtls_ct_uint_t expected0 = c ? t : 0;
+
+ TEST_CF_SECRET(&c, sizeof(c));
+ TEST_CF_SECRET(&t, sizeof(t));
+ TEST_CF_SECRET(&f, sizeof(f));
+
+ TEST_EQUAL(mbedtls_ct_if(c, t, f), expected);
+ TEST_EQUAL(mbedtls_ct_size_if(c, t, f), (size_t) expected);
+ TEST_EQUAL(mbedtls_ct_uint_if(c, t, f), (unsigned) expected);
+#if defined(MBEDTLS_BIGNUM_C)
+ TEST_EQUAL(mbedtls_ct_mpi_uint_if(c, t, f), (mbedtls_mpi_uint) expected);
+#endif
+
+ TEST_EQUAL(mbedtls_ct_uint_if_else_0(c, t), (unsigned) expected0);
+ TEST_EQUAL(mbedtls_ct_size_if_else_0(c, (size_t) t), (size_t) expected0);
+#if defined(MBEDTLS_BIGNUM_C)
+ TEST_EQUAL(mbedtls_ct_mpi_uint_if_else_0(c, t), (mbedtls_mpi_uint) expected0);
+#endif
+
+ TEST_CF_PUBLIC(&c, sizeof(c));
+ TEST_CF_PUBLIC(&t, sizeof(t));
+ TEST_CF_PUBLIC(&f, sizeof(f));
+}
+/* END_CASE */
+
+/* BEGIN_CASE depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:!MBEDTLS_RSA_ALT */
+void mbedtls_ct_zeroize_if(char *c_str, int len)
+{
+ uint8_t *buf = NULL;
+ mbedtls_ct_condition_t c = mbedtls_ct_bool(strtoull(c_str, NULL, 16));
+
+ TEST_CALLOC(buf, len);
+ for (size_t i = 0; i < (size_t) len; i++) {
+ buf[i] = 1;
+ }
+
+ TEST_CF_SECRET(&c, sizeof(c));
+ TEST_CF_SECRET(buf, len);
+ mbedtls_ct_zeroize_if(c, buf, len);
+ TEST_CF_PUBLIC(&c, sizeof(c));
+ TEST_CF_PUBLIC(buf, len);
+
+ for (size_t i = 0; i < (size_t) len; i++) {
+ TEST_EQUAL(buf[i], c != 0 ? 0 : 1);
+ }
+exit:
+ mbedtls_free(buf);
+}
+/* END_CASE */
+
+/* BEGIN_CASE */
void mbedtls_ct_memcmp(int same, int size, int offset)
{
uint8_t *a = NULL, *b = NULL;
- ASSERT_ALLOC(a, size + offset);
- ASSERT_ALLOC(b, size + offset);
-
- TEST_CF_SECRET(a + offset, size);
- TEST_CF_SECRET(b + offset, size);
+ TEST_CALLOC(a, size + offset);
+ TEST_CALLOC(b, size + offset);
/* Construct data that matches, if same == -1, otherwise
* same gives the number of bytes (after the initial offset)
@@ -49,9 +193,15 @@
}
int reference = memcmp(a + offset, b + offset, size);
+
+ TEST_CF_SECRET(a, size + offset);
+ TEST_CF_SECRET(b, size + offset);
+
int actual = mbedtls_ct_memcmp(a + offset, b + offset, size);
- TEST_CF_PUBLIC(a + offset, size);
- TEST_CF_PUBLIC(b + offset, size);
+
+ TEST_CF_PUBLIC(a, size + offset);
+ TEST_CF_PUBLIC(b, size + offset);
+ TEST_CF_PUBLIC(&actual, sizeof(actual));
if (same == -1 || same >= size) {
TEST_ASSERT(reference == 0);
@@ -66,67 +216,147 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_SSL_SOME_SUITES_USE_MAC */
-void mbedtls_ct_memcpy_if_eq(int eq, int size, int offset)
+/* BEGIN_CASE */
+void mbedtls_ct_memcpy_if(int eq, int size, int offset)
{
- uint8_t *src = NULL, *result = NULL, *expected = NULL;
- ASSERT_ALLOC(src, size + offset);
- ASSERT_ALLOC(result, size + offset);
- ASSERT_ALLOC(expected, size + offset);
+ uint8_t *src = NULL, *src2 = NULL, *result = NULL, *expected = NULL;
+ TEST_CALLOC(src, size + offset);
+ TEST_CALLOC(src2, size + offset);
+ TEST_CALLOC(result, size + offset);
+ TEST_CALLOC(expected, size + offset);
+ /* Apply offset to result only */
+ for (int i = 0; i < size + offset; i++) {
+ src[i] = 1;
+ result[i] = 0xff;
+ expected[i] = eq ? 1 : 0xff;
+ }
+
+ int secret_eq = eq;
+ TEST_CF_SECRET(&secret_eq, sizeof(secret_eq));
+ TEST_CF_SECRET(src, size + offset);
+ TEST_CF_SECRET(result, size + offset);
+
+ mbedtls_ct_memcpy_if(mbedtls_ct_bool(secret_eq), result + offset, src, NULL, size);
+
+ TEST_CF_PUBLIC(&secret_eq, sizeof(secret_eq));
+ TEST_CF_PUBLIC(src, size + offset);
+ TEST_CF_PUBLIC(result, size + offset);
+
+ TEST_MEMORY_COMPARE(expected, size, result + offset, size);
+
+
+ /* Apply offset to src only */
for (int i = 0; i < size + offset; i++) {
src[i] = 1;
result[i] = 0xff;
expected[i] = eq ? 1 : 0xff;
}
- int one, secret_eq;
- TEST_CF_SECRET(&one, sizeof(one));
- TEST_CF_SECRET(&secret_eq, sizeof(secret_eq));
- one = 1;
- secret_eq = eq;
+ TEST_CF_SECRET(&secret_eq, sizeof(secret_eq));
+ TEST_CF_SECRET(src, size + offset);
+ TEST_CF_SECRET(result, size + offset);
- mbedtls_ct_memcpy_if_eq(result + offset, src, size, secret_eq, one);
+ mbedtls_ct_memcpy_if(mbedtls_ct_bool(secret_eq), result, src + offset, NULL, size);
- TEST_CF_PUBLIC(&one, sizeof(one));
TEST_CF_PUBLIC(&secret_eq, sizeof(secret_eq));
+ TEST_CF_PUBLIC(src, size + offset);
+ TEST_CF_PUBLIC(result, size + offset);
- ASSERT_COMPARE(expected, size, result + offset, size);
+ TEST_MEMORY_COMPARE(expected, size, result, size);
+
+ /* Apply offset to src and src2 */
for (int i = 0; i < size + offset; i++) {
- src[i] = 1;
- result[i] = 0xff;
- expected[i] = eq ? 1 : 0xff;
+ src[i] = 1;
+ src2[i] = 2;
+ result[i] = 0xff;
+ expected[i] = eq ? 1 : 2;
}
- TEST_CF_SECRET(&one, sizeof(one));
- TEST_CF_SECRET(&secret_eq, sizeof(secret_eq));
- one = 1;
- secret_eq = eq;
+ TEST_CF_SECRET(&secret_eq, sizeof(secret_eq));
+ TEST_CF_SECRET(src, size + offset);
+ TEST_CF_SECRET(src2, size + offset);
+ TEST_CF_SECRET(result, size + offset);
- mbedtls_ct_memcpy_if_eq(result, src + offset, size, secret_eq, one);
+ mbedtls_ct_memcpy_if(mbedtls_ct_bool(secret_eq), result, src + offset, src2 + offset, size);
- TEST_CF_PUBLIC(&one, sizeof(one));
TEST_CF_PUBLIC(&secret_eq, sizeof(secret_eq));
+ TEST_CF_PUBLIC(src, size + offset);
+ TEST_CF_SECRET(src2, size + offset);
+ TEST_CF_PUBLIC(result, size + offset);
- ASSERT_COMPARE(expected, size, result, size);
+ TEST_MEMORY_COMPARE(expected, size, result, size);
+
+
+ /* result == src == dest */
+ for (int i = 0; i < size + offset; i++) {
+ src[i] = 2;
+ expected[i] = 2;
+ }
+
+ TEST_CF_SECRET(&secret_eq, sizeof(secret_eq));
+ TEST_CF_SECRET(src, size + offset);
+ TEST_CF_SECRET(result, size + offset);
+
+ mbedtls_ct_memcpy_if(mbedtls_ct_bool(secret_eq), src + offset, src + offset, src + offset,
+ size);
+
+ TEST_CF_PUBLIC(&secret_eq, sizeof(secret_eq));
+ TEST_CF_PUBLIC(src, size + offset);
+ TEST_CF_PUBLIC(result, size + offset);
+
+ TEST_MEMORY_COMPARE(expected, size, src + offset, size);
exit:
mbedtls_free(src);
+ mbedtls_free(src2);
mbedtls_free(result);
mbedtls_free(expected);
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC:MBEDTLS_TEST_HOOKS */
-void ssl_cf_memcpy_offset(int offset_min, int offset_max, int len)
+/* BEGIN_CASE depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:!MBEDTLS_RSA_ALT */
+void mbedtls_ct_memmove_left(int len, int offset)
+{
+ size_t l = (size_t) len;
+ size_t o = (size_t) offset;
+
+ uint8_t *buf = NULL, *buf_expected = NULL;
+ TEST_CALLOC(buf, l);
+ TEST_CALLOC(buf_expected, l);
+
+ for (size_t i = 0; i < l; i++) {
+ buf[i] = (uint8_t) i;
+ buf_expected[i] = buf[i];
+ }
+
+ TEST_CF_SECRET(&o, sizeof(o));
+ TEST_CF_SECRET(buf, l);
+ mbedtls_ct_memmove_left(buf, l, o);
+ TEST_CF_PUBLIC(&o, sizeof(o));
+ TEST_CF_PUBLIC(buf, l);
+
+ if (l > 0) {
+ memmove(buf_expected, buf_expected + o, l - o);
+ memset(buf_expected + (l - o), 0, o);
+ TEST_ASSERT(memcmp(buf, buf_expected, l) == 0);
+ }
+exit:
+ mbedtls_free(buf);
+ mbedtls_free(buf_expected);
+}
+/* END_CASE */
+
+/* BEGIN_CASE */
+void mbedtls_ct_memcpy_offset(int offset_min, int offset_max, int len)
{
unsigned char *dst = NULL;
unsigned char *src = NULL;
size_t src_len = offset_max + len;
size_t secret;
- ASSERT_ALLOC(dst, len);
- ASSERT_ALLOC(src, src_len);
+ TEST_CALLOC(dst, len);
+ TEST_CALLOC(src, src_len);
/* Fill src in a way that we can detect if we copied the right bytes */
mbedtls_test_rnd_std_rand(NULL, src, src_len);
@@ -135,12 +365,15 @@
mbedtls_test_set_step((int) secret);
TEST_CF_SECRET(&secret, sizeof(secret));
+ TEST_CF_SECRET(src, len);
+ TEST_CF_SECRET(dst, len);
mbedtls_ct_memcpy_offset(dst, src, secret,
offset_min, offset_max, len);
TEST_CF_PUBLIC(&secret, sizeof(secret));
+ TEST_CF_PUBLIC(src, len);
TEST_CF_PUBLIC(dst, len);
- ASSERT_COMPARE(dst, len, src + secret, len);
+ TEST_MEMORY_COMPARE(dst, len, src + secret, len);
}
exit:
diff --git a/tests/suites/test_suite_constant_time_hmac.function b/tests/suites/test_suite_constant_time_hmac.function
index 9ee372b..435e4b9 100644
--- a/tests/suites/test_suite_constant_time_hmac.function
+++ b/tests/suites/test_suite_constant_time_hmac.function
@@ -8,7 +8,7 @@
#include <test/constant_flow.h>
/* END_HEADER */
-/* BEGIN_CASE depends_on:MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC:MBEDTLS_TEST_HOOKS */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_SOME_SUITES_USE_MAC:MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC:MBEDTLS_TEST_HOOKS */
void ssl_cf_hmac(int hash)
{
/*
@@ -58,7 +58,7 @@
#endif /* MBEDTLS_USE_PSA_CRYPTO */
/* Use allocated out buffer to catch overwrites */
- ASSERT_ALLOC(out, out_len);
+ TEST_CALLOC(out, out_len);
#if defined(MBEDTLS_USE_PSA_CRYPTO)
/* Set up dummy key */
@@ -85,7 +85,7 @@
mbedtls_test_set_step(max_in_len * 10000);
/* Use allocated in buffer to catch overreads */
- ASSERT_ALLOC(data, max_in_len);
+ TEST_CALLOC(data, max_in_len);
min_in_len = max_in_len > 255 ? max_in_len - 255 : 0;
for (in_len = min_in_len; in_len <= max_in_len; in_len++) {
@@ -133,7 +133,7 @@
TEST_EQUAL(0, mbedtls_md_hmac_reset(&ref_ctx));
/* Compare */
- ASSERT_COMPARE(out, out_len, ref_out, out_len);
+ TEST_MEMORY_COMPARE(out, out_len, ref_out, out_len);
#endif /* MBEDTLS_USE_PSA_CRYPTO */
}
diff --git a/tests/suites/test_suite_ecp.data b/tests/suites/test_suite_ecp.data
index f10e572..1002991 100644
--- a/tests/suites/test_suite_ecp.data
+++ b/tests/suites/test_suite_ecp.data
@@ -677,55 +677,55 @@
mbedtls_ecp_read_key:MBEDTLS_ECP_DP_CURVE25519:"70076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c6a":0:1
ECP mod p192 small (more than 192 bits, less limbs than 2 * 192 bits)
-depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP192R1:"0100000000000103010000000000010201000000000001010100000000000100"
ECP mod p192 readable
-depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP192R1:"010000000000010501000000000001040100000000000103010000000000010201000000000001010100000000000100"
ECP mod p192 readable with carry
-depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP192R1:"FF00000000010500FF00000000010400FF00000000010300FF00000000010200FF00000000010100FF00000000010000"
ECP mod p192 random
-depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP192R1:"36CF96B45D706A0954D89E52CE5F38517A2270E0175849B6F3740151D238CCABEF921437E475881D83BB69E4AA258EBD"
ECP mod p192 (from a past failure case)
-depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP192R1:"1AC2D6F96A2A425E9DD1776DD8368D4BBC86BF4964E79FEA713583BF948BBEFF0939F96FB19EC48C585BDA6A2D35C750"
ECP mod p224 readable without carry
-depends_on:MBEDTLS_ECP_DP_SECP224R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP224R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP224R1:"0000000D0000000C0000000B0000000A0000000900000008000000070000FF060000FF050000FF040000FF03000FF0020000FF010000FF00"
ECP mod p224 readable with negative carry
-depends_on:MBEDTLS_ECP_DP_SECP224R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP224R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP224R1:"0000000D0000000C0000000B0000000A00000009000000080000000700000006000000050000000400000003000000020000000100000000"
ECP mod p224 readable with positive carry
-depends_on:MBEDTLS_ECP_DP_SECP224R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP224R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP224R1:"0000000D0000000C0000000BFFFFFF0AFFFFFF09FFFFFF08FFFFFF070000FF060000FF050000FF040000FF03000FF0020000FF010000FF00"
ECP mod p224 readable with final negative carry
-depends_on:MBEDTLS_ECP_DP_SECP224R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP224R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP224R1:"FF00000D0000000C0000000B0000000A00000009000000080000000700000006000000050000000400000003000000020000000100000000"
ECP mod p521 very small
-depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP521R1:"01"
ECP mod p521 small (522 bits)
-depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP521R1:"030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
ECP mod p521 readable
-depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP521R1:"03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
ECP mod p521 readable with carry
-depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED
+depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
ecp_fast_mod:MBEDTLS_ECP_DP_SECP521R1:"03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"
ECP test vectors secp192r1 rfc 5114
diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function
index 962745c..c4408df 100644
--- a/tests/suites/test_suite_ecp.function
+++ b/tests/suites/test_suite_ecp.function
@@ -538,8 +538,8 @@
&len, actual_result, sizeof(actual_result)));
TEST_ASSERT(len <= MBEDTLS_ECP_MAX_PT_LEN);
- ASSERT_COMPARE(expected_result->x, expected_result->len,
- actual_result, len);
+ TEST_MEMORY_COMPARE(expected_result->x, expected_result->len,
+ actual_result, len);
exit:
mbedtls_ecp_group_free(&grp);
@@ -1061,8 +1061,8 @@
ret = mbedtls_ecp_write_key(&key, buf, in_key->len);
TEST_ASSERT(ret == 0);
- ASSERT_COMPARE(in_key->x, in_key->len,
- buf, in_key->len);
+ TEST_MEMORY_COMPARE(in_key->x, in_key->len,
+ buf, in_key->len);
} else {
unsigned char export1[MBEDTLS_ECP_MAX_BYTES];
unsigned char export2[MBEDTLS_ECP_MAX_BYTES];
@@ -1076,8 +1076,8 @@
ret = mbedtls_ecp_write_key(&key2, export2, in_key->len);
TEST_ASSERT(ret == 0);
- ASSERT_COMPARE(export1, in_key->len,
- export2, in_key->len);
+ TEST_MEMORY_COMPARE(export1, in_key->len,
+ export2, in_key->len);
}
}
@@ -1101,7 +1101,7 @@
rnd_info.fallback_f_rng = NULL;
rnd_info.fallback_p_rng = NULL;
- ASSERT_ALLOC(actual, expected->len);
+ TEST_CALLOC(actual, expected->len);
ret = mbedtls_ecp_gen_privkey_mx(bits, &d,
mbedtls_test_rnd_buffer_rand, &rnd_info);
@@ -1123,8 +1123,8 @@
* (can be enforced by checking these bits).
* - Other bits must be random (by testing with different RNG outputs,
* we validate that those bits are indeed influenced by the RNG). */
- ASSERT_COMPARE(expected->x, expected->len,
- actual, expected->len);
+ TEST_MEMORY_COMPARE(expected->x, expected->len,
+ actual, expected->len);
}
exit:
@@ -1379,7 +1379,7 @@
TEST_LE_U(mbedtls_mpi_core_bitlen(X, limbs_X), curve_bits);
mbedtls_mpi_mod_raw_fix_quasi_reduction(X, &m);
- ASSERT_COMPARE(X, bytes, res, bytes);
+ TEST_MEMORY_COMPARE(X, bytes, res, bytes);
exit:
mbedtls_free(X);
@@ -1420,7 +1420,7 @@
}
/* Compare output byte-by-byte */
- ASSERT_COMPARE(p, bytes, m.p, bytes);
+ TEST_MEMORY_COMPARE(p, bytes, m.p, bytes);
/* Test for user free-ing allocated memory */
mbedtls_mpi_mod_modulus_free(&m);
@@ -1456,10 +1456,10 @@
/* Test for limb sizes */
TEST_EQUAL(m.limbs, limbs);
- ASSERT_ALLOC(A_inverse, limbs);
+ TEST_CALLOC(A_inverse, limbs);
TEST_EQUAL(0, mbedtls_mpi_mod_residue_setup(&rA_inverse, &m, A_inverse, limbs));
- ASSERT_ALLOC(rX_raw, limbs);
+ TEST_CALLOC(rX_raw, limbs);
TEST_EQUAL(0, mbedtls_mpi_mod_residue_setup(&rX, &m, rX_raw, limbs));
/* Get inverse of A mode m, and multiply it with itself,
@@ -1467,15 +1467,15 @@
TEST_EQUAL(0, mbedtls_mpi_mod_inv(&rA_inverse, &rA, &m));
TEST_EQUAL(mbedtls_mpi_mod_mul(&rX, &rA, &rA_inverse, &m), 0);
- ASSERT_ALLOC(bufx, limbs);
+ TEST_CALLOC(bufx, limbs);
TEST_EQUAL(mbedtls_mpi_mod_write(&rX, &m, (unsigned char *) bufx,
limbs * ciL,
MBEDTLS_MPI_MOD_EXT_REP_LE), 0);
- ASSERT_COMPARE(bufx, ciL, one, ciL);
+ TEST_MEMORY_COMPARE(bufx, ciL, one, ciL);
/*Borrow the buffer of A to compare the left lims with 0 */
memset(A, 0, limbs * ciL);
- ASSERT_COMPARE(&bufx[1], (limbs - 1) * ciL, A, (limbs - 1) * ciL);
+ TEST_MEMORY_COMPARE(&bufx[1], (limbs - 1) * ciL, A, (limbs - 1) * ciL);
exit:
mbedtls_mpi_mod_modulus_free(&m);
@@ -1515,7 +1515,7 @@
TEST_EQUAL(m.limbs, p_A_limbs);
bytes = p_A_limbs * ciL;
- ASSERT_ALLOC(p_S, p_A_limbs);
+ TEST_CALLOC(p_S, p_A_limbs);
TEST_EQUAL(mbedtls_mpi_mod_residue_setup(&rA, &m, p_A, p_A_limbs), 0);
TEST_EQUAL(mbedtls_mpi_mod_residue_setup(&rB, &m, p_B, p_B_limbs), 0);
@@ -1527,7 +1527,7 @@
TEST_EQUAL(0, mbedtls_mpi_mod_sub(&rS, &rS, &rB, &m));
/* Compare difference with rA byte-by-byte */
- ASSERT_COMPARE(rA.p, bytes, rS.p, bytes);
+ TEST_MEMORY_COMPARE(rA.p, bytes, rS.p, bytes);
exit:
mbedtls_mpi_mod_modulus_free(&m);
@@ -1562,11 +1562,11 @@
/* Test for limb sizes */
TEST_EQUAL(m.limbs, limbs);
- ASSERT_ALLOC(rX_raw, limbs);
+ TEST_CALLOC(rX_raw, limbs);
TEST_EQUAL(0, mbedtls_mpi_mod_residue_setup(&rX, &m, rX_raw, limbs));
bytes = limbs * ciL;
- ASSERT_ALLOC(bufx, limbs);
+ TEST_CALLOC(bufx, limbs);
/* Write source mod residue to a buffer, then read it back to
* the destination mod residue, compare the two mod residues.
