Skip to content

Commit 22e810f

Browse files
davidhorstmann-armdavidhorstmann-arm
authored
Merge pull request #10353 from minosgalanakis/feature/introduce_crypto_rng_hash_cleanup
Cleanup: Introduce MBEDTLS_PSA_CRYPTO_RNG_HASH (4/4)
2 parents 2bd0cfd + a0b1c8c commit 22e810f

File tree

7 files changed

+24
-55
lines changed

7 files changed

+24
-55
lines changed

‎CMakeLists.txt‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -100,17 +100,6 @@ option(USE_SHARED_MBEDTLS_LIBRARY "Build Mbed TLS shared library." OFF)
100100
option(LINK_WITH_PTHREAD "Explicitly link Mbed TLS library to pthread." OFF)
101101
option(LINK_WITH_TRUSTED_STORAGE "Explicitly link Mbed TLS library to trusted_storage." OFF)
102102

103-
# Warning string - created as a list for compatibility with CMake 2.8
104-
set(CTR_DRBG_128_BIT_KEY_WARN_L1 "**** WARNING! MBEDTLS_CTR_DRBG_USE_128_BIT_KEY defined!\n")
105-
set(CTR_DRBG_128_BIT_KEY_WARN_L2 "**** Using 128-bit keys for CTR_DRBG limits the security of generated\n")
106-
set(CTR_DRBG_128_BIT_KEY_WARN_L3 "**** keys and operations that use random values generated to 128-bit security\n")
107-
108-
set(CTR_DRBG_128_BIT_KEY_WARNING "${WARNING_BORDER}"
109-
"${CTR_DRBG_128_BIT_KEY_WARN_L1}"
110-
"${CTR_DRBG_128_BIT_KEY_WARN_L2}"
111-
"${CTR_DRBG_128_BIT_KEY_WARN_L3}"
112-
"${WARNING_BORDER}")
113-
114103
# Python 3 is only needed here to check for configuration warnings.
115104
if(NOT CMAKE_VERSION VERSION_LESS 3.15.0)
116105
set(Python3_FIND_STRATEGY LOCATION)
@@ -124,16 +113,6 @@ else()
124113
set(MBEDTLS_PYTHON_EXECUTABLE ${PYTHON_EXECUTABLE})
125114
endif()
126115
endif()
127-
if(MBEDTLS_PYTHON_EXECUTABLE)
128-
129-
# If 128-bit keys are configured for CTR_DRBG, display an appropriate warning
130-
execute_process(COMMAND ${MBEDTLS_PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/config.py -f ${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/mbedtls_config.h get MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
131-
RESULT_VARIABLE result)
132-
if(${result} EQUAL 0)
133-
message(WARNING ${CTR_DRBG_128_BIT_KEY_WARNING})
134-
endif()
135-
136-
endif()
137116

138117
# We now potentially need to link all executables against PThreads, if available
139118
set(CMAKE_THREAD_PREFER_PTHREAD TRUE)

‎Makefile‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ endif
2626
.PHONY: all no_test programs lib tests install uninstall clean test check lcov apidoc apidoc_clean
2727

2828
all: programs tests
29-
$(MAKE) post_build
3029

3130
no_test: programs
3231

@@ -146,24 +145,6 @@ uninstall:
146145
done
147146
endif
148147

149-
150-
WARNING_BORDER_LONG =**********************************************************************************\n
151-
CTR_DRBG_128_BIT_KEY_WARN_L1=**** WARNING! MBEDTLS_CTR_DRBG_USE_128_BIT_KEY defined! ****\n
152-
CTR_DRBG_128_BIT_KEY_WARN_L2=**** Using 128-bit keys for CTR_DRBG limits the security of generated ****\n
153-
CTR_DRBG_128_BIT_KEY_WARN_L3=**** keys and operations that use random values generated to 128-bit security ****\n
154-
155-
CTR_DRBG_128_BIT_KEY_WARNING=\n$(WARNING_BORDER_LONG)$(CTR_DRBG_128_BIT_KEY_WARN_L1)$(CTR_DRBG_128_BIT_KEY_WARN_L2)$(CTR_DRBG_128_BIT_KEY_WARN_L3)$(WARNING_BORDER_LONG)
156-
157-
# Post build steps
158-
post_build:
159-
ifndef WINDOWS
160-
161-
# If 128-bit keys are configured for CTR_DRBG, display an appropriate warning
162-
-scripts/config.py get MBEDTLS_CTR_DRBG_USE_128_BIT_KEY && ([ $$? -eq 0 ]) && \
163-
echo '$(CTR_DRBG_128_BIT_KEY_WARNING)'
164-
165-
endif
166-
167148
clean: clean_more_on_top
168149
$(MAKE) -C library clean
169150
$(MAKE) -C programs clean

‎scripts/config.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,10 @@ def realfull_adapter(_name, _value, _active):
7676
'MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH', # interacts with CTR_DRBG_128_BIT_KEY
7777
'MBEDTLS_AES_USE_HARDWARE_ONLY', # hardware dependency
7878
'MBEDTLS_BLOCK_CIPHER_NO_DECRYPT', # incompatible with ECB in PSA, CBC/XTS/NIST_KW
79-
'MBEDTLS_CTR_DRBG_USE_128_BIT_KEY', # interacts with ENTROPY_FORCE_SHA256
8079
'MBEDTLS_DEPRECATED_REMOVED', # conflicts with deprecated options
8180
'MBEDTLS_DEPRECATED_WARNING', # conflicts with deprecated options
8281
'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED', # influences the use of ECDH in TLS
8382
'MBEDTLS_ECP_WITH_MPI_UINT', # disables the default ECP and is experimental
84-
'MBEDTLS_ENTROPY_FORCE_SHA256', # interacts with CTR_DRBG_128_BIT_KEY
8583
'MBEDTLS_HAVE_SSE2', # hardware dependency
8684
'MBEDTLS_MEMORY_BACKTRACE', # depends on MEMORY_BUFFER_ALLOC_C
8785
'MBEDTLS_MEMORY_BUFFER_ALLOC_C', # makes sanitizers (e.g. ASan) less effective

