| 2d7740f6 | 03-Jun-2022 |
Sohaib ul Hassan <sohaib.ul.hassan@unikie.com> |
core: libtomcrypt: Remove prng_state* NULL pointer check from x25519_make_key()
Calling x25519_make_key(prng_state *prng, int wprng, curve25519_key *key)
checks if prng_state is NULL. This would req
core: libtomcrypt: Remove prng_state* NULL pointer check from x25519_make_key()
Calling x25519_make_key(prng_state *prng, int wprng, curve25519_key *key)
checks if prng_state is NULL. This would require the caller to pass
a valid pointer. Initializing prng_state in some configurations
can get very large. For instance, xtest for X25519 key generation
causes the TA to panic due to stack overrun
F/TC:? 0 trace_syscall:151 syscall #54 (syscall_obj_generate_key)
E/TC:1 Dead canary at end of 'stack_abt[3]' (0xe1a01fc)
E/TC:1 Panic at core/kernel/thread.c:124 <thread_check_canaries>
E/TC:1 TEE load address @ 0xe100000
E/TC:1 Call stack:
E/TC:1 0x0e108934 print_kernel_stack at optee_os/core/arch/arm/kernel/unwind_arm64.c:80
E/TC:1 0x0e113f24 __do_panic at optee_os/core/kernel/panic.c:24
E/TC:1 0x0e116eb4 thread_check_canaries at optee_os/core/kernel/thread.c:115
E/TC:1 0x0e106a60 thread_handle_std_smc at optee_os/core/arch/arm/kernel/thread_optee_smc.c:56
OP-TEE registers a custom prng descriptor (prng_crypto_desc) used for
LTC asymmetric crypto operations and prng_state is not used.
The LTC_ARGCHK(prng != NULL) check is not present in the LTC key generation
functions for ECC, RSA, DH and DSA implementations.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Sohaib ul Hassan <sohaib.ul.hassan@unikie.com>
show more ...
|
| 9f543cd3 | 17-Nov-2020 |
Jerome Forissier <jerome@forissier.org> |
core: libtomcrypt: dh_make_key(): do not force bit 'xbits' to be 1
When xbits != 0, dh_make_key() generates a private key of size xbits as
specified by GP ("TEE_ATTR_DH_X_BITS: If present, constrain
core: libtomcrypt: dh_make_key(): do not force bit 'xbits' to be 1
When xbits != 0, dh_make_key() generates a private key of size xbits as
specified by GP ("TEE_ATTR_DH_X_BITS: If present, constrains the private
value x to have [xbits] bits"). However, it also makes sure the top bit
of the private key is 1. Not only is it not required by the spec, it is
also a security vulnerability because it can drastically reduce the
acceptable range for the key: 2^(xbits-1) <= X <= P - 2.
Note: this brings the LTC implementation in line with the MBed TLS one,
see mbedtls_dhm_make_public().
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| f9a78287 | 17-Dec-2019 |
Jerome Forissier <jerome@forissier.org> |
core: ltc: add support for SM2 PKE
SM2 is a set of public key cryptographic algorithms based on elliptic
curves published by the Chinese Commercial Cryptography Administration
Office [1]. The standa
core: ltc: add support for SM2 PKE
SM2 is a set of public key cryptographic algorithms based on elliptic
curves published by the Chinese Commercial Cryptography Administration
Office [1]. The standard has three main parts which define:
- A Digital Signature Algorithm (part 2)
- A Key Exchange Protocol (part 3)
- A Public Key Encryption method (part 4)
This commit implements the PKE LibTomcrypt for use by the OP-TEE core.
It uses the LibTomCrypt ECC and arithmetic helper functions as well as
the OP-TEE hash interface for the SM3 algorithm.
As far as the ECC point encoding goes, only the uncompressed form is
supported, as permitted by the standard. In practice, it means that the
cipher text always starts with the byte value 0x04. Other forms cannot
be decrypted by this implementation.
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|