| 8a7505b0 | 28-Apr-2025 |
Lauren Wehrmeister <lauren.wehrmeister@arm.com> |
feat(auth): mbedtls psa key id mgmt
Currently the psa key is created and destroyed after each usage during
signature verification.
This redesign adds a key_cache to store the key ID, psa algorithm,
feat(auth): mbedtls psa key id mgmt
Currently the psa key is created and destroyed after each usage during
signature verification.
This redesign adds a key_cache to store the key ID, psa algorithm, and
key attributes associated with a particular pk_oid. This allows for the
psa key to be reused by each image that has the associated pk_oid.
The pk_oid of the image being authenticated is stored as the global
current_pk_oid variable, which is used during the psa crypto
verification stage to associate a key_cache entry with a particular
pk_oid.
Since the psa key is no longer destroyed after each usage, the psa keys
are therefore destroyed after all images have been loaded during each
boot phase in the new crypto_mod_finish() function that is registered
by the REGISTER_CRYPTO_LIB and enabled through the build option of
PSA_CRYTPO.
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Iba330bc659a76493bd958673424efcc621bab1c4
show more ...
|
| c307efce | 09-Dec-2024 |
Ryan Everett <ryan.everett@arm.com> |
feat(mbedtls): mbedtls config update for v3.6.2
This new update to the LTS branch of MbedTLS provides
the fix for a buffer underrun vulnerability. TF-A does
not use the previously vulnerable functio
feat(mbedtls): mbedtls config update for v3.6.2
This new update to the LTS branch of MbedTLS provides
the fix for a buffer underrun vulnerability. TF-A does
not use the previously vulnerable functions
`mbedtls_pk_write_key_der` or `mbedtls_pk_write_key_pem`.
Full patch notes to this MbedTLS update can be found at
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.2.
We now enforce the mbedtls version to be greater than or equal
to 3.6.2 in our default configs.
Change-Id: I79027f6c741ab3f419f7b555321507e6a78b977b
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
show more ...
|
| 4eaaaa19 | 06-Sep-2023 |
Manish V Badarkhe <Manish.Badarkhe@arm.com> |
feat(mbedtls-psa): initialise mbedtls psa crypto
Initialised Mbedtls PSA cryto during Crypto init using
function call 'psa_crypto_init'.
MbedTLS currently requires a Random Number Generator (RNG) o
feat(mbedtls-psa): initialise mbedtls psa crypto
Initialised Mbedtls PSA cryto during Crypto init using
function call 'psa_crypto_init'.
MbedTLS currently requires a Random Number Generator (RNG) once
PSA Crypto support is enabled. However, TF-A itself doesn't engage
in cryptographic operations that demand randomness. Consequently,
we simulate the presence of an external TRNG (through the configuration
option 'MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) while, in reality, we offer
a dummy implementation of mbedtls_psa_external_get_random() that always
returns an error.
Change-Id: Ife6d03909c0e6081438d2b2519ef500e5dcdb88f
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
show more ...
|