AuroraMiddleware/mbedtls
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Note the expectations on mbedtls_psa_external_get_random()

Browse Source 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2020-11-18 15:27:37 +01:00
parent 89ffb28051
commit b663a60140
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/mbedtls/config.h
View File

@ -1342,6 +1342,14 @@
* Make the PSA Crypto module use an external random generator provided
* by a driver, instead of Mbed TLS's entropy and DRBG modules.
*
* \note This random generator must deliver random numbers with cryptographic
* quality and high performance. It must supply unpredictable numbers
* with a uniform distribution. The implementation of this function
* is responsible for ensuring that the random generator is seeded
* with sufficient entropy. If you have a hardware TRNG which is slow
* or delivers non-uniform output, declare it as an entropy source
* with mbedtls_entropy_add_source() instead of enabling this option.
*
* If you enable this option, you must supply configure the type
* ::mbedtls_psa_external_random_context_t in psa/crypto_platform.h
* and define a function called mbedtls_psa_external_get_random()

8
include/psa/crypto_extra.h
View File

@ -660,6 +660,14 @@ mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
* this function replaces Mbed TLS's entropy and DRBG modules for all
* random generation triggered via PSA crypto interfaces.
*
* \note This random generator must deliver random numbers with cryptographic
* quality and high performance. It must supply unpredictable numbers
* with a uniform distribution. The implementation of this function
* is responsible for ensuring that the random generator is seeded
* with sufficient entropy. If you have a hardware TRNG which is slow
* or delivers non-uniform output, declare it as an entropy source
* with mbedtls_entropy_add_source() instead of enabling this option.
*
* \param[in,out] context Pointer to the random generator context.
* This is all-bits-zero on the first call
* and preserved between successive calls.