7bfcfac164
Change key type encodings to avoid bit 16
...
Key types are now encoded through a category in the upper 4 bits (bits
28-31) and a type-within-category in the next 11 bits (bits 17-27),
with bit 16 unused and bits 0-15 only used for the EC curve or DH
group.
For symmetric keys, bits 20-22 encode the block size (0x0=stream,
0x3=8B, 0x4=16B).
2020-01-31 10:15:32 +01:00
8fe6e0de3a
Symmetric key types only use the upper 16 bits of psa_key_type_t
...
Change the numerical encoding of values for symmetric key types to
have 0000 as the lower 16 bits. Now the lower 16 bits are only used
for key types that have a subtype (EC curve or DH group).
2020-01-31 10:15:32 +01:00
2a1f178d7c
Add test for prescribed states of handshake with the custom IO callbacks
2020-01-31 10:06:04 +01:00
350d4c3630
Merge pull request #327 from gilles-peskine-arm/psa-hash_compute
...
Implement psa_hash_compute and psa_hash_compare
2020-01-31 09:31:41 +01:00
ead19fecf9
Merge pull request #2975 from mpg/add-zlib-tests-dev
...
Add zlib tests and fix runtime bug
2020-01-31 09:22:24 +01:00
b719d4bede
Merge pull request #2963 from jiblime/zlib-fix into development
2020-01-30 16:15:16 +00:00
13faa2d920
Don't declare a parameter as const
...
An earlier commit fixed this for psa_hash_compare. psa_mac_verify had
the same flaw.
2020-01-30 16:32:21 +01:00
88e08464f5
Add dedicated test cases for psa_hash_compare
...
psa_hash_compare is tested for good cases and invalid-signature cases
in hash_compute_compare. Also test invalid-argument cases. Also run a
few autonomous test cases with valid arguments.
2020-01-30 12:27:14 +01:00
29eb80d26c
Remove some spurious dependencies on MBEDTLS_SHA256_C
2020-01-30 12:27:14 +01:00
fa710f5c6a
Don't declare a parameter as const
...
Whether a parameter should be const is an implementation detail of the
function, so don't declare a parameter of psa_hash_compare as
const. (This only applies to parameters themselves, not to objects
that pointer parameters points to.)
2020-01-30 12:27:14 +01:00
1fb7aea9b3
Add command line option to hide warnings
2020-01-30 12:27:14 +01:00
84b8fc8213
Use psa_hash_compute in psa_hmac_setup_internal
2020-01-30 12:27:14 +01:00
7b8efaffaa
Add missing dependencies on MBEDTLS_MD_C
...
The PSA implementations of deterministic ECDSA, of all RSA signatures
and of RSA OAEP use the MD module.
2020-01-30 12:27:14 +01:00
aead02cce9
Remove obsolete dependencies on MBEDTLS_MD_C
...
The PSA implementation of hash algorithms, HMAC algorithms and KDF
algorithms using HMAC no longer use the MD module.
2020-01-30 12:27:14 +01:00
0a749c8fa3
Implement and test psa_hash_compute, psa_hash_compare
2020-01-30 12:27:12 +01:00
79ef1d4e55
Merge pull request #2987 from AndrzejKurek/iotssl-2958-datagram-transport-simulated
...
Message transport mocks in ssl tests
2020-01-30 10:23:27 +00:00
f712e163b0
Merge pull request #179 from mpg/sha512-no-sha384
...
Add option to build SHA-512 without SHA-384
2020-01-30 10:32:20 +01:00
d020bfc396
Merge pull request #2949 from zfields/patch-1
...
[cmake] Propagate public headers
2020-01-30 09:53:16 +01:00
8b38978b85
Merge pull request #349 from gilles-peskine-arm/coverity-20200115-crypto
...
Fix minor defects found by Coverity
2020-01-29 15:05:11 +00:00
ba1150f822
Merge pull request #2995 from gilles-peskine-arm/coverity-20200115-tls into development
2020-01-29 14:51:24 +00:00
74ca84a7a9
Fix some whitespace issues
2020-01-29 09:46:49 +01:00
2e9eef4f7b
Final review comments
2020-01-28 14:43:52 -05:00
c0c92fea3d
Merge pull request #3008 from jp-bennett/development
...
Allow loading symlinked certificates
2020-01-28 15:55:33 +00:00
bfc73bcfd2
Merge pull request #2988 from piotr-now/iotssl-2954-custom-io-callbacks-to-ssl-unit-test
...
Changes in custom IO callbacks used in unit tests
2020-01-28 14:46:13 +00:00
d796e19d3b
Fix memory allocation fail in TCP mock socket
...
Because two buffers were aliased too early in the code, it was possible that
after an allocation failure, free() would be called twice for the same pointer.
2020-01-28 13:04:21 +01:00
4c987e2c83
Merge pull request #2993 from yanesca/bump-version-2.20.0
...
