| 273a583e | 30-Sep-2025 |
Thomas Bourgoin <thomas.bourgoin@foss.st.com> |
Squashed commit upgrading to mbedtls-3.6.4
Squash merging branch import/mbedtls-3.6.4
commit 43e97a8f0625 ("Import mbedtls-3.6.4")
commit 8ac83749d343 ("mbedtls: remove default include/mbedtls/conf
Squashed commit upgrading to mbedtls-3.6.4
Squash merging branch import/mbedtls-3.6.4
commit 43e97a8f0625 ("Import mbedtls-3.6.4")
commit 8ac83749d343 ("mbedtls: remove default include/mbedtls/config.h")
commit 89c0fc652535 ("mbedtls: configure mbedtls to reach for config")
commit 59c9730a19a8 ("libmbedtls: make mbedtls_mpi_mont*() available")
commit 20d408b354b4 ("libmbedtls: add mbedtls_mpi_init_mempool()")
commit ae519b65d8e1 ("libmedtls: mpi_miller_rabin: increase count limit")
commit eec216feead8 ("libmbedtls: add interfaces in mbedtls for context memory operation")
commit 436c9dec3733 ("libmbedtls: fix no CRT issue")
commit eb7fd40aa0c1 ("libmbedtls: add SM2 curve")
commit 6ca24312de58 ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()")
commit a7a355ebd993 ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()")
commit 45083a9c2d7f ("libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly")
commit a345e1bb1572 ("libmbedtls: fix cipher_wrap.c for NIST AES Key Wrap mode")
commit 015ba93f356d ("libmbedtls: allow inclusion of arm_neon.h")
commit 3c7a228496a7 ("libmbedtls: add CFG_CORE_UNSAFE_MODEXP and CFG_TA_MBEDTLS_UNSAFE_MODEXP")
commit c88a506a0f55 ("libmbedtls: use mempool_calloc() for temporary memory")
commit b22584209222 ("libmbedtls: fix build warning related to deprecated DTLS connect ID")
commit 4afc1eba8114 ("libmbedtls: sync with DTLS connect ID build fix")
commit 85329760d40b ("libmbedtls: fix compilation warning with GCC14")
Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_virt)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)
show more ...
|
| 98dd4c70 | 07-Mar-2025 |
Jerome Forissier <jerome.forissier@linaro.org> |
libmbedtls: fix compilation warning with GCC14 (2)
Cherry-picking commit 7505c3588f44 ("libmbedtls: fix compilation warning
with GCC14") which was lost in commit c3deb3d6f3b1 ("Squashed commit
upgra
libmbedtls: fix compilation warning with GCC14 (2)
Cherry-picking commit 7505c3588f44 ("libmbedtls: fix compilation warning
with GCC14") which was lost in commit c3deb3d6f3b1 ("Squashed commit
upgrading to mbedtls-3.6.3"). It should have been pushed onto the
import/mbedtls-3.6.2 branch when it was accepted in master but that
didn't happen and therefore it was unfortunately left aside when
upgrading. This time it has been applied to import/mbedtls-3.6.3 [1] so
it will hopefully not be forgotten in the next upgrade.
Link: https://github.com/OP-TEE/optee_os/commit/b526c146f87 [1]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 3a0fa646 | 28-Apr-2025 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: config: re-enable long long divisions
This reverts commit d3ec4328a070 ("libmbedtls: config: disable long long
divisions") to address performance regressions introduced by that
commit. T
libmbedtls: config: re-enable long long divisions
This reverts commit d3ec4328a070 ("libmbedtls: config: disable long long
divisions") to address performance regressions introduced by that
commit. The commit can be reverted now that __udivti3() needed by the
unsigned long long divisions is available again.
Link: https://github.com/OP-TEE/optee_os/pull/7359
Link: https://github.com/OP-TEE/optee_os/issues/7374
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| c3deb3d6 | 28-Mar-2025 |
Etienne Carriere <etienne.carriere@foss.st.com> |
Squashed commit upgrading to mbedtls-3.6.3
Squash merging branch import/mbedtls-3.6.3.
83dd409f0591 ("Import mbedtls-3.6.3")
aa3df5be08de ("mbedtls: remove default include/mbedtls/config.h")
10d3d4
Squashed commit upgrading to mbedtls-3.6.3
Squash merging branch import/mbedtls-3.6.3.
