c61ddb2089
Add C language annotation to code block
...
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-23 19:18:50 +01:00
cbf068dbee
Fix broken reference
...
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-23 19:03:10 +01:00
f889e0fa0a
Replace vague 'above' with a reference for ease-of-navigation
...
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-23 19:01:21 +01:00
ded14a2c02
Add example wrapper function implementation
...
Give an example wrapper foir psa_aead_update for the transparent testing
option.
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-23 18:58:41 +01:00
16dac00cb9
Add skeleton of detailed design rewrite
...
In light of choosing Valgrind/ASan over mprotect()-based poisoning,
update the detailed design of copy validation.
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-23 18:57:01 +01:00
54bd71b40f
Update operation threading strategy
...
The library does not need to provide protection, leave it to the crypto
service.
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-23 10:30:50 +01:00
e604269a59
Threading Design: emphasise performance requirement
...
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-23 10:16:58 +01:00
23f7e41633
Threading design: improve language
...
Co-authored-by: Paul Elliott <62069445+paul-elliott-arm@users.noreply.github.com >
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-23 10:11:18 +01:00
be868347f4
Rewrite design exploration of copy validation
...
Main changes:
* New tests are easier to write than first stated
* Use of existing tests is ledd beneficial
* But using existing tests is a benefit if it can be done transparently
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-20 19:25:11 +01:00
51fc6cf378
Explore sanitizers for memory poisoning
...
Consider MSan, ASan and Valgrind as options for implementing memory
poisoning tests. Come to the altered conclusion that Valgrind is the
best option.
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-20 18:40:15 +01:00
17b3716c5a
Tweak compiler optimization evaluation section
...
* Remove references to the platform - this is unlikely to affect whether
copies are optimized.
* Note that the evaluation should test extreme optimisation settings.
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-20 18:39:14 +01:00
49d467c37d
Threading design: update and clarify 3.6 plan
...
- Separation of attr and slot state is added
- Driver support is cut back
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-20 15:41:40 +01:00
de0e3e352d
Threading design: Update empty slot tracking
...
Using a dedicated field allows clean separatin between key attributes
and slot state. This allows us to use the same mechanics for attributes
and key content. Which in turn means lower code size and easier
maintenance.
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-20 15:12:42 +01:00
52586895f7
Clarify threading design document structure
...
Separate design analysis from plans and make the distinction clear
between what is implemented, what is planned to be implemented soon,
what is planned to be implemented in the future, and what is ideas that
are rejected.
(The distinction between the last two categories doesn't have to be
clear, we can't and shouldn't plan that far ahead.)
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-20 14:26:57 +01:00
19192a5158
Clarify reentrancy requirements for drivers
...
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-20 13:16:48 +01:00
4e54abf182
Add section on possible use of Valgrind tracing
...
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-19 17:59:45 +01:00
05ca3d9a1b
Expand design for validation of careful access
...
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-19 16:45:37 +01:00
a72b4ca734
Modify optimize-testing instructions
...
Mention -flto and whole-program optimization as this is the most
important aspect.
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-19 15:22:15 +01:00
3f7e42a750
Move implementation by module table earlier
...
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-19 15:14:50 +01:00
dae0ad439f
Add more detail in design of memory poisoning
...
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-19 15:12:34 +01:00
0bd87f5959
Change unsigned int to uint8_t
...
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-19 13:45:21 +01:00
23661cc232
Detailed design of memory protection strategy
...
Signed-off-by: David Horstmann <david.horstmann@arm.com >
2023-10-18 18:20:33 +01:00
df62f1a010
Merge pull request #1106 from gilles-peskine-arm/psa-shared-buffers-requirements
...
PSA shared buffers requirements
2023-10-17 20:38:00 +02:00
d7a39ae21e
Add plan for 3.6 to threading design
...
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-17 14:34:26 +01:00
574100bb0d
Add clarifications to thread safety design
...
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-17 12:50:28 +01:00
811a954383
Add reentrancy section to thread safety design
...
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-17 12:50:21 +01:00
8ebeb9c180
Test for read-read inconsistency with mprotect and ptrace/gdb
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-16 18:37:02 +02:00
87889ebe86
Fix editorial error with semantic consequences
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-16 15:40:02 +02:00
a3ce6437bf
Typos
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-16 15:39:37 +02:00
1f2802c403
Suggest validating copy by memory poisoning
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 21:49:17 +02:00
6998721c69
Add a section skeleton for copy bypass
...
It's something we're likely to want to do at some point.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 20:05:32 +02:00
7bc1bb65e9
Short explanations of what is expected in the design sections
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 20:05:25 +02:00
35de1f7a7d
Distinguish whole-message signature from other asymmetric cryptography
...
Whole-message signature may process the message multiple times (EdDSA
signature does it).
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 20:04:16 +02:00
9cad3b3a70
Design change for cipher/AEAD
...
There are many reasons why a driver might violate the security requirements
for plaintext or ciphertext buffers, so mandate copying.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 20:03:18 +02:00
2859267a27
Clarify terminology: built-in driver
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 20:02:00 +02:00
db00543b3a
Add a section on write-read feedback
...
It's a security violation, although it's not clear whether it really needs
to influence the design.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 19:57:53 +02:00
352095ca86
Simplify the relaxed output-output rule
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 19:56:22 +02:00
60c453ee72
Expand explanations of the vulnerabilities
...
Add a few more examples.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 19:07:56 +02:00
8daedaeac9
Fix typos and copypasta
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-13 18:47:29 +02:00
f7806ca782
Analyze requirements for protection of arguments in shared memory
...
Propose a dual-approach strategy where some buffers are copied and others
can remain shared.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-12 16:00:11 +02:00
f1878d8974
Update to only serve GCM and CCM
...
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com >
2023-10-12 11:19:00 +02:00
bb5d907aa9
Automatically pick up all Markdown files
...
Assume GNU make. We already do with the toplevel makefile.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com >
2023-10-11 20:47:44 +02:00
28b4da954b
Add PSA threading design
...
Signed-off-by: Janos Follath <janos.follath@arm.com >
2023-10-10 15:15:55 +01:00
301d2a29a7
Update to MD light section
...
Mostly to reflect this has been implemented, and remove references to
temporary remains from the previous strategy (hash_info, legacy_or_psa)
which would probably be more confusing than helpful at this point.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com >
2023-10-10 10:04:07 +02:00
2daee0410e
Update list of modules using hashes
...
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com >
2023-10-10 10:04:07 +02:00
ca18b7747e
Update definition of Cipher light
...
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com >
2023-10-10 10:04:07 +02:00
839d3580bd
Update details of modules using cipher operations
...
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com >
2023-10-10 09:22:59 +02:00
32743619a2
Merge pull request #8114 from yanesca/threading_requirements_update
...
Refine thread safety requirements
2023-10-09 11:22:59 +00:00
db3035b8bc
Fix a typo in psa-crypto-implementation-structure.md
...
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com >
2023-09-26 09:09:20 +00:00
76e55a20dd
Change the documenti about psa_crypto_driver_wrappers.c{h}
...
Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com >
2023-09-26 09:09:20 +00:00