Bump version to Mbed TLS 2.20.0
2020-01-28 11:31:57 +00:00
042c5e4217
Merge pull request #3000 from gilles-peskine-arm/changelog-2.20.0
...
Add changelog entries for the crypto changes in 2.20.0
2020-01-28 09:38:30 +01:00
358462df85
Merge pull request #354 from mpg/fix-ecdsa-pointer-inc
...
Fix incrementing pointer instead of value
2020-01-28 09:26:28 +01:00
60239753d2
Avoid memory leak when RSA-CRT is not enabled in build
2020-01-27 17:53:36 -05:00
96134effea
Update ChangeLog
2020-01-27 16:12:02 -06:00
4c736fb6a8
Update Mbed Crypto SO version
...
The recent update changed the Mbed Crypto SO version, get Mbed TLS in
sync.
2020-01-27 16:37:14 +00:00
ceceedb532
Update Mbed Crypto to 3.0.1
2020-01-27 16:23:55 +00:00
1146b4e060
Merge pull request #348 from yanesca/bump-version-to-mbed-tls-2.20.0
...
Bump version to Mbed TLS 2.20.0 and crypto SO version to 4
2020-01-27 15:56:45 +00:00
e3b285d2c8
Add crypto security fixes merged after mbedcrypto-3.0.0
2020-01-27 14:24:19 +01:00
62236d7651
Add ChangeLog entry
...
Add a ChangeLog entry for Jonathan Bennett's contribution which allows
loading symlinked certificates.
2020-01-24 18:20:56 +00:00
fdc16f36b4
Allow loading symlinked certificates
...
When mbedtls_x509_crt_parse_path() checks each object in the supplied path, it only processes regular files. This change makes it also accept a symlink to a file. Fixes #3005 .
This was observed to be a problem on Fedora/CentOS/RHEL systems, where the ca-bundle in the default location is actually a symlink.
2020-01-24 09:12:03 -06:00
ee4ba54d8d
Fix incrementing pointer instead of value
...
This was introduced by a hasty search-and-replace that didn't account for C's
operator precedence when changing those variables to pointer types.
2020-01-24 12:11:56 +01:00
2b9b780ac0
Rename internal macro for consistency
...
Other modules have similar internal macros using _LENGTH in the name.
2020-01-24 11:01:02 +01:00
b7f7092f57
Remove preprocessor directive for consistency
...
Other cases in this switch statement aren't guarded either.
2020-01-24 10:59:08 +01:00
3a3b5c7827
Improve doxygen formatting
2020-01-24 10:57:25 +01:00
f2e2902c5a
Add detection for zlib headers to all.sh
2020-01-24 10:44:13 +01:00
c40b685837
Fix bug in record decompression
...
ssl_decompress_buf() was operating on data from the ssl context, but called at
a point where this data is actually in the rec structure. Call it later so
that the data is back to the ssl structure.
2020-01-24 10:44:13 +01:00
342d2ca9ab
Add test for record compression in ssl-opt.sh
...
Deprecated but still needs to be tested.
2020-01-24 10:44:13 +01:00
95e04490fa
Add all.sh components with ZLIB enabled
...
ZLIB support is deprecated, but until it's removed it should still be tested.
2020-01-24 10:44:13 +01:00
80fcacebdb
Add changelog entry for the zlib support fix
2020-01-24 09:35:01 +01:00
9f25b8deff
Fixes definition error when the deprecated MBEDTLS_ZLIB_SUPPORT and ENABLE_ZLIB_SUPPORT macro are defined/enabled for zlib support in mbedtls
...
100% tests passed, 0 tests failed out of 85
https://github.com/ARMmbed/mbedtls/blob/mbedtls-2.19.1/library/ssl_tls.c#L1842
https://github.com/ARMmbed/mbedtls/blob/mbedtls-2.19.1/library/ssl_tls.c#L1862
2020-01-24 09:34:06 +01:00
8c2631b6d3
Address review comments
2020-01-23 17:23:52 -05:00
80cc811039
Parse RSA parameters DP, DQ and QP from PKCS1 private keys
...
Otherwise these values are recomputed in mbedtls_rsa_deduce_crt, which
currently suffers from side channel issues in the computation of QP (see
https://eprint.iacr.org/2020/055 ). By loading the pre-computed values not
only is the side channel avoided, but runtime overhead of loading RSA keys
is reduced.
Discussion in https://github.com/ARMmbed/mbed-crypto/issues/347
2020-01-22 17:34:29 -05:00
50f577067c
Fix GitHub repository indications for crypto changes in 2.20
...
The content was originally written for mbed-crypto. Change pull
request references to be relative to mbedtls instead.
2020-01-22 19:02:59 +01:00
8c7d2c25a4
Remove markdown artifacts
2020-01-22 19:02:09 +01:00