83dd409f0591 ("Import mbedtls-3.6.3")
aa3df5be08de ("mbedtls: remove default include/mbedtls/config.h")
10d3d445f46f ("mbedtls: configure mbedtls to reach for config")
03fd7670bc8e ("libmbedtls: make mbedtls_mpi_mont*() available")
134b0c7c7577 ("libmbedtls: add mbedtls_mpi_init_mempool()")
84a14c2a9e2a ("libmedtls: mpi_miller_rabin: increase count limit")
5e39a372b06e ("libmbedtls: add interfaces in mbedtls for context memory operation")
d5f89f104e2f ("libmbedtls: fix no CRT issue")
7efbd8164a57 ("libmbedtls: add SM2 curve")
ef671e650a67 ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()")
dd7fe0899a74 ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()")
2ff56f350a3e ("libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly")
63b52087554b ("libmbedtls: fix cipher_wrap.c for NIST AES Key Wrap mode")
1a615e16f58a ("libmbedtls: allow inclusion of arm_neon.h")
3de987540e82 ("libmbedtls: add CFG_CORE_UNSAFE_MODEXP and CFG_TA_MBEDTLS_UNSAFE_MODEXP")
878995ea5dee ("libmbedtls: use mempool_calloc() for temporary memory")
0a7b758bcd12 ("libmbedtls: fix build warning related to deprecated DTLS connect ID")
e7332889098e ("libmbedtls: libmbedtls: sync with DTLS connect ID build fix")
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_virt)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)
show more ...
|
| e1abe7d1 | 20-Mar-2025 |
Alvin Chang <alvinga@andestech.com> |
libmbedtls: fix typo: CFG_TA_MEBDTLS_UNSAFE_MODEXP
CFG_TA_"MEBDTLS"_UNSAFE_MODEXP is typo. This commit fixes it.
Fixes: cb03400251f9 ("Squashed commit upgrading to mbedtls-3.6.2")
Signed-off-by: Al
libmbedtls: fix typo: CFG_TA_MEBDTLS_UNSAFE_MODEXP
CFG_TA_"MEBDTLS"_UNSAFE_MODEXP is typo. This commit fixes it.
Fixes: cb03400251f9 ("Squashed commit upgrading to mbedtls-3.6.2")
Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| d3ec4328 | 06-Mar-2025 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: config: disable long long divisions
Currently on Aarch64, mbedtls uses long long divisions which result in
calls to __udivti3() in libgcc. This is at the moment the only
dependency on li
libmbedtls: config: disable long long divisions
Currently on Aarch64, mbedtls uses long long divisions which result in
calls to __udivti3() in libgcc. This is at the moment the only
dependency on libgcc in mbedtls, so disable the long long divisions by
defining MBEDTLS_NO_UDBL_DIVISION to remove the dependency.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| 7505c358 | 07-Mar-2025 |
Jerome Forissier <jerome.forissier@linaro.org> |
libmbedtls: fix compilation warning with GCC14
GCC 14.2 outputs the following compilation warning:
CC out/arm-plat-imx/ta_arm64-lib/libmbedtls/mbedtls/library/ecp.o
In file included from lib/li
libmbedtls: fix compilation warning with GCC14
GCC 14.2 outputs the following compilation warning:
CC out/arm-plat-imx/ta_arm64-lib/libmbedtls/mbedtls/library/ecp.o
In file included from lib/libmbedtls/mbedtls/library/ctr_drbg.c:13:
In function ‘mbedtls_xor’,
inlined from ‘ctr_drbg_update_internal’ at lib/libmbedtls/mbedtls/library/ctr_drbg.c:372:5:
lib/libmbedtls/mbedtls/library/common.h:245:17: warning: array subscript 48 is outside array bounds of ‘unsigned char[48]’ [-Warray-bounds=]
245 | r[i] = a[i] ^ b[i];
| ~^~~
lib/libmbedtls/mbedtls/library/ctr_drbg.c: In function ‘ctr_drbg_update_internal’:
lib/libmbedtls/mbedtls/library/ctr_drbg.c:335:19: note: at offset 48 into object ‘tmp’ of size 48
335 | unsigned char tmp[MBEDTLS_CTR_DRBG_SEEDLEN];
| ^~~
Fix it by returning early in mbedtls_xor() if the compiler is GCC.