* Firstly test little endian write and read */
@@ -1577,7 +1577,7 @@
bytes, MBEDTLS_MPI_MOD_EXT_REP_LE));
TEST_EQUAL(limbs, rX.limbs);
- ASSERT_COMPARE(rA.p, bytes, rX.p, bytes);
+ TEST_MEMORY_COMPARE(rA.p, bytes, rX.p, bytes);
memset(bufx, 0x00, bytes);
memset(rX_raw, 0x00, bytes);
@@ -1591,7 +1591,7 @@
MBEDTLS_MPI_MOD_EXT_REP_BE));
TEST_EQUAL(limbs, rX.limbs);
- ASSERT_COMPARE(rA.p, bytes, rX.p, bytes);
+ TEST_MEMORY_COMPARE(rA.p, bytes, rX.p, bytes);
exit:
mbedtls_mpi_mod_modulus_free(&m);
@@ -1616,13 +1616,13 @@
limbs = m.limbs;
- ASSERT_ALLOC(rX_raw, limbs);
+ TEST_CALLOC(rX_raw, limbs);
TEST_EQUAL(0, mbedtls_mpi_mod_residue_setup(&rX, &m, rX_raw, limbs));
TEST_EQUAL(0, mbedtls_mpi_mod_random(&rX, 1, &m,
mbedtls_test_rnd_std_rand, NULL));
- TEST_ASSERT(mbedtls_mpi_core_lt_ct(rX.p, m.p, limbs) == 1);
+ TEST_ASSERT(mbedtls_mpi_core_lt_ct(rX.p, m.p, limbs) == MBEDTLS_CT_TRUE);
exit:
mbedtls_mpi_mod_modulus_free(&m);
diff --git a/tests/suites/test_suite_gcm.function b/tests/suites/test_suite_gcm.function
index fd68abf..747914f 100644
--- a/tests/suites/test_suite_gcm.function
+++ b/tests/suites/test_suite_gcm.function
@@ -33,26 +33,26 @@
/* Allocate a tight buffer for each update call. This way, if the function
* tries to write beyond the advertised required buffer size, this will
* count as an overflow for memory sanitizers and static checkers. */
- ASSERT_ALLOC(output, n1);
+ TEST_CALLOC(output, n1);
olen = 0xdeadbeef;
TEST_EQUAL(0, mbedtls_gcm_update(ctx, input->x, n1, output, n1, &olen));
TEST_EQUAL(n1, olen);
- ASSERT_COMPARE(output, olen, expected_output->x, n1);
+ TEST_MEMORY_COMPARE(output, olen, expected_output->x, n1);
mbedtls_free(output);
output = NULL;
- ASSERT_ALLOC(output, n2);
+ TEST_CALLOC(output, n2);
olen = 0xdeadbeef;
TEST_EQUAL(0, mbedtls_gcm_update(ctx, input->x + n1, n2, output, n2, &olen));
TEST_EQUAL(n2, olen);
- ASSERT_COMPARE(output, olen, expected_output->x + n1, n2);
+ TEST_MEMORY_COMPARE(output, olen, expected_output->x + n1, n2);
mbedtls_free(output);
output = NULL;
- ASSERT_ALLOC(output, tag->len);
+ TEST_CALLOC(output, tag->len);
TEST_EQUAL(0, mbedtls_gcm_finish(ctx, NULL, 0, &olen, output, tag->len));
TEST_EQUAL(0, olen);
- ASSERT_COMPARE(output, tag->len, tag->x, tag->len);
+ TEST_MEMORY_COMPARE(output, tag->len, tag->x, tag->len);
mbedtls_free(output);
output = NULL;
@@ -87,18 +87,18 @@
/* Allocate a tight buffer for each update call. This way, if the function
* tries to write beyond the advertised required buffer size, this will
* count as an overflow for memory sanitizers and static checkers. */
- ASSERT_ALLOC(output, input->len);
+ TEST_CALLOC(output, input->len);
olen = 0xdeadbeef;
TEST_EQUAL(0, mbedtls_gcm_update(ctx, input->x, input->len, output, input->len, &olen));
TEST_EQUAL(input->len, olen);
- ASSERT_COMPARE(output, olen, expected_output->x, input->len);
+ TEST_MEMORY_COMPARE(output, olen, expected_output->x, input->len);
mbedtls_free(output);
output = NULL;
- ASSERT_ALLOC(output, tag->len);
+ TEST_CALLOC(output, tag->len);
TEST_EQUAL(0, mbedtls_gcm_finish(ctx, NULL, 0, &olen, output, tag->len));
TEST_EQUAL(0, olen);
- ASSERT_COMPARE(output, tag->len, tag->x, tag->len);
+ TEST_MEMORY_COMPARE(output, tag->len, tag->x, tag->len);
exit:
mbedtls_free(output);
@@ -124,11 +124,11 @@
TEST_EQUAL(0, olen);
}
- ASSERT_ALLOC(output_tag, tag->len);
+ TEST_CALLOC(output_tag, tag->len);
TEST_EQUAL(0, mbedtls_gcm_finish(ctx, NULL, 0, &olen,
output_tag, tag->len));
TEST_EQUAL(0, olen);
- ASSERT_COMPARE(output_tag, tag->len, tag->x, tag->len);
+ TEST_MEMORY_COMPARE(output_tag, tag->len, tag->x, tag->len);
exit:
mbedtls_free(output_tag);
@@ -144,10 +144,10 @@
TEST_EQUAL(0, mbedtls_gcm_starts(ctx, mode,
iv->x, iv->len));
- ASSERT_ALLOC(output, tag->len);
+ TEST_CALLOC(output, tag->len);
TEST_EQUAL(0, mbedtls_gcm_finish(ctx, NULL, 0, &olen, output, tag->len));
TEST_EQUAL(0, olen);
- ASSERT_COMPARE(output, tag->len, tag->x, tag->len);
+ TEST_MEMORY_COMPARE(output, tag->len, tag->x, tag->len);
exit:
mbedtls_free(output);
@@ -212,8 +212,8 @@
iv_str->len, add_str->x, add_str->len, src_str->x,
output, tag_len, tag_output) == 0);
- ASSERT_COMPARE(output, src_str->len, dst->x, dst->len);
- ASSERT_COMPARE(tag_output, tag_len, tag->x, tag->len);
+ TEST_MEMORY_COMPARE(output, src_str->len, dst->x, dst->len);
+ TEST_MEMORY_COMPARE(tag_output, tag_len, tag->x, tag->len);
for (n1 = 0; n1 <= src_str->len; n1 += 1) {
for (n1_add = 0; n1_add <= add_str->len; n1_add += 1) {
@@ -269,7 +269,7 @@
TEST_ASSERT(ret == MBEDTLS_ERR_GCM_AUTH_FAILED);
} else {
TEST_ASSERT(ret == 0);
- ASSERT_COMPARE(output, src_str->len, pt_result->x, pt_result->len);
+ TEST_MEMORY_COMPARE(output, src_str->len, pt_result->x, pt_result->len);
for (n1 = 0; n1 <= src_str->len; n1 += 1) {
for (n1_add = 0; n1_add <= add_str->len; n1_add += 1) {
@@ -448,7 +448,7 @@
TEST_EQUAL(mbedtls_gcm_setkey(&ctx, cipher_id, key_str->x, key_str->len * 8), 0);
TEST_EQUAL(0, mbedtls_gcm_starts(&ctx, mode, iv->x, iv->len));
- ASSERT_ALLOC(output, output_len);
+ TEST_CALLOC(output, output_len);
TEST_EQUAL(MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL,
mbedtls_gcm_update(&ctx, input->x, input->len, output, output_len, &olen));
diff --git a/tests/suites/test_suite_hkdf.function b/tests/suites/test_suite_hkdf.function
index ce8edcf..becf672 100644
--- a/tests/suites/test_suite_hkdf.function
+++ b/tests/suites/test_suite_hkdf.function
@@ -26,8 +26,8 @@
info->x, info->len, okm, expected_okm->len);
TEST_ASSERT(ret == 0);
- ASSERT_COMPARE(okm, expected_okm->len,
- expected_okm->x, expected_okm->len);
+ TEST_MEMORY_COMPARE(okm, expected_okm->len,
+ expected_okm->x, expected_okm->len);
exit:
MD_PSA_DONE();
@@ -50,13 +50,13 @@
TEST_ASSERT(md != NULL);
output_prk_len = mbedtls_md_get_size(md);
- ASSERT_ALLOC(output_prk, output_prk_len);
+ TEST_CALLOC(output_prk, output_prk_len);
ret = mbedtls_hkdf_extract(md, salt->x, salt->len,
ikm->x, ikm->len, output_prk);
TEST_ASSERT(ret == 0);
- ASSERT_COMPARE(output_prk, output_prk_len, prk->x, prk->len);
+ TEST_MEMORY_COMPARE(output_prk, output_prk_len, prk->x, prk->len);
exit:
mbedtls_free(output_prk);
@@ -79,7 +79,7 @@
const mbedtls_md_info_t *md = mbedtls_md_info_from_type(md_alg);
TEST_ASSERT(md != NULL);
- ASSERT_ALLOC(output_okm, OKM_LEN);
+ TEST_CALLOC(output_okm, OKM_LEN);
TEST_ASSERT(prk->len == mbedtls_md_get_size(md));
TEST_ASSERT(okm->len < OKM_LEN);
@@ -88,7 +88,7 @@
info->x, info->len,
output_okm, OKM_LEN);
TEST_ASSERT(ret == 0);
- ASSERT_COMPARE(output_okm, okm->len, okm->x, okm->len);
+ TEST_MEMORY_COMPARE(output_okm, okm->len, okm->x, okm->len);
exit:
mbedtls_free(output_okm);
@@ -110,7 +110,7 @@
fake_md_info.type = MBEDTLS_MD_NONE;
fake_md_info.size = hash_len;
- ASSERT_ALLOC(prk, MBEDTLS_MD_MAX_SIZE);
+ TEST_CALLOC(prk, MBEDTLS_MD_MAX_SIZE);
salt_len = 0;
ikm_len = 0;
@@ -140,11 +140,11 @@
info_len = 0;
if (prk_len > 0) {
- ASSERT_ALLOC(prk, prk_len);
+ TEST_CALLOC(prk, prk_len);
}
if (okm_len > 0) {
- ASSERT_ALLOC(okm, okm_len);
+ TEST_CALLOC(okm, okm_len);
}
output_ret = mbedtls_hkdf_expand(&fake_md_info, prk, prk_len,
diff --git a/tests/suites/test_suite_lmots.function b/tests/suites/test_suite_lmots.function
index 8f06ee5..293287a 100644
--- a/tests/suites/test_suite_lmots.function
+++ b/tests/suites/test_suite_lmots.function
@@ -122,7 +122,7 @@
continue;
}
- ASSERT_ALLOC(tmp_sig, size);
+ TEST_CALLOC(tmp_sig, size);
if (tmp_sig != NULL) {
memcpy(tmp_sig, sig->x, MIN(size, sig->len));
}
@@ -154,7 +154,7 @@
if (expected_import_rc == 0) {
exported_pub_key_buf_size = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(MBEDTLS_LMOTS_SHA256_N32_W8);
- ASSERT_ALLOC(exported_pub_key, exported_pub_key_buf_size);
+ TEST_CALLOC(exported_pub_key, exported_pub_key_buf_size);
TEST_EQUAL(mbedtls_lmots_export_public_key(&ctx, exported_pub_key,
exported_pub_key_buf_size,
@@ -162,14 +162,14 @@
TEST_EQUAL(exported_pub_key_size,
MBEDTLS_LMOTS_PUBLIC_KEY_LEN(MBEDTLS_LMOTS_SHA256_N32_W8));
- ASSERT_COMPARE(pub_key->x, pub_key->len,
- exported_pub_key, exported_pub_key_size);
+ TEST_MEMORY_COMPARE(pub_key->x, pub_key->len,
+ exported_pub_key, exported_pub_key_size);
mbedtls_free(exported_pub_key);
exported_pub_key = NULL;
/* Export into too-small buffer should fail */
exported_pub_key_buf_size = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(MBEDTLS_LMOTS_SHA256_N32_W8) - 1;
- ASSERT_ALLOC(exported_pub_key, exported_pub_key_buf_size);
+ TEST_CALLOC(exported_pub_key, exported_pub_key_buf_size);
TEST_EQUAL(mbedtls_lmots_export_public_key(&ctx, exported_pub_key,
exported_pub_key_buf_size, NULL),
MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL);
@@ -178,13 +178,13 @@
/* Export into too-large buffer should succeed */
exported_pub_key_buf_size = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(MBEDTLS_LMOTS_SHA256_N32_W8) + 1;
- ASSERT_ALLOC(exported_pub_key, exported_pub_key_buf_size);
+ TEST_CALLOC(exported_pub_key, exported_pub_key_buf_size);
TEST_EQUAL(mbedtls_lmots_export_public_key(&ctx, exported_pub_key,
exported_pub_key_buf_size,
&exported_pub_key_size),
0);
- ASSERT_COMPARE(pub_key->x, pub_key->len,
- exported_pub_key, exported_pub_key_size);
+ TEST_MEMORY_COMPARE(pub_key->x, pub_key->len,
+ exported_pub_key, exported_pub_key_size);
mbedtls_free(exported_pub_key);
exported_pub_key = NULL;
}
diff --git a/tests/suites/test_suite_lms.function b/tests/suites/test_suite_lms.function
index bfc3e06..7116f61 100644
--- a/tests/suites/test_suite_lms.function
+++ b/tests/suites/test_suite_lms.function
@@ -124,7 +124,7 @@
continue;
}
- ASSERT_ALLOC(tmp_sig, size);
+ TEST_CALLOC(tmp_sig, size);
if (tmp_sig != NULL) {
memcpy(tmp_sig, sig->x, MIN(size, sig->len));
}
@@ -156,7 +156,7 @@
if (expected_import_rc == 0) {
exported_pub_key_buf_size = MBEDTLS_LMS_PUBLIC_KEY_LEN(MBEDTLS_LMS_SHA256_M32_H10);
- ASSERT_ALLOC(exported_pub_key, exported_pub_key_buf_size);
+ TEST_CALLOC(exported_pub_key, exported_pub_key_buf_size);
TEST_EQUAL(mbedtls_lms_export_public_key(&ctx, exported_pub_key,
exported_pub_key_buf_size,
@@ -164,14 +164,14 @@
TEST_EQUAL(exported_pub_key_size,
MBEDTLS_LMS_PUBLIC_KEY_LEN(MBEDTLS_LMS_SHA256_M32_H10));
- ASSERT_COMPARE(pub_key->x, pub_key->len,
- exported_pub_key, exported_pub_key_size);
+ TEST_MEMORY_COMPARE(pub_key->x, pub_key->len,
+ exported_pub_key, exported_pub_key_size);
mbedtls_free(exported_pub_key);
exported_pub_key = NULL;
/* Export into too-small buffer should fail */
exported_pub_key_buf_size = MBEDTLS_LMS_PUBLIC_KEY_LEN(MBEDTLS_LMS_SHA256_M32_H10) - 1;
- ASSERT_ALLOC(exported_pub_key, exported_pub_key_buf_size);
+ TEST_CALLOC(exported_pub_key, exported_pub_key_buf_size);
TEST_EQUAL(mbedtls_lms_export_public_key(&ctx, exported_pub_key,
exported_pub_key_buf_size, NULL),
MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL);
@@ -180,13 +180,13 @@
/* Export into too-large buffer should succeed */
exported_pub_key_buf_size = MBEDTLS_LMS_PUBLIC_KEY_LEN(MBEDTLS_LMS_SHA256_M32_H10) + 1;
- ASSERT_ALLOC(exported_pub_key, exported_pub_key_buf_size);
+ TEST_CALLOC(exported_pub_key, exported_pub_key_buf_size);
TEST_EQUAL(mbedtls_lms_export_public_key(&ctx, exported_pub_key,
exported_pub_key_buf_size,
&exported_pub_key_size),
0);
- ASSERT_COMPARE(pub_key->x, pub_key->len,
- exported_pub_key, exported_pub_key_size);
+ TEST_MEMORY_COMPARE(pub_key->x, pub_key->len,
+ exported_pub_key, exported_pub_key_size);
mbedtls_free(exported_pub_key);
exported_pub_key = NULL;
}
diff --git a/tests/suites/test_suite_md.function b/tests/suites/test_suite_md.function
index e3f0e15..fadb362 100644
--- a/tests/suites/test_suite_md.function
+++ b/tests/suites/test_suite_md.function
@@ -185,7 +185,7 @@
TEST_EQUAL(0, mbedtls_md(md_info, src, src_len, output));
- ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
exit:
MD_PSA_DONE();
@@ -206,7 +206,7 @@
TEST_EQUAL(0, mbedtls_md(md_info, src_str->x, src_str->len, output));
- ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
exit:
MD_PSA_DONE();
@@ -248,14 +248,14 @@
TEST_EQUAL(0, mbedtls_md_update(&ctx, src + halfway, src_len - halfway));
TEST_EQUAL(0, mbedtls_md_finish(&ctx, output));
- ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
/* Test clone */
memset(output, 0x00, sizeof(output));
TEST_EQUAL(0, mbedtls_md_update(&ctx_copy, src + halfway, src_len - halfway));
TEST_EQUAL(0, mbedtls_md_finish(&ctx_copy, output));
- ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
exit:
mbedtls_md_free(&ctx);
@@ -295,14 +295,14 @@
TEST_EQUAL(0, mbedtls_md_update(&ctx, src_str->x + halfway, src_str->len - halfway));
TEST_EQUAL(0, mbedtls_md_finish(&ctx, output));
- ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
/* Test clone */
memset(output, 0x00, sizeof(output));
TEST_EQUAL(0, mbedtls_md_update(&ctx_copy, src_str->x + halfway, src_str->len - halfway));
TEST_EQUAL(0, mbedtls_md_finish(&ctx_copy, output));
- ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
exit:
mbedtls_md_free(&ctx);
@@ -328,7 +328,7 @@
TEST_EQUAL(0, mbedtls_md_hmac(md_info, key_str->x, key_str->len,
src_str->x, src_str->len, output));
- ASSERT_COMPARE(output, trunc_size, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, trunc_size, hash->x, hash->len);
exit:
MD_PSA_DONE();
@@ -363,7 +363,7 @@
TEST_EQUAL(0, mbedtls_md_hmac_update(&ctx, src_str->x + halfway, src_str->len - halfway));
TEST_EQUAL(0, mbedtls_md_hmac_finish(&ctx, output));
- ASSERT_COMPARE(output, trunc_size, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, trunc_size, hash->x, hash->len);
/* Test again, for reset() */
memset(output, 0x00, sizeof(output));
@@ -373,7 +373,7 @@
TEST_EQUAL(0, mbedtls_md_hmac_update(&ctx, src_str->x + halfway, src_str->len - halfway));
TEST_EQUAL(0, mbedtls_md_hmac_finish(&ctx, output));
- ASSERT_COMPARE(output, trunc_size, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, trunc_size, hash->x, hash->len);
exit:
mbedtls_md_free(&ctx);
@@ -395,7 +395,7 @@
TEST_EQUAL(0, mbedtls_md_file(md_info, filename, output));
- ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
exit:
MD_PSA_DONE();
diff --git a/tests/suites/test_suite_mps.function b/tests/suites/test_suite_mps.function
index 6d9a8a8..0b8434b 100644
--- a/tests/suites/test_suite_mps.function
+++ b/tests/suites/test_suite_mps.function
@@ -60,7 +60,7 @@
/* Consumption (upper layer) */
/* Consume exactly what's available */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 100, bufA, 100);
+ TEST_MEMORY_COMPARE(tmp, 100, bufA, 100);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Wrapup (lower layer) */
TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, &paused) == 0);
@@ -108,14 +108,14 @@
/* Consumption (upper layer) */
/* Consume exactly what's available */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 100, bufA, 100);
+ TEST_MEMORY_COMPARE(tmp, 100, bufA, 100);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Preparation */
TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0);
TEST_ASSERT(mbedtls_mps_reader_feed(&rd, bufB, sizeof(bufB)) == 0);
/* Consumption */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 100, bufB, 100);
+ TEST_MEMORY_COMPARE(tmp, 100, bufB, 100);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Wrapup (lower layer) */
TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0);
@@ -162,11 +162,11 @@
TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0);
/* Consumption (upper layer) */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, buf, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, buf, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 70, buf + 10, 70);
+ TEST_MEMORY_COMPARE(tmp, 70, buf + 10, 70);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, &tmp_len) == 0);
- ASSERT_COMPARE(tmp, tmp_len, buf + 80, 20);
+ TEST_MEMORY_COMPARE(tmp, tmp_len, buf + 80, 20);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Wrapup (lower layer) */
TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0);
@@ -202,18 +202,18 @@
TEST_ASSERT(mbedtls_mps_reader_feed(&rd, bufA, sizeof(bufA)) == 0);
/* Consumption (upper layer) */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 70, bufA + 10, 70);
+ TEST_MEMORY_COMPARE(tmp, 70, bufA + 10, 70);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, &tmp_len) == 0);
- ASSERT_COMPARE(tmp, tmp_len, bufA + 80, 20);
+ TEST_MEMORY_COMPARE(tmp, tmp_len, bufA + 80, 20);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Preparation */
TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0);
TEST_ASSERT(mbedtls_mps_reader_feed(&rd, bufB, sizeof(bufB)) == 0);
/* Consumption */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 100, bufB, 100);
+ TEST_MEMORY_COMPARE(tmp, 100, bufB, 100);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Wrapup */
TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0);
@@ -243,7 +243,7 @@
TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0);
/* Consumption (upper layer) */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 50, buf, 50);
+ TEST_MEMORY_COMPARE(tmp, 50, buf, 50);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) ==
MBEDTLS_ERR_MPS_READER_OUT_OF_DATA);
@@ -284,10 +284,10 @@
TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0);
/* Consumption (upper layer) */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 50, buf, 50);
