lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-11-03 20:33:16 +03:00
Code Activity

Use a plausible input size with asymmetric verification

Browse Source 
Otherwise the error status can be PSA_ERROR_INVALID_SIGNATURE instead of the
expected PSA_ERROR_NOT_SUPPORTED in some configurations. For example, the
RSA verification code currently checks the signature size first whenever
PSA_KEY_TYPE_RSA_PUBLIC_KEY is enabled, and only gets into
algorithm-specific code if this passes, so it returns INVALID_SIGNATURE even
if the specific algorithm is not supported.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
2022-03-15 19:51:53 +01:00
parent c2fc241e46
commit 161c5ee5ff
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/suites/test_suite_psa_crypto_op_fail.function
View File

@@ -234,10 +234,20 @@ void sign_fail( int key_type_arg, data_t *key_data,
output, sizeof( output ), &length ) ); output, sizeof( output ), &length ) );
if( ! private_only ) if( ! private_only )
{ {
/* Determine a plausible signature size to avoid an INVALID_SIGNATURE
* error based on this. */
PSA_ASSERT( psa_get_key_attributes( key_id, &attributes ) );
size_t key_bits = psa_get_key_bits( &attributes );
size_t output_length = sizeof( output );
if( PSA_KEY_TYPE_IS_RSA( key_type ) )
output_length = PSA_BITS_TO_BYTES( key_bits );
else if( PSA_KEY_TYPE_IS_ECC( key_type ) )
output_length = 2 * PSA_BITS_TO_BYTES( key_bits );
TEST_ASSERT( output_length <= sizeof( output ) );
TEST_STATUS( expected_status, TEST_STATUS( expected_status,
psa_verify_hash( key_id, alg, psa_verify_hash( key_id, alg,
input, sizeof( input ), input, sizeof( input ),
output, sizeof( output ) ) ); output, output_length ) );
} }
exit: exit: