AuroraMiddleware/mbedtls
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
8,189 Commits 1 Branch 0 Tags 61 MiB
65408c5f92
Commit Graph

3972 Commits

Author SHA1 Message Date
Jaeden Amero
65408c5f92 Merge remote-tracking branch 'origin/pr/2355' into development-psa 2019-02-04 16:41:12 +00:00
Andrzej Kurek
2d4faa6afa ssl_tls: remove redundant status check 2019-01-29 03:14:15 -05:00
Andrzej Kurek
2f76075b78 ssl_tls: adjust to the new key policy initialization and key allocation 2019-01-28 08:08:15 -05:00
Andrzej Kurek
ac5dc3423a Fix key allocation for tls_prf_generic 2019-01-28 07:49:56 -05:00
Andrzej Kurek
3317126819 ssl_tls: add missing return brackets 2019-01-28 07:49:56 -05:00
Andrzej Kurek
70737ca827 ssl_tls: add key destruction upon generator failure 2019-01-28 07:49:56 -05:00
Andrzej Kurek
c929a82a6b Implement tls_prf_generic using the PSA API 2019-01-28 07:49:56 -05:00
Andrzej Kurek
5615dabeef ssl_tls: remove line breaks from a debug message 2019-01-28 07:04:19 -05:00
Andrzej Kurek
e85414edd0 ssl-opt: add a check for PSA computation of digest of ServerKeyExchange 2019-01-28 07:04:19 -05:00
Andrzej Kurek
814feffd15 Whitespace, logging and documentation fixes 
Introduce a psa_status_t status to handle return values.
Add a debug message with API usage description.
 2019-01-28 07:04:19 -05:00
Andrzej Kurek
d6db9be598 Adapt mbedtls_ssl_get_key_exchange_md_tls1_2 to PSA hashing 2019-01-28 07:04:19 -05:00
Hanno Becker
f99c2ec9d7 PSA: Adapt pk.c, pk_wrap.c, cipher.c to new key policy init API 2019-01-25 14:36:07 +00:00
Hanno Becker
e34f636f8d PSA: Adapt cipher.c, pk.c, pk_wrap.c to new key slot allocation API 2019-01-25 14:31:06 +00:00
Andrzej Kurek
c0a1be08a0 Fix indentation of documentation 2019-01-15 03:33:35 -05:00
Andrzej Kurek
62594a8b12 pk_wrap: pass curve size instead of a larger size of the exported key 
Whitespace fixes
 2019-01-14 05:14:18 -05:00
Andrzej Kurek
93a38a3101 pk: wrap curve_id before passing it to PSA 
Add a helper function in PSA utils
 2019-01-14 05:09:46 -05:00
Andrzej Kurek
a62a58ece5 cipher: fixed key ownership scope 
Indicate key ownership earlier, so that it gets destroyed on faulty policy setting.
 2019-01-14 05:01:28 -05:00
Andrzej Kurek
2349c4db88 Adapt to the new key allocation mechanism 2019-01-08 09:36:01 -05:00
Jaeden Amero
5dfca1e1bd Update library version to 2.15.1 2018-12-01 18:44:29 +00:00
Simon Butcher
60ee838a8a Merge remote-tracking branch 'public/pr/2224' into development-psa-proposed 2018-11-23 21:18:32 +00:00
Simon Butcher
ebeb6cb446 Update library version to 2.15.0 2018-11-23 14:18:15 +00:00
Hanno Becker
3441d2e4a4 Merge branch 'iotssl-2597-psa-hashing-x509' into development-psa-proposed 2018-11-23 11:42:07 +00:00
Hanno Becker
4ae8b497c0 Merge branch 'iotssl-2578-psa-sig-verification' into development-psa-proposed 2018-11-23 11:37:00 +00:00
Hanno Becker
a0a96a0c56 Merge branch 'psa_cipher_integration' into development-psa-proposed 2018-11-23 11:26:57 +00:00
Hanno Becker
f8b5f27bce Merge branch 'psa_cipher' into development-psa-proposed 2018-11-23 11:18:02 +00:00
Hanno Becker
485529952f Merge branch 'opaque_psk_implementation' into development-psa-proposed 2018-11-23 11:12:38 +00:00
Andrzej Kurek
b7f3ac6504 pkwrite: add an explicit cast to size_t 2018-11-22 12:05:08 -05:00
Andrzej Kurek
158c3d10d0 pkwrite: add a safety check before calculating the buffer size 2018-11-22 12:05:08 -05:00
Andrzej Kurek
4b11407258 Cosmetic changes 
Adjust whitespaces, reduce test dependencies and reduce buffer size passed by 1.
 2018-11-22 12:05:08 -05:00
Andrzej Kurek
5fec0860f9 pkwrite: add opaque key handling for public key exporting 
Return early from mbedtls_pk_write_pubkey_der - public opaque key
exporting is expected to contain all of the needed data, therefore it shouldn't
be written again.
 2018-11-22 12:05:08 -05:00
Andrzej Kurek
8b38ff57ab Remove trailing whitespace 2018-11-22 11:53:04 -05:00
Andrzej Kurek
a609337ca0 x509: remove unnecessary calls to psa_hash_abort 