This fix is not in MBed TLS upstream yet but the issue and the fix have
been reported [1].
Link: https://github.com/Mbed-TLS/mbedtls/issues/9003#issuecomment-2108239255 [1]
Reported-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Closes: https://github.com/OP-TEE/optee_os/issues/7295
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Sahil Malhotra <sahil.malhotra@nxp.com>
show more ...
|
| 5c603566 | 12-Dec-2024 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: use mempool_calloc() for temporary memory
mbedtls_mpi_exp_mod_optionally_safe() needs a large chunk of temporary
memory for the mbedtls_mpi_core_exp_mod() function. The amount of memory
libmbedtls: use mempool_calloc() for temporary memory
mbedtls_mpi_exp_mod_optionally_safe() needs a large chunk of temporary
memory for the mbedtls_mpi_core_exp_mod() function. The amount of memory
is too much to reliably allocate from the heap. So use mempool_calloc()
instead of mbedtls_calloc(), similar to using mbedtls_mpi_init_mempool()
instead of mbedtls_mpi_init().
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| cb034002 | 25-Nov-2024 |
Jerome Forissier <jerome.forissier@linaro.org> |
Squashed commit upgrading to mbedtls-3.6.2
Squash merging branch import/mbedtls-3.6.2.
85df256c4a67 ("libmbedtls: add CFG_CORE_UNSAFE_MODEXP and CFG_TA_MEBDTLS_UNSAFE_MODEXP")
1e9c6f15ef0f ("libm
Squashed commit upgrading to mbedtls-3.6.2
Squash merging branch import/mbedtls-3.6.2.
85df256c4a67 ("libmbedtls: add CFG_CORE_UNSAFE_MODEXP and CFG_TA_MEBDTLS_UNSAFE_MODEXP")
1e9c6f15ef0f ("libmbedtls: allow inclusion of arm_neon.h")
fab5313d7598 ("libmbedtls: fix cipher_wrap.c for NIST AES Key Wrap mode")
58c8b24bac04 ("libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly")
50e013c6c306 ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()")
c363a3c7e7e1 ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()")
91d9fe4fad38 ("libmbedtls: add SM2 curve")
b03fbd7006aa ("libmbedtls: fix no CRT issue")
bed9eb0c5209 ("libmbedtls: add interfaces in mbedtls for context memory operation")
65e7ec82d894 ("libmedtls: mpi_miller_rabin: increase count limit")
5e0191a043cb ("libmbedtls: add mbedtls_mpi_init_mempool()")
bf7ce25bb90f ("libmbedtls: make mbedtls_mpi_mont*() available")
04a9845a09b4 ("mbedtls: configure mbedtls to reach for config")
3f98104bba82 ("mbedtls: remove default include/mbedtls/config.h")
4d211f365152 ("Import mbedtls-3.6.2")
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 511c3c42 | 26-Sep-2024 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: mbedtls_config_uta.h: enable SHA-384 and SHA-512 support
Enable SHA-384 and SHA-512 support for user TAs.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne
libmbedtls: mbedtls_config_uta.h: enable SHA-384 and SHA-512 support
Enable SHA-384 and SHA-512 support for user TAs.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 021fee0a | 19-Aug-2024 |
Jacob Kroon <jacobkr@axis.com> |
core: mbedtls: Fix build
The macro 'MBEDTLS_INTERNAL_VALIDATE_RET()' was removed in upstream commit
https://github.com/Mbed-TLS/mbedtls/commit/cc0fd47531ffeffb3185db77a17ee113
The macro was a no-op
core: mbedtls: Fix build
The macro 'MBEDTLS_INTERNAL_VALIDATE_RET()' was removed in upstream commit
https://github.com/Mbed-TLS/mbedtls/commit/cc0fd47531ffeffb3185db77a17ee113
The macro was a no-op, so just remove the checks.
