| b56ad90e | 06-Oct-2020 |
Cedric Neveux <cedric.neveux@nxp.com> |
libs: ltc and mbedtls introduce crypto_ecc[public/keypair]_ops
Change ECC call functions name to be able to use a ECC HW driver.
At ECC public and keypair allocation, if success, set the key ops fie
libs: ltc and mbedtls introduce crypto_ecc[public/keypair]_ops
Change ECC call functions name to be able to use a ECC HW driver.
At ECC public and keypair allocation, if success, set the key ops field
to call the cryptographic operations linked to the key allocator.
Signed-off-by: Cedric Neveux <cedric.neveux@nxp.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 1ab1ebd8 | 12-Nov-2020 |
Jerome Forissier <jerome@forissier.org> |
core: libmbedtls: use crypto_acipher_free_rsa_keypair() instead of open-coding
There is a function to free an RSA keypair, use it instead of
duplicating the code.
Signed-off-by: Jerome Forissier <j
core: libmbedtls: use crypto_acipher_free_rsa_keypair() instead of open-coding
There is a function to free an RSA keypair, use it instead of
duplicating the code.
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 5118efbe | 12-Nov-2020 |
Jerome Forissier <jerome@forissier.org> |
core: libmbedtls: crypto_acipher_free_rsa_keypair(): add missing free for s->dq
The crypto_acipher_free_rsa_keypair() function lacks a call to
crypto_bignum_free() for the dq member of the key. Add
core: libmbedtls: crypto_acipher_free_rsa_keypair(): add missing free for s->dq
The crypto_acipher_free_rsa_keypair() function lacks a call to
crypto_bignum_free() for the dq member of the key. Add it.
Fixes: a1d5c81f8834 ("crypto: add function to free rsa keypair")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| a1d5c81f | 11-Aug-2020 |
Elias von Däniken <elias.vondaeniken@bluewin.ch> |
crypto: add function to free rsa keypair
There was no function to proper free a rsa kepair from inside a PTA.
Now there is crypto_acipher_free_rsa_keypair().
Signed-off-by: Elias von Däniken <elias
crypto: add function to free rsa keypair
There was no function to proper free a rsa kepair from inside a PTA.
Now there is crypto_acipher_free_rsa_keypair().
Signed-off-by: Elias von Däniken <elias.vondaeniken@bluewin.ch>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| ed3fa831 | 29-Apr-2020 |
Jerome Forissier <jerome@forissier.org> |
libmbedtls: mbedtls_mpi_shrink(): fix possible unwanted truncation
If mbedtls_mpi_shrink() is passed a value for nblimbs that is smaller
than the minimum number of limbs required to store the big nu
libmbedtls: mbedtls_mpi_shrink(): fix possible unwanted truncation
If mbedtls_mpi_shrink() is passed a value for nblimbs that is smaller
than the minimum number of limbs required to store the big number, the
current implementation will unexpectedly truncate the number to the
requested size. It should use the minimal size instead in order not to
corrupt the bigum value.
This issue was introduced in [1] probably as a result of a bad copy
and paste from mbedtls_mpi_grow().
Fixes: [1] commit 98bd5fe350be ("libmbedtls: add mbedtls_mpi_init_mempool()")
Reported-by: Zhenke Ma <zhenke.ma@armchina.com>
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 11fa71b9 | 20-Apr-2020 |
Jerome Forissier <jerome@forissier.org> |
Squashed commit upgrading to mbedtls-2.22.0
Squash merging branch import/mbedtls-2.22.0
5cab03377186 ("mk/clang.mk: define libgcc$(sm)")
3607a5386a72 ("core: mbedtls: enable MBEDTLS_ECDH_LEGACY_CON
Squashed commit upgrading to mbedtls-2.22.0
Squash merging branch import/mbedtls-2.22.0
5cab03377186 ("mk/clang.mk: define libgcc$(sm)")
3607a5386a72 ("core: mbedtls: enable MBEDTLS_ECDH_LEGACY_CONTEXT")
896c8845bbda ("mbedtls: remove file md_wrap.c from build")
400b2af54fa0 ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage")
777827c7af3d ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
549e4600678e ("libmbedtls: preserve mempool usage on reinit")
02d636083fe2 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W")
d2ac2b3c92bf ("libmbedtls: fix no CRT issue")
f550879d5be2 ("libmbedtls: add interfaces in mbedtls for context memory operation")
219173d807ce ("libmedtls: mpi_miller_rabin: increase count limit")
7930b0b6b5e4 ("libmbedtls: add mbedtls_mpi_init_mempool()")
78af9fdc120f ("libmbedtls: make mbedtls_mpi_mont*() available")
8f7357271cc2 ("libmbedtls: refine mbedtls license header")
c5993878881f ("mbedtls: configure mbedtls to reach for config")
6f9c587783af ("mbedtls: remove default include/mbedtls/config.h")
3d3bd3b12752 ("Import mbedtls-2.22.0")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 21282bae | 16-Apr-2020 |
Jerome Forissier <jerome@forissier.org> |
core: crypto: ECC: make sure key_size is consistent with attributes
TEE_GenerateKey() takes a key_size argument and various attributes. If
the size derived from the attributes is not key_size, we sh
core: crypto: ECC: make sure key_size is consistent with attributes
TEE_GenerateKey() takes a key_size argument and various attributes. If
the size derived from the attributes is not key_size, we should return
TEE_ERROR_BAD_PARAMETERS as per the GP TEE Internal Core API
specification v1.2.1: "If an incorrect or inconsistent attribute is
detected. The checks that are performed depend on the implementation.".
