Remove SHA-1 as a fallback option
- it's 2020, there shouldn't be too many systems out there where SHA-1 is the
only available hash option, so its usefulness is limited
- OTOH testing configurations without SHA-2 reveal bugs that are not easy to
fix in a fully compatible way
So overall, the benefit/cost ratio is not good enough to justify keeping SHA-1
as a fallback option here.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
diff --git a/ChangeLog.d/ecp-internal-rng.txt b/ChangeLog.d/ecp-internal-rng.txt
index f6b3c0f..8b5c514 100644
--- a/ChangeLog.d/ecp-internal-rng.txt
+++ b/ChangeLog.d/ecp-internal-rng.txt
@@ -1,9 +1,9 @@
Changes
* The ECP module, enabled by `MBEDTLS_ECP_C`, now depends on
- `MBEDTLS_CTR_DRBG_C`, `MBEDTLS_HMAC_DRBG_C`, `MBEDTLS_SHA512_C`,
- `MBEDTLS_SHA256_C` or `MBEDTLS_SHA1_C` for some side-channel
- coutermeasures. If side channels are not a concern, this dependency can
- be avoided by enabling the new option `MBEDTLS_ECP_NO_INTERNAL_RNG`.
+ `MBEDTLS_CTR_DRBG_C`, `MBEDTLS_HMAC_DRBG_C`, `MBEDTLS_SHA512_C` or
+ `MBEDTLS_SHA256_C` for some side-channel coutermeasures. If side channels
+ are not a concern, this dependency can be avoided by enabling the new
+ option `MBEDTLS_ECP_NO_INTERNAL_RNG`.
Security
* Fix side channel in mbedtls_ecp_check_pub_priv() and
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index 3ae86a1..21991b8 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -146,9 +146,8 @@
defined(MBEDTLS_HMAC_DRBG_C) || \
defined(MBEDTLS_SHA512_C) || \
defined(MBEDTLS_SHA256_C) || \
- defined(MBEDTLS_SHA1_C) || \
defined(MBEDTLS_ECP_NO_INTERNAL_RNG))
-#error "MBEDTLS_ECP_C requires a DRBG or SHA module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
+#error "MBEDTLS_ECP_C requires a DRBG or SHA-2 module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
#endif
#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 90c90f9..f0057db 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -788,12 +788,11 @@
* against some side-channel attacks.
*
* This protection introduces a dependency of the ECP module on one of the
- * DRBG or SHA modules (HMAC-DRBG, CTR-DRBG, SHA-512, SHA-256 or SHA-1).
- * For very constrained applications that don't require this protection
- * (for example, because you're only doing signature verification, so not
- * manipulating any secret, or because local/physical side-channel attacks are
- * outside your threat model), it might be desirable to get rid of that
- * dependency.
+ * DRBG or SHA modules (HMAC-DRBG, CTR-DRBG, SHA-512 or SHA-256.) For very
+ * constrained applications that don't require this protection (for example,
+ * because you're only doing signature verification, so not manipulating any
+ * secret, or because local/physical side-channel attacks are outside your
+ * threat model), it might be desirable to get rid of that dependency.
*
* \warning Enabling this option makes some uses of ECP vulnerable to some
* side-channel attacks. Only enable it if you know that's not a problem for
diff --git a/library/ecp.c b/library/ecp.c
index 9e0c8ef..cb21f36 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -113,8 +113,6 @@
#include "mbedtls/sha512.h"
#elif defined(MBEDTLS_SHA256_C)
#include "mbedtls/sha256.h"
-#elif defined(MBEDTLS_SHA1_C)
-#include "mbedtls/sha1.h"
#else
#error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
#endif
@@ -254,9 +252,7 @@
return( ret );
}
-#elif defined(MBEDTLS_SHA512_C) || \
- defined(MBEDTLS_SHA256_C) || \
- defined(MBEDTLS_SHA1_C)
+#elif defined(MBEDTLS_SHA512_C) || defined(MBEDTLS_SHA256_C)
/* This will be used in the self-test function */
#define ECP_ONE_STEP_KDF
@@ -268,7 +264,7 @@
* function) and empty FixedInfo. (Though we'll make it fit the DRBG API for
* convenience, this is not a full-fledged DRBG, but we don't need one here.)
*
- * We need a basic hash abstraction layer to use whatever SHA is available.
+ * We need a basic hash abstraction layer to use whatever SHA-2 is available.