+ TEST_MEMORY_COMPARE(tmp, 50, buf, 50);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, buf + 50, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, buf + 50, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) ==
MBEDTLS_ERR_MPS_READER_OUT_OF_DATA);
/* Wrapup (lower layer) */
@@ -295,7 +295,7 @@
MBEDTLS_ERR_MPS_READER_ACCUMULATOR_TOO_SMALL);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, &tmp_len) == 0);
- ASSERT_COMPARE(tmp, tmp_len, buf + 50, 50);
+ TEST_MEMORY_COMPARE(tmp, tmp_len, buf + 50, 50);
mbedtls_mps_reader_free(&rd);
}
@@ -325,7 +325,7 @@
TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0);
/* Consumption (upper layer) */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 50, buf, 50);
+ TEST_MEMORY_COMPARE(tmp, 50, buf, 50);
/* Excess request */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, (mbedtls_mps_size_t) -1, &tmp, NULL) ==
MBEDTLS_ERR_MPS_READER_OUT_OF_DATA);
@@ -376,10 +376,10 @@
/* Consumption (upper layer) */
/* Ask for more than what's available. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 80, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 80, bufA, 80);
+ TEST_MEMORY_COMPARE(tmp, 80, bufA, 80);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10);
switch (option) {
case 0: /* Single uncommitted fetch at pausing */
case 1:
@@ -400,50 +400,50 @@
switch (option) {
case 0: /* Single fetch at pausing, re-fetch with commit. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
break;
case 1: /* Single fetch at pausing, re-fetch without commit. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
break;
case 2: /* Multiple fetches at pausing, repeat without commit. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
break;
case 3: /* Multiple fetches at pausing, repeat with commit 1. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
break;
case 4: /* Multiple fetches at pausing, repeat with commit 2. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
break;
case 5: /* Multiple fetches at pausing, repeat with commit 3. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
break;
@@ -453,7 +453,7 @@
/* In all cases, fetch the rest of the second buffer. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 90, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 90, bufB + 10, 90);
+ TEST_MEMORY_COMPARE(tmp, 90, bufB + 10, 90);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Wrapup */
@@ -498,7 +498,7 @@
/* Consumption (upper layer) */
/* Ask for more than what's available. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 80, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 80, bufA, 80);
+ TEST_MEMORY_COMPARE(tmp, 80, bufA, 80);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* 20 left, ask for 70 -> 50 overhead */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) ==
@@ -538,8 +538,8 @@
/* Consumption */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 20, bufA + 80, 20);
- ASSERT_COMPARE(tmp + 20, 50, bufB, 50);
+ TEST_MEMORY_COMPARE(tmp, 20, bufA + 80, 20);
+ TEST_MEMORY_COMPARE(tmp + 20, 50, bufB, 50);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 1000, &tmp, &fetch_len) == 0);
switch (option) {
case 0:
@@ -591,14 +591,14 @@
/* Fetch (but not commit) the entire buffer. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf), &tmp, NULL)
== 0);
- ASSERT_COMPARE(tmp, 100, buf, 100);
+ TEST_MEMORY_COMPARE(tmp, 100, buf, 100);
break;
case 1:
/* Fetch (but not commit) parts of the buffer. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2,
&tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2);
+ TEST_MEMORY_COMPARE(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2);
break;
case 2:
@@ -606,13 +606,13 @@
* fetch but not commit the rest of the buffer. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2,
&tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2);
+ TEST_MEMORY_COMPARE(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2,
&tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, sizeof(buf) / 2,
- buf + sizeof(buf) / 2,
- sizeof(buf) / 2);
+ TEST_MEMORY_COMPARE(tmp, sizeof(buf) / 2,
+ buf + sizeof(buf) / 2,
+ sizeof(buf) / 2);
break;
default:
@@ -646,16 +646,16 @@
TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0);
/* Consumption (upper layer) */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 50, buf, 50);
+ TEST_MEMORY_COMPARE(tmp, 50, buf, 50);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 50, buf + 50, 50);
+ TEST_MEMORY_COMPARE(tmp, 50, buf + 50, 50);
/* Preparation */
TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) ==
MBEDTLS_ERR_MPS_READER_DATA_LEFT);
/* Consumption */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 50, buf + 50, 50);
+ TEST_MEMORY_COMPARE(tmp, 50, buf + 50, 50);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Wrapup */
TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0);
@@ -699,10 +699,10 @@
/* Consumption (upper layer) */
/* Ask for more than what's available. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 80, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 80, bufA, 80);
+ TEST_MEMORY_COMPARE(tmp, 80, bufA, 80);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) ==
MBEDTLS_ERR_MPS_READER_OUT_OF_DATA);
@@ -717,10 +717,10 @@
/* Consume */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, &tmp_len) == 0);
- ASSERT_COMPARE(tmp, tmp_len, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, tmp_len, bufA + 80, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) ==
MBEDTLS_ERR_MPS_READER_OUT_OF_DATA);
@@ -731,18 +731,18 @@
/* Consume */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufB + 10, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufC, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufB + 10, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufC, 10);
break;
case 1: /* Fetch same chunks, commit afterwards, and
* then exceed bounds of new buffer; accumulator
* not large enough. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 51, &tmp, NULL) ==
MBEDTLS_ERR_MPS_READER_OUT_OF_DATA);
@@ -756,10 +756,10 @@
* then exceed bounds of new buffer; accumulator
* large enough. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) ==
MBEDTLS_ERR_MPS_READER_OUT_OF_DATA);
@@ -769,19 +769,19 @@
/* Consume */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 20, bufA + 80, 20);
- ASSERT_COMPARE(tmp + 20, 20, bufB, 20);
- ASSERT_COMPARE(tmp + 40, 10, bufC, 10);
+ TEST_MEMORY_COMPARE(tmp, 20, bufA + 80, 20);
+ TEST_MEMORY_COMPARE(tmp + 20, 20, bufB, 20);
+ TEST_MEMORY_COMPARE(tmp + 40, 10, bufC, 10);
break;
case 3: /* Fetch same chunks, don't commit afterwards, and
* then exceed bounds of new buffer; accumulator
* not large enough. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 80, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 10, bufA + 90, 10);
- ASSERT_COMPARE(tmp + 10, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10);
+ TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 21, &tmp, NULL) ==
MBEDTLS_ERR_MPS_READER_OUT_OF_DATA);
@@ -844,15 +844,15 @@
mbedtls_mps_reader rd;
if (acc_size > 0) {
- ASSERT_ALLOC(acc, acc_size);
+ TEST_CALLOC(acc, acc_size);
}
/* This probably needs to be changed because we want
* our tests to be deterministic. */
// srand( time( NULL ) );
- ASSERT_ALLOC(outgoing, num_out_chunks * max_chunk_size);
- ASSERT_ALLOC(incoming, num_out_chunks * max_chunk_size);
+ TEST_CALLOC(outgoing, num_out_chunks * max_chunk_size);
+ TEST_CALLOC(incoming, num_out_chunks * max_chunk_size);
mbedtls_mps_reader_init(&rd, acc, acc_size);
@@ -884,7 +884,7 @@
}
tmp_size = (rand() % max_chunk_size) + 1;
- ASSERT_ALLOC(tmp, tmp_size);
+ TEST_CALLOC(tmp, tmp_size);
TEST_ASSERT(mbedtls_test_rnd_std_rand(NULL, tmp, tmp_size) == 0);
ret = mbedtls_mps_reader_feed(&rd, tmp, tmp_size);
@@ -1005,16 +1005,16 @@
case 0:
/* Ask for buffered data in a single chunk, no commit */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 20, bufA + 80, 20);
- ASSERT_COMPARE(tmp + 20, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 20, bufA + 80, 20);
+ TEST_MEMORY_COMPARE(tmp + 20, 10, bufB, 10);
success = 1;
break;
case 1:
/* Ask for buffered data in a single chunk, with commit */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 20, bufA + 80, 20);
- ASSERT_COMPARE(tmp + 20, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 20, bufA + 80, 20);
+ TEST_MEMORY_COMPARE(tmp + 20, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
success = 1;
break;
@@ -1035,7 +1035,7 @@
/* Asking for buffered data in different
* chunks than before CAN fail. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 15, bufA + 80, 15);
+ TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) ==
MBEDTLS_ERR_MPS_READER_INCONSISTENT_REQUESTS);
break;
@@ -1044,10 +1044,10 @@
/* Asking for buffered data different chunks
* than before NEED NOT fail - no commits */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 15, bufA + 80, 15);
+ TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 5, bufA + 95, 5);
- ASSERT_COMPARE(tmp + 5, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 5, bufA + 95, 5);
+ TEST_MEMORY_COMPARE(tmp + 5, 10, bufB, 10);
success = 1;
break;
@@ -1055,11 +1055,11 @@
/* Asking for buffered data different chunks
* than before NEED NOT fail - intermediate commit */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 15, bufA + 80, 15);
+ TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 5, bufA + 95, 5);
- ASSERT_COMPARE(tmp + 5, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 5, bufA + 95, 5);
+ TEST_MEMORY_COMPARE(tmp + 5, 10, bufB, 10);
success = 1;
break;
@@ -1067,10 +1067,10 @@
/* Asking for buffered data different chunks
* than before NEED NOT fail - end commit */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 15, bufA + 80, 15);
+ TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 5, bufA + 95, 5);
- ASSERT_COMPARE(tmp + 5, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 5, bufA + 95, 5);
+ TEST_MEMORY_COMPARE(tmp + 5, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
success = 1;
break;
@@ -1079,11 +1079,11 @@
/* Asking for buffered data different chunks
* than before NEED NOT fail - intermediate & end commit */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 15, bufA + 80, 15);
+ TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15);
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
- ASSERT_COMPARE(tmp, 5, bufA + 95, 5);
- ASSERT_COMPARE(tmp + 5, 10, bufB, 10);
+ TEST_MEMORY_COMPARE(tmp, 5, bufA + 95, 5);
+ TEST_MEMORY_COMPARE(tmp + 5, 10, bufB, 10);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
success = 1;
break;
@@ -1096,7 +1096,7 @@
if (success == 1) {
/* In all succeeding cases, fetch the rest of the second buffer. */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 90, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 90, bufB + 10, 90);
+ TEST_MEMORY_COMPARE(tmp, 90, bufB + 10, 90);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Wrapup */
@@ -1131,7 +1131,7 @@
/* Consumption (upper layer) */
TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0);
- ASSERT_COMPARE(tmp, 100, buf, 100);
+ TEST_MEMORY_COMPARE(tmp, 100, buf, 100);
TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0);
/* Wrapup */
diff --git a/tests/suites/test_suite_pkcs12.function b/tests/suites/test_suite_pkcs12.function
index 3ac1a77..2c93c13 100644
--- a/tests/suites/test_suite_pkcs12.function
+++ b/tests/suites/test_suite_pkcs12.function
@@ -44,7 +44,7 @@
salt_len = salt_arg->len;
- ASSERT_ALLOC(output_data, key_size);
+ TEST_CALLOC(output_data, key_size);
int ret = mbedtls_pkcs12_derivation(output_data,
key_size,
@@ -59,8 +59,8 @@
TEST_EQUAL(ret, expected_status);
if (expected_status == 0) {
- ASSERT_COMPARE(expected_output->x, expected_output->len,
- output_data, key_size);
+ TEST_MEMORY_COMPARE(expected_output->x, expected_output->len,
+ output_data, key_size);
}
exit:
diff --git a/tests/suites/test_suite_pkcs1_v21.function b/tests/suites/test_suite_pkcs1_v21.function
index c803f97..6261979 100644
--- a/tests/suites/test_suite_pkcs1_v21.function
+++ b/tests/suites/test_suite_pkcs1_v21.function
@@ -48,7 +48,7 @@
message_str->x,
output) == result);
if (result == 0) {
- ASSERT_COMPARE(output, ctx.len, result_str->x, result_str->len);
+ TEST_MEMORY_COMPARE(output, ctx.len, result_str->x, result_str->len);
}
exit:
@@ -110,7 +110,7 @@
output,
sizeof(output)) == result);
if (result == 0) {
- ASSERT_COMPARE(output, output_len, result_str->x, result_str->len);
+ TEST_MEMORY_COMPARE(output, output_len, result_str->x, result_str->len);
}
}
@@ -167,7 +167,7 @@
&ctx, &mbedtls_test_rnd_buffer_rand, &info,
digest, hash_digest->len, hash_digest->x, output) == result);
if (result == 0) {
- ASSERT_COMPARE(output, ctx.len, result_str->x, result_str->len);
+ TEST_MEMORY_COMPARE(output, ctx.len, result_str->x, result_str->len);
}
info.buf = rnd_buf->x;
@@ -179,7 +179,7 @@
digest, hash_digest->len, hash_digest->x,
fixed_salt_length, output) == result);
if (result == 0) {
- ASSERT_COMPARE(output, ctx.len, result_str->x, result_str->len);
+ TEST_MEMORY_COMPARE(output, ctx.len, result_str->x, result_str->len);
}
exit:
diff --git a/tests/suites/test_suite_pkcs7.function b/tests/suites/test_suite_pkcs7.function
index 3585522..a0da1d7 100644
--- a/tests/suites/test_suite_pkcs7.function
+++ b/tests/suites/test_suite_pkcs7.function
@@ -85,8 +85,8 @@
}
}
- ASSERT_ALLOC(crts, n_crts);
- ASSERT_ALLOC(crt_files_arr, n_crts);
+ TEST_CALLOC(crts, n_crts);
+ TEST_CALLOC(crt_files_arr, n_crts);
for (i = 0; i < strlen(crt_files); i++) {
for (k = i; k < strlen(crt_files); k++) {
@@ -94,7 +94,7 @@
break;
}
}
- ASSERT_ALLOC(crt_files_arr[cnt], (k-i)+1);
+ TEST_CALLOC(crt_files_arr[cnt], (k-i)+1);
crt_files_arr[cnt][k-i] = '\0';
memcpy(crt_files_arr[cnt++], crt_files + i, k-i);
i = k;
@@ -102,7 +102,7 @@
mbedtls_pkcs7_init(&pkcs7);
for (i = 0; i < n_crts; i++) {
- ASSERT_ALLOC(crts[i], 1);
+ TEST_CALLOC(crts[i], 1);
mbedtls_x509_crt_init(crts[i]);
}
@@ -127,7 +127,7 @@
datalen = st.st_size;
/* Special-case for zero-length input so that data will be non-NULL */
- ASSERT_ALLOC(data, datalen == 0 ? 1 : datalen);
+ TEST_CALLOC(data, datalen == 0 ? 1 : datalen);
buflen = fread((void *) data, sizeof(unsigned char), datalen, file);
TEST_EQUAL(buflen, datalen);
@@ -135,7 +135,7 @@
if (do_hash_alg) {
md_info = mbedtls_md_info_from_type((mbedtls_md_type_t) do_hash_alg);
- ASSERT_ALLOC(hash, mbedtls_md_get_size(md_info));
+ TEST_CALLOC(hash, mbedtls_md_get_size(md_info));
res = mbedtls_md(md_info, data, datalen, hash);
TEST_EQUAL(res, 0);
diff --git a/tests/suites/test_suite_pkparse.function b/tests/suites/test_suite_pkparse.function
index df139c6..0d9a0c8 100644
--- a/tests/suites/test_suite_pkparse.function
+++ b/tests/suites/test_suite_pkparse.function
@@ -8,7 +8,7 @@
/* END_HEADER */
/* BEGIN_DEPENDENCIES
- * depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_BIGNUM_C
+ * depends_on:MBEDTLS_PK_PARSE_C
* END_DEPENDENCIES
*/
@@ -169,13 +169,13 @@
mbedtls_test_rnd_std_rand, NULL), 0);
output_key_len = input_key->len;
- ASSERT_ALLOC(output_key, output_key_len);
+ TEST_CALLOC(output_key, output_key_len);
/* output_key_len is updated with the real amount of data written to
* output_key buffer. */
output_key_len = mbedtls_pk_write_key_der(&pk, output_key, output_key_len);
TEST_ASSERT(output_key_len > 0);
- ASSERT_COMPARE(exp_output->x, exp_output->len, output_key, output_key_len);
+ TEST_MEMORY_COMPARE(exp_output->x, exp_output->len, output_key, output_key_len);
exit:
if (output_key != NULL) {
diff --git a/tests/suites/test_suite_pkwrite.function b/tests/suites/test_suite_pkwrite.function
index 4820fbd..37c06c8 100644
--- a/tests/suites/test_suite_pkwrite.function
+++ b/tests/suites/test_suite_pkwrite.function
@@ -99,7 +99,7 @@
}
TEST_ASSERT(check_buf_len > 0);
- ASSERT_ALLOC(buf, check_buf_len);
+ TEST_CALLOC(buf, check_buf_len);
if (is_public_key) {
TEST_EQUAL(mbedtls_pk_parse_public_keyfile(&key, key_file), 0);
@@ -113,7 +113,7 @@
TEST_EQUAL(pk_write_any_key(&key, &start_buf, &buf_len, is_public_key,
is_der), 0);
- ASSERT_COMPARE(start_buf, buf_len, check_buf, check_buf_len);
+ TEST_MEMORY_COMPARE(start_buf, buf_len, check_buf, check_buf_len);
#if defined(MBEDTLS_USE_PSA_CRYPTO)
/* Verify that pk_write works also for opaque private keys */
@@ -128,7 +128,7 @@
TEST_EQUAL(pk_write_any_key(&key, &start_buf, &buf_len, is_public_key,
is_der), 0);
- ASSERT_COMPARE(start_buf, buf_len, check_buf, check_buf_len);
+ TEST_MEMORY_COMPARE(start_buf, buf_len, check_buf, check_buf_len);
}
#endif /* MBEDTLS_USE_PSA_CRYPTO */
@@ -144,7 +144,7 @@
/* END_HEADER */
/* BEGIN_DEPENDENCIES
- * depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_PK_WRITE_C:MBEDTLS_BIGNUM_C:MBEDTLS_FS_IO
+ * depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_PK_WRITE_C:MBEDTLS_FS_IO
* END_DEPENDENCIES
*/
@@ -185,13 +185,13 @@
&pub_key_len), 0);
derived_key_len = pub_key_len;
- ASSERT_ALLOC(derived_key_raw, derived_key_len);
+ TEST_CALLOC(derived_key_raw, derived_key_len);
TEST_EQUAL(mbedtls_pk_write_pubkey_der(&priv_key, derived_key_raw,
derived_key_len), pub_key_len);
- ASSERT_COMPARE(derived_key_raw, derived_key_len,
- pub_key_raw, pub_key_len);
+ TEST_MEMORY_COMPARE(derived_key_raw, derived_key_len,
+ pub_key_raw, pub_key_len);
#if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_platform_zeroize(derived_key_raw, sizeof(derived_key_raw));
@@ -203,8 +203,8 @@
TEST_EQUAL(mbedtls_pk_write_pubkey_der(&priv_key, derived_key_raw,
derived_key_len), pub_key_len);
- ASSERT_COMPARE(derived_key_raw, derived_key_len,
- pub_key_raw, pub_key_len);
+ TEST_MEMORY_COMPARE(derived_key_raw, derived_key_len,
+ pub_key_raw, pub_key_len);
#endif /* MBEDTLS_USE_PSA_CRYPTO */
exit:
diff --git a/tests/suites/test_suite_platform_printf.function b/tests/suites/test_suite_platform_printf.function
index 3c816fe..643accf 100644
--- a/tests/suites/test_suite_platform_printf.function
+++ b/tests/suites/test_suite_platform_printf.function
@@ -32,9 +32,9 @@
const size_t n = strlen(result);
/* Nominal case: buffer just large enough */
- ASSERT_ALLOC(output, n + 1);
+ TEST_CALLOC(output, n + 1);
TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, x));
- ASSERT_COMPARE(result, n + 1, output, n + 1);
+ TEST_MEMORY_COMPARE(result, n + 1, output, n + 1);
mbedtls_free(output);
output = NULL;
@@ -53,13 +53,13 @@
const size_t n = sizeof(value) * 2;
/* We assume that long has no padding bits! */
- ASSERT_ALLOC(expected, n + 1);
+ TEST_CALLOC(expected, n + 1);
expected[0] = '7';
memset(expected + 1, 'f', sizeof(value) * 2 - 1);
- ASSERT_ALLOC(output, n + 1);
+ TEST_CALLOC(output, n + 1);
TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, value));
- ASSERT_COMPARE(expected, n + 1, output, n + 1);
+ TEST_MEMORY_COMPARE(expected, n + 1, output, n + 1);
mbedtls_free(output);
output = NULL;
@@ -77,9 +77,9 @@
const size_t n = strlen(result);
/* Nominal case: buffer just large enough */
- ASSERT_ALLOC(output, n + 1);
+ TEST_CALLOC(output, n + 1);
TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, arg1, arg2));
- ASSERT_COMPARE(result, n + 1, output, n + 1);
+ TEST_MEMORY_COMPARE(result, n + 1, output, n + 1);
mbedtls_free(output);
output = NULL;
diff --git a/tests/suites/test_suite_poly1305.function b/tests/suites/test_suite_poly1305.function
index fffa89f..dbf817e 100644
--- a/tests/suites/test_suite_poly1305.function
+++ b/tests/suites/test_suite_poly1305.function
@@ -22,8 +22,8 @@
TEST_ASSERT(mbedtls_poly1305_mac(key->x, src_str->x,
src_str->len, mac) == 0);
- ASSERT_COMPARE(mac, expected_mac->len,
- expected_mac->x, expected_mac->len);
+ TEST_MEMORY_COMPARE(mac, expected_mac->len,
+ expected_mac->x, expected_mac->len);
/*
* Test the streaming API
@@ -36,8 +36,8 @@
TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0);
- ASSERT_COMPARE(mac, expected_mac->len,
- expected_mac->x, expected_mac->len);
+ TEST_MEMORY_COMPARE(mac, expected_mac->len,
+ expected_mac->x, expected_mac->len);
/*
* Test the streaming API again, piecewise
@@ -53,8 +53,8 @@
TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0);
- ASSERT_COMPARE(mac, expected_mac->len,
- expected_mac->x, expected_mac->len);
+ TEST_MEMORY_COMPARE(mac, expected_mac->len,
+ expected_mac->x, expected_mac->len);
}
/*
@@ -69,8 +69,8 @@
TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0);
- ASSERT_COMPARE(mac, expected_mac->len,
- expected_mac->x, expected_mac->len);
+ TEST_MEMORY_COMPARE(mac, expected_mac->len,
+ expected_mac->x, expected_mac->len);
}
mbedtls_poly1305_free(&ctx);
diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function
index b58077b..2396590 100644
--- a/tests/suites/test_suite_psa_crypto.function
+++ b/tests/suites/test_suite_psa_crypto.function
@@ -429,7 +429,7 @@
data_true_size = input_data->len - tag_length;
}
- ASSERT_ALLOC(output_data, output_size);
+ TEST_CALLOC(output_data, output_size);
if (is_encrypt) {
final_output_size = PSA_AEAD_FINISH_OUTPUT_SIZE(key_type, alg);
@@ -439,7 +439,7 @@
TEST_LE_U(final_output_size, PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE);
}
- ASSERT_ALLOC(final_data, final_output_size);
+ TEST_CALLOC(final_data, final_output_size);
if (is_encrypt) {
status = psa_aead_encrypt_setup(&operation, key, alg);
@@ -502,7 +502,7 @@
part_data_size = PSA_AEAD_UPDATE_OUTPUT_SIZE(key_type, alg,
(size_t) data_part_len);
- ASSERT_ALLOC(part_data, part_data_size);
+ TEST_CALLOC(part_data, part_data_size);
for (part_offset = 0, part_count = 0;
part_offset < data_true_size;
@@ -583,8 +583,8 @@
}
- ASSERT_COMPARE(expected_output->x, expected_output->len,
- output_data, output_length);
+ TEST_MEMORY_COMPARE(expected_output->x, expected_output->len,
+ output_data, output_length);
test_ok = 1;
@@ -692,8 +692,8 @@
PSA_ASSERT(psa_mac_sign_finish(&operation, mac,
PSA_MAC_MAX_SIZE, &mac_len));
- ASSERT_COMPARE(expected_output->x, expected_output->len,
- mac, mac_len);
+ TEST_MEMORY_COMPARE(expected_output->x, expected_output->len,
+ mac, mac_len);
}
test_ok = 1;
@@ -744,8 +744,8 @@
psa_status_t expected_status = PSA_SUCCESS;
psa_status_t status;
- ASSERT_ALLOC(buffer0, buffer_length);
- ASSERT_ALLOC(buffer1, buffer_length);
+ TEST_CALLOC(buffer0, buffer_length);
+ TEST_CALLOC(buffer1, buffer_length);
switch (round) {
case 1:
@@ -1410,7 +1410,7 @@
/* Skip the test case if the target running the test cannot
* accommodate large keys due to heap size constraints */
- ASSERT_ALLOC_WEAK(buffer, buffer_size);
+ TEST_CALLOC_OR_SKIP(buffer, buffer_size);
memset(buffer, 'K', byte_size);
PSA_ASSERT(psa_crypto_init());
@@ -1472,7 +1472,7 @@
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
PSA_ASSERT(psa_crypto_init());
- ASSERT_ALLOC(buffer, buffer_size);
+ TEST_CALLOC(buffer, buffer_size);
TEST_ASSERT((ret = construct_fake_rsa_key(buffer, buffer_size, &p,
bits, keypair)) >= 0);
@@ -1519,9 +1519,9 @@
psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
export_size = (ptrdiff_t) data->len + export_size_delta;
- ASSERT_ALLOC(exported, export_size);
+ TEST_CALLOC(exported, export_size);
if (!canonical_input) {
- ASSERT_ALLOC(reexported, export_size);
+ TEST_CALLOC(reexported, export_size);
}
PSA_ASSERT(psa_crypto_init());
@@ -1574,7 +1574,7 @@
}
if (canonical_input) {
- ASSERT_COMPARE(data->x, data->len, exported, exported_length);
+ TEST_MEMORY_COMPARE(data->x, data->len, exported, exported_length);
} else {
mbedtls_svc_key_id_t key2 = MBEDTLS_SVC_KEY_ID_INIT;
PSA_ASSERT(psa_import_key(&attributes, exported, exported_length,
@@ -1583,8 +1583,8 @@
reexported,
export_size,
&reexported_length));
- ASSERT_COMPARE(exported, exported_length,
- reexported, reexported_length);
+ TEST_MEMORY_COMPARE(exported, exported_length,
+ reexported, reexported_length);
PSA_ASSERT(psa_destroy_key(key2));
}
TEST_LE_U(exported_length,
@@ -1645,7 +1645,7 @@
PSA_ASSERT(psa_import_key(&attributes, data->x, data->len, &key));
/* Export the public key */
- ASSERT_ALLOC(exported, export_size);
+ TEST_CALLOC(exported, export_size);
status = psa_export_public_key(key,
exported, export_size,
&exported_length);
@@ -1661,8 +1661,8 @@
PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_type, bits));
TEST_LE_U(expected_public_key->len,
PSA_EXPORT_PUBLIC_KEY_MAX_SIZE);
- ASSERT_COMPARE(expected_public_key->x, expected_public_key->len,
- exported, exported_length);
+ TEST_MEMORY_COMPARE(expected_public_key->x, expected_public_key->len,
+ exported, exported_length);
}
exit:
/*
@@ -1942,8 +1942,8 @@
output_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, exercise_alg,
input_buffer_size);
- ASSERT_ALLOC(input, input_buffer_size);
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(input, input_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
PSA_ASSERT(psa_crypto_init());
@@ -2132,7 +2132,7 @@
key_bits = psa_get_key_bits(&attributes);
buffer_length = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits,
exercise_alg);
- ASSERT_ALLOC(buffer, buffer_length);
+ TEST_CALLOC(buffer, buffer_length);
status = psa_asymmetric_encrypt(key, exercise_alg,
NULL, 0,
@@ -2502,11 +2502,11 @@
psa_get_key_enrollment_algorithm(&target_attributes));
if (expected_usage & PSA_KEY_USAGE_EXPORT) {
size_t length;
- ASSERT_ALLOC(export_buffer, material->len);
+ TEST_CALLOC(export_buffer, material->len);
PSA_ASSERT(psa_export_key(target_key, export_buffer,
material->len, &length));
- ASSERT_COMPARE(material->x, material->len,
- export_buffer, length);
+ TEST_MEMORY_COMPARE(material->x, material->len,
+ export_buffer, length);
}
if (!psa_key_lifetime_is_external(target_lifetime)) {
@@ -2630,7 +2630,7 @@
/* Hash Setup, one-shot */
output_size = PSA_HASH_LENGTH(alg);
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
status = psa_hash_compute(alg, NULL, 0,
output, output_size, &output_length);
@@ -2673,7 +2673,7 @@
psa_status_t expected_status = expected_status_arg;
psa_status_t status;
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
PSA_ASSERT(psa_crypto_init());
@@ -2764,8 +2764,8 @@
output, PSA_HASH_LENGTH(alg),
&output_length));
TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg));
- ASSERT_COMPARE(output, output_length,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, output_length,
+ expected_output->x, expected_output->len);
/* Compute with tight buffer, multi-part */
PSA_ASSERT(psa_hash_setup(&operation, alg));
@@ -2774,16 +2774,16 @@
PSA_HASH_LENGTH(alg),
&output_length));
TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg));
- ASSERT_COMPARE(output, output_length,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, output_length,
+ expected_output->x, expected_output->len);
/* Compute with larger buffer, one-shot */
PSA_ASSERT(psa_hash_compute(alg, input->x, input->len,
output, sizeof(output),
&output_length));
TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg));
- ASSERT_COMPARE(output, output_length,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, output_length,
+ expected_output->x, expected_output->len);
/* Compute with larger buffer, multi-part */
PSA_ASSERT(psa_hash_setup(&operation, alg));
@@ -2791,8 +2791,8 @@
PSA_ASSERT(psa_hash_finish(&operation, output,
sizeof(output), &output_length));
TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg));
- ASSERT_COMPARE(output, output_length,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, output_length,
+ expected_output->x, expected_output->len);
/* Compare with correct hash, one-shot */
PSA_ASSERT(psa_hash_compare(alg, input->x, input->len,
@@ -3388,7 +3388,7 @@
PSA_ERROR_BUFFER_TOO_SMALL);
mbedtls_test_set_step(output_size);
- ASSERT_ALLOC(actual_mac, output_size);
+ TEST_CALLOC(actual_mac, output_size);
/* Calculate the MAC, one-shot case. */
TEST_EQUAL(psa_mac_compute(key, alg,
@@ -3396,8 +3396,8 @@
actual_mac, output_size, &mac_length),
expected_status);
if (expected_status == PSA_SUCCESS) {
- ASSERT_COMPARE(expected_mac->x, expected_mac->len,
- actual_mac, mac_length);
+ TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len,
+ actual_mac, mac_length);
}
if (output_size > 0) {
@@ -3415,8 +3415,8 @@
PSA_ASSERT(psa_mac_abort(&operation));
if (expected_status == PSA_SUCCESS) {
- ASSERT_COMPARE(expected_mac->x, expected_mac->len,
- actual_mac, mac_length);
+ TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len,
+ actual_mac, mac_length);
}
mbedtls_free(actual_mac);
actual_mac = NULL;
@@ -3484,7 +3484,7 @@
PSA_ERROR_INVALID_SIGNATURE);
/* Test a MAC that's too long, one-shot case. */
- ASSERT_ALLOC(perturbed_mac, expected_mac->len + 1);
+ TEST_CALLOC(perturbed_mac, expected_mac->len + 1);
memcpy(perturbed_mac, expected_mac->x, expected_mac->len);
TEST_EQUAL(psa_mac_verify(key, alg,
input->x, input->len,
@@ -3814,7 +3814,7 @@
output_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg,
input->len);
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len,
&key));
@@ -3873,7 +3873,7 @@
unsigned char *output = NULL;
output_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len);
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
PSA_ASSERT(psa_crypto_init());
@@ -3931,7 +3931,7 @@
&key));
output_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg,
plaintext->len);
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
/* set_iv() is not allowed */
PSA_ASSERT(psa_cipher_encrypt_setup(&operation, key, alg));
@@ -3966,8 +3966,8 @@
output_buffer_size - output_length,
&length));
output_length += length;
- ASSERT_COMPARE(ciphertext->x, ciphertext->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(ciphertext->x, ciphertext->len,
+ output, output_length);
/* Multipart encryption */
PSA_ASSERT(psa_cipher_decrypt_setup(&operation, key, alg));
@@ -3984,24 +3984,24 @@
output_buffer_size - output_length,
&length));
output_length += length;
- ASSERT_COMPARE(plaintext->x, plaintext->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(plaintext->x, plaintext->len,
+ output, output_length);
/* One-shot encryption */
output_length = ~0;
PSA_ASSERT(psa_cipher_encrypt(key, alg, plaintext->x, plaintext->len,
output, output_buffer_size,
&output_length));
- ASSERT_COMPARE(ciphertext->x, ciphertext->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(ciphertext->x, ciphertext->len,
+ output, output_length);
/* One-shot decryption */
output_length = ~0;
PSA_ASSERT(psa_cipher_decrypt(key, alg, ciphertext->x, ciphertext->len,
output, output_buffer_size,
&output_length));
- ASSERT_COMPARE(plaintext->x, plaintext->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(plaintext->x, plaintext->len,
+ output, output_length);
exit:
PSA_ASSERT(psa_cipher_abort(&operation));
@@ -4081,8 +4081,8 @@
output1_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len);
output2_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) +
PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg);
- ASSERT_ALLOC(output1, output1_buffer_size);
- ASSERT_ALLOC(output2, output2_buffer_size);
+ TEST_CALLOC(output1, output1_buffer_size);
+ TEST_CALLOC(output2, output2_buffer_size);
PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len,
&key));
@@ -4120,8 +4120,8 @@
output2_length += function_output_length;
PSA_ASSERT(psa_cipher_abort(&operation));
- ASSERT_COMPARE(output1 + iv_size, output1_length - iv_size,
- output2, output2_length);
+ TEST_MEMORY_COMPARE(output1 + iv_size, output1_length - iv_size,
+ output2, output2_length);
exit:
psa_cipher_abort(&operation);
@@ -4173,7 +4173,7 @@
output_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) +
PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg);
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
TEST_LE_U(first_part_size, input->len);
PSA_ASSERT(psa_cipher_update(&operation, input->x, first_part_size,
@@ -4219,8 +4219,8 @@
if (expected_status == PSA_SUCCESS) {
PSA_ASSERT(psa_cipher_abort(&operation));
- ASSERT_COMPARE(expected_output->x, expected_output->len,
- output, total_output_length);
+ TEST_MEMORY_COMPARE(expected_output->x, expected_output->len,
+ output, total_output_length);
}
exit:
@@ -4272,7 +4272,7 @@
output_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) +
PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg);
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
TEST_LE_U(first_part_size, input->len);
PSA_ASSERT(psa_cipher_update(&operation,
@@ -4319,8 +4319,8 @@
if (expected_status == PSA_SUCCESS) {
PSA_ASSERT(psa_cipher_abort(&operation));
- ASSERT_COMPARE(expected_output->x, expected_output->len,
- output, total_output_length);
+ TEST_MEMORY_COMPARE(expected_output->x, expected_output->len,
+ output, total_output_length);
}
exit:
@@ -4368,13 +4368,13 @@
/* Allocate input buffer and copy the iv and the plaintext */
input_buffer_size = ((size_t) input_arg->len + (size_t) iv->len);
if (input_buffer_size > 0) {
- ASSERT_ALLOC(input, input_buffer_size);
+ TEST_CALLOC(input, input_buffer_size);
memcpy(input, iv->x, iv->len);
memcpy(input + iv->len, input_arg->x, input_arg->len);
}
output_buffer_size = PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_buffer_size);
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
/* Decrypt, one-short */
status = psa_cipher_decrypt(key, alg, input, input_buffer_size, output,
@@ -4387,7 +4387,7 @@
output_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg,
input_arg->len) +
PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg);
- ASSERT_ALLOC(output_multi, output_buffer_size);
+ TEST_CALLOC(output_multi, output_buffer_size);
if (iv->len > 0) {
status = psa_cipher_set_iv(&operation, iv->x, iv->len);
@@ -4458,13 +4458,13 @@
/* Allocate input buffer and copy the iv and the plaintext */
input_buffer_size = ((size_t) input_arg->len + (size_t) iv->len);
if (input_buffer_size > 0) {
- ASSERT_ALLOC(input, input_buffer_size);
+ TEST_CALLOC(input, input_buffer_size);
memcpy(input, iv->x, iv->len);
memcpy(input + iv->len, input_arg->x, input_arg->len);
}
output_buffer_size = PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_buffer_size);
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len,
&key));
@@ -4476,8 +4476,8 @@
TEST_LE_U(output_length,
PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(input_buffer_size));
- ASSERT_COMPARE(expected_output->x, expected_output->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(expected_output->x, expected_output->len,
+ output, output_length);
exit:
mbedtls_free(input);
mbedtls_free(output);
@@ -4512,7 +4512,7 @@
PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len,
&key));
output1_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len);
- ASSERT_ALLOC(output1, output1_size);
+ TEST_CALLOC(output1, output1_size);