According to the documentation, it does not need to be called after a failed
psa_hash call.
 2018-11-22 11:53:04 -05:00
Andrzej Kurek
d4a6553191 x509: use the PSA API to perform hashing operations 
So far limited only to certificate verification withour CRL and CSR generation.
 2018-11-22 11:53:04 -05:00
Andrzej Kurek
ad5d58124a pk_wrap.c: fix length mismatch check placement 2018-11-22 11:17:37 -05:00
Andrzej Kurek
eeac03b354 pk_wrap.c: tidy up signature extraction 
Add a sanity check for signature length, remove superfluous bounds check.
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
6cb63aa010 Cosmetic changes 
Move memset to a more relevant spot, fix one whitespace error
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
9241d18773 pk_wrap: rework and tidy up signature extraction 
Improve comments, use a normal buffer instead of mbedtls_asn1_buf,
remove unneeded variables and use shared utilities where possible.
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
b6016c52c5 pk_wrap: reuse a static buffer for signature extraction 
Use a buffer left over after importing a key to hold an extracted signature.
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
b7b0478f76 pk_wrap: rework signature extraction to work with small r and s values 
There is a probability that r will be encoded as 31 or less bytes in DER,
so additional padding is added in such case.
Added a signature-part extraction function to tidy up the code further.
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
4f0253962e pk_wrap: improve error codes returned from ecdsa_verify_wrap 
Use the shared PSA utilities to translate errors.
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
2122774d72 pk_wrap: switch to helper functions defined in psa_util.h 
Remove duplicated helper functions.
Remove an unnecessary call to psa_crypto_init().
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
c05ec9f39c pk_wrap: test if a valid md_alg is passed to ecdsa_verify_wrap 
Adjust tests to pass a valid algorithm
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
cef91afab6 pk_wrap: destroy key slot on errors with policy or key importing 2018-11-22 11:17:37 -05:00
Andrzej Kurek
3f864c2457 pk_wrap: add a check for equal signature parts 2018-11-22 11:17:37 -05:00
Andrzej Kurek
b3d1b12177 pk_wrap: check if curve conversion is successful 2018-11-22 11:17:37 -05:00
Andrzej Kurek
ea84233e02 pk_wrap: nullify the signature pointer on error in extract_ecdsa_sig 
Fix a double free error in ecdsa_verify_wrap
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
6376d638b8 pk_wrap: cosmetic changes 
Adjust whitespaces and variable names
 2018-11-22 11:17:37 -05:00
Andrzej Kurek
8b036a6082 pk_wrap.c: add support for ecdsa signature verification using PSA 
Use PSA internally to verify signatures.
Add a conversion to a raw signature format.
 2018-11-22 11:17:37 -05:00
Hanno Becker
cb1cc80cf5 Use PSA-based ciphers for record protections in TLS-1.2 only 
Reasons:
- For the first release, we attempt to support TLS-1.2 only,
- At least TLS-1.0 is known to not work at the moment, as
  for CBC ciphersuites the code in mbedtls_ssl_decrypt_buf()
  and mbedtls_ssl_encrypt_buf() assumes that mbedtls_cipher_crypt()
  updates the structure field for the IV in the cipher context,
  which the PSA-based implementation currently doesn't.
 2018-11-22 14:05:54 +00:00
Hanno Becker
679d8ceb13 Use PSA-based ciphers for SSL ticket protection 
This commit modifies the default SSL ticket implementation
from `library/ssl_ticket.c` to use PSA-based cipher context
for ticket creation and parsing.

As in mbedtls_ssl_derive_keys() adapted in an earlier commit,
we allow fallback to the ordinary mbedtls_cipher_setup()
if the provided cipher is not known. We do this even though
we always call mbedtls_ssl_ticket_setup() with AES-GCM
in our own code since this function is public and might
be used with other ciphers by users.
 2018-11-22 14:05:54 +00:00