core: libmbedtls: add fault mitigation in crypto_acipher_rsassa_verify()

Adds fault mitigations in crypto_acipher_rsassa_verify() by checking
that the internal call to memcmp() when verifying the ha

core: libmbedtls: add fault mitigation in crypto_acipher_rsassa_verify()

Adds fault mitigations in crypto_acipher_rsassa_verify() by checking
that the internal call to memcmp() when verifying the hash in the RSA
signature was called and was successful.

The internal call to memcmp() records the result of the comparison if
successful. This is double checked against the normal return value from
the called pk_info->verify_func().

If the normal return value is OK then the recorded return value must
match or we're likely subject to a fault injection attack and we're
triggering a panic.

If the normal return value isn't OK we don't care about the recorded
value, it's overridden by a new error code. In this case we don't know
if we're subject to a fault injection attack or not, the important thing
to make sure that the calling function doesn't miss the error.

This fault mitigation is only enabled with the calling function enabled
fault mitigations and CFG_CORE_FAULT_MITIGATION is 'y'.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()

Adds fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify() by using
the macro FTMN_CALLEE_DONE_MEMCMP() instead of just

libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()

Adds fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify() by using
the macro FTMN_CALLEE_DONE_MEMCMP() instead of just
mbedtls_safer_memcmp() when checking that the hash in the RSA signature
is matching the expected value.

FTMN_CALLEE_DONE_MEMCMP() saves on success the result in a thread local
storage if fault mitigations was enabled when the function was called.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()

Adds fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext() by using
the macro FTMN_CALLEE_DONE_MEMCMP() instead of memcmp()

libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()

Adds fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext() by using
the macro FTMN_CALLEE_DONE_MEMCMP() instead of memcmp() when checking
that the hash in the RSA signature is matching the expected value.

FTMN_CALLEE_DONE_MEMCMP() saves on success the result in a thread local
storage if fault mitigations was enabled when the function was called.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: mbedtls_config_uta.h: enable chacha20 and chachapoly support

Extend the mbedtls UTA configuration to support the ciphers chacha20 and
chachapoly for usage in custom TAs, as they are supp

libmbedtls: mbedtls_config_uta.h: enable chacha20 and chachapoly support

Extend the mbedtls UTA configuration to support the ciphers chacha20 and
chachapoly for usage in custom TAs, as they are supported by common
protocols, such as TLS1.3, IPsec or WireGuard

Signed-off-by: Simon Ott <simon.ott@aisec.fraunhofer.de>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly

For chacha20 and chachapoly, the *_ctx_clone() function is missing
and therefore the wrong function pointers are assigned to
.ctx_clone_func

libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly

For chacha20 and chachapoly, the *_ctx_clone() function is missing
and therefore the wrong function pointers are assigned to
.ctx_clone_func and .ctx_free_func when MBEDTLS_CHACHA20_C
or MBEDTLS_CHACHAPOLY_C is enabled.

Signed-off-by: Simon Ott <simon.ott@aisec.fraunhofer.de>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

lib: mbedtls: rsa: support the crypto driver

Allow the software implementation to coexist with the crypto driver
API.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Jens Wikla

lib: mbedtls: rsa: support the crypto driver

Allow the software implementation to coexist with the crypto driver
API.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: mbedtls: Add ECC signature size check

The ECC signature implementation must check that the output buffer
has sufficient space to store the signature. This check was missing
in the mbedtls vers

core: mbedtls: Add ECC signature size check

The ECC signature implementation must check that the output buffer
has sufficient space to store the signature. This check was missing
in the mbedtls version of ecc_sign.

Fixes: ad6cfae7c0 ("libmbedtls: support mbedtls ECC function")
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Lars Persson <lars.persson@axis.com>

show more ...

core: mbedtls: Use a DRBG to speed up RSA key generation

The output rate of a TRNG is quite slow and this has a big impact
on the time needed to generate an RSA key since that process does
require a

core: mbedtls: Use a DRBG to speed up RSA key generation

The output rate of a TRNG is quite slow and this has a big impact
on the time needed to generate an RSA key since that process does
require a lot of random bits to find prime numbers.

