Skip to content

Allow builds with no RNG but entropy in an NV seed: adopt in Mbed TLS #10296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: development
Choose a base branch
from
+12 −15
Open

Allow builds with no RNG but entropy in an NV seed: adopt in Mbed TLS #10296

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
aeac0b3
Disable new platform-related option
gilles-peskine-arm Jul 10, 2025
1edd046
Update submodules with MBEDTLS_PSA_DRIVER_GET_ENTROPY
gilles-peskine-arm Jul 10, 2025
a123993
Explicitly enable built-in entropy in sample and test configs
gilles-peskine-arm Jul 15, 2025
0b01bb7
Prepare to ignore a new test case
gilles-peskine-arm Jul 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 1 addition & 7 deletions configs/crypto-config-ccm-psk-tls1_2.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,15 +31,9 @@

#define MBEDTLS_CTR_DRBG_C
#define MBEDTLS_ENTROPY_C
#define MBEDTLS_PSA_BUILTIN_GET_ENTROPY

/* Save RAM at the expense of ROM */
#define MBEDTLS_AES_ROM_TABLES

/*
* You should adjust this to the exact number of sources you're using: default
* is the "platform_entropy_poll" source, but you may want to add other ones
* Minimum is 2 for the entropy test suite.
*/
#define MBEDTLS_ENTROPY_MAX_SOURCES 2

#endif /* PSA_CRYPTO_CONFIG_H */
7 changes: 1 addition & 6 deletions configs/crypto-config-suite-b.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@
#define MBEDTLS_ENTROPY_C
#define MBEDTLS_PK_C
#define MBEDTLS_PK_PARSE_C
#define MBEDTLS_PSA_BUILTIN_GET_ENTROPY

/* For test certificates */
#define MBEDTLS_BASE64_C
Expand All @@ -69,10 +70,4 @@
/* Significant speed benefit at the expense of some ROM */
#define MBEDTLS_ECP_NIST_OPTIM

/*
* You should adjust this to the exact number of sources you're using: default
* is the "mbedtls_platform_entropy_poll" source, but you may want to add other ones.
* Minimum is 2 for the entropy test suite.
*/
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
#endif /* PSA_CRYPTO_CONFIG_H */
1 change: 1 addition & 0 deletions configs/crypto-config-thread.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@
#define MBEDTLS_MD_C
#define MBEDTLS_PK_C
#define MBEDTLS_PK_PARSE_C
#define MBEDTLS_PSA_BUILTIN_GET_ENTROPY

/* Save RAM at the expense of ROM */
#define MBEDTLS_AES_ROM_TABLES
Expand Down
2 changes: 1 addition & 1 deletion framework
Open in desktop
Submodule framework updated 4 files
+3 −5 scripts/test_psa_compliance.py
+2 −2 tests/include/test/fake_external_rng_for_test.h
+4 −1 tests/include/test/psa_exercise_key.h
+39 −7 tests/src/fake_external_rng_for_test.c
1 change: 1 addition & 0 deletions scripts/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ def realfull_adapter(_name, _value, _active):
'MBEDTLS_NO_64BIT_MULTIPLICATION', # influences anything that uses bignum
'MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES', # removes a feature
'MBEDTLS_NO_UDBL_DIVISION', # influences anything that uses bignum
'MBEDTLS_PSA_DRIVER_GET_ENTROPY', # incompatible with MBEDTLS_PSA_BUILTIN_GET_ENTROPY
'MBEDTLS_PSA_P256M_DRIVER_ENABLED', # influences SECP256R1 KeyGen/ECDH/ECDSA
'MBEDTLS_PLATFORM_NO_STD_FUNCTIONS', # removes a feature
'MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS', # removes a feature
Expand Down
6 changes: 6 additions & 0 deletions tests/scripts/analyze_outcomes.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,12 @@ def _has_word_re(words: typing.Iterable[str],
# https://github.com/Mbed-TLS/mbedtls/issues/9586
'Config: !MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED',
],
'test_suite_config.crypto_combinations': [
# New thing in crypto. Not intended to be tested separately
# in mbedtls.
# https://github.com/Mbed-TLS/mbedtls/issues/10300
'Config: entropy: NV seed only',
],
'test_suite_config.psa_boolean': [
# We don't test with HMAC disabled.
# https://github.com/Mbed-TLS/mbedtls/issues/9591
Expand Down
2 changes: 1 addition & 1 deletion tf-psa-crypto
Open in desktop
Submodule tf-psa-crypto updated 27 files
+21 −0 ChangeLog.d/entropy-options.txt
+1 −0 configs/crypto-config-ccm-aes-sha256.h
+1 −0 configs/crypto-config-symmetric-only.h
+29 −24 configs/ext/crypto_config_profile_medium.h
+145 −0 docs/4.0-migration-guide/entropy.md
+0 −83 docs/4.0-migration-guide/platform-entropy-gathering.md
+13 −6 docs/proposed/psa-driver-interface.md
+3 −3 drivers/builtin/include/mbedtls/entropy.h
+12 −8 drivers/builtin/src/entropy.c
+28 −3 drivers/builtin/src/entropy_poll.c
+3 −11 drivers/builtin/src/entropy_poll.h
+24 −19 drivers/builtin/src/platform_util.c
+1 −1 framework
+19 −12 include/mbedtls/platform.h
+33 −0 include/psa/crypto_adjust_config_derived.h
+9 −0 include/psa/crypto_adjust_config_synonyms.h
+75 −22 include/psa/crypto_config.h
+42 −0 include/psa/crypto_driver_random.h
+23 −0 include/tf-psa-crypto/check_config.h
+2 −2 scripts/config.py
+1 −0 tests/configs/crypto_config_test_driver.h
+27 −5 tests/scripts/components-configuration-platform.sh
+0 −6 tests/suites/helpers.function
+16 −0 tests/suites/test_suite_config.crypto_combinations.data
+2 −2 tests/suites/test_suite_entropy.data
+10 −20 tests/suites/test_suite_entropy.function
+3 −3 tests/suites/test_suite_psa_crypto_init.function