‎tests/scripts/components-configuration-crypto.sh‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2353,11 +2353,22 @@ component_test_block_cipher_no_decrypt_aesce_armcc () {
23532353
not grep aesce_decrypt_block ${BUILTIN_SRC_PATH}/aesce.o
23542354
}
23552355

2356+
component_test_ctr_drbg_aes_256_sha_512 () {
2357+
msg "build: full + MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_512 (ASan build)"
2358+
scripts/config.py full
2359+
scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2360+
scripts/config.py set MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_512
2361+
CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
2362+
make
2363+
2364+
msg "test: full + MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_512 (ASan build)"
2365+
make test
2366+
}
2367+
23562368
component_test_ctr_drbg_aes_256_sha_256 () {
23572369
msg "build: full + MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_256 (ASan build)"
23582370
scripts/config.py full
23592371
scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2360-
scripts/config.py set MBEDTLS_ENTROPY_FORCE_SHA256
23612372
scripts/config.py set MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_256
23622373
CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
23632374
make
@@ -2367,28 +2378,28 @@ component_test_ctr_drbg_aes_256_sha_256 () {
23672378
}
23682379

23692380
component_test_ctr_drbg_aes_128_sha_512 () {
2370-
msg "build: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY (ASan build)"
2381+
msg "build: full + set MBEDTLS_PSA_CRYPTO_RNG_STRENGTH 128 (ASan build)"
23712382
scripts/config.py full
23722383
scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2373-
scripts/config.py set MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
2384+
scripts/config.py set MBEDTLS_PSA_CRYPTO_RNG_STRENGTH 128
2385+
scripts/config.py set MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_512
23742386
CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
23752387
make
23762388

2377-
msg "test: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY (ASan build)"
2389+
msg "test: full + set MBEDTLS_PSA_CRYPTO_RNG_STRENGTH 128 (ASan build)"
23782390
make test
23792391
}
23802392

23812393
component_test_ctr_drbg_aes_128_sha_256 () {
2382-
msg "build: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_256 (ASan build)"
2394+
msg "build: full + set MBEDTLS_PSA_CRYPTO_RNG_STRENGTH 128 + MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_256 (ASan build)"
23832395
scripts/config.py full
23842396
scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2385-
scripts/config.py set MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
2386-
scripts/config.py set MBEDTLS_ENTROPY_FORCE_SHA256
2397+
scripts/config.py set MBEDTLS_PSA_CRYPTO_RNG_STRENGTH 128
23872398
scripts/config.py set MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_256
23882399
CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
23892400
make
23902401

2391-
msg "test: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_256 (ASan build)"
2402+
msg "test: full + set MBEDTLS_PSA_CRYPTO_RNG_STRENGTH 128 + MBEDTLS_PSA_CRYPTO_RNG_HASH PSA_ALG_SHA_256 (ASan build)"
23922403
make test
23932404
}
23942405

‎tests/scripts/depends.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -316,11 +316,9 @@ def test(self, options):
316316
'MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED'],
317317

318318
'PSA_WANT_ALG_SHA_224': ['MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED',
319-
'MBEDTLS_ENTROPY_FORCE_SHA256',
320319
'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT',
321320
'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY'],
322321
'PSA_WANT_ALG_SHA_256': ['MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED',
323-
'MBEDTLS_ENTROPY_FORCE_SHA256',
324322
'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT',
325323
'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY',
326324
'MBEDTLS_LMS_C',

‎tests/ssl-opt.sh‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -484,7 +484,8 @@ detect_required_features() {
484484
*"programs/ssl/dtls_client "*|\
485485
*"programs/ssl/ssl_client1 "*)
486486
requires_config_enabled MBEDTLS_CTR_DRBG_C
487-
requires_config_enabled MBEDTLS_ENTROPY_C
487+
requires_config_enabled MBEDTLS_PSA_CRYPTO_C
488+
requires_config_disabled MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
488489
requires_config_enabled MBEDTLS_PEM_PARSE_C
489490
requires_config_enabled MBEDTLS_SSL_CLI_C
490491
requires_certificate_authentication
@@ -494,7 +495,8 @@ detect_required_features() {
494495
*"programs/ssl/ssl_pthread_server "*|\
495496
*"programs/ssl/ssl_server "*)
496497
requires_config_enabled MBEDTLS_CTR_DRBG_C
497-
requires_config_enabled MBEDTLS_ENTROPY_C
498+
requires_config_enabled MBEDTLS_PSA_CRYPTO_C
499+
requires_config_disabled MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
498500
requires_config_enabled MBEDTLS_PEM_PARSE_C
499501
requires_config_enabled MBEDTLS_SSL_SRV_C
500502
requires_certificate_authentication

‎tf-psa-crypto‎

Submodule tf-psa-crypto updated 24 files

0 commit comments

Comments
 (0)