This fixes building OP-TEE with:
make PLATFORM=vexpress \
PLATFORM_FLAVOR=juno \
CFG_CRYPTOLIB_NAME=mbedtls \
CFG_CRYPTOLIB_DIR=lib/libmbedtls
...
lib/libmbedtls/core/hash.c: In function 'mbedtls_internal_sha1_process':
lib/libmbedtls/core/hash.c:205:9: error: implicit declaration of function 'MBEDTLS_INTERNAL_VALIDATE_RET'
Signed-off-by: Jacob Kroon <jacobkr@axis.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| b0563631 | 13-Jun-2024 |
Tom Van Eyck <tom.vaneyck@kuleuven.be> |
Squashed commit upgrading to mbedtls-3.6.0
Squash merging branch import/mbedtls-3.6.0
0fc9291f4 ("libmbedtls: bignum: restore mbedtls_mpi_exp_mod() from v3.5.2")
0ef87b1e6 ("libmbedtls: reset minim
Squashed commit upgrading to mbedtls-3.6.0
Squash merging branch import/mbedtls-3.6.0
0fc9291f4 ("libmbedtls: bignum: restore mbedtls_mpi_exp_mod() from v3.5.2")
0ef87b1e6 ("libmbedtls: reset minimum rsa key size")
70b079496 ("libmbedtls: adjust use of rsa pk_wrap API")
6cf76464f ("libmbedtls: allow inclusion of arm_neon.h")
27df5c911 ("libmbedtls: fix cipher_wrap.c for NIST AES Key Wrap mode")
aa584f9ed ("libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly")
523ae957e ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()")
30bdb1bbf ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()")
e45cdab62 ("libmbedtls: add SM2 curve")
d2fda4fc2 ("libmbedtls: fix no CRT issue")
ab0eb5515 ("libmbedtls: add interfaces in mbedtls for context memory operation")
7925a6f26 ("libmedtls: mpi_miller_rabin: increase count limit")
8eaf69279 ("libmbedtls: add mbedtls_mpi_init_mempool()")
12e83fc8d ("libmbedtls: make mbedtls_mpi_mont*() available")
f9e261da5 ("mbedtls: configure mbedtls to reach for config")
7b6f378d7 ("mbedtls: remove default include/mbedtls/config.h")
c16331743 ("Import mbedtls-3.6.0")
Signed-off-by: Tom Van Eyck <tom.vaneyck@kuleuven.be>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| 86ee543b | 07-Mar-2024 |
Sami Tolvanen <samitolvanen@google.com> |
core: pass TEE_ATTR_RSA_OAEP_MGF_HASH to RSA-OAEP implementations
OP-TEE currently doesn't support using a different hash for MGF1
with RSA-OAEP. However, this is required for AOSP compatibility
(e.
core: pass TEE_ATTR_RSA_OAEP_MGF_HASH to RSA-OAEP implementations
OP-TEE currently doesn't support using a different hash for MGF1
with RSA-OAEP. However, this is required for AOSP compatibility
(e.g. in EncryptionOperationsTest.RsaOaepWithMGFDigestSuccess [1]).
Pass the MGF1 attribute to crypto implementations. Note that
only libtomcrypt supports this feature at the moment, so other
implementations will either fail or fall back to libtomcrypt when
passed a different MGF1 hash.
Link: https://android.googlesource.com/platform/hardware/interfaces/+/refs/heads/main/security/keymint/aidl/vts/functional/KeyMintTest.cpp#5552 [1]
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| bce2f88a | 19-Nov-2023 |
Vincent Mailhol <mailhol.vincent@wanadoo.fr> |
tree-wide: remove useless newline character in *MSG() messages
The *MSG() macros take care of printing a newline. Adding a newline
character ('\n') is useless. Remove it.
Signed-off-by: Vincent Mai
tree-wide: remove useless newline character in *MSG() messages
The *MSG() macros take care of printing a newline. Adding a newline
character ('\n') is useless. Remove it.
