core: ltc: aes_modes_armv8a_ce_a64.S: fix incorrect assembly syntax

"umov w0, v0.4s[0]" is not valid UAL syntax; the 4 should not be here.
GCC accepts it fine but Clang does not. Fix it.

Signed-off

core: ltc: aes_modes_armv8a_ce_a64.S: fix incorrect assembly syntax

"umov w0, v0.4s[0]" is not valid UAL syntax; the 4 should not be here.
GCC accepts it fine but Clang does not. Fix it.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Do not let CFG_CRYPTO_SIZE_OPTIMIZATION set -Os

Compiler optimization flags -O0 or -Os are selected globally by the
config variable CFG_CC_OPTIMIZE_FOR_SIZE, but crypto code
(lib/libmbedtls and core

Do not let CFG_CRYPTO_SIZE_OPTIMIZATION set -Os

Compiler optimization flags -O0 or -Os are selected globally by the
config variable CFG_CC_OPTIMIZE_FOR_SIZE, but crypto code
(lib/libmbedtls and core/lib/libtomcrypt) is always built with -Os
when CFG_CRYPTO_SIZE_OPTIMIZATION=y. This is a bit inconvenient
when debugging crypto code because two flags have to be set, and it
is not obvious why CFG_CC_OPTIMIZE_FOR_SIZE would not influence crypto.

Since performance does not matter much when debugging, and -Os/-O0
does not make a huge difference anyway, it is wiser to keep the purpose
of the two CFG_ variables separated: CFG_CC_OPTIMIZE_FOR_SIZE should
control the -O flag for all sources, while CFG_CRYPTO_SIZE_OPTIMIZATION
should deal with other size-related settings in the crypto code
(namely: set -DLTC_SMALL_CODE for LibTomCrypt).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ecc_sign_hash blinding CVE-2018-12437

This originates from the LibTomCrypt upstream mitigation patch:
f0a51bbdbd ("ecc_sign_hash blinding CVE-2018-12437") [1]

but with modifications to fit into th

ecc_sign_hash blinding CVE-2018-12437

This originates from the LibTomCrypt upstream mitigation patch:
f0a51bbdbd ("ecc_sign_hash blinding CVE-2018-12437") [1]

but with modifications to fit into the current LibTomCrypt version used
by OP-TEE (use the old function name rand_bn_range(..) instead of the
new name rand_bn_upto(..)).

Link: [1] https://github.com/libtom/libtomcrypt/commit/f0a51bbdbd50e03a43914c9ee912c451b6ad82e5

Fixes: OP-TEE-2019-0018

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU-v7)
Reported-by: Santos Merino del Pozo <santos.research@gmail.com>
Suggested-by: Santos Merino del Pozo <santos.research@gmail.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

ltc: allow usage of rand_bn functions for ECC builds

To be able to backport [1] we have to enable the "rand_bn" functions.

Link: [1] https://github.com/libtom/libtomcrypt/commit/f0a51bbdbd50e03a439

ltc: allow usage of rand_bn functions for ECC builds

To be able to backport [1] we have to enable the "rand_bn" functions.

Link: [1] https://github.com/libtom/libtomcrypt/commit/f0a51bbdbd50e03a43914c9ee912c451b6ad82e5

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: crypto: libtomcrypt: fix LTC_CLEAN_STACK bug

LTC_CLEAN_STACK uses burn_stack() API that uses a recursive call which
leads to approx. double the size of stack cleaned than expected on ARM64,
be

core: crypto: libtomcrypt: fix LTC_CLEAN_STACK bug

LTC_CLEAN_STACK uses burn_stack() API that uses a recursive call which
leads to approx. double the size of stack cleaned than expected on ARM64,
because it consumes stack space in 32-byte chunks and assumes only buf
is pushed onto the stack while ignoring any other data such as lr, fp,
etc.. This causes stack overflow corrupting canaries in case we perform
a SHA512 hash operation which utilizes maximum stack as compared to other
libtomcrypt APIs. So get rid of this recursive call via using variable
length array to clean stack.

Also, convert zeromem() API as a wrapper to call memzero_explicit().

Fixes: ad565116a0d7 ("core: crypto: libtomcrypt: enable LTC_CLEAN_STACK")
Suggested-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: add system wide mempool_default

Adds system wide mempool_default for temporary large memory allocations.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere

core: add system wide mempool_default

Adds system wide mempool_default for temporary large memory allocations.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: crypto: libtomcrypt: enable LTC_CLEAN_STACK

Enables LTC_CLEAN_STACK so that LibTomCrypt will wipe key material and
other sensitive data once no longer used.

Signed-off-by: Jerome Forissier <j

core: crypto: libtomcrypt: enable LTC_CLEAN_STACK

Enables LTC_CLEAN_STACK so that LibTomCrypt will wipe key material and
other sensitive data once no longer used.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Suggested-by: Bastien Simondi <bsimondi@netflix.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

core: remove flags argument from tee_pager_alloc()

Removes the flags argument from tee_pager_alloc() since it's only used
with TEE_MATTR_LOCKED. The exception is the bignum pool, but since it
still

core: remove flags argument from tee_pager_alloc()

Removes the flags argument from tee_pager_alloc() since it's only used
with TEE_MATTR_LOCKED. The exception is the bignum pool, but since it
still releases all locked pages each time the pool becomes unused it's
efficient usage of memory.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: fix preallocation of MPI bignums

Fixes the preallocation to make room for the actual content also in
crypto_bignum_allocate() by calling mbedtls_mpi_grow().