We instantiate a CTR DRBG that is seeded from the TRNG to provide a
higher-speed source of random bits.

Performance comparison for rsa 2048 key generation on our device
with a TRNG that outputs on the order of 1e5 bits per second.

Before patch (14 samples)
mean time 14.02 sec stddev. 7.91

With patch (14 samples):
mean time 1.67 sec stddev. 1.24

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Lars Persson <larper@axis.com>

show more ...

Squashed commit upgrading to mbedtls-2.28.1

Squash merging branch import/mbedtls-2.28.1

ebf1f6a58089 ("libmbedtls: compile new files added with 2.28.1")
3ffb51b58a54 ("libmbedtls: add SM2 curve")

Squashed commit upgrading to mbedtls-2.28.1

Squash merging branch import/mbedtls-2.28.1

ebf1f6a58089 ("libmbedtls: compile new files added with 2.28.1")
3ffb51b58a54 ("libmbedtls: add SM2 curve")
c425755720b4 ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage")
23493c822a82 ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
dcdca2348dff ("libmbedtls: mbedtls_mpi_exp_mod() initialize W")
dc2994976958 ("libmbedtls: fix no CRT issue")
c6628873b281 ("libmbedtls: add interfaces in mbedtls for context memory operation")
8acd202d3e55 ("libmedtls: mpi_miller_rabin: increase count limit")
37284e28d5d9 ("libmbedtls: add mbedtls_mpi_init_mempool()")
b499a75f29f3 ("libmbedtls: make mbedtls_mpi_mont*() available")
2080a8c96a5d ("mbedtls: configure mbedtls to reach for config")
e0858334327a ("mbedtls: remove default include/mbedtls/config.h")
dd9688e6b8ce ("Import mbedtls-2.28.1")

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: mbedtls: sm2: fix SM2 key generation

ecc_get_keysize() lacks a case for TEE_ECC_CURVE_SM2, which prevents the
generation of a SM2 key pair. Fix this.

Signed-off-by: Jerome Forissier <jerome@f

core: mbedtls: sm2: fix SM2 key generation

ecc_get_keysize() lacks a case for TEE_ECC_CURVE_SM2, which prevents the
generation of a SM2 key pair. Fix this.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: mbedtls: add curve type to domain parameter group ID conversion

MBedTLS functions mbedtls_ecp_group_load() and mbedtls_ecdsa_genkey()
take a group ID parameter of type mbedtls_ecp_group_id whi

core: mbedtls: add curve type to domain parameter group ID conversion

MBedTLS functions mbedtls_ecp_group_load() and mbedtls_ecdsa_genkey()
take a group ID parameter of type mbedtls_ecp_group_id which is an enum
(MBEDTLS_ECP_DP_SECP192R1, etc.). The code in lib/libmbedtls/core/ecc.c
incorrectly passes a uint32_t TEE curve ID instead
(TEE_ECC_CURVE_NIST_P192, etc.). By chance the values happen to be the
same for all the NIST curves, but not for SM2. Fix that by introducing a
conversion function.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: mbedtls: sm2: set curve by default when key type is SM2

crypto_asym_alloc_ecc_keypair() and crypto_asym_alloc_ecc_public_key()
should set the curve field of the ecc_key structure to TEE_ECC_CU

core: mbedtls: sm2: set curve by default when key type is SM2

crypto_asym_alloc_ecc_keypair() and crypto_asym_alloc_ecc_public_key()
should set the curve field of the ecc_key structure to TEE_ECC_CURVE_SM2
when the key type is one of TEE_TYPE_SM2_{DSA,KEP,PKE}_KEYPAIR because
the user is not supposed to provide any TEE_ATTR_ECC_CURVE attribute,
contrary to other ECC algorithms.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libmbedtls: disable -Wdeclaration-after-statement

Disabled -Wdeclaration-after-statement when compiling the mbedtls
library in order to avoid that kind of warnings from upstream code.

