commit ae93ee6ddcaae46a6574c862737d8a956c65f222
author Gilles Peskine <Gilles.Peskine@arm.com> Sat Mar 19 10:49:43 2022 +0100
committer Gilles Peskine <Gilles.Peskine@arm.com> Fri Apr 15 16:15:48 2022 +0200
tree 62e150edce5098f18c2880088dbe8d03b508f234
parent b0537ba3b942f96d8e2953f479ee73bead2ecb85

Reject block cipher modes that are not implemented in Mbed TLS

Mbed TLS doesn't support certain block cipher mode combinations. This
limitation should probably be lifted, but for now, test them as unsupported.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

scripts/mbedtls_dev/crypto_knowledge.py

diff --git a/scripts/mbedtls_dev/crypto_knowledge.py b/scripts/mbedtls_dev/crypto_knowledge.py
index a1f426b..b8ca621 100644
--- a/scripts/mbedtls_dev/crypto_knowledge.py
+++ b/scripts/mbedtls_dev/crypto_knowledge.py
@@ -228,6 +228,9 @@
            alg.head in frozenset.union(BLOCK_MAC_MODES,
                                        BLOCK_CIPHER_MODES,
                                        BLOCK_AEAD_MODES):
+            if alg.head in ['CMAC', 'OFB'] and \
+               self.head in ['ARIA', 'CAMELLIA']:
+                return False # not implemented in Mbed TLS
             return True
         if self.head == 'CHACHA20' and alg.head == 'CHACHA20_POLY1305':
             return True