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 9f4dcefb | 16-Apr-2020 |
Jerome Forissier <jerome@forissier.org> |
core: crypto: DH: make sure key_size is consistent with attributes
TEE_GenerateKey() takes a key_size argument and various attributes. For
Diffie-Hellman, if the size of the prime number (TEE_ATTR_D
core: crypto: DH: make sure key_size is consistent with attributes
TEE_GenerateKey() takes a key_size argument and various attributes. For
Diffie-Hellman, if the size of the prime number (TEE_ATTR_DH_PRIME) is
not key_size, we should return TEE_ERROR_BAD_PARAMETERS as per the GP
TEE Internal Core API specification v1.2.1: "If an incorrect or
inconsistent attribute is detected. The checks that are performed
depend on the implementation.".
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 5b25c76a | 07-Apr-2020 |
Jerome Forissier <jerome@forissier.org> |
Squashed commit upgrading to mbedtls-2.16.5
Squash merging branch import/mbedtls-2.16.5
058aefb2bfa4 ("core: mbedtls: use SHA-256 crypto accelerated routines")
bcef9baed8f1 ("core: mbedtls: use SHA
Squashed commit upgrading to mbedtls-2.16.5
Squash merging branch import/mbedtls-2.16.5
058aefb2bfa4 ("core: mbedtls: use SHA-256 crypto accelerated routines")
bcef9baed8f1 ("core: mbedtls: use SHA-1 crypto accelerated routines")
c9359f31db12 ("core: mbedtls: use AES crypto accelerated routines")
0e6c1e2642c7 ("core: merge tee_*_get_digest_size() into a single function")
0cb3c28a2f4d ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage")
5abf0e6ab72e ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
2ccc08ac7fef ("libmbedtls: preserve mempool usage on reinit")
cd2a24648569 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W")
7727182ecb56 ("libmbedtls: fix no CRT issue")
120737075dcf ("libmbedtls: add interfaces in mbedtls for context memory operation")
1126250b3af8 ("libmbedtls: add missing source file chachapoly.c")
23972e9f1c98 ("libmedtls: mpi_miller_rabin: increase count limit")
1fcbc05b3cd2 ("libmbedtls: add mbedtls_mpi_init_mempool()")
66e03f068078 ("libmbedtls: make mbedtls_mpi_mont*() available")
d07e0ce56236 ("libmbedtls: refine mbedtls license header")
491ee2cd0ff4 ("mbedtls: configure mbedtls to reach for config")
9b6cee685d9a ("mbedtls: remove default include/mbedtls/config.h")
84f7467a0a91 ("Import mbedtls-2.16.5")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 2fc5dc95 | 30-Mar-2020 |
Jens Wiklander <jens.wiklander@linaro.org> |
core: mbedtls: use SHA-256 crypto accelerated routines
Uses the recently provided accelerated SHA-256 routine.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander
core: mbedtls: use SHA-256 crypto accelerated routines
Uses the recently provided accelerated SHA-256 routine.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 734545da | 30-Mar-2020 |
Jens Wiklander <jens.wiklander@linaro.org> |
core: mbedtls: use SHA-1 crypto accelerated routines
Uses the recently provided accelerated SHA-1 routine.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <je
core: mbedtls: use SHA-1 crypto accelerated routines
Uses the recently provided accelerated SHA-1 routine.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 10b90791 | 30-Mar-2020 |
Jens Wiklander <jens.wiklander@linaro.org> |
core: mbedtls: use AES crypto accelerated routines
Uses the recently provided accelerated AES crypto routines in mbedtls.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jen
core: mbedtls: use AES crypto accelerated routines
Uses the recently provided accelerated AES crypto routines in mbedtls.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 7c767434 | 02-Apr-2020 |
Albert Schwarzkopf <a.schwarzkopf@phytec.de> |
core: merge tee_*_get_digest_size() into a single function
Rename tee_hash_get_digest_size() to tee_alg_get_digest_size().