Reviewed-by:

libmbedtls: disable -Wdeclaration-after-statement

Disabled -Wdeclaration-after-statement when compiling the mbedtls
library in order to avoid that kind of warnings from upstream code.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

lib: mbebtls: correct return value in RSA-SSA signature verification

The value TEE_ERROR_MAC_INVALID returned by function
crypto_acipher_rsassa_verify() of mbedtls library will
cause TEE_AsymmetricV

lib: mbebtls: correct return value in RSA-SSA signature verification

The value TEE_ERROR_MAC_INVALID returned by function
crypto_acipher_rsassa_verify() of mbedtls library will
cause TEE_AsymmetricVerifyDigest() to call TEE_Panic()
when it reports an invalid signature. Fix this by returning
TEE_ERROR_SIGNATURE_INVALID instead as specified by
the GPD TEE Internal Core API specifications.

Signed-off-by: lubing <lubing@eswin.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Squashed commit upgrading to mbedtls-2.27.0

Squash merging branch import/mbedtls-2.27.0

335b95f50f90 ("core: libmbedtls: add ctr_drbg.c to core sources")
9ad9df8b36e4 ("core: libtomcrypt: libmbed

Squashed commit upgrading to mbedtls-2.27.0

Squash merging branch import/mbedtls-2.27.0

335b95f50f90 ("core: libmbedtls: add ctr_drbg.c to core sources")
9ad9df8b36e4 ("core: libtomcrypt: libmbedtls: mbedtls_mpi_montred() now returns void")
ade0994c57b3 ("libmbedtls: add SM2 curve")
3041cf9726e2 ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage")
a2e7a4cd262d ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
87efbd27f8e0 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W")
e7c59b9b1d5f ("libmbedtls: fix no CRT issue")
d76bd278d9e2 ("libmbedtls: add interfaces in mbedtls for context memory operation")
e5b6c167f809 ("libmedtls: mpi_miller_rabin: increase count limit")
b81d896a903d ("libmbedtls: add mbedtls_mpi_init_mempool()")
3fbd8660c09d ("libmbedtls: make mbedtls_mpi_mont*() available")
2cc759c67e37 ("mbedtls: configure mbedtls to reach for config")
48bf81758c6e ("mbedtls: remove default include/mbedtls/config.h")
3602df84d7b3 ("Import mbedtls-2.27.0")

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

lib: mbedtls: return TEE_ERROR_BAD_PARAMETERS on input data error

This change fixes Keymaster VTS if cryptolib uses libmedtls
EncryptionOperationsTest, RsaPkcs1Success and
EncryptionOperationsTest,

lib: mbedtls: return TEE_ERROR_BAD_PARAMETERS on input data error

This change fixes Keymaster VTS if cryptolib uses libmedtls
EncryptionOperationsTest, RsaPkcs1Success and
EncryptionOperationsTest, RsaOaepSuccess probabilistic failure.
We should change error code from libmedtls to TEE_AsymmetricDecrypt.
In the same scenario, the tomcrypt return value is eventually
Converted to TEE_ERROR_BAD_PARAMETERS,and then pass the test.
But mbedtls converted to TEE_ERROR_BAD_STATE,
This causes TEE_AsymmetricDecrypt() to panic.

Signed-off-by: Liu Shiwei <liushiwei@eswin.com>
Tested-by: Liu Shiwei <liushiwei@eswin.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Victor Chong <victor.chong@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Fix memory leaks in sm2 of Mbedtls lib

When enable mbedtls in optee-os , xtest run twice will be fail.
Memory leakage exists in three functions.
1. grp and mpi in sm2_mbedtls_pke_encrypt
2. gr

core: Fix memory leaks in sm2 of Mbedtls lib

When enable mbedtls in optee-os , xtest run twice will be fail.
Memory leakage exists in three functions.
1. grp and mpi in sm2_mbedtls_pke_encrypt
2. grp in sm2_mbedtls_dsa_sign
3. grp in sm2_mbedtls_dsa_verify

Fixes: c84eee6397bb ("core: add support for SM2 using MBed TLS")
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: lubing <lubing@eswin.com>

show more ...

libmbedtls: Use single-line string literals.

