From bc3f917fb363fe86715181993270a035038a8be8 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 24 Dec 2024 11:32:39 +0100 Subject: [PATCH] crypto_config.h: Don't list mechanisms that are not implemented Don't list mechanisms that are not implemented in `include/psa/crypto_config.h`, even commented out. Uncommenting them wouldn't help anyway: they don't work. Having them listed, even commented out, causes `find_dependencies_not_implemented()` in `psa_test_case.py` to consider those mechanisms to be implemented, and thus causes `generate_psa_tests.py` to generate test cases that cannot be executed. The affected mechanisms are: * `PSA_ALG_CBC_MAC` (`PSA_WANT_ALG_CBC_MAC`) * `PSA_ALG_XTS` (`PSA_WANT_ALG_XTS`) * `PSA_ECC_FAMILY_SECP_K1` 224-bit (`PSA_WANT_ECC_SECP_K1_224`) Also remove the affected mechanisms from configuration adjustment files, since that is code that can never be triggered. There were already no generated test cases for SECP224K1 because `PSA_WANT_ECC_SECP_K1_224` was already detected as a dependency that cannot be implemented, because that is not a valid size: PSA defines SECP224K1 as 225-bit, and `crypto_knowledge.py` follows suite, so `generate_psa_tests.py` saw `PSA_WANT_ECC_SECP_K1_225` in its enumeration but skipped it because it was never mentioned in `crypto_config.h`. This causes generated PSA tests to no longer include positive test cases for `PSA_ALG_CBC_MAC` and `PSA_ALG_XTS`. Signed-off-by: Gilles Peskine --- .../mbedtls/config_adjust_legacy_from_psa.h | 19 --------------- .../config_adjust_psa_superset_legacy.h | 7 ------ include/psa/crypto_config.h | 14 ----------- library/psa_crypto_cipher.c | 3 --- scripts/config.py | 11 +-------- .../crypto_config_test_driver_extension.h | 24 ------------------- 6 files changed, 1 insertion(+), 77 deletions(-) diff --git a/include/mbedtls/config_adjust_legacy_from_psa.h b/include/mbedtls/config_adjust_legacy_from_psa.h index 04bdae61bb..48f1bab1ed 100644 --- a/include/mbedtls/config_adjust_legacy_from_psa.h +++ b/include/mbedtls/config_adjust_legacy_from_psa.h @@ -69,7 +69,6 @@ (defined(PSA_WANT_ECC_SECP_R1_384) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384)) || \ (defined(PSA_WANT_ECC_SECP_R1_521) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521)) || \ (defined(PSA_WANT_ECC_SECP_K1_192) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192)) || \ - (defined(PSA_WANT_ECC_SECP_K1_224) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224)) || \ (defined(PSA_WANT_ECC_SECP_K1_256) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256)) #define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES #define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES @@ -225,17 +224,6 @@ #endif /* missing accel */ #endif /* PSA_WANT_ECC_SECP_K1_192 */ -#if defined(PSA_WANT_ECC_SECP_K1_224) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1 -#define MBEDTLS_ECP_DP_SECP224K1_ENABLED -/* https://github.com/Mbed-TLS/mbedtls/issues/3541 */ -#error "SECP224K1 is buggy via the PSA API in Mbed TLS." -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_SECP_K1_224 */ - #if defined(PSA_WANT_ECC_SECP_K1_256) #if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) || \ defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ @@ -782,13 +770,6 @@ #define PSA_HAVE_SOFT_BLOCK_CIPHER 1 #endif -#if defined(PSA_WANT_ALG_CBC_MAC) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_MAC) -#error "CBC-MAC is not yet supported via the PSA API in Mbed TLS." -#define MBEDTLS_PSA_BUILTIN_ALG_CBC_MAC 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_CBC_MAC */ -#endif /* PSA_WANT_ALG_CBC_MAC */ - #if defined(PSA_WANT_ALG_CMAC) #if !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC) || \ defined(PSA_HAVE_SOFT_BLOCK_CIPHER) diff --git a/include/mbedtls/config_adjust_psa_superset_legacy.h b/include/mbedtls/config_adjust_psa_superset_legacy.h index ef65cce0d9..1a232cbb81 100644 --- a/include/mbedtls/config_adjust_psa_superset_legacy.h +++ b/include/mbedtls/config_adjust_psa_superset_legacy.h @@ -136,13 +136,6 @@ #endif /* PSA_WANT_ECC_SECP_K1_192 */ #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */ -/* SECP224K1 is buggy via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/3541) */ -#if 0 && defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) -#if !defined(PSA_WANT_ECC_SECP_K1_224) -#define PSA_WANT_ECC_SECP_K1_224 1 -#endif /* PSA_WANT_ECC_SECP_K1_224 */ -#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */ - #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) #if !defined(PSA_WANT_ECC_SECP_K1_256) #define PSA_WANT_ECC_SECP_K1_256 1 diff --git a/include/psa/crypto_config.h b/include/psa/crypto_config.h index 36e937ad35..e0a8d60606 100644 --- a/include/psa/crypto_config.h +++ b/include/psa/crypto_config.h @@ -38,10 +38,6 @@ #ifndef PSA_CRYPTO_CONFIG_H #define PSA_CRYPTO_CONFIG_H -/* - * CBC-MAC is not yet supported via the PSA API in Mbed TLS. - */ -//#define PSA_WANT_ALG_CBC_MAC 1 #define PSA_WANT_ALG_CBC_NO_PADDING 1 #define PSA_WANT_ALG_CBC_PKCS7 1 #define PSA_WANT_ALG_CCM 1 @@ -84,22 +80,12 @@ #define PSA_WANT_ALG_TLS12_PSK_TO_MS 1 #define PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS 1 -/* XTS is not yet supported via the PSA API in Mbed TLS. - * Note: when adding support, also adjust include/mbedtls/config_psa.h */ -//#define PSA_WANT_ALG_XTS 1 - #define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1 #define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1 #define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1 #define PSA_WANT_ECC_MONTGOMERY_255 1 #define PSA_WANT_ECC_MONTGOMERY_448 1 #define PSA_WANT_ECC_SECP_K1_192 1 -/* - * SECP224K1 is buggy via the PSA API in Mbed TLS - * (https://github.com/Mbed-TLS/mbedtls/issues/3541). Thus, do not enable it by - * default. - */ -//#define PSA_WANT_ECC_SECP_K1_224 1 #define PSA_WANT_ECC_SECP_K1_256 1 #define PSA_WANT_ECC_SECP_R1_192 1 #define PSA_WANT_ECC_SECP_R1_224 1 diff --git a/library/psa_crypto_cipher.c b/library/psa_crypto_cipher.c index 3216c94898..efc5813ff0 100644 --- a/library/psa_crypto_cipher.c +++ b/library/psa_crypto_cipher.c @@ -71,9 +71,6 @@ static psa_status_t mbedtls_cipher_validate_values( #if !defined(PSA_WANT_ALG_OFB) MBEDTLS_ASSUME(alg != PSA_ALG_OFB); #endif -#if !defined(PSA_WANT_ALG_XTS) - MBEDTLS_ASSUME(alg != PSA_ALG_XTS); -#endif #if !defined(PSA_WANT_ALG_ECB_NO_PADDING) MBEDTLS_ASSUME(alg != PSA_ALG_ECB_NO_PADDING); #endif diff --git a/scripts/config.py b/scripts/config.py index ef13062936..957127e5d4 100755 --- a/scripts/config.py +++ b/scripts/config.py @@ -48,8 +48,6 @@ def realfull_adapter(_name, _value, _active): return True PSA_UNSUPPORTED_FEATURE = frozenset([ - 'PSA_WANT_ALG_CBC_MAC', - 'PSA_WANT_ALG_XTS', 'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE', 'PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE' ]) @@ -59,13 +57,8 @@ PSA_DEPRECATED_FEATURE = frozenset([ 'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR' ]) -PSA_UNSTABLE_FEATURE = frozenset([ - 'PSA_WANT_ECC_SECP_K1_224' -]) - EXCLUDE_FROM_CRYPTO = PSA_UNSUPPORTED_FEATURE | \ - PSA_DEPRECATED_FEATURE | \ - PSA_UNSTABLE_FEATURE + PSA_DEPRECATED_FEATURE # The goal of the full configuration is to have everything that can be tested # together. This includes deprecated or insecure options. It excludes: @@ -357,8 +350,6 @@ class CryptoConfig(config_common.Config): if name in PSA_UNSUPPORTED_FEATURE: raise ValueError(f'Feature is unsupported: \'{name}\'') - if name in PSA_UNSTABLE_FEATURE: - raise ValueError(f'Feature is unstable: \'{name}\'') if name not in self.settings: self._get_configfile().templates.append((name, '', '#define ' + name + ' ')) diff --git a/tests/configs/crypto_config_test_driver_extension.h b/tests/configs/crypto_config_test_driver_extension.h index 66378e7def..879e29eb3f 100644 --- a/tests/configs/crypto_config_test_driver_extension.h +++ b/tests/configs/crypto_config_test_driver_extension.h @@ -127,14 +127,6 @@ #endif #endif -#if defined(PSA_WANT_ECC_SECP_K1_224) -#if defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224) -#undef MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224 -#else -#define MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224 1 -#endif -#endif - #if defined(PSA_WANT_ECC_SECP_K1_256) #if defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) #undef MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256 @@ -367,14 +359,6 @@ #endif #endif -#if defined(PSA_WANT_ALG_XTS) -#if defined(MBEDTLS_PSA_ACCEL_ALG_XTS) -#undef MBEDTLS_PSA_ACCEL_ALG_XTS -#else -#define MBEDTLS_PSA_ACCEL_ALG_XTS 1 -#endif -#endif - #if defined(PSA_WANT_ALG_CHACHA20_POLY1305) #if defined(MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305) #undef MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 @@ -600,14 +584,6 @@ #endif #endif -#if defined(PSA_WANT_ALG_CBC_MAC) -#if defined(MBEDTLS_PSA_ACCEL_ALG_CBC_MAC) -#undef MBEDTLS_PSA_ACCEL_ALG_CBC_MAC -#else -#define MBEDTLS_PSA_ACCEL_ALG_CBC_MAC 1 -#endif -#endif - #if defined(PSA_WANT_ALG_HMAC) #if defined(MBEDTLS_PSA_ACCEL_ALG_HMAC) #undef MBEDTLS_PSA_ACCEL_ALG_HMAC