Change tee_alg_get_digest_size() to use new libutee macro
TEE_ALG_GET_DIGE
core: merge tee_*_get_digest_size() into a single function
Rename tee_hash_get_digest_size() to tee_alg_get_digest_size().
Change tee_alg_get_digest_size() to use new libutee macro
TEE_ALG_GET_DIGEST_SIZE.
Remove tee_mac_get_digest_size() as its functionality
is handled by tee_alg_get_digest_size() now.
Signed-off-by: Albert Schwarzkopf <a.schwarzkopf@phytec.de>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 7fb525f1 | 23-Jan-2020 |
Jerome Forissier <jerome@forissier.org> |
Remove libmpa in favor of libmbedtls
We currently have two "big numbers" library, Mbed TLS and MPA. Both can
be used by libutee to implement the TEE Internal Core API Arithmetical
functions, and by
Remove libmpa in favor of libmbedtls
We currently have two "big numbers" library, Mbed TLS and MPA. Both can
be used by libutee to implement the TEE Internal Core API Arithmetical
functions, and by the TEE core or pseudo-TAs. This situation is
reflected by two configuration variables allowing to choose between
libmbedtls and libmpa:
- CFG_TA_MBEDTLS_MPI (default y) configures libutee,
- CFG_CORE_MBEDTLS_MPI (default y) configures the TEE core/PTAs.
In addition there is CFG_TA_MBEDTLS (default y, mandatory when
CFG_TA_MBEDTLS_MPI is y) to build libmbedtls and install it into the
SDK for direct use by TAs (libmbedtls also has function to deal with
certificates for instance).
MBed TLS has been supported and used by default for just over a year;
and we have recently found an issue with the MPA implementation of the
integer multiplication with modulus (mpa_mulmod()) [1] [2]. Therefore,
now is a good time to remove libmpa and use libmbedtls instead.
Link: [1] https://github.com/OP-TEE/optee_os/pull/3541#issuecomment-577592381
Link: [2] https://github.com/OP-TEE/optee_test/pull/389
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| df24e651 | 29-Jan-2020 |
Cao, Vincent T <vincent.t.cao@intel.com> |
libmbedtls: fix public key size in crypto_acipher_gen_dh_key()
GP wrapper of mbedtls DH operation generate key function wrongly
calculates the number of bytes from bits, leading to incorrect public
libmbedtls: fix public key size in crypto_acipher_gen_dh_key()
GP wrapper of mbedtls DH operation generate key function wrongly
calculates the number of bytes from bits, leading to incorrect public
key generated and returned.
Fixes: 34789f62982f ("libmbedtls: support mbedtls DH function")
Signed-off-by: Cao, Vincent T <vincent.t.cao@intel.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
show more ...
|
| 0d77037f | 31-Oct-2019 |
Florian Depraz <florian.depraz@alumni.epfl.ch> |
mbedtls: Add MBEDTLS_X509_CSR_WRITE_C define
Enable the mbedtls_x509write_csr_* functions that can be used
to create certificate signing requests by generating and
updating the structure mbedtls_x50
mbedtls: Add MBEDTLS_X509_CSR_WRITE_C define
Enable the mbedtls_x509write_csr_* functions that can be used
to create certificate signing requests by generating and
updating the structure mbedtls_x509write_csr.
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Florian Depraz <florian.depraz@alumni.epfl.ch>
show more ...
|
| dc57b110 | 28-Aug-2019 |
Jerome Forissier <jerome.forissier@linaro.org> |
Do not let CFG_CRYPTO_SIZE_OPTIMIZATION set -Os
Compiler optimization flags -O0 or -Os are selected globally by the
config variable CFG_CC_OPTIMIZE_FOR_SIZE, but crypto code
(lib/libmbedtls and core
Do not let CFG_CRYPTO_SIZE_OPTIMIZATION set -Os
Compiler optimization flags -O0 or -Os are selected globally by the
config variable CFG_CC_OPTIMIZE_FOR_SIZE, but crypto code
(lib/libmbedtls and core/lib/libtomcrypt) is always built with -Os
when CFG_CRYPTO_SIZE_OPTIMIZATION=y. This is a bit inconvenient
when debugging crypto code because two flags have to be set, and it
is not obvious why CFG_CC_OPTIMIZE_FOR_SIZE would not influence crypto.