PSA_ASSERT(psa_cipher_encrypt(key, alg, input->x, input->len,
output1, output1_size,
@@ -4523,7 +4523,7 @@
PSA_CIPHER_ENCRYPT_OUTPUT_MAX_SIZE(input->len));
output2_size = output1_length;
- ASSERT_ALLOC(output2, output2_size);
+ TEST_CALLOC(output2, output2_size);
PSA_ASSERT(psa_cipher_decrypt(key, alg, output1, output1_length,
output2, output2_size,
@@ -4533,7 +4533,7 @@
TEST_LE_U(output2_length,
PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(output1_length));
- ASSERT_COMPARE(input->x, input->len, output2, output2_length);
+ TEST_MEMORY_COMPARE(input->x, input->len, output2, output2_length);
exit:
mbedtls_free(output1);
@@ -4589,7 +4589,7 @@
output1_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len);
TEST_LE_U(output1_buffer_size,
PSA_CIPHER_ENCRYPT_OUTPUT_MAX_SIZE(input->len));
- ASSERT_ALLOC(output1, output1_buffer_size);
+ TEST_CALLOC(output1, output1_buffer_size);
TEST_LE_U(first_part_size, input->len);
@@ -4632,7 +4632,7 @@
PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, output1_length));
TEST_LE_U(output2_buffer_size,
PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(output1_length));
- ASSERT_ALLOC(output2, output2_buffer_size);
+ TEST_CALLOC(output2, output2_buffer_size);
if (iv_length > 0) {
PSA_ASSERT(psa_cipher_set_iv(&operation2,
@@ -4673,7 +4673,7 @@
PSA_ASSERT(psa_cipher_abort(&operation2));
- ASSERT_COMPARE(input->x, input->len, output2, output2_length);
+ TEST_MEMORY_COMPARE(input->x, input->len, output2, output2_length);
exit:
psa_cipher_abort(&operation1);
@@ -4728,7 +4728,7 @@
TEST_LE_U(output_size,
PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len));
}
- ASSERT_ALLOC(output_data, output_size);
+ TEST_CALLOC(output_data, output_size);
status = psa_aead_encrypt(key, alg,
nonce->x, nonce->len,
@@ -4749,7 +4749,7 @@
TEST_EQUAL(status, expected_result);
if (PSA_SUCCESS == expected_result) {
- ASSERT_ALLOC(output_data2, output_length);
+ TEST_CALLOC(output_data2, output_length);
/* For all currently defined algorithms, PSA_AEAD_DECRYPT_OUTPUT_SIZE
* should be exact. */
@@ -4768,8 +4768,8 @@
&output_length2),
expected_result);
- ASSERT_COMPARE(input_data->x, input_data->len,
- output_data2, output_length2);
+ TEST_MEMORY_COMPARE(input_data->x, input_data->len,
+ output_data2, output_length2);
}
exit:
@@ -4817,7 +4817,7 @@
PSA_AEAD_ENCRYPT_OUTPUT_SIZE(key_type, alg, input_data->len));
TEST_LE_U(output_size,
PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len));
- ASSERT_ALLOC(output_data, output_size);
+ TEST_CALLOC(output_data, output_size);
status = psa_aead_encrypt(key, alg,
nonce->x, nonce->len,
@@ -4835,8 +4835,8 @@
}
PSA_ASSERT(status);
- ASSERT_COMPARE(expected_result->x, expected_result->len,
- output_data, output_length);
+ TEST_MEMORY_COMPARE(expected_result->x, expected_result->len,
+ output_data, output_length);
exit:
psa_destroy_key(key);
@@ -4887,7 +4887,7 @@
TEST_LE_U(output_size,
PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(input_data->len));
}
- ASSERT_ALLOC(output_data, output_size);
+ TEST_CALLOC(output_data, output_size);
status = psa_aead_decrypt(key, alg,
nonce->x, nonce->len,
@@ -4908,8 +4908,8 @@
TEST_EQUAL(status, expected_result);
if (expected_result == PSA_SUCCESS) {
- ASSERT_COMPARE(expected_data->x, expected_data->len,
- output_data, output_length);
+ TEST_MEMORY_COMPARE(expected_data->x, expected_data->len,
+ output_data, output_length);
}
exit:
@@ -5146,13 +5146,13 @@
output_size = PSA_AEAD_UPDATE_OUTPUT_SIZE(key_type, alg, input_data->len);
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
ciphertext_size = PSA_AEAD_FINISH_OUTPUT_SIZE(key_type, alg);
TEST_LE_U(ciphertext_size, PSA_AEAD_FINISH_OUTPUT_MAX_SIZE);
- ASSERT_ALLOC(ciphertext, ciphertext_size);
+ TEST_CALLOC(ciphertext, ciphertext_size);
status = psa_aead_encrypt_setup(&operation, key, alg);
@@ -5249,13 +5249,13 @@
output_size = PSA_AEAD_UPDATE_OUTPUT_SIZE(key_type, alg, input_data->len);
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
ciphertext_size = PSA_AEAD_FINISH_OUTPUT_SIZE(key_type, alg);
TEST_LE_U(ciphertext_size, PSA_AEAD_FINISH_OUTPUT_MAX_SIZE);
- ASSERT_ALLOC(ciphertext, ciphertext_size);
+ TEST_CALLOC(ciphertext, ciphertext_size);
status = psa_aead_encrypt_setup(&operation, key, alg);
@@ -5272,12 +5272,12 @@
/* -1 == zero length and valid buffer, 0 = zero length and NULL buffer. */
if (nonce_length_arg == -1) {
/* Arbitrary size buffer, to test zero length valid buffer. */
- ASSERT_ALLOC(nonce_buffer, 4);
+ TEST_CALLOC(nonce_buffer, 4);
nonce_length = 0;
} else {
/* If length is zero, then this will return NULL. */
nonce_length = (size_t) nonce_length_arg;
- ASSERT_ALLOC(nonce_buffer, nonce_length);
+ TEST_CALLOC(nonce_buffer, nonce_length);
if (nonce_buffer) {
for (index = 0; index < nonce_length - 1; ++index) {
@@ -5366,11 +5366,11 @@
PSA_ASSERT(psa_get_key_attributes(key, &attributes));
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
ciphertext_size = PSA_AEAD_FINISH_OUTPUT_SIZE(key_type, alg);
- ASSERT_ALLOC(ciphertext, ciphertext_size);
+ TEST_CALLOC(ciphertext, ciphertext_size);
status = psa_aead_encrypt_setup(&operation, key, alg);
@@ -5453,11 +5453,11 @@
ciphertext_size = PSA_AEAD_UPDATE_OUTPUT_SIZE(key_type, alg, input_data->len);
- ASSERT_ALLOC(ciphertext, ciphertext_size);
+ TEST_CALLOC(ciphertext, ciphertext_size);
- ASSERT_ALLOC(finish_ciphertext, finish_ciphertext_size);
+ TEST_CALLOC(finish_ciphertext, finish_ciphertext_size);
- ASSERT_ALLOC(tag_buffer, tag_size);
+ TEST_CALLOC(tag_buffer, tag_size);
status = psa_aead_encrypt_setup(&operation, key, alg);
@@ -5542,11 +5542,11 @@
plaintext_size = PSA_AEAD_UPDATE_OUTPUT_SIZE(key_type, alg,
input_data->len);
- ASSERT_ALLOC(plaintext, plaintext_size);
+ TEST_CALLOC(plaintext, plaintext_size);
verify_plaintext_size = PSA_AEAD_VERIFY_OUTPUT_SIZE(key_type, alg);
- ASSERT_ALLOC(finish_plaintext, verify_plaintext_size);
+ TEST_CALLOC(finish_plaintext, verify_plaintext_size);
status = psa_aead_decrypt_setup(&operation, key, alg);
@@ -5683,13 +5683,13 @@
output_size = PSA_AEAD_UPDATE_OUTPUT_SIZE(key_type, alg, input_data->len);
- ASSERT_ALLOC(output_data, output_size);
+ TEST_CALLOC(output_data, output_size);
finish_output_size = PSA_AEAD_FINISH_OUTPUT_SIZE(key_type, alg);
TEST_LE_U(finish_output_size, PSA_AEAD_FINISH_OUTPUT_MAX_SIZE);
- ASSERT_ALLOC(final_data, finish_output_size);
+ TEST_CALLOC(final_data, finish_output_size);
/* Test all operations error without calling setup first. */
@@ -6487,7 +6487,7 @@
key_bits, alg);
TEST_ASSERT(signature_size != 0);
TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
/* Perform the signature. */
PSA_ASSERT(psa_sign_hash(key, alg,
@@ -6495,8 +6495,8 @@
signature, signature_size,
&signature_length));
/* Verify that the signature is what is expected. */
- ASSERT_COMPARE(output_data->x, output_data->len,
- signature, signature_length);
+ TEST_MEMORY_COMPARE(output_data->x, output_data->len,
+ signature, signature_length);
exit:
/*
@@ -6570,7 +6570,7 @@
key_bits, alg);
TEST_ASSERT(signature_size != 0);
TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
psa_interruptible_set_max_ops(max_ops);
@@ -6618,8 +6618,8 @@
TEST_LE_U(num_completes, max_completes);
/* Verify that the signature is what is expected. */
- ASSERT_COMPARE(output_data->x, output_data->len,
- signature, signature_length);
+ TEST_MEMORY_COMPARE(output_data->x, output_data->len,
+ signature, signature_length);
PSA_ASSERT(psa_sign_hash_abort(&operation));
@@ -6655,7 +6655,7 @@
size_t signature_length = 0xdeadbeef;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
PSA_ASSERT(psa_crypto_init());
@@ -6735,7 +6735,7 @@
psa_sign_hash_interruptible_operation_t operation =
psa_sign_hash_interruptible_operation_init();
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
PSA_ASSERT(psa_crypto_init());
@@ -6863,7 +6863,7 @@
key_bits, alg);
TEST_ASSERT(signature_size != 0);
TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
/* Perform the signature. */
PSA_ASSERT(psa_sign_hash(key, alg,
@@ -6966,7 +6966,7 @@
key_bits, alg);
TEST_ASSERT(signature_size != 0);
TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
psa_interruptible_set_max_ops(max_ops);
@@ -7448,7 +7448,7 @@
key_bits, alg);
TEST_ASSERT(signature_size != 0);
TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
psa_interruptible_set_max_ops(PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED);
@@ -7604,7 +7604,7 @@
key_bits, alg);
TEST_ASSERT(signature_size != 0);
TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
/* --- Change function inputs mid run, to cause an error (sign only,
* verify passes all inputs to start. --- */
@@ -7735,7 +7735,7 @@
TEST_ASSERT(signature_size != 0);
TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
/* Check that default max ops gets set if we don't set it. */
PSA_ASSERT(psa_sign_hash_start(&sign_operation, key, alg,
@@ -7909,15 +7909,15 @@
signature_size = PSA_SIGN_OUTPUT_SIZE(key_type, key_bits, alg);
TEST_ASSERT(signature_size != 0);
TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
PSA_ASSERT(psa_sign_message(key, alg,
input_data->x, input_data->len,
signature, signature_size,
&signature_length));
- ASSERT_COMPARE(output_data->x, output_data->len,
- signature, signature_length);
+ TEST_MEMORY_COMPARE(output_data->x, output_data->len,
+ signature, signature_length);
exit:
psa_reset_key_attributes(&attributes);
@@ -7947,7 +7947,7 @@
size_t signature_length = 0xdeadbeef;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
PSA_ASSERT(psa_crypto_init());
@@ -8007,7 +8007,7 @@
signature_size = PSA_SIGN_OUTPUT_SIZE(key_type, key_bits, alg);
TEST_ASSERT(signature_size != 0);
TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
PSA_ASSERT(psa_sign_message(key, alg,
input_data->x, input_data->len,
@@ -8147,7 +8147,7 @@
output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg);
TEST_LE_U(output_size, PSA_ASYMMETRIC_ENCRYPT_OUTPUT_MAX_SIZE);
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
/* Encrypt the input */
actual_status = psa_asymmetric_encrypt(key, alg,
@@ -8229,13 +8229,13 @@
output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg);
TEST_LE_U(output_size, PSA_ASYMMETRIC_ENCRYPT_OUTPUT_MAX_SIZE);
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
output2_size = input_data->len;
TEST_LE_U(output2_size,
PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg));
TEST_LE_U(output2_size, PSA_ASYMMETRIC_DECRYPT_OUTPUT_MAX_SIZE);
- ASSERT_ALLOC(output2, output2_size);
+ TEST_CALLOC(output2, output2_size);
/* We test encryption by checking that encrypt-then-decrypt gives back
* the original plaintext because of the non-optional random
@@ -8254,8 +8254,8 @@
label->x, label->len,
output2, output2_size,
&output2_length));
- ASSERT_COMPARE(input_data->x, input_data->len,
- output2, output2_length);
+ TEST_MEMORY_COMPARE(input_data->x, input_data->len,
+ output2, output2_length);
exit:
/*
@@ -8303,7 +8303,7 @@
/* Determine the maximum ciphertext length */
output_size = PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg);
TEST_LE_U(output_size, PSA_ASYMMETRIC_DECRYPT_OUTPUT_MAX_SIZE);
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
PSA_ASSERT(psa_asymmetric_decrypt(key, alg,
input_data->x, input_data->len,
@@ -8311,8 +8311,8 @@
output,
output_size,
&output_length));
- ASSERT_COMPARE(expected_data->x, expected_data->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(expected_data->x, expected_data->len,
+ output, output_length);
/* If the label is empty, the test framework puts a non-null pointer
* in label->x. Test that a null pointer works as well. */
@@ -8327,8 +8327,8 @@
output,
output_size,
&output_length));
- ASSERT_COMPARE(expected_data->x, expected_data->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(expected_data->x, expected_data->len,
+ output, output_length);
}
exit:
@@ -8358,7 +8358,7 @@
psa_status_t expected_status = expected_status_arg;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
PSA_ASSERT(psa_crypto_init());
@@ -8726,7 +8726,7 @@
expected_outputs[i] = NULL;
}
}
- ASSERT_ALLOC(output_buffer, output_buffer_size);
+ TEST_CALLOC(output_buffer, output_buffer_size);
PSA_ASSERT(psa_crypto_init());
/* Extraction phase. */
@@ -8784,7 +8784,7 @@
}
break;
default:
- TEST_ASSERT(!"default case not supported");
+ TEST_FAIL("default case not supported");
break;
}
break;
@@ -8834,7 +8834,7 @@
key_agreement_peer_key->len), statuses[i]);
break;
default:
- TEST_ASSERT(!"default case not supported");
+ TEST_FAIL("default case not supported");
break;
}
@@ -8896,8 +8896,8 @@
/* Success. Check the read data. */
PSA_ASSERT(status);
if (output_sizes[i] != 0) {
- ASSERT_COMPARE(output_buffer, output_sizes[i],
- expected_outputs[i], output_sizes[i]);
+ TEST_MEMORY_COMPARE(output_buffer, output_sizes[i],
+ expected_outputs[i], output_sizes[i]);
}
/* Check the operation status. */
expected_capacity -= output_sizes[i];
@@ -8999,7 +8999,7 @@
psa_status_t expected_capacity_status = (psa_status_t) expected_capacity_status_arg;
psa_status_t expected_output_status = (psa_status_t) expected_output_status_arg;
- ASSERT_ALLOC(output_buffer, expected_output->len);
+ TEST_CALLOC(output_buffer, expected_output->len);
PSA_ASSERT(psa_crypto_init());
PSA_ASSERT(psa_key_derivation_setup(&operation, alg));
@@ -9019,8 +9019,8 @@
TEST_EQUAL(status, expected_output_status);
if (expected_output->len != 0 && expected_output_status == PSA_SUCCESS) {
- ASSERT_COMPARE(output_buffer, expected_output->len, expected_output->x,
- expected_output->len);
+ TEST_MEMORY_COMPARE(output_buffer, expected_output->len, expected_output->x,
+ expected_output->len);
}
exit:
@@ -9120,8 +9120,8 @@
psa_key_attributes_t derived_attributes = PSA_KEY_ATTRIBUTES_INIT;
size_t length;
- ASSERT_ALLOC(output_buffer, capacity);
- ASSERT_ALLOC(export_buffer, capacity);
+ TEST_CALLOC(output_buffer, capacity);
+ TEST_CALLOC(export_buffer, capacity);
PSA_ASSERT(psa_crypto_init());
psa_set_key_usage_flags(&base_attributes, PSA_KEY_USAGE_DERIVE);
@@ -9171,8 +9171,8 @@
TEST_EQUAL(length, bytes2);
/* Compare the outputs from the two runs. */
- ASSERT_COMPARE(output_buffer, bytes1 + bytes2,
- export_buffer, capacity);
+ TEST_MEMORY_COMPARE(output_buffer, bytes1 + bytes2,
+ export_buffer, capacity);
exit:
mbedtls_free(output_buffer);
@@ -9205,7 +9205,7 @@
psa_key_attributes_t derived_attributes = PSA_KEY_ATTRIBUTES_INIT;
size_t export_length;
- ASSERT_ALLOC(export_buffer, export_buffer_size);
+ TEST_CALLOC(export_buffer, export_buffer_size);
PSA_ASSERT(psa_crypto_init());
psa_set_key_usage_flags(&base_attributes, PSA_KEY_USAGE_DERIVE);
@@ -9232,8 +9232,8 @@
PSA_ASSERT(psa_export_key(derived_key,
export_buffer, export_buffer_size,
&export_length));
- ASSERT_COMPARE(export_buffer, export_length,
- expected_export->x, expected_export->len);
+ TEST_MEMORY_COMPARE(export_buffer, export_length,
+ expected_export->x, expected_export->len);
exit:
mbedtls_free(export_buffer);
@@ -9377,31 +9377,31 @@
PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE);
/* Good case with exact output size */
- ASSERT_ALLOC(output, expected_output->len);
+ TEST_CALLOC(output, expected_output->len);
PSA_ASSERT(psa_raw_key_agreement(alg, our_key,
peer_key_data->x, peer_key_data->len,
output, expected_output->len,
&output_length));
- ASSERT_COMPARE(output, output_length,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, output_length,
+ expected_output->x, expected_output->len);
mbedtls_free(output);
output = NULL;
output_length = ~0;
/* Larger buffer */
- ASSERT_ALLOC(output, expected_output->len + 1);
+ TEST_CALLOC(output, expected_output->len + 1);
PSA_ASSERT(psa_raw_key_agreement(alg, our_key,
peer_key_data->x, peer_key_data->len,
output, expected_output->len + 1,
&output_length));
- ASSERT_COMPARE(output, output_length,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output, output_length,
+ expected_output->x, expected_output->len);
mbedtls_free(output);
output = NULL;
output_length = ~0;
/* Buffer too small */
- ASSERT_ALLOC(output, expected_output->len - 1);
+ TEST_CALLOC(output, expected_output->len - 1);
TEST_EQUAL(psa_raw_key_agreement(alg, our_key,
peer_key_data->x, peer_key_data->len,
output, expected_output->len - 1,
@@ -9490,8 +9490,8 @@
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
uint8_t *actual_output = NULL;
- ASSERT_ALLOC(actual_output, MAX(expected_output1->len,
- expected_output2->len));
+ TEST_CALLOC(actual_output, MAX(expected_output1->len,
+ expected_output2->len));
PSA_ASSERT(psa_crypto_init());
@@ -9517,14 +9517,14 @@
PSA_ASSERT(psa_key_derivation_output_bytes(&operation,
actual_output,
expected_output1->len));
- ASSERT_COMPARE(actual_output, expected_output1->len,
- expected_output1->x, expected_output1->len);
+ TEST_MEMORY_COMPARE(actual_output, expected_output1->len,
+ expected_output1->x, expected_output1->len);
if (expected_output2->len != 0) {
PSA_ASSERT(psa_key_derivation_output_bytes(&operation,
actual_output,
expected_output2->len));
- ASSERT_COMPARE(actual_output, expected_output2->len,
- expected_output2->x, expected_output2->len);
+ TEST_MEMORY_COMPARE(actual_output, expected_output2->len,
+ expected_output2->x, expected_output2->len);
}
exit:
@@ -9546,8 +9546,8 @@
TEST_ASSERT(bytes_arg >= 0);
- ASSERT_ALLOC(output, bytes);
- ASSERT_ALLOC(changed, bytes);
+ TEST_CALLOC(output, bytes);