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 32b31808 | 06-Oct-2023 |
Jens Wiklander <jens.wiklander@linaro.org> |
Squashed commit upgrading to mbedtls-3.4.0
Squash merging branch import/mbedtls-3.4.0
8225713449d3 ("libmbedtls: fix unrecognized compiler option")
f03730842d7b ("core: ltc: configure internal MD5"
Squashed commit upgrading to mbedtls-3.4.0
Squash merging branch import/mbedtls-3.4.0
8225713449d3 ("libmbedtls: fix unrecognized compiler option")
f03730842d7b ("core: ltc: configure internal MD5")
2b0d0c50127c ("core: ltc: configure internal SHA-1 and SHA-224")
0e48a6e17630 ("libmedtls: core: update to mbedTLS 3.4.0 API")
049882b143af ("libutee: update to mbedTLS 3.4.0 API")
982307bf6169 ("core: LTC mpi_desc.c: update to mbedTLS 3.4.0 API")
33218e9eff7b ("ta: pkcs11: update to mbedTLS 3.4.0 API")
6956420cc064 ("libmbedtls: fix cipher_wrap.c for NIST AES Key Wrap mode")
ad67ef0b43fd ("libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly")
7300f4d97bbf ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()")
cec89b62a86d ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()")
e7e048796c44 ("libmbedtls: add SM2 curve")
096beff2cd31 ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage")
7108668efd3f ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
0ba4eb8d0572 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W")
3fd6ecf00382 ("libmbedtls: fix no CRT issue")
d5ea7e9e9aa7 ("libmbedtls: add interfaces in mbedtls for context memory operation")
2b0fb3f1fa3d ("libmedtls: mpi_miller_rabin: increase count limit")
2c3301ab99bb ("libmbedtls: add mbedtls_mpi_init_mempool()")
9a111f0da04b ("libmbedtls: make mbedtls_mpi_mont*() available")
804fe3a374f5 ("mbedtls: configure mbedtls to reach for config")
b28a41531427 ("mbedtls: remove default include/mbedtls/config.h")
dfafe507bbef ("Import mbedtls-3.4.0")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)
show more ...
|
| e2ec831c | 03-Jul-2023 |
Jihwan Park <jihwp@amazon.com> |
core: crypto_bignum_free(): add indirection and set pointer to NULL
To prevent human mistake, crypto_bignum_free() sets the location of the
bignum pointer to NULL after freeing it.
Signed-off-by: J
core: crypto_bignum_free(): add indirection and set pointer to NULL
To prevent human mistake, crypto_bignum_free() sets the location of the
bignum pointer to NULL after freeing it.
Signed-off-by: Jihwan Park <jihwp@amazon.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 7bd215a7 | 06-Mar-2023 |
Jerome Forissier <jerome.forissier@linaro.org> |
core: mbedtls: ecc_get_keysize(): do not check algorithm against curve
Since commit fe2fd3ff46c0 ("GP131: Add TEE_ALG_ECDH_DERIVE_SHARED_SECRET
and TEE_ALG_ECDSA_SHA*"), the algorithm and curve valu
core: mbedtls: ecc_get_keysize(): do not check algorithm against curve
Since commit fe2fd3ff46c0 ("GP131: Add TEE_ALG_ECDH_DERIVE_SHARED_SECRET
and TEE_ALG_ECDSA_SHA*"), the algorithm and curve values are not tied
as closely as before. The GP TEE Internal Core API specification v1.3.1
mentions "ECDSA algorithm identifiers should be tied to the size of the
digest, not the key. The key size information is provided with the key
material." (Table B-2). In other words, a number of algorithm values
are valid for use with any given ECC curve. Therefore remove the
algorithm checks in ecc_get_keysize(). This function is not the proper
place anyways.
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| f5c3d85a | 01-Dec-2020 |
Julien Masson <jmasson@baylibre.com> |
core: crypto: add support MD5 hashes in RSA sign/verify/cipher
Introduce support of using MD5 hashes in RSA sign/verify/cipher
operations, which is required by AOSP Keymaster.
This is verified in
core: crypto: add support MD5 hashes in RSA sign/verify/cipher
Introduce support of using MD5 hashes in RSA sign/verify/cipher
operations, which is required by AOSP Keymaster.
This is verified in VerificationOperationsTest.RsaSuccess VTS Test [1],
which checks usage of such digests: NONE, MD5, SHA1, SHA_2_224, SHA_2_256,
SHA_2_384, SHA_2_512.
This patch has been inspired by commit[2]:
Link: [1] https://android.googlesource.com/platform/hardware/interfaces/+/master/keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp
Link: [2] https://github.com/OP-TEE/optee_os/commit/199d0b7310d1705661a106358f1f0b46e4c5c587 ("core: crypto: add support MD5 hashes in RSA sign/verify")
Signed-off-by: Julien Masson <jmasson@baylibre.com>
Signed-off-by: Safae Ouajih <souajih@baylibre.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 8ad96da2 | 27-Dec-2022 |
Jens Wiklander <jens.wiklander@linaro.org> |
core: mbedtls: use SHA-512 crypto accelerated routines
Uses the recently provided accelerated SHA-512 routine.
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklan
core: mbedtls: use SHA-512 crypto accelerated routines
Uses the recently provided accelerated SHA-512 routine.