Since performance does not matter much when debugging, and -Os/-O0
does not make a huge difference anyway, it is wiser to keep the purpose
of the two CFG_ variables separated: CFG_CC_OPTIMIZE_FOR_SIZE should
control the -O flag for all sources, while CFG_CRYPTO_SIZE_OPTIMIZATION
should deal with other size-related settings in the crypto code
(namely: set -DLTC_SMALL_CODE for LibTomCrypt).
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| ad443200 | 27-May-2019 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage
d5572fade852 ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool
usage") from branch import/mbedtls-2.16.0
With W allocated in the mempoo
libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage
d5572fade852 ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool
usage") from branch import/mbedtls-2.16.0
With W allocated in the mempool instead of the stack it is more important
to utilize the mempool in a stack like way.
With this patch allocation and initialization of W is moved to a point
where all following mempool allocations are free before the function
returns.
This reduces maximum memory consumption of mempool in regression case
8101 for an AArch64 TA in from 17280 to 7640 bytes. Figures for an
AArch32 TA are 12040 to 5288 bytes.
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 41e5aa8f | 21-May-2019 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage
68df6eb0f256 ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
from branch import/mbedtls-2.16.0
The W variable is 3072 bytes on AArch6
libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage
68df6eb0f256 ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
from branch import/mbedtls-2.16.0
The W variable is 3072 bytes on AArch64 with MBEDTLS_MPI_WINDOW_SIZE set
to 6 for maximum performance. Instead of allocating such a large
variable on the stack use mempool_alloc().
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 2976273f | 17-Apr-2019 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: preserve mempool usage on reinit
be040a3e949b ("libmbedtls: preserve mempool usage on reinit") from
branch import/mbedtls-2.16.0
Preserve the use_mempool field when reinitializing X in
libmbedtls: preserve mempool usage on reinit
be040a3e949b ("libmbedtls: preserve mempool usage on reinit") from
branch import/mbedtls-2.16.0
Preserve the use_mempool field when reinitializing X in
mbedtls_mpi_read_binary().
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| b99a4a18 | 17-Apr-2019 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: mbedtls_mpi_exp_mod() initialize W
ae499f6a39f3 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W") from
branch import/mbedtls-2.16.0
Initialize W using mbedtls_mpi_init_mempool() instea
libmbedtls: mbedtls_mpi_exp_mod() initialize W
ae499f6a39f3 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W") from
branch import/mbedtls-2.16.0
Initialize W using mbedtls_mpi_init_mempool() instead of memset() to
ensure that the temporary variable uses the designated memory pool if
configured.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| ef21404e | 21-Mar-2019 |
Jens Wiklander <jens.wiklander@linaro.org> |
mbedtls: Support AES-CCM algorithm
Use AES-CCM implementation from libtomcrypt instead of mbedtls version
due to limitations in the mbedtls API.
Acked-by: Etienne Carriere <etienne.carriere@linaro.
mbedtls: Support AES-CCM algorithm
Use AES-CCM implementation from libtomcrypt instead of mbedtls version
due to limitations in the mbedtls API.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| a4ae1ebe | 27-Mar-2019 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: Support cipher XTS algorithm
Cipher XTS is not supported in MbedTLS, use libtomcrypt instead.
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jen
libmbedtls: Support cipher XTS algorithm
Cipher XTS is not supported in MbedTLS, use libtomcrypt instead.
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| a2aa5803 | 27-Mar-2019 |
Jens Wiklander <jens.wiklander@linaro.org> |
libmbedtls: Support DSA algorithm
DSA is not supported in MbedTLS, use libtomcrypt instead.
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@li
libmbedtls: Support DSA algorithm
DSA is not supported in MbedTLS, use libtomcrypt instead.
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| ad6cfae7 | 11-Sep-2017 |
Edison Ai <edison.ai@arm.com> |
libmbedtls: support mbedtls ECC function
Support mbedtls ECC: ecdh and ecdsa.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Je
libmbedtls: support mbedtls ECC function
Support mbedtls ECC: ecdh and ecdsa.
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|