+ TEST_CALLOC(changed, bytes);
PSA_ASSERT(psa_crypto_init());
@@ -9665,8 +9665,8 @@
is_default_public_exponent = 1;
e_read_size = 0;
}
- ASSERT_ALLOC(e_read_buffer, e_read_size);
- ASSERT_ALLOC(exported, exported_size);
+ TEST_CALLOC(e_read_buffer, e_read_size);
+ TEST_CALLOC(exported, exported_size);
PSA_ASSERT(psa_crypto_init());
@@ -9692,7 +9692,7 @@
if (is_default_public_exponent) {
TEST_EQUAL(e_read_length, 0);
} else {
- ASSERT_COMPARE(e_read_buffer, e_read_length, e_arg->x, e_arg->len);
+ TEST_MEMORY_COMPARE(e_read_buffer, e_read_length, e_arg->x, e_arg->len);
}
/* Do something with the key according to its type and permitted usage. */
@@ -9728,7 +9728,7 @@
TEST_EQUAL(p[1], 0);
TEST_EQUAL(p[2], 1);
} else {
- ASSERT_COMPARE(p, len, e_arg->x, e_arg->len);
+ TEST_MEMORY_COMPARE(p, len, e_arg->x, e_arg->len);
}
}
@@ -9768,8 +9768,8 @@
size_t second_exported_length;
if (usage_flags & PSA_KEY_USAGE_EXPORT) {
- ASSERT_ALLOC(first_export, export_size);
- ASSERT_ALLOC(second_export, export_size);
+ TEST_CALLOC(first_export, export_size);
+ TEST_CALLOC(second_export, export_size);
}
PSA_ASSERT(psa_crypto_init());
@@ -9826,7 +9826,7 @@
break;
default:
- TEST_ASSERT(!"generation_method not implemented in test");
+ TEST_FAIL("generation_method not implemented in test");
break;
}
psa_reset_key_attributes(&attributes);
@@ -9837,8 +9837,8 @@
first_export, export_size,
&first_exported_length));
if (generation_method == IMPORT_KEY) {
- ASSERT_COMPARE(data->x, data->len,
- first_export, first_exported_length);
+ TEST_MEMORY_COMPARE(data->x, data->len,
+ first_export, first_exported_length);
}
}
@@ -9864,8 +9864,8 @@
PSA_ASSERT(psa_export_key(key,
second_export, export_size,
&second_exported_length));
- ASSERT_COMPARE(first_export, first_exported_length,
- second_export, second_exported_length);
+ TEST_MEMORY_COMPARE(first_export, first_exported_length,
+ second_export, second_exported_length);
}
/* Do something with the key according to its type and permitted usage. */
@@ -9916,7 +9916,7 @@
size_t buf_size = PSA_PAKE_OUTPUT_SIZE(alg, primitive_arg,
PSA_PAKE_STEP_KEY_SHARE);
- ASSERT_ALLOC(output_buffer, buf_size);
+ TEST_CALLOC(output_buffer, buf_size);
if (pw_data->len > 0) {
psa_set_key_usage_flags(&attributes, key_usage_pw);
diff --git a/tests/suites/test_suite_psa_crypto_driver_wrappers.function b/tests/suites/test_suite_psa_crypto_driver_wrappers.function
index fa83ad3..1d96f72 100644
--- a/tests/suites/test_suite_psa_crypto_driver_wrappers.function
+++ b/tests/suites/test_suite_psa_crypto_driver_wrappers.function
@@ -49,8 +49,8 @@
size_t c_x1_pr_off, c_x2_pr_off, c_x2s_pr_off;
psa_status_t status;
- ASSERT_ALLOC(buffer0, buffer_length);
- ASSERT_ALLOC(buffer1, buffer_length);
+ TEST_CALLOC(buffer0, buffer_length);
+ TEST_CALLOC(buffer1, buffer_length);
switch (round) {
case 1:
@@ -460,13 +460,13 @@
TEST_EQUAL(buf[0], 0x00);
TEST_EQUAL(buf[1], 0x02);
TEST_EQUAL(buf[length - input_data->len - 1], 0x00);
- ASSERT_COMPARE(buf + length - input_data->len, input_data->len,
- input_data->x, input_data->len);
+ TEST_MEMORY_COMPARE(buf + length - input_data->len, input_data->len,
+ input_data->x, input_data->len);
} else if (PSA_ALG_IS_RSA_OAEP(alg)) {
TEST_EQUAL(buf[0], 0x00);
/* The rest is too hard to check */
} else {
- TEST_ASSERT(!"Encryption result sanity check not implemented for RSA algorithm");
+ TEST_FAIL("Encryption result sanity check not implemented for RSA algorithm");
}
#endif /* MBEDTLS_BIGNUM_C */
@@ -538,7 +538,7 @@
TEST_ASSERT(signature_size != 0);
TEST_ASSERT(signature_size <= PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
actual_status = psa_sign_hash(key, alg,
data_input->x, data_input->len,
@@ -546,8 +546,8 @@
&signature_length);
TEST_EQUAL(actual_status, expected_status);
if (expected_status == PSA_SUCCESS) {
- ASSERT_COMPARE(signature, signature_length,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(signature, signature_length,
+ expected_output->x, expected_output->len);
}
TEST_EQUAL(mbedtls_test_driver_signature_sign_hooks.hits, 1);
@@ -665,7 +665,7 @@
TEST_ASSERT(signature_size != 0);
TEST_ASSERT(signature_size <= PSA_SIGNATURE_MAX_SIZE);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(signature, signature_size);
actual_status = psa_sign_message(key, alg,
data_input->x, data_input->len,
@@ -673,8 +673,8 @@
&signature_length);
TEST_EQUAL(actual_status, expected_status);
if (expected_status == PSA_SUCCESS) {
- ASSERT_COMPARE(signature, signature_length,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(signature, signature_length,
+ expected_output->x, expected_output->len);
}
/* In the builtin algorithm the driver is called twice. */
TEST_EQUAL(mbedtls_test_driver_signature_sign_hooks.hits,
@@ -795,8 +795,8 @@
psa_export_key(key, actual_output, sizeof(actual_output), &actual_output_length);
if (fake_output->len > 0) {
- ASSERT_COMPARE(actual_output, actual_output_length,
- expected_output, expected_output_length);
+ TEST_MEMORY_COMPARE(actual_output, actual_output_length,
+ expected_output, expected_output_length);
} else {
size_t zeroes = 0;
for (size_t i = 0; i < sizeof(actual_output); i++) {
@@ -927,8 +927,8 @@
}
if (actual_status == PSA_SUCCESS) {
- ASSERT_COMPARE(actual_output, actual_output_length,
- expected_output_ptr, expected_output_length);
+ TEST_MEMORY_COMPARE(actual_output, actual_output_length,
+ expected_output_ptr, expected_output_length);
}
exit:
psa_reset_key_attributes(&attributes);
@@ -997,7 +997,7 @@
mbedtls_test_driver_key_agreement_hooks.hits = 0;
mbedtls_test_driver_key_agreement_hooks.forced_status = force_status;
- ASSERT_ALLOC(actual_output, expected_output->len);
+ TEST_CALLOC(actual_output, expected_output->len);
actual_status = psa_raw_key_agreement(alg, our_key,
peer_key_data->x, peer_key_data->len,
actual_output, expected_output->len,
@@ -1006,8 +1006,8 @@
TEST_EQUAL(mbedtls_test_driver_key_agreement_hooks.hits, 1);
if (actual_status == PSA_SUCCESS) {
- ASSERT_COMPARE(actual_output, actual_output_length,
- expected_output_ptr, expected_output_length);
+ TEST_MEMORY_COMPARE(actual_output, actual_output_length,
+ expected_output_ptr, expected_output_length);
}
mbedtls_free(actual_output);
actual_output = NULL;
@@ -1053,8 +1053,8 @@
output1_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len);
output2_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) +
PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg);
- ASSERT_ALLOC(output1, output1_buffer_size);
- ASSERT_ALLOC(output2, output2_buffer_size);
+ TEST_CALLOC(output1, output1_buffer_size);
+ TEST_CALLOC(output2, output2_buffer_size);
PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len,
&key));
@@ -1093,8 +1093,8 @@
PSA_ASSERT(psa_cipher_abort(&operation));
// driver function should've been called as part of the finish() core routine
TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0);
- ASSERT_COMPARE(output1 + iv_size, output1_length - iv_size,
- output2, output2_length);
+ TEST_MEMORY_COMPARE(output1 + iv_size, output1_length - iv_size,
+ output2, output2_length);
exit:
psa_cipher_abort(&operation);
@@ -1171,7 +1171,7 @@
output_buffer_size = ((size_t) input->len +
PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type));
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
if (mock_output_arg) {
mbedtls_test_driver_cipher_hooks.forced_output = expected_output->x;
@@ -1221,8 +1221,8 @@
PSA_ASSERT(psa_cipher_abort(&operation));
TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0);
- ASSERT_COMPARE(expected_output->x, expected_output->len,
- output, total_output_length);
+ TEST_MEMORY_COMPARE(expected_output->x, expected_output->len,
+ output, total_output_length);
}
exit:
@@ -1299,7 +1299,7 @@
output_buffer_size = ((size_t) input->len +
PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type));
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
if (mock_output_arg) {
mbedtls_test_driver_cipher_hooks.forced_output = expected_output->x;
@@ -1350,8 +1350,8 @@
PSA_ASSERT(psa_cipher_abort(&operation));
TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0);
- ASSERT_COMPARE(expected_output->x, expected_output->len,
- output, total_output_length);
+ TEST_MEMORY_COMPARE(expected_output->x, expected_output->len,
+ output, total_output_length);
}
exit:
@@ -1398,13 +1398,13 @@
/* Allocate input buffer and copy the iv and the plaintext */
input_buffer_size = ((size_t) input_arg->len + (size_t) iv->len);
if (input_buffer_size > 0) {
- ASSERT_ALLOC(input, input_buffer_size);
+ TEST_CALLOC(input, input_buffer_size);
memcpy(input, iv->x, iv->len);
memcpy(input + iv->len, input_arg->x, input_arg->len);
}
output_buffer_size = PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_buffer_size);
- ASSERT_ALLOC(output, output_buffer_size);
+ TEST_CALLOC(output, output_buffer_size);
PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len,
&key));
@@ -1422,8 +1422,8 @@
TEST_EQUAL(status, expected_status);
if (expected_status == PSA_SUCCESS) {
- ASSERT_COMPARE(expected_output->x, expected_output->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(expected_output->x, expected_output->len,
+ output, output_length);
}
exit:
@@ -1451,7 +1451,7 @@
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
mbedtls_test_driver_cipher_hooks = mbedtls_test_driver_cipher_hooks_init();
- ASSERT_ALLOC(output, input->len + 16);
+ TEST_CALLOC(output, input->len + 16);
output_buffer_size = input->len + 16;
PSA_ASSERT(psa_crypto_init());
@@ -1691,7 +1691,7 @@
PSA_AEAD_ENCRYPT_OUTPUT_SIZE(key_type, alg, input_data->len));
TEST_ASSERT(output_size <=
PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len));
- ASSERT_ALLOC(output_data, output_size);
+ TEST_CALLOC(output_data, output_size);
mbedtls_test_driver_aead_hooks.forced_status = forced_status;
status = psa_aead_encrypt(key, alg,
@@ -1707,8 +1707,8 @@
PSA_SUCCESS : forced_status);
if (status == PSA_SUCCESS) {
- ASSERT_COMPARE(expected_result->x, expected_result->len,
- output_data, output_length);
+ TEST_MEMORY_COMPARE(expected_result->x, expected_result->len,
+ output_data, output_length);
}
exit:
@@ -1753,7 +1753,7 @@
output_size = input_data->len - PSA_AEAD_TAG_LENGTH(key_type, key_bits,
alg);
- ASSERT_ALLOC(output_data, output_size);
+ TEST_CALLOC(output_data, output_size);
mbedtls_test_driver_aead_hooks.forced_status = forced_status;
status = psa_aead_decrypt(key, alg,
@@ -1770,8 +1770,8 @@
PSA_SUCCESS : forced_status);
if (status == PSA_SUCCESS) {
- ASSERT_COMPARE(expected_data->x, expected_data->len,
- output_data, output_length);
+ TEST_MEMORY_COMPARE(expected_data->x, expected_data->len,
+ output_data, output_length);
}
exit:
@@ -1816,7 +1816,7 @@
PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len,
&key));
- ASSERT_ALLOC(actual_mac, mac_buffer_size);
+ TEST_CALLOC(actual_mac, mac_buffer_size);
mbedtls_test_driver_mac_hooks.forced_status = forced_status;
/*
@@ -1839,8 +1839,8 @@
TEST_EQUAL(mbedtls_test_driver_mac_hooks.hits, 1);
if (forced_status == PSA_SUCCESS) {
- ASSERT_COMPARE(expected_mac->x, expected_mac->len,
- actual_mac, mac_length);
+ TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len,
+ actual_mac, mac_length);
}
mbedtls_free(actual_mac);
@@ -1891,7 +1891,7 @@
PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len,
&key));
- ASSERT_ALLOC(actual_mac, mac_buffer_size);
+ TEST_CALLOC(actual_mac, mac_buffer_size);
mbedtls_test_driver_mac_hooks.forced_status = forced_status;
/*
@@ -1957,8 +1957,8 @@
}
if (forced_status == PSA_SUCCESS) {
- ASSERT_COMPARE(expected_mac->x, expected_mac->len,
- actual_mac, mac_length);
+ TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len,
+ actual_mac, mac_length);
}
mbedtls_free(actual_mac);
@@ -2152,15 +2152,15 @@
psa_status_t actual_status;
PSA_ASSERT(psa_crypto_init());
- ASSERT_ALLOC(output_buffer, expected_output->len);
+ TEST_CALLOC(output_buffer, expected_output->len);
actual_status = psa_export_key(key, output_buffer, expected_output->len, &output_size);
if (expected_status == PSA_SUCCESS) {
PSA_ASSERT(actual_status);
TEST_EQUAL(output_size, expected_output->len);
- ASSERT_COMPARE(output_buffer, output_size,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output_buffer, output_size,
+ expected_output->x, expected_output->len);
PSA_ASSERT(psa_get_key_attributes(key, &attributes));
TEST_EQUAL(psa_get_key_bits(&attributes), builtin_key_bits);
@@ -2203,15 +2203,15 @@
psa_status_t actual_status;
PSA_ASSERT(psa_crypto_init());
- ASSERT_ALLOC(output_buffer, expected_output->len);
+ TEST_CALLOC(output_buffer, expected_output->len);
actual_status = psa_export_public_key(key, output_buffer, expected_output->len, &output_size);
if (expected_status == PSA_SUCCESS) {
PSA_ASSERT(actual_status);
TEST_EQUAL(output_size, expected_output->len);
- ASSERT_COMPARE(output_buffer, output_size,
- expected_output->x, expected_output->len);
+ TEST_MEMORY_COMPARE(output_buffer, output_size,
+ expected_output->x, expected_output->len);
PSA_ASSERT(psa_get_key_attributes(key, &attributes));
TEST_EQUAL(psa_get_key_bits(&attributes), builtin_key_bits);
@@ -2244,7 +2244,7 @@
PSA_ASSERT(psa_crypto_init());
- ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg));
+ TEST_CALLOC(output, PSA_HASH_LENGTH(alg));
/* Do this after psa_crypto_init() which may call hash drivers */
mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init();
@@ -2257,7 +2257,7 @@
TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, forced_status);
if (expected_status == PSA_SUCCESS) {
- ASSERT_COMPARE(output, output_length, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len);
}
exit:
@@ -2282,7 +2282,7 @@
PSA_ASSERT(psa_crypto_init());
- ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg));
+ TEST_CALLOC(output, PSA_HASH_LENGTH(alg));
/* Do this after psa_crypto_init() which may call hash drivers */
mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init();
@@ -2305,7 +2305,7 @@
forced_status == PSA_ERROR_NOT_SUPPORTED ? 1 : 4);
TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, forced_status);
- ASSERT_COMPARE(output, output_length, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len);
}
exit:
@@ -2329,7 +2329,7 @@
PSA_ASSERT(psa_crypto_init());
- ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg));
+ TEST_CALLOC(output, PSA_HASH_LENGTH(alg));
/* Do this after psa_crypto_init() which may call hash drivers */
mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init();
@@ -2362,7 +2362,7 @@
TEST_EQUAL(mbedtls_test_driver_hash_hooks.hits, 2);
TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, PSA_SUCCESS);
- ASSERT_COMPARE(output, output_length, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len);
}
exit:
@@ -2385,7 +2385,7 @@
size_t output_length;
PSA_ASSERT(psa_crypto_init());
- ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg));
+ TEST_CALLOC(output, PSA_HASH_LENGTH(alg));
/* Do this after psa_crypto_init() which may call hash drivers */
mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init();
@@ -2416,7 +2416,7 @@
TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, forced_status);
if (forced_status == PSA_SUCCESS) {
- ASSERT_COMPARE(output, output_length, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len);
}
exit:
@@ -2440,7 +2440,7 @@
size_t output_length;
PSA_ASSERT(psa_crypto_init());
- ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg));
+ TEST_CALLOC(output, PSA_HASH_LENGTH(alg));
/* Do this after psa_crypto_init() which may call hash drivers */
mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init();
@@ -2476,7 +2476,7 @@
TEST_EQUAL(mbedtls_test_driver_hash_hooks.hits, 3);
TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, PSA_SUCCESS);
- ASSERT_COMPARE(output, output_length, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len);
}
exit:
@@ -2539,11 +2539,11 @@
mbedtls_test_driver_asymmetric_encryption_hooks.forced_output_length =
fake_output_encrypt->len;
output_size = fake_output_encrypt->len;
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
} else {
output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg);
TEST_ASSERT(output_size <= PSA_ASYMMETRIC_ENCRYPT_OUTPUT_MAX_SIZE);
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
}
/* We test encryption by checking that encrypt-then-decrypt gives back
@@ -2560,8 +2560,8 @@
if (expected_status_encrypt == PSA_SUCCESS) {
if (fake_output_encrypt->len > 0) {
- ASSERT_COMPARE(fake_output_encrypt->x, fake_output_encrypt->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(fake_output_encrypt->x, fake_output_encrypt->len,
+ output, output_length);
} else {
mbedtls_test_driver_asymmetric_encryption_hooks.forced_status =
forced_status_decrypt;
@@ -2571,13 +2571,13 @@
mbedtls_test_driver_asymmetric_encryption_hooks.forced_output_length =
fake_output_decrypt->len;
output2_size = fake_output_decrypt->len;
- ASSERT_ALLOC(output2, output2_size);
+ TEST_CALLOC(output2, output2_size);
} else {
output2_size = input_data->len;
TEST_ASSERT(output2_size <=
PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg));
TEST_ASSERT(output2_size <= PSA_ASYMMETRIC_DECRYPT_OUTPUT_MAX_SIZE);
- ASSERT_ALLOC(output2, output2_size);
+ TEST_CALLOC(output2, output2_size);
}
TEST_EQUAL(psa_asymmetric_decrypt(key, alg,
@@ -2587,11 +2587,11 @@
&output2_length), expected_status_decrypt);
