From 6b32ac74e7aceb24582b3127a8955317de08e8a8 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 1 Jul 2024 21:14:45 +0200 Subject: [PATCH 1/2] Document that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not force HMAC MBEDTLS_PSA_HMAC_DRBG_MD_TYPE was documented and announced as causing the PSA DRBG to be HMAC_DRBG. However, that was never actually implemented: CTR_DRBG is prioritized if enabled. Since there is a simple workaround of disabling MBEDTLS_CTR_DRBG_C if you want to use HMAC_DRBG, we have decided to accept the actual behavior and fix the documentation. Signed-off-by: Gilles Peskine --- ChangeLog.d/MBEDTLS_PSA_HMAC_DRBG_MD_TYPE.txt | 4 ++++ include/mbedtls/config.h | 17 ++++++++++++----- 2 files changed, 16 insertions(+), 5 deletions(-) create mode 100644 ChangeLog.d/MBEDTLS_PSA_HMAC_DRBG_MD_TYPE.txt diff --git a/ChangeLog.d/MBEDTLS_PSA_HMAC_DRBG_MD_TYPE.txt b/ChangeLog.d/MBEDTLS_PSA_HMAC_DRBG_MD_TYPE.txt new file mode 100644 index 0000000000..079cd741dc --- /dev/null +++ b/ChangeLog.d/MBEDTLS_PSA_HMAC_DRBG_MD_TYPE.txt @@ -0,0 +1,4 @@ +Security + * Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does + not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when + MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled. diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 4842fd494c..406ae3fc2d 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -4020,11 +4020,18 @@ * Use HMAC_DRBG with the specified hash algorithm for HMAC_DRBG for the * PSA crypto subsystem. * - * If this option is unset: - * - If CTR_DRBG is available, the PSA subsystem uses it rather than HMAC_DRBG. - * - Otherwise, the PSA subsystem uses HMAC_DRBG with either - * #MBEDTLS_MD_SHA512 or #MBEDTLS_MD_SHA256 based on availability and - * on unspecified heuristics. + * If this option is unset, the library chooses a hash (currently between + * #MBEDTLS_MD_SHA512 and #MBEDTLS_MD_SHA256) based on availability and + * unspecified heuristics. + * + * \note The PSA crypto subsystem uses the first available mechanism amongst + * the following: + * - #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG if enabled; + * - Entropy from #MBEDTLS_ENTROPY_C plus CTR_DRBG with AES + * if #MBEDTLS_CTR_DRBG_C is enabled; + * - Entropy from #MBEDTLS_ENTROPY_C plus HMAC_DRBG. + * + * A future version may reevaluate the prioritization of DRBG mechanisms. */ //#define MBEDTLS_PSA_HMAC_DRBG_MD_TYPE MBEDTLS_MD_SHA256 From e752eaf73a930651facfafcc5ac373cb66574a75 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 2 Jul 2024 15:47:22 +0200 Subject: [PATCH 2/2] Force MBEDTLS_PSA_HMAC_DRBG_MD_TYPE based on CTR_DRBG If MBEDTLS_CTR_DRBG_C is enabled, force MBEDTLS_PSA_HMAC_DRBG_MD_TYPE to be disabled. This resolves the former inconsistency in builds where MBEDTLS_PSA_HMAC_DRBG_MD_TYPE is explicitly defined but MBEDTLS_CTR_DRBG_C remains enabled, where PSA called the CTR_DRBG functions but other parts of the code based assumed that HMAC was in use, in particular error code conversions (leading to a test failure in test_suite_psa_crypto_init). Signed-off-by: Gilles Peskine --- library/psa_crypto_random_impl.h | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/library/psa_crypto_random_impl.h b/library/psa_crypto_random_impl.h index 6150fee120..d47e057f9b 100644 --- a/library/psa_crypto_random_impl.h +++ b/library/psa_crypto_random_impl.h @@ -39,13 +39,10 @@ int mbedtls_psa_get_random(void *p_rng, #else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ /* Choose a DRBG based on configuration and availability */ -#if defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) - -#include "mbedtls/hmac_drbg.h" - -#elif defined(MBEDTLS_CTR_DRBG_C) +#if defined(MBEDTLS_CTR_DRBG_C) #include "mbedtls/ctr_drbg.h" +#undef MBEDTLS_PSA_HMAC_DRBG_MD_TYPE #elif defined(MBEDTLS_HMAC_DRBG_C) @@ -67,9 +64,11 @@ int mbedtls_psa_get_random(void *p_rng, #error "No hash algorithm available for HMAC_DBRG." #endif -#else +#else /* !MBEDTLS_CTR_DRBG_C && !MBEDTLS_HMAC_DRBG_C*/ + #error "No DRBG module available for the psa_crypto module." -#endif + +#endif /* !MBEDTLS_CTR_DRBG_C && !MBEDTLS_HMAC_DRBG_C*/ #include "mbedtls/entropy.h"