ECDSA has two variants: deterministic (PSA_ALG_DETERMINISTIC_ECDSA) and
randomized (PSA_ALG_ECDSA). The two variants are different for signature but
identical for verification. Mbed TLS accepts either variant as the algorithm
parameter for verification even when only the other variant is supported,
so we need to handle this as a special case when generating not-supported
test cases.
In this commit:
* Automatically generated not-supported test cases for ECDSA now require
both variants to be disabled.
* Add manually written not-supported test cases for the signature
operation when exactly one variant is supported.
* Add manually written positive test cases for the verification
operation when exactly one variant is supported.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
If we don't exclude them from test case enumeration, then
detect_not_implemented_dependencies would cause the generated test cases to
be commented out, but the test case generation would fail before that
because asymmetric_key_data.py doesn't include DH and DSA keys.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
When we generate a test case for a mechanism that is not implemented,
comment out the test case rather than giving it a never-fulfilled
dependency. That way we don't create test cases that cannot be executed.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Move hack_dependencies_not_implemented into a class to make the file
structure easier to understand and reduce the visibility of the
_implemented_dependencies cache. Rename it because it's no longer a
temporary hack (originally intended to work around the fact that not all
PSA_WANT symbols were implemented), it's now a way to detect test cases for
cryptographic mechanisms that are declared but not implemented.
Internal refactoring only. No behavior change.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
In automatically generated PSA test cases, we detect cryptographic
mechanisms that are not implemented, and skip the corresponding test cases.
Originally this detection was intended for mechanisms for which the PSA_WANT
symbols were not implemented, but then it morphed into skipping mechanisms
that are declared in crypto_values.h but not actually implemented. So it no
longer makes sense to skip the test cases for which a negative
dependency (!PSA_WANT_xxx) is not implemented.
This causes more not-supported test cases to run.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Use psa_information.TestCase for operation failure test cases.
This changes the generated output in two ways:
* Not-implemented mechanisms now have a `DEPENDENCY_NOT_IMPLEMENTED_YET_xxx`
dependency in addition to the never-fulfilled `PSA_WANT_xxx` dependency.
This does not affect when test cases run.
* ECC test cases now have correct dependency symbols, e.g.
`PSA_WANT_ECC_SECP_R1_192` instead of `PSA_WANT_ECC_FAMILY_SECP_R1`. This
is a bug fix: ECC test cases were formerly never executed because of
incorrect dependency symbols.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Use psa_information.TestCase for not-supported test cases for key import and
generation.
No change to the generated output.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
In automatically generated PSA test cases, annotate the test cases that are
expected to be never executed due to a dependency that is not implemented.
This was already done for not-supported test cases and for key generation,
but not for positive test cases of key usage.
You can audit which mechanisms are detected as not-implemented with
```
grep -hEo 'DEPENDENCY_NOT_IMPLEMENTED_YET_\w+' tests/suites/*.data | sort -u
```
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
To determine PSA mechanisms that are not implemented, also read PSA_WANT
symbols that cannot (or are not intended to) be configured independently,
and thus are not listed in psa/crypto_config.h. Find those symbols in
the config adjustment header mbedtls/config_psa.h.
No impact on generated files yet, because hack_dependencies_not_implemented
is currently only used on key types that have explicit dependencies. This
will allow using hack_dependencies_not_implemented in other places, for
example to handle algorithm variants like PSA_WANT_ALG_ECDSA_ANY which is
inferred from PSA_WANT_ALG_ECDSA.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Create a class for test cases with automatically inferred dependencies,
suitable for PSA crypto API test cases. As of this commit, only basic cases
that use a key are supported. Subsequent commits will address negative tests
and key generation tests that require fancier handling of dependencies.
No change to the generated output.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The output is less nice, since it no longer mostly matches the order in
which symbols are used in the test case arguments. But this makes the output
more canonical, so it will be easier to notice if semantic changes occur in
subsequent commits.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Indicate which dependencies are not implemented. This makes it feasible to
audit the not-implemented detection.
The generated test cases that are detected as never-executed now have one or
more `DEPENDENCY_NOT_IMPLEMENTED_YET_PSA_WANT_xxx` instead of a single
`DEPENDENCY_NOT_IMPLEMENTED`. This does not affect when the test cases run.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This will let us use these features from other modules (yet to be created).
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Signed-off-by: Tomás González <tomasagustin.gonzalezorlando@arm.com>