if (expected_status_decrypt == PSA_SUCCESS) {
if (fake_output_decrypt->len > 0) {
- ASSERT_COMPARE(fake_output_decrypt->x, fake_output_decrypt->len,
- output2, output2_length);
+ TEST_MEMORY_COMPARE(fake_output_decrypt->x, fake_output_decrypt->len,
+ output2, output2_length);
} else {
- ASSERT_COMPARE(input_data->x, input_data->len,
- output2, output2_length);
+ TEST_MEMORY_COMPARE(input_data->x, input_data->len,
+ output2, output2_length);
}
}
}
@@ -2651,10 +2651,10 @@
mbedtls_test_driver_asymmetric_encryption_hooks.forced_output_length =
fake_output_decrypt->len;
output_size = fake_output_decrypt->len;
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
} else {
output_size = expected_output_data->len;
- ASSERT_ALLOC(output, expected_output_data->len);
+ TEST_CALLOC(output, expected_output_data->len);
}
TEST_EQUAL(psa_asymmetric_decrypt(key, alg,
@@ -2664,8 +2664,8 @@
&output_length), expected_status_decrypt);
if (expected_status_decrypt == PSA_SUCCESS) {
TEST_EQUAL(output_length, expected_output_data->len);
- ASSERT_COMPARE(expected_output_data->x, expected_output_data->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(expected_output_data->x, expected_output_data->len,
+ output, output_length);
}
exit:
/*
@@ -2724,10 +2724,10 @@
mbedtls_test_driver_asymmetric_encryption_hooks.forced_output_length =
fake_output_encrypt->len;
output_size = fake_output_encrypt->len;
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
} else {
output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg);
- ASSERT_ALLOC(output, output_size);
+ TEST_CALLOC(output, output_size);
}
TEST_EQUAL(psa_asymmetric_encrypt(key, alg,
@@ -2738,8 +2738,8 @@
if (expected_status_encrypt == PSA_SUCCESS) {
if (fake_output_encrypt->len > 0) {
TEST_EQUAL(fake_output_encrypt->len, output_length);
- ASSERT_COMPARE(fake_output_encrypt->x, fake_output_encrypt->len,
- output, output_length);
+ TEST_MEMORY_COMPARE(fake_output_encrypt->x, fake_output_encrypt->len,
+ output, output_length);
} else {
/* Perform sanity checks on the output */
#if PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
@@ -2755,7 +2755,7 @@
{
(void) modulus;
(void) private_exponent;
- TEST_ASSERT(!"Encryption sanity checks not implemented for this key type");
+ TEST_FAIL("Encryption sanity checks not implemented for this key type");
}
}
}
@@ -2824,7 +2824,7 @@
PSA_AEAD_ENCRYPT_OUTPUT_SIZE(key_type, alg, input_data->len));
TEST_ASSERT(output_size <=
PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len));
- ASSERT_ALLOC(output_data, output_size);
+ TEST_CALLOC(output_data, output_size);
status = psa_aead_encrypt_setup(&operation, key, alg);
@@ -2873,11 +2873,11 @@
forced_status == PSA_SUCCESS ? 1 : 0);
/* Compare output_data and expected_ciphertext */
- ASSERT_COMPARE(expected_ciphertext->x, expected_ciphertext->len,
- output_data, output_length + finish_output_length);
+ TEST_MEMORY_COMPARE(expected_ciphertext->x, expected_ciphertext->len,
+ output_data, output_length + finish_output_length);
/* Compare tag and expected_tag */
- ASSERT_COMPARE(expected_tag->x, expected_tag->len, tag_buffer, tag_length);
+ TEST_MEMORY_COMPARE(expected_tag->x, expected_tag->len, tag_buffer, tag_length);
}
exit:
@@ -2926,7 +2926,7 @@
output_size = input_ciphertext->len;
- ASSERT_ALLOC(output_data, output_size);
+ TEST_CALLOC(output_data, output_size);
mbedtls_test_driver_aead_hooks.forced_status = forced_status;
@@ -2979,8 +2979,8 @@
TEST_EQUAL(mbedtls_test_driver_aead_hooks.hits_abort,
forced_status == PSA_SUCCESS ? 1 : 0);
- ASSERT_COMPARE(expected_result->x, expected_result->len,
- output_data, output_length + verify_output_length);
+ TEST_MEMORY_COMPARE(expected_result->x, expected_result->len,
+ output_data, output_length + verify_output_length);
}
exit:
@@ -3016,14 +3016,14 @@
PSA_PAKE_STEP_KEY_SHARE);
int in_driver = (forced_status_setup_arg == PSA_SUCCESS);
- ASSERT_ALLOC(input_buffer,
- PSA_PAKE_INPUT_SIZE(PSA_ALG_JPAKE, primitive,
- PSA_PAKE_STEP_KEY_SHARE));
+ TEST_CALLOC(input_buffer,
+ PSA_PAKE_INPUT_SIZE(PSA_ALG_JPAKE, primitive,
+ PSA_PAKE_STEP_KEY_SHARE));
memset(input_buffer, 0xAA, size_key_share);
- ASSERT_ALLOC(output_buffer,
- PSA_PAKE_INPUT_SIZE(PSA_ALG_JPAKE, primitive,
- PSA_PAKE_STEP_KEY_SHARE));
+ TEST_CALLOC(output_buffer,
+ PSA_PAKE_INPUT_SIZE(PSA_ALG_JPAKE, primitive,
+ PSA_PAKE_STEP_KEY_SHARE));
memset(output_buffer, 0x55, output_size);
PSA_INIT();
diff --git a/tests/suites/test_suite_psa_crypto_entropy.function b/tests/suites/test_suite_psa_crypto_entropy.function
index b4834d3..4d5eda2 100644
--- a/tests/suites/test_suite_psa_crypto_entropy.function
+++ b/tests/suites/test_suite_psa_crypto_entropy.function
@@ -114,8 +114,8 @@
size_t signature_size = PSA_SIGNATURE_MAX_SIZE;
size_t signature_length;
- ASSERT_ALLOC(input, input_size);
- ASSERT_ALLOC(signature, signature_size);
+ TEST_CALLOC(input, input_size);
+ TEST_CALLOC(signature, signature_size);
PSA_ASSERT(psa_crypto_init());
PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len,
@@ -163,7 +163,7 @@
} else {
seed_size = seed_length_b;
}
- ASSERT_ALLOC(seed, seed_size);
+ TEST_CALLOC(seed, seed_size);
/* fill seed with some data */
for (i = 0; i < seed_size; ++i) {
seed[i] = i;
diff --git a/tests/suites/test_suite_psa_crypto_hash.function b/tests/suites/test_suite_psa_crypto_hash.function
index f12541d..0405c1d 100644
--- a/tests/suites/test_suite_psa_crypto_hash.function
+++ b/tests/suites/test_suite_psa_crypto_hash.function
@@ -25,8 +25,8 @@
PSA_ASSERT(psa_hash_finish(&operation,
actual_hash, sizeof(actual_hash),
&actual_hash_length));
- ASSERT_COMPARE(expected_hash->x, expected_hash->len,
- actual_hash, actual_hash_length);
+ TEST_MEMORY_COMPARE(expected_hash->x, expected_hash->len,
+ actual_hash, actual_hash_length);
exit:
psa_hash_abort(&operation);
@@ -83,14 +83,14 @@
PSA_ASSERT(psa_hash_finish(&operation,
actual_hash, sizeof(actual_hash),
&actual_hash_length));
- ASSERT_COMPARE(expected_hash->x, expected_hash->len,
- actual_hash, actual_hash_length);
+ TEST_MEMORY_COMPARE(expected_hash->x, expected_hash->len,
+ actual_hash, actual_hash_length);
PSA_ASSERT(psa_hash_finish(&operation2,
actual_hash, sizeof(actual_hash),
&actual_hash_length));
- ASSERT_COMPARE(expected_hash->x, expected_hash->len,
- actual_hash, actual_hash_length);
+ TEST_MEMORY_COMPARE(expected_hash->x, expected_hash->len,
+ actual_hash, actual_hash_length);
} while (len++ != input->len);
exit:
diff --git a/tests/suites/test_suite_psa_crypto_init.function b/tests/suites/test_suite_psa_crypto_init.function
index 6e1305e..7a43432 100644
--- a/tests/suites/test_suite_psa_crypto_init.function
+++ b/tests/suites/test_suite_psa_crypto_init.function
@@ -267,7 +267,7 @@
uint8_t *seed = NULL;
size_t seed_size = seed_size_arg;
- ASSERT_ALLOC(seed, seed_size);
+ TEST_CALLOC(seed, seed_size);
TEST_ASSERT(mbedtls_nv_seed_write(seed, seed_size) >= 0);
custom_entropy_sources_mask = ENTROPY_SOURCE_NV_SEED;
diff --git a/tests/suites/test_suite_psa_crypto_pake.function b/tests/suites/test_suite_psa_crypto_pake.function
index f04d56f..96c1195 100644
--- a/tests/suites/test_suite_psa_crypto_pake.function
+++ b/tests/suites/test_suite_psa_crypto_pake.function
@@ -137,8 +137,8 @@
size_t c_x1_pr_off, c_x2_pr_off, c_x2s_pr_off;
psa_status_t status;
- ASSERT_ALLOC(buffer0, buffer_length);
- ASSERT_ALLOC(buffer1, buffer_length);
+ TEST_CALLOC(buffer0, buffer_length);
+ TEST_CALLOC(buffer1, buffer_length);
switch (round) {
case PAKE_ROUND_ONE:
@@ -617,7 +617,7 @@
size_t buf_size = PSA_PAKE_OUTPUT_SIZE(alg, primitive_arg,
PSA_PAKE_STEP_KEY_SHARE);
- ASSERT_ALLOC(output_buffer, buf_size);
+ TEST_CALLOC(output_buffer, buf_size);
psa_set_key_usage_flags(&attributes, key_usage_pw);
psa_set_key_algorithm(&attributes, alg);
@@ -1031,7 +1031,7 @@
&buffer_len_ret),
PSA_SUCCESS);
- ASSERT_COMPARE(password_ret, buffer_len_ret, password, strlen(password));
+ TEST_MEMORY_COMPARE(password_ret, buffer_len_ret, password, strlen(password));
exit:
PSA_ASSERT(psa_destroy_key(key));
PSA_ASSERT(psa_pake_abort(&operation));
@@ -1064,8 +1064,8 @@
TEST_EQUAL(psa_crypto_driver_pake_get_cipher_suite(&operation.data.inputs, &cipher_suite_ret),
PSA_SUCCESS);
- ASSERT_COMPARE(&cipher_suite_ret, sizeof(cipher_suite_ret),
- &cipher_suite, sizeof(cipher_suite));
+ TEST_MEMORY_COMPARE(&cipher_suite_ret, sizeof(cipher_suite_ret),
+ &cipher_suite, sizeof(cipher_suite));
exit:
PSA_ASSERT(psa_pake_abort(&operation));
@@ -1128,7 +1128,7 @@
&buffer_len_ret),
PSA_SUCCESS);
- ASSERT_COMPARE(user_ret, buffer_len_ret, user, user_len);
+ TEST_MEMORY_COMPARE(user_ret, buffer_len_ret, user, user_len);
}
exit:
PSA_ASSERT(psa_pake_abort(&operation));
@@ -1191,7 +1191,7 @@
&buffer_len_ret),
PSA_SUCCESS);
- ASSERT_COMPARE(peer_ret, buffer_len_ret, peer, peer_len);
+ TEST_MEMORY_COMPARE(peer_ret, buffer_len_ret, peer, peer_len);
}
exit:
PSA_ASSERT(psa_pake_abort(&operation));
diff --git a/tests/suites/test_suite_psa_crypto_persistent_key.function b/tests/suites/test_suite_psa_crypto_persistent_key.function
index 23535df..a48114f 100644
--- a/tests/suites/test_suite_psa_crypto_persistent_key.function
+++ b/tests/suites/test_suite_psa_crypto_persistent_key.function
@@ -61,13 +61,13 @@
psa_set_key_algorithm(&attributes, key_alg);
psa_set_key_enrollment_algorithm(&attributes, key_alg2);
- ASSERT_ALLOC(file_data, file_data_length);
+ TEST_CALLOC(file_data, file_data_length);
psa_format_key_data_for_storage(key_data->x, key_data->len,
&attributes.core,
file_data);
- ASSERT_COMPARE(expected_file_data->x, expected_file_data->len,
- file_data, file_data_length);
+ TEST_MEMORY_COMPARE(expected_file_data->x, expected_file_data->len,
+ file_data, file_data_length);
exit:
mbedtls_free(file_data);
@@ -111,8 +111,8 @@
(uint32_t) expected_key_alg);
TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes),
(uint32_t) expected_key_alg2);
- ASSERT_COMPARE(expected_key_data->x, expected_key_data->len,
- key_data, key_data_length);
+ TEST_MEMORY_COMPARE(expected_key_data->x, expected_key_data->len,
+ key_data, key_data_length);
exit:
mbedtls_free(key_data);
@@ -127,7 +127,7 @@
size_t data_length = data_length_arg;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
- ASSERT_ALLOC(data, data_length);
+ TEST_CALLOC(data, data_length);
PSA_ASSERT(psa_crypto_init());
@@ -267,7 +267,7 @@
size_t exported_length;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
- ASSERT_ALLOC(exported, export_size);
+ TEST_CALLOC(exported, export_size);
PSA_ASSERT(psa_crypto_init());
@@ -307,7 +307,7 @@
PSA_ASSERT(psa_export_key(key_id, exported, export_size,
&exported_length));
- ASSERT_COMPARE(data->x, data->len, exported, exported_length);
+ TEST_MEMORY_COMPARE(data->x, data->len, exported, exported_length);
/* Destroy the key */
PSA_ASSERT(psa_destroy_key(key_id));
diff --git a/tests/suites/test_suite_psa_crypto_se_driver_hal.function b/tests/suites/test_suite_psa_crypto_se_driver_hal.function
index bb6b0e4..9c5ef23 100644
--- a/tests/suites/test_suite_psa_crypto_se_driver_hal.function
+++ b/tests/suites/test_suite_psa_crypto_se_driver_hal.function
@@ -605,9 +605,9 @@
int ok = 0;
PSA_ASSERT(psa_its_get_info(uid, &info));
- ASSERT_ALLOC(loaded, info.size);
+ TEST_CALLOC(loaded, info.size);
PSA_ASSERT(psa_its_get(uid, 0, info.size, loaded, NULL));
- ASSERT_COMPARE(expected_data, size, loaded, info.size);
+ TEST_MEMORY_COMPARE(expected_data, size, loaded, info.size);
ok = 1;
exit:
@@ -965,8 +965,8 @@
PSA_ASSERT(psa_export_key(returned_id,
exported, sizeof(exported),
&exported_length));
- ASSERT_COMPARE(key_material, sizeof(key_material),
- exported, exported_length);
+ TEST_MEMORY_COMPARE(key_material, sizeof(key_material),
+ exported, exported_length);
PSA_ASSERT(psa_destroy_key(returned_id));
if (!check_persistent_data(location,
@@ -1328,7 +1328,7 @@
key_management.p_export_public = ram_export_public;
break;
default:
- TEST_ASSERT(!"unsupported flow (should be SIGN_IN_xxx)");
+ TEST_FAIL("unsupported flow (should be SIGN_IN_xxx)");
break;
}
asymmetric.p_verify = ram_verify;
diff --git a/tests/suites/test_suite_psa_crypto_slot_management.function b/tests/suites/test_suite_psa_crypto_slot_management.function
index e3bb0d3..5bd12eb 100644
--- a/tests/suites/test_suite_psa_crypto_slot_management.function
+++ b/tests/suites/test_suite_psa_crypto_slot_management.function
@@ -303,12 +303,12 @@
psa_get_key_type(&read_attributes));
TEST_EQUAL(psa_get_key_bits(&attributes),
psa_get_key_bits(&read_attributes));
- ASSERT_ALLOC(reexported, key_data->len);
+ TEST_CALLOC(reexported, key_data->len);
if (usage_flags & PSA_KEY_USAGE_EXPORT) {
PSA_ASSERT(psa_export_key(id, reexported, key_data->len,
&reexported_length));
- ASSERT_COMPARE(key_data->x, key_data->len,
- reexported, reexported_length);
+ TEST_MEMORY_COMPARE(key_data->x, key_data->len,
+ reexported, reexported_length);
} else {
TEST_EQUAL(psa_export_key(id, reexported,
key_data->len, &reexported_length),
@@ -402,8 +402,8 @@
PSA_ASSERT(psa_export_key(id,
reexported, sizeof(reexported),
&reexported_length));
- ASSERT_COMPARE(material1, sizeof(material1),
- reexported, reexported_length);
+ TEST_MEMORY_COMPARE(material1, sizeof(material1),
+ reexported, reexported_length);
PSA_ASSERT(psa_close_key(id));
@@ -575,11 +575,11 @@
psa_get_key_enrollment_algorithm(&target_attributes));
if (expected_usage & PSA_KEY_USAGE_EXPORT) {
size_t length;
- ASSERT_ALLOC(export_buffer, material->len);
+ TEST_CALLOC(export_buffer, material->len);
PSA_ASSERT(psa_export_key(returned_target_id, export_buffer,
material->len, &length));
- ASSERT_COMPARE(material->x, material->len,
- export_buffer, length);
+ TEST_MEMORY_COMPARE(material->x, material->len,
+ export_buffer, length);
} else {
size_t length;
/* Check that the key is actually non-exportable. */
@@ -689,11 +689,11 @@
psa_get_key_algorithm(&attributes2));
if (target_usage & PSA_KEY_USAGE_EXPORT) {
size_t length;
- ASSERT_ALLOC(export_buffer, target_material->len);
+ TEST_CALLOC(export_buffer, target_material->len);
PSA_ASSERT(psa_export_key(returned_target_id, export_buffer,
target_material->len, &length));
- ASSERT_COMPARE(target_material->x, target_material->len,
- export_buffer, length);
+ TEST_MEMORY_COMPARE(target_material->x, target_material->len,
+ export_buffer, length);
}
PSA_ASSERT(psa_destroy_key(returned_source_id));
@@ -775,7 +775,7 @@
mbedtls_svc_key_id_make(0, PSA_KEY_ID_VENDOR_MAX + 1);
break;
default:
- TEST_ASSERT(!"unknown handle construction");
+ TEST_FAIL("unknown handle construction");
}
/* Attempt to use the invalid handle. */
@@ -813,7 +813,7 @@
uint8_t exported[sizeof(size_t)];
size_t exported_length;
- ASSERT_ALLOC(keys, max_keys);
+ TEST_CALLOC(keys, max_keys);
PSA_ASSERT(psa_crypto_init());
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT);
@@ -840,8 +840,8 @@
PSA_ASSERT(psa_export_key(keys[i],
exported, sizeof(exported),
&exported_length));
- ASSERT_COMPARE(exported, exported_length,
- (uint8_t *) &i, sizeof(i));
+ TEST_MEMORY_COMPARE(exported, exported_length,
+ (uint8_t *) &i, sizeof(i));
}
PSA_ASSERT(psa_close_key(keys[i - 1]));
@@ -917,8 +917,8 @@
PSA_ASSERT(psa_export_key(key,
exported, sizeof(exported),
&exported_length));
- ASSERT_COMPARE(exported, exported_length,
- (uint8_t *) &i, sizeof(i));
+ TEST_MEMORY_COMPARE(exported, exported_length,
+ (uint8_t *) &i, sizeof(i));
PSA_ASSERT(psa_destroy_key(key));
}
@@ -942,7 +942,7 @@
TEST_ASSERT(MBEDTLS_PSA_KEY_SLOT_COUNT >= 1);
- ASSERT_ALLOC(keys, MBEDTLS_PSA_KEY_SLOT_COUNT);
+ TEST_CALLOC(keys, MBEDTLS_PSA_KEY_SLOT_COUNT);
PSA_ASSERT(psa_crypto_init());
psa_set_key_usage_flags(&attributes,
@@ -988,7 +988,7 @@
exported, sizeof(exported),
&exported_length));
i = MBEDTLS_PSA_KEY_SLOT_COUNT - 1;
- ASSERT_COMPARE(exported, exported_length, (uint8_t *) &i, sizeof(i));
+ TEST_MEMORY_COMPARE(exported, exported_length, (uint8_t *) &i, sizeof(i));
PSA_ASSERT(psa_destroy_key(keys[MBEDTLS_PSA_KEY_SLOT_COUNT - 1]));
/*
@@ -1016,8 +1016,8 @@
PSA_ASSERT(psa_export_key(keys[i],
exported, sizeof(exported),
&exported_length));
- ASSERT_COMPARE(exported, exported_length,
- (uint8_t *) &i, sizeof(i));
+ TEST_MEMORY_COMPARE(exported, exported_length,
+ (uint8_t *) &i, sizeof(i));
PSA_ASSERT(psa_destroy_key(keys[i]));
}
@@ -1028,8 +1028,8 @@
PSA_ASSERT(psa_export_key(persistent_key, exported, sizeof(exported),
&exported_length));
- ASSERT_COMPARE(exported, exported_length,
- (uint8_t *) &persistent_key, sizeof(persistent_key));
+ TEST_MEMORY_COMPARE(exported, exported_length,
+ (uint8_t *) &persistent_key, sizeof(persistent_key));
exit:
/*
* Key attributes may have been returned by psa_get_key_attributes()
diff --git a/tests/suites/test_suite_psa_crypto_storage_format.function b/tests/suites/test_suite_psa_crypto_storage_format.function
index 8434fc1..116f4cd 100644
--- a/tests/suites/test_suite_psa_crypto_storage_format.function
+++ b/tests/suites/test_suite_psa_crypto_storage_format.function
@@ -36,11 +36,11 @@
/* Check that the key is represented as expected. */
PSA_ASSERT(psa_its_get_info(uid, &storage_info));
TEST_EQUAL(storage_info.size, expected_representation->len);
- ASSERT_ALLOC(actual_representation, storage_info.size);
+ TEST_CALLOC(actual_representation, storage_info.size);
PSA_ASSERT(psa_its_get(uid, 0, storage_info.size,
actual_representation, &length));