*/
#if defined(MBEDTLS_SHA512_C)
@@ -280,12 +276,7 @@
#define HASH_FUNC( in, ilen, out ) mbedtls_sha256_ret( in, ilen, out, 0 );
#define HASH_BLOCK_BYTES ( 256 / 8 )
-#else // from a previous #if we know that SHA-1 is available if SHA-2 isn't
-
-#define HASH_FUNC mbedtls_sha1_ret
-#define HASH_BLOCK_BYTES ( 160 / 8 )
-
-#endif /* SHA512/SHA256/SHA1 abstraction */
+#endif /* SHA512/SHA256 abstraction */
/*
* State consists of a 32-bit counter plus the secret value.
@@ -333,8 +324,8 @@
* bytes from this function, and retrying up to 10 times if unlucky.
*
* So for the largest curve, each scalar multiplication draws at most
- * 2 * 66 bytes. The minimum block size is 20 bytes (with SHA-1), so
- * that means at most 66 blocks.
+ * 20 * 66 bytes. The minimum block size is 32 (SHA-256), so with
+ * rounding that means a most 20 * 3 blocks.
*
* Since we don't need to draw more that 255 blocks, don't bother
* with carry propagation and just return an error instead. We can
@@ -3231,8 +3222,8 @@
* https://github.com/patrickfav/singlestep-kdf/wiki/NIST-SP-800-56C-Rev1:-Non-Official-Test-Vectors
*
* We only use the ones with empty fixedInfo, and for brevity's sake, only
- * 32-bytes output (with SHA-1 that's more than one block, with SHA-256
- * exactly one block, and with SHA-512 less than one block).
+ * 32-bytes output (with SHA-256 that's exactly one block, and with SHA-512
+ * less than one block).
*/
#if defined(MBEDTLS_SHA512_C)
@@ -3260,21 +3251,6 @@
0x34, 0x3f, 0x6d, 0x82, 0x16, 0x22, 0xb4, 0x45,
};
-#elif defined(MBEDTLS_SHA1_C)
-
-static const uint8_t test_kdf_z[16] = {
- 0x4e, 0x1e, 0x70, 0xc9, 0x88, 0x68, 0x19, 0xa3,
- 0x1b, 0xc2, 0x9a, 0x53, 0x79, 0x11, 0xad, 0xd9,
-};
-static const uint8_t test_kdf_out[32] = {
- 0xdd, 0xbf, 0xc4, 0x40, 0x44, 0x9a, 0xab, 0x41,
- 0x31, 0xc6, 0xd8, 0xae, 0xc0, 0x8c, 0xe1, 0x49,
- 0x6f, 0x27, 0x02, 0x24, 0x1d, 0x0e, 0x27, 0xcc,
- 0x15, 0x5c, 0x5c, 0x7c, 0x3c, 0xda, 0x75, 0xb5,
-};
-
-#else
-#error "Need at least one of SHA-512, SHA-256 or SHA-1"
#endif
static int ecp_kdf_self_test( void )
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 4831736..87c1653 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -854,32 +854,6 @@
# no SSL tests as they all depend on having a DRBG
}
-component_test_no_drbg_no_sha2 () {
- # this tests the internal ECP DRBG using a KDF based on SHA-1
- msg "build: Default minus DRBGs minus SHA-2"
- scripts/config.pl unset MBEDTLS_CTR_DRBG_C
- scripts/config.pl unset MBEDTLS_HMAC_DRBG_C
- scripts/config.pl unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
- scripts/config.pl unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
- scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
- scripts/config.pl unset MBEDTLS_SHA512_C
- scripts/config.pl unset MBEDTLS_SHA256_C
- scripts/config.pl unset MBEDTLS_ENTROPY_C # requires SHA-2
- scripts/config.pl unset MBEDTLS_PSA_CRYPTO_C # requires Entropy
- scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
- scripts/config.pl unset MBEDTLS_PSA_CRYPTO_SE_C # requires PSA Crypto
- scripts/config.pl unset MBEDTLS_USE_PSA_CRYPTO # requires PSA Crypto
- scripts/config.pl unset MBEDTLS_SSL_PROTO_TLS1_2 # requires SHA-2
-
- CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
- make
-
- msg "test: Default minus DRBGs minus SHA-2"
- make test
-
- # no SSL tests as they all depend on having a DRBG
-}
-
component_test_ecp_no_internal_rng () {
msg "build: Default plus ECP_NO_INTERNAL_RNG minus DRBG modules"
scripts/config.pl set MBEDTLS_ECP_NO_INTERNAL_RNG