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| db750c42 | 27-Dec-2022 |
Jens Wiklander <jens.wiklander@linaro.org> |
core: mbedtls: fix use of SHA-256 crypto accelerated routines
The wrong name of a configuration was used to test in mbedtls if the
accelerated SHA-256 routines should be used. Fix this by using the
core: mbedtls: fix use of SHA-256 crypto accelerated routines
The wrong name of a configuration was used to test in mbedtls if the
accelerated SHA-256 routines should be used. Fix this by using the
correct name CFG_CORE_CRYPTO_SHA256_ACCEL instead.
Fixes: 2fc5dc95a949 ("core: mbedtls: use SHA-256 crypto accelerated routines")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 6e909320 | 15-Nov-2022 |
Valerii Chubar <valerii_chubar@epam.com> |
libmbedtls: Enable nist_kw
Enable the AES KW mechanisms to be able to use them
from a trusted application.
Signed-off-by: Valerii Chubar <valerii_chubar@epam.com>
Signed-off-by: Sergiy Kibrik <Serg
libmbedtls: Enable nist_kw
Enable the AES KW mechanisms to be able to use them
from a trusted application.
Signed-off-by: Valerii Chubar <valerii_chubar@epam.com>
Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| e5353ad9 | 14-Nov-2022 |
Sergiy Kibrik <Sergiy_Kibrik@epam.com> |
libmbedtls: Fix cipher_wrap.c for nist_kw
The *_ctx_clone() function is missing and therefore
the wrong function pointers are assigned to
.ctx_free_func when MBEDTLS_NIST_KW_C is enabled.
lib/libmb
libmbedtls: Fix cipher_wrap.c for nist_kw
The *_ctx_clone() function is missing and therefore
the wrong function pointers are assigned to
.ctx_free_func when MBEDTLS_NIST_KW_C is enabled.
lib/libmbedtls/mbedtls/library/cipher_wrap.c:2248:5: warning:
initialization of ‘void (*)(void *, const void *)’ from incompatible
pointer type ‘void (*)(void *)’ [-Wincompatible-pointer-types]
2248 | kw_ctx_free,
^~~~~~~~~~~
Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
Signed-off-by: Valerii Chubar <valerii_chubar@epam.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 5879c0ee | 21-Nov-2022 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
lib: mbedtls: ecc: support the crypto driver
Provide an interface that can be used by drivers using the Crypto API
so that they can fallback to MBEDTLS software operations.
Signed-off-by: Jorge Ram
lib: mbedtls: ecc: support the crypto driver
Provide an interface that can be used by drivers using the Crypto API
so that they can fallback to MBEDTLS software operations.
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 98ada65e | 01-Apr-2022 |
Jens Wiklander <jens.wiklander@linaro.org> |
core: libmbedtls: add fault mitigation in crypto_acipher_rsassa_verify()
Adds fault mitigations in crypto_acipher_rsassa_verify() by checking
that the internal call to memcmp() when verifying the ha
core: libmbedtls: add fault mitigation in crypto_acipher_rsassa_verify()
Adds fault mitigations in crypto_acipher_rsassa_verify() by checking
that the internal call to memcmp() when verifying the hash in the RSA
signature was called and was successful.
The internal call to memcmp() records the result of the comparison if
successful. This is double checked against the normal return value from
the called pk_info->verify_func().
If the normal return value is OK then the recorded return value must
match or we're likely subject to a fault injection attack and we're
triggering a panic.
If the normal return value isn't OK we don't care about the recorded
value, it's overridden by a new error code. In this case we don't know
if we're subject to a fault injection attack or not, the important thing
to make sure that the calling function doesn't miss the error.
This fault mitigation is only enabled with the calling function enabled
fault mitigations and CFG_CORE_FAULT_MITIGATION is 'y'.
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 06de6080 | 01-Apr-2022 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()
Adds fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify() by using
the macro FTMN_CALLEE_DONE_MEMCMP() instead of just
libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()
Adds fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify() by using
the macro FTMN_CALLEE_DONE_MEMCMP() instead of just
mbedtls_safer_memcmp() when checking that the hash in the RSA signature
is matching the expected value.
FTMN_CALLEE_DONE_MEMCMP() saves on success the result in a thread local
storage if fault mitigations was enabled when the function was called.
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|