- ASSERT_COMPARE(expected_representation->x, expected_representation->len,
- actual_representation, length);
+ TEST_MEMORY_COMPARE(expected_representation->x, expected_representation->len,
+ actual_representation, length);
ok = 1;
@@ -259,12 +259,12 @@
TEST_EQUAL(psa_get_key_enrollment_algorithm(expected_attributes),
psa_get_key_enrollment_algorithm(&actual_attributes));
if (can_export(expected_attributes)) {
- ASSERT_ALLOC(exported_material, expected_material->len);
+ TEST_CALLOC(exported_material, expected_material->len);
PSA_ASSERT(psa_export_key(key_id,
exported_material, expected_material->len,
&length));
- ASSERT_COMPARE(expected_material->x, expected_material->len,
- exported_material, length);
+ TEST_MEMORY_COMPARE(expected_material->x, expected_material->len,
+ exported_material, length);
}
if ((flags & TEST_FLAG_EXERCISE) && can_exercise(&actual_attributes)) {
diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function
index 7864b9c..cb11f18 100644
--- a/tests/suites/test_suite_psa_its.function
+++ b/tests/suites/test_suite_psa_its.function
@@ -92,7 +92,7 @@
unsigned char *buffer = NULL;
size_t ret_len = 0;
- ASSERT_ALLOC(buffer, data->len);
+ TEST_CALLOC(buffer, data->len);
PSA_ASSERT(psa_its_set_wrap(uid, data->len, data->x, flags));
@@ -100,7 +100,7 @@
TEST_ASSERT(info.size == data->len);
TEST_ASSERT(info.flags == flags);
PSA_ASSERT(psa_its_get(uid, 0, data->len, buffer, &ret_len));
- ASSERT_COMPARE(data->x, data->len, buffer, ret_len);
+ TEST_MEMORY_COMPARE(data->x, data->len, buffer, ret_len);
PSA_ASSERT(psa_its_remove(uid));
@@ -122,14 +122,14 @@
unsigned char *buffer = NULL;
size_t ret_len = 0;
- ASSERT_ALLOC(buffer, MAX(data1->len, data2->len));
+ TEST_CALLOC(buffer, MAX(data1->len, data2->len));
PSA_ASSERT(psa_its_set_wrap(uid, data1->len, data1->x, flags1));
PSA_ASSERT(psa_its_get_info(uid, &info));
TEST_ASSERT(info.size == data1->len);
TEST_ASSERT(info.flags == flags1);
PSA_ASSERT(psa_its_get(uid, 0, data1->len, buffer, &ret_len));
- ASSERT_COMPARE(data1->x, data1->len, buffer, ret_len);
+ TEST_MEMORY_COMPARE(data1->x, data1->len, buffer, ret_len);
PSA_ASSERT(psa_its_set_wrap(uid, data2->len, data2->x, flags2));
PSA_ASSERT(psa_its_get_info(uid, &info));
@@ -137,7 +137,7 @@
TEST_ASSERT(info.flags == flags2);
ret_len = 0;
PSA_ASSERT(psa_its_get(uid, 0, data2->len, buffer, &ret_len));
- ASSERT_COMPARE(data2->x, data2->len, buffer, ret_len);
+ TEST_MEMORY_COMPARE(data2->x, data2->len, buffer, ret_len);
PSA_ASSERT(psa_its_remove(uid));
@@ -167,8 +167,8 @@
mbedtls_snprintf(stored, sizeof(stored),
"Content of file 0x%08lx", (unsigned long) uid);
PSA_ASSERT(psa_its_get(uid, 0, sizeof(stored), retrieved, &ret_len));
- ASSERT_COMPARE(retrieved, ret_len,
- stored, sizeof(stored));
+ TEST_MEMORY_COMPARE(retrieved, ret_len,
+ stored, sizeof(stored));
PSA_ASSERT(psa_its_remove(uid));
TEST_ASSERT(psa_its_get(uid, 0, 0, NULL, NULL) ==
PSA_ERROR_DOES_NOT_EXIST);
@@ -214,7 +214,7 @@
size_t i;
size_t ret_len = 0;
- ASSERT_ALLOC(buffer, length + 16);
+ TEST_CALLOC(buffer, length + 16);
trailer = buffer + length;
memset(trailer, '-', 16);
@@ -223,8 +223,8 @@
status = psa_its_get(uid, offset, length_arg, buffer, &ret_len);
TEST_ASSERT(status == (psa_status_t) expected_status);
if (status == PSA_SUCCESS) {
- ASSERT_COMPARE(data->x + offset, (size_t) length_arg,
- buffer, ret_len);
+ TEST_MEMORY_COMPARE(data->x + offset, (size_t) length_arg,
+ buffer, ret_len);
}
for (i = 0; i < 16; i++) {
TEST_ASSERT(trailer[i] == '-');
diff --git a/tests/suites/test_suite_random.function b/tests/suites/test_suite_random.function
index 708a5d0..58cddb7 100644
--- a/tests/suites/test_suite_random.function
+++ b/tests/suites/test_suite_random.function
@@ -169,7 +169,7 @@
unsigned char *output = NULL;
PSA_ASSERT(psa_crypto_init());
- ASSERT_ALLOC(output, n);
+ TEST_CALLOC(output, n);
TEST_EQUAL(0, mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE,
output, n));
diff --git a/tests/suites/test_suite_shax.function b/tests/suites/test_suite_shax.function
index 326cc79..7dd9166 100644
--- a/tests/suites/test_suite_shax.function
+++ b/tests/suites/test_suite_shax.function
@@ -155,11 +155,11 @@
{
unsigned char *output = NULL;
- ASSERT_ALLOC(output, hash->len);
+ TEST_CALLOC(output, hash->len);
TEST_ASSERT(mbedtls_sha3(family, in->x, in->len, output, hash->len) == 0);
- ASSERT_COMPARE(output, hash->len, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, hash->len, hash->x, hash->len);
exit:
mbedtls_free(output);
@@ -193,7 +193,7 @@
mbedtls_sha3_context ctx;
const unsigned int block_size = 256;
- ASSERT_ALLOC(output, hash->len);
+ TEST_CALLOC(output, hash->len);
mbedtls_sha3_init(&ctx);
mbedtls_sha3_starts(&ctx, family);
@@ -204,7 +204,7 @@
TEST_ASSERT(mbedtls_sha3_finish(&ctx, output, hash->len) == 0);
- ASSERT_COMPARE(output, hash->len, hash->x, hash->len);
+ TEST_MEMORY_COMPARE(output, hash->len, hash->x, hash->len);
exit:
mbedtls_free(output);
@@ -253,7 +253,7 @@
mbedtls_sha3_finish(&ctx, hash, hash_length);
mbedtls_sha3_free(&ctx);
- ASSERT_COMPARE(hash, hash_length, reference_hash, hash_length);
+ TEST_MEMORY_COMPARE(hash, hash_length, reference_hash, hash_length);
}
exit:
@@ -275,27 +275,27 @@
case 32: type1 = MBEDTLS_SHA3_256; break;
case 48: type1 = MBEDTLS_SHA3_384; break;
case 64: type1 = MBEDTLS_SHA3_512; break;
- default: TEST_ASSERT(!"hash1->len validity"); break;
+ default: TEST_FAIL("hash1->len validity"); break;
}
switch (hash2->len) {
case 28: type2 = MBEDTLS_SHA3_224; break;
case 32: type2 = MBEDTLS_SHA3_256; break;
case 48: type2 = MBEDTLS_SHA3_384; break;
case 64: type2 = MBEDTLS_SHA3_512; break;
- default: TEST_ASSERT(!"hash2->len validity"); break;
+ default: TEST_FAIL("hash2->len validity"); break;
}
/* Round 1 */
TEST_ASSERT(mbedtls_sha3_starts(&ctx, type1) == 0);
TEST_ASSERT(mbedtls_sha3_update(&ctx, input1->x, input1->len) == 0);
TEST_ASSERT(mbedtls_sha3_finish(&ctx, output, sizeof(output)) == 0);
- ASSERT_COMPARE(output, hash1->len, hash1->x, hash1->len);
+ TEST_MEMORY_COMPARE(output, hash1->len, hash1->x, hash1->len);
/* Round 2 */
TEST_ASSERT(mbedtls_sha3_starts(&ctx, type2) == 0);
TEST_ASSERT(mbedtls_sha3_update(&ctx, input2->x, input2->len) == 0);
TEST_ASSERT(mbedtls_sha3_finish(&ctx, output, sizeof(output)) == 0);
- ASSERT_COMPARE(output, hash2->len, hash2->x, hash2->len);
+ TEST_MEMORY_COMPARE(output, hash2->len, hash2->x, hash2->len);
exit:
mbedtls_sha3_free(&ctx);
diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function
index 8229884..915d104 100644
--- a/tests/suites/test_suite_ssl.function
+++ b/tests/suites/test_suite_ssl.function
@@ -152,7 +152,7 @@
if (input_len == 0) {
input_len = 1;
}
- ASSERT_ALLOC(input, input_len);
+ TEST_CALLOC(input, input_len);
output_len = 0;
for (j = 0; j < ROUNDS; j++) {
@@ -166,7 +166,7 @@
if (output_len == 0) {
output_len = 1;
}
- ASSERT_ALLOC(output, output_len);
+ TEST_CALLOC(output, output_len);
/* Fill up the buffer with structured data so that unwanted changes
* can be detected */
@@ -1543,8 +1543,8 @@
+ plaintext_len
+ t0.maclen
+ padlen + 1;
- ASSERT_ALLOC(buf, buflen);
- ASSERT_ALLOC(buf_save, buflen);
+ TEST_CALLOC(buf, buflen);
+ TEST_CALLOC(buf_save, buflen);
/* Prepare a dummy record header */
memset(rec.ctr, 0, sizeof(rec.ctr));
@@ -1728,8 +1728,8 @@
ctx->x, ctx->len,
dst, desired_length) == 0);
- ASSERT_COMPARE(dst, (size_t) desired_length,
- expected->x, (size_t) expected->len);
+ TEST_MEMORY_COMPARE(dst, (size_t) desired_length,
+ expected->x, (size_t) expected->len);
exit:
PSA_DONE();
@@ -1768,22 +1768,22 @@
desired_key_len, desired_iv_len,
&keys) == 0);
- ASSERT_COMPARE(keys.client_write_key,
- keys.key_len,
- expected_client_write_key->x,
- (size_t) desired_key_len);
- ASSERT_COMPARE(keys.server_write_key,
- keys.key_len,
- expected_server_write_key->x,
- (size_t) desired_key_len);
- ASSERT_COMPARE(keys.client_write_iv,
- keys.iv_len,
- expected_client_write_iv->x,
- (size_t) desired_iv_len);
- ASSERT_COMPARE(keys.server_write_iv,
- keys.iv_len,
- expected_server_write_iv->x,
- (size_t) desired_iv_len);
+ TEST_MEMORY_COMPARE(keys.client_write_key,
+ keys.key_len,
+ expected_client_write_key->x,
+ (size_t) desired_key_len);
+ TEST_MEMORY_COMPARE(keys.server_write_key,
+ keys.key_len,
+ expected_server_write_key->x,
+ (size_t) desired_key_len);
+ TEST_MEMORY_COMPARE(keys.client_write_iv,
+ keys.iv_len,
+ expected_client_write_iv->x,
+ (size_t) desired_iv_len);
+ TEST_MEMORY_COMPARE(keys.server_write_iv,
+ keys.iv_len,
+ expected_server_write_iv->x,
+ (size_t) desired_iv_len);
exit:
PSA_DONE();
@@ -1827,8 +1827,8 @@
already_hashed,
dst, desired_length) == 0);
- ASSERT_COMPARE(dst, desired_length,
- expected->x, desired_length);
+ TEST_MEMORY_COMPARE(dst, desired_length,
+ expected->x, desired_length);
exit:
PSA_DONE();
@@ -1859,10 +1859,10 @@
alg, secret->x, transcript->x, transcript->len,
&secrets) == 0);
- ASSERT_COMPARE(secrets.client_early_traffic_secret, hash_len,
- traffic_expected->x, traffic_expected->len);
- ASSERT_COMPARE(secrets.early_exporter_master_secret, hash_len,
- exporter_expected->x, exporter_expected->len);
+ TEST_MEMORY_COMPARE(secrets.client_early_traffic_secret, hash_len,
+ traffic_expected->x, traffic_expected->len);
+ TEST_MEMORY_COMPARE(secrets.early_exporter_master_secret, hash_len,
+ exporter_expected->x, exporter_expected->len);
exit:
PSA_DONE();
@@ -1893,10 +1893,10 @@
alg, secret->x, transcript->x, transcript->len,
&secrets) == 0);
- ASSERT_COMPARE(secrets.client_handshake_traffic_secret, hash_len,
- client_expected->x, client_expected->len);
- ASSERT_COMPARE(secrets.server_handshake_traffic_secret, hash_len,
- server_expected->x, server_expected->len);
+ TEST_MEMORY_COMPARE(secrets.client_handshake_traffic_secret, hash_len,
+ client_expected->x, client_expected->len);
+ TEST_MEMORY_COMPARE(secrets.server_handshake_traffic_secret, hash_len,
+ server_expected->x, server_expected->len);
exit:
PSA_DONE();
@@ -1929,12 +1929,12 @@
alg, secret->x, transcript->x, transcript->len,
&secrets) == 0);
- ASSERT_COMPARE(secrets.client_application_traffic_secret_N, hash_len,
- client_expected->x, client_expected->len);
- ASSERT_COMPARE(secrets.server_application_traffic_secret_N, hash_len,
- server_expected->x, server_expected->len);
- ASSERT_COMPARE(secrets.exporter_master_secret, hash_len,
- exporter_expected->x, exporter_expected->len);
+ TEST_MEMORY_COMPARE(secrets.client_application_traffic_secret_N, hash_len,
+ client_expected->x, client_expected->len);
+ TEST_MEMORY_COMPARE(secrets.server_application_traffic_secret_N, hash_len,
+ server_expected->x, server_expected->len);
+ TEST_MEMORY_COMPARE(secrets.exporter_master_secret, hash_len,
+ exporter_expected->x, exporter_expected->len);
exit:
PSA_DONE();
@@ -1963,8 +1963,8 @@
alg, secret->x, transcript->x, transcript->len,
&secrets) == 0);
- ASSERT_COMPARE(secrets.resumption_master_secret, hash_len,
- resumption_expected->x, resumption_expected->len);
+ TEST_MEMORY_COMPARE(secrets.resumption_master_secret, hash_len,
+ resumption_expected->x, resumption_expected->len);
exit:
PSA_DONE();
@@ -1997,8 +1997,8 @@
transcript->x,
binder) == 0);
- ASSERT_COMPARE(binder, hash_len,
- binder_expected->x, binder_expected->len);
+ TEST_MEMORY_COMPARE(binder, hash_len,
+ binder_expected->x, binder_expected->len);
exit:
PSA_DONE();
@@ -2064,7 +2064,7 @@
/* Make sure we have enough space in the buffer even if
* we use more padding than the KAT. */
buf_len = ciphertext->len + MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY;
- ASSERT_ALLOC(buf, buf_len);
+ TEST_CALLOC(buf, buf_len);
rec.type = MBEDTLS_SSL_MSG_APPLICATION_DATA;
/* TLS 1.3 uses the version identifier from TLS 1.2 on the wire. */
@@ -2090,13 +2090,13 @@
NULL, NULL) == 0);
if (padding_used == MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY) {
- ASSERT_COMPARE(rec.buf + rec.data_offset, rec.data_len,
- ciphertext->x, ciphertext->len);
+ TEST_MEMORY_COMPARE(rec.buf + rec.data_offset, rec.data_len,
+ ciphertext->x, ciphertext->len);
}
TEST_ASSERT(mbedtls_ssl_decrypt_buf(NULL, &transform_recv, &rec) == 0);
- ASSERT_COMPARE(rec.buf + rec.data_offset, rec.data_len,
- plaintext->x, plaintext->len);
+ TEST_MEMORY_COMPARE(rec.buf + rec.data_offset, rec.data_len,
+ plaintext->x, plaintext->len);
exit:
mbedtls_free(buf);
@@ -2122,8 +2122,8 @@
input->len ? input->x : NULL, input->len,
secret_new) == 0);
- ASSERT_COMPARE(secret_new, (size_t) expected->len,
- expected->x, (size_t) expected->len);
+ TEST_MEMORY_COMPARE(secret_new, (size_t) expected->len,
+ expected->x, (size_t) expected->len);
exit:
PSA_DONE();
@@ -3326,7 +3326,7 @@
== 0);
TEST_EQUAL(cid_enabled, MBEDTLS_SSL_CID_ENABLED);
- ASSERT_COMPARE(own_cid, own_cid_len, test_cid, own_cid_len);
+ TEST_MEMORY_COMPARE(own_cid, own_cid_len, test_cid, own_cid_len);
/* Test disabling works. */
TEST_ASSERT(mbedtls_ssl_set_cid(&ssl, MBEDTLS_SSL_CID_DISABLED, NULL,
diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data
index 3d092db..7af9de9 100644
--- a/tests/suites/test_suite_x509parse.data
+++ b/tests/suites/test_suite_x509parse.data
@@ -3115,6 +3115,14 @@
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
mbedtls_x509_crt_parse_file:"data_files/parse_input/cli-rsa-sha256-badalg.crt.der":MBEDTLS_ERR_X509_SIG_MISMATCH:0
+X509 File parse (does not conform to RFC 5480 / RFC 5758 - AlgorithmIdentifier's parameters field is present, mbedTLS generated before bugfix, OK)
+depends_on:MBEDTLS_PK_CAN_ECDSA_SOME:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_MD_CAN_SHA256
+x509parse_crt_file:"data_files/parse_input/server5-non-compliant.crt":0
+
+X509 File parse (conforms to RFC 5480 / RFC 5758 - AlgorithmIdentifier's parameters field must be absent for ECDSA)
+depends_on:MBEDTLS_PK_CAN_ECDSA_SOME:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_MD_CAN_SHA256
+x509parse_crt_file:"data_files/parse_input/server5.crt":0
+
X509 Get time (UTC no issues)
depends_on:MBEDTLS_X509_USE_C
x509_get_time:MBEDTLS_ASN1_UTC_TIME:"500101000000Z":0:1950:1:1:0:0:0
diff --git a/tests/suites/test_suite_x509parse.function b/tests/suites/test_suite_x509parse.function
index 7a2bbef..1b08bc3 100644
--- a/tests/suites/test_suite_x509parse.function
+++ b/tests/suites/test_suite_x509parse.function
@@ -415,11 +415,6 @@
#endif /* MBEDTLS_X509_CRT_PARSE_C */
/* END_HEADER */
-/* BEGIN_DEPENDENCIES
- * depends_on:MBEDTLS_BIGNUM_C
- * END_DEPENDENCIES
- */
-
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */
void x509_accessor_ext_types(int ext_type, int has_ext_type)
{
@@ -447,7 +442,7 @@
TEST_EQUAL(addrlen, (size_t) ref_ret);
if (addrlen) {
- ASSERT_COMPARE(exp->x, exp->len, addr, addrlen);
+ TEST_MEMORY_COMPARE(exp->x, exp->len, addr, addrlen);
}
}
/* END_CASE */
@@ -702,7 +697,7 @@
} else if (strcmp(profile_str, "all") == 0) {
profile = &profile_all;
} else {
- TEST_ASSERT("Unknown algorithm profile" == 0);
+ TEST_FAIL("Unknown algorithm profile");
}
if (strcmp(verify_callback, "NULL") == 0) {
@@ -712,7 +707,7 @@
} else if (strcmp(verify_callback, "verify_all") == 0) {
f_vrfy = verify_all;
} else {
- TEST_ASSERT("No known verify callback selected" == 0);
+ TEST_FAIL("No known verify callback selected");
}
TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
@@ -881,7 +876,7 @@
} else if (strcmp(entity, "issuer") == 0) {
res = mbedtls_x509_dn_gets(buf, 2000, &crt.issuer);
} else {
- TEST_ASSERT("Unknown entity" == 0);
+ TEST_FAIL("Unknown entity");
}
TEST_ASSERT(res != -1);
@@ -944,7 +939,7 @@
c = buf + sizeof(buf);
// Additional size required for trailing space
out_size = strlen(expected_oids) + 2;
- ASSERT_ALLOC(out, out_size);
+ TEST_CALLOC(out, out_size);
TEST_EQUAL(mbedtls_x509_string_to_names(&names, name_str), 0);
@@ -979,7 +974,7 @@
out = NULL;
out_size = strlen(exp_dn_gets) + 1;
- ASSERT_ALLOC(out, out_size);
+ TEST_CALLOC(out, out_size);
TEST_LE_S(0, mbedtls_x509_dn_gets((char *) out, out_size, &parsed));
TEST_EQUAL(strcmp((char *) out, exp_dn_gets), 0);
@@ -1006,7 +1001,7 @@
} else if (strcmp(entity, "valid_to") == 0) {
TEST_EQUAL(mbedtls_x509_time_is_past(&crt.valid_to), result);
} else {
- TEST_ASSERT("Unknown entity" == 0);
+ TEST_FAIL("Unknown entity");
}
exit:
@@ -1030,7 +1025,7 @@
} else if (strcmp(entity, "valid_to") == 0) {
TEST_EQUAL(mbedtls_x509_time_is_future(&crt.valid_to), result);
} else {
- TEST_ASSERT("Unknown entity" == 0);
+ TEST_FAIL("Unknown entity");
}
exit:
diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function
index ab4a2d0..04a7931 100644
--- a/tests/suites/test_suite_x509write.function
+++ b/tests/suites/test_suite_x509write.function
@@ -128,7 +128,7 @@
/* END_HEADER */
/* BEGIN_DEPENDENCIES
- * depends_on:MBEDTLS_BIGNUM_C:MBEDTLS_FS_IO:MBEDTLS_PK_PARSE_C
+ * depends_on:MBEDTLS_FS_IO:MBEDTLS_PK_PARSE_C
* END_DEPENDENCIES
*/
diff --git a/visualc/VS2013/.gitignore b/visualc/VS2013/.gitignore
index d3da304..a9ded4a 100644
--- a/visualc/VS2013/.gitignore
+++ b/visualc/VS2013/.gitignore
@@ -1,7 +1,3 @@
-# Files automatically generated by generate_visualc_files.pl
-/mbedTLS.sln
-/*.vcxproj
-
# Files that may be left over from check-generated-files.sh
/*.bak
@@ -12,3 +8,9 @@
/Release/
/*.vcxproj.filters
/*.vcxproj.user
+
+###START_GENERATED_FILES###
+# Files automatically generated by generate_visualc_files.pl
+/mbedTLS.sln
+/*.vcxproj
+###END_GENERATED_FILES###