Signed-off-by: Guido Vranken <guidovranken@gmail.com>
[Cherry-pick upstream commit 962e4ee4a6b3, add libmbedtls: prefix]
Signed-off-by: Jerome Forissier

libmbedtls: Use single-line string literals.

Signed-off-by: Guido Vranken <guidovranken@gmail.com>
[Cherry-pick upstream commit 962e4ee4a6b3, add libmbedtls: prefix]
Signed-off-by: Jerome Forissier <jerome@forissier.org>

show more ...

libmbedtls: Prevent triggering Clang 12 -Wstring-concatenation warning

Wrap multi-line string literals in parentheses
to prevent a Clang 12 -Wstring-concatenation warning
(activated by -Wall), which

libmbedtls: Prevent triggering Clang 12 -Wstring-concatenation warning

Wrap multi-line string literals in parentheses
to prevent a Clang 12 -Wstring-concatenation warning
(activated by -Wall), which caused the build to fail.

Fixes https://github.com/ARMmbed/mbedtls/issues/3586

Signed-off-by: Guido Vranken <guidovranken@gmail.com>
[Cherry-pick upstream commit 027fe00d2e32, add libmbedtls: prefix]
Signed-off-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: libmbedtls: build only necessary files

When building MBed TLS source files for use in the TEE core, some files
are currently compiled which are not used in the final link. This wastes
some res

core: libmbedtls: build only necessary files

When building MBed TLS source files for use in the TEE core, some files
are currently compiled which are not used in the final link. This wastes
some resources (build time and disk space), although not much; but it
also makes it less clear what is actually used by the core.

Introduce a reduced source file list in lib/libmbedtls/sub.mk when the
library is built for the core.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: libmbedtls: CMAC: remove code duplication

Use common code for AES CMAC and 3DES CMAC

Signed-off-by: Alexander Zakharov <uglym8@gmail.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

core: libmbedtls: CMAC: remove code duplication

Use common code for AES CMAC and 3DES CMAC

Signed-off-by: Alexander Zakharov <uglym8@gmail.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: libmbedtls: add 3DES CMAC implementation

Add 3DES CMAC (NIST SP800-38B).

Signed-off-by: Alexander Zakharov <uglym8@gmail.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Et

core: libmbedtls: add 3DES CMAC implementation

Add 3DES CMAC (NIST SP800-38B).

Signed-off-by: Alexander Zakharov <uglym8@gmail.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
[jf: add commit description]
Signed-off-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: add support for SM2 using MBed TLS

The SM2 algorithms (PKE, KEP and DSA) are currently implemented using
LibTomCrypt. They are automatically disabled when MBed TLS is selected
as the core cryp

core: add support for SM2 using MBed TLS

The SM2 algorithms (PKE, KEP and DSA) are currently implemented using
LibTomCrypt. They are automatically disabled when MBed TLS is selected
as the core crypto library (that is, when CFG_CRYPTOLIB_NAME=mbedtls
CFG_CRYPTOLIB_DIR=lib/libmbedtls).

This commit removes this restriction by porting the relevant files
(core/lib/libtomcrypt/sm2-{dsa,kep,pke}.c) over to the MBed TLS API in
lib/libmbedtls/core.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libmbedtls: add SM2 curve

When MBEDTLS_ECP_DP_SM2_ENABLED is set, adds support for the ECC curve
defined for the Chinese SM2 algorithm (G/MT 0003 Part 5, [1]).

Link: [1] http://www.gmbz.org.cn/uplo

libmbedtls: add SM2 curve

When MBEDTLS_ECP_DP_SM2_ENABLED is set, adds support for the ECC curve
defined for the Chinese SM2 algorithm (G/MT 0003 Part 5, [1]).

Link: [1] http://www.gmbz.org.cn/upload/2018-07-24/1532401863206085511.pdf
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: libmbedtls: drop useless & before function names

There is no need to use & on a function name to obtain the function
address. Drop the useless & characters.

Signed-off-by: Jerome Forissier <j

core: libmbedtls: drop useless & before function names

There is no need to use & on a function name to obtain the function
address. Drop the useless & characters.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...