Acked-by: Etienne Carriere <e

core: ltc: fix preallocation of MPI bignums

Fixes the preallocation to make room for the actual content also in
crypto_bignum_allocate() by calling mbedtls_mpi_grow().

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: add tomcrypt_init() when not crypto lib

Adds tomcrypt_init() which is only available when LTC isn't configured
as the crypto lib. tomcrypt_init() performs the same initialization as
crypt

core: ltc: add tomcrypt_init() when not crypto lib

Adds tomcrypt_init() which is only available when LTC isn't configured
as the crypto lib. tomcrypt_init() performs the same initialization as
crypto_init() does when LTC is configured as the crypto lib.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tomcrypt.c: conditionally init for aciphers

Adds #if defined(_CFG_CORE_LTC_ACIPHER) around code only needed if LTC
is configured for asymmetric ciphers (RSA, DSA, DH or ECC).

Acked-by: Jerome

core: tomcrypt.c: conditionally init for aciphers

Adds #if defined(_CFG_CORE_LTC_ACIPHER) around code only needed if LTC
is configured for asymmetric ciphers (RSA, DSA, DH or ECC).

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: LTC use only _CFG_CORE_LTC_ variables

LTC is only taking _CFG_CORE_LTC_ prefixed variables into account for
configuration.

_CFG_CORE_LTC_ prefixed variables are assigned based on CFG_CRYPTO_

core: LTC use only _CFG_CORE_LTC_ variables

LTC is only taking _CFG_CORE_LTC_ prefixed variables into account for
configuration.

_CFG_CORE_LTC_ prefixed variables are assigned based on CFG_CRYPTO_ and
other variables for unchanged LTC configuration.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: tomcrypt.c: remove unused includes

Removes #include of files not needed any longer.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander

core: ltc: tomcrypt.c: remove unused includes

Removes #include of files not needed any longer.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: rename prng_mpa to prng_crypto

Changes the name of the registered prng descriptor from "prng_mpa" to
"prng_crypto" to better reflect the source of the prng.

Acked-by: Jerome Forissier <j

core: ltc: rename prng_mpa to prng_crypto

Changes the name of the registered prng descriptor from "prng_mpa" to
"prng_crypto" to better reflect the source of the prng.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: move remaining external files from src

Moves the remaining external source files from tomcrypt src directory.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens

core: ltc: move remaining external files from src

Moves the remaining external source files from tomcrypt src directory.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: move remaining exported aes functions

Moves remaining exported aes functions to aes.c

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wikland

core: ltc: move remaining exported aes functions

Moves remaining exported aes functions to aes.c

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: move remaining exported hash functions

Moves remaining exported hash functions to hash.c

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wikl

core: ltc: move remaining exported hash functions

Moves remaining exported hash functions to hash.c

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: move dh wrappers to separate file

Moves the DH wrappers in tee_ltc_provider.c to its own file, dh.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklande

core: ltc: move dh wrappers to separate file

Moves the DH wrappers in tee_ltc_provider.c to its own file, dh.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: move rsa wrappers to separate file

Moves the RSA wrappers in tee_ltc_provider.c to its own file, rsa.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wikla

core: ltc: move rsa wrappers to separate file

Moves the RSA wrappers in tee_ltc_provider.c to its own file, rsa.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: move ecc wrappers to separate file

Moves the ECC wrappers in tee_ltc_provider.c to its own file, ecc.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wikla

core: ltc: move ecc wrappers to separate file

Moves the ECC wrappers in tee_ltc_provider.c to its own file, ecc.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: move dsa wrappers to separate file

Moves the DSA wrappers in tee_ltc_provider.c to its own file, dsa.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wikla

core: ltc: move dsa wrappers to separate file

Moves the DSA wrappers in tee_ltc_provider.c to its own file, dsa.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ltc: dsa_import() use inlen instead of MAX_RSA_SIZE

Upstream has changed dsa_import() to use inlen instead of MAX_RSA_SIZE.
This is needed when compiling LTC with DSA but without RSA support.

core: ltc: dsa_import() use inlen instead of MAX_RSA_SIZE

Upstream has changed dsa_import() to use inlen instead of MAX_RSA_SIZE.
This is needed when compiling LTC with DSA but without RSA support.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add encrypt key length in AES encrypt API

Adds size of expanded AES encryption key to crypto_aes_expand_enc_key()
and crypto_aes_enc_block() to make the functions more safe to call.

Reviewed-

core: add encrypt key length in AES encrypt API

Adds size of expanded AES encryption key to crypto_aes_expand_enc_key()
and crypto_aes_enc_block() to make the functions more safe to call.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Summer Qin <summer.qin@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: crypto: move AES-CTS wrappers from libtomcrypt/ to crypto/

Moves the AES-CTS implementation from LTC wrapper to core/crypto.

The AES-CTS implementation can be overridden in a crypto library b

core: crypto: move AES-CTS wrappers from libtomcrypt/ to crypto/

Moves the AES-CTS implementation from LTC wrapper to core/crypto.

The AES-CTS implementation can be overridden in a crypto library by
setting CFG_CRYPTO_CTS_FROM_CRYPTOLIB:=y

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: crypto: introduce struct crypto_authenc_ops

Uses struct crypto_authenc_ops pointer in crypto context for authenc
ciphers (AES-GCM and AES-CCM) as a glue layer instead of a switch(algo)
in each

core: crypto: introduce struct crypto_authenc_ops

Uses struct crypto_authenc_ops pointer in crypto context for authenc
ciphers (AES-GCM and AES-CCM) as a glue layer instead of a switch(algo)
in each cryto_authenc_*() function.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...