From cab5eff98cf8e1c1e201c99951f67ecae511416d Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Nov 2023 10:23:52 +0100 Subject: [PATCH 01/13] adjust_config_synonyms: make CCM and CCM* indipendent Signed-off-by: Valerio Setti --- include/psa/crypto_adjust_config_synonyms.h | 6 ------ 1 file changed, 6 deletions(-) diff --git a/include/psa/crypto_adjust_config_synonyms.h b/include/psa/crypto_adjust_config_synonyms.h index cf33465b53..332b622c9b 100644 --- a/include/psa/crypto_adjust_config_synonyms.h +++ b/include/psa/crypto_adjust_config_synonyms.h @@ -24,12 +24,6 @@ #define PSA_WANT_ALG_ECDSA_ANY PSA_WANT_ALG_ECDSA #endif -#if defined(PSA_WANT_ALG_CCM_STAR_NO_TAG) && !defined(PSA_WANT_ALG_CCM) -#define PSA_WANT_ALG_CCM PSA_WANT_ALG_CCM_STAR_NO_TAG -#elif !defined(PSA_WANT_ALG_CCM_STAR_NO_TAG) && defined(PSA_WANT_ALG_CCM) -#define PSA_WANT_ALG_CCM_STAR_NO_TAG PSA_WANT_ALG_CCM -#endif - #if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) #define PSA_WANT_ALG_RSA_PKCS1V15_SIGN PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW #elif !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) From c2d68f56118ce06debd8ad2e560ec7216f4c7bd5 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Nov 2023 10:36:55 +0100 Subject: [PATCH 02/13] adjust_legacy_from_psa: treat CCM and CCM* separately Signed-off-by: Valerio Setti --- include/mbedtls/config_adjust_legacy_from_psa.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/mbedtls/config_adjust_legacy_from_psa.h b/include/mbedtls/config_adjust_legacy_from_psa.h index 6356bddc10..ba623a8bc3 100644 --- a/include/mbedtls/config_adjust_legacy_from_psa.h +++ b/include/mbedtls/config_adjust_legacy_from_psa.h @@ -847,6 +847,15 @@ defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) #define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 +#define MBEDTLS_CCM_C +#endif +#endif /* PSA_WANT_ALG_CCM */ + +#if defined(PSA_WANT_ALG_CCM_STAR_NO_TAG) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CCM_STAR_NO_TAG) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) #define MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG 1 #define MBEDTLS_CCM_C #endif From bdfecb6a83ada71ad2f7846745f0216284c8c969 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Nov 2023 15:37:20 +0100 Subject: [PATCH 03/13] all.sh: add test components for no-CCM and no-CCM* The idea is to show that there is no more any dependency between the two symbols: - component_test_full_no_ccm() keeps ALG_CCM_STAR_NO_TAG enabled, disables ALG_CCM and ensures that the latter does not get re-enabled accidentally - test_full_no_ccm_star_no_tag() keeps ALG_CCM enabled and disables ALG_CCM_STAR_NO_TAG and ensures that the latter does not get re-enabled accidentally Signed-off-by: Valerio Setti --- tests/scripts/all.sh | 51 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index cba98c5516..9f5712e7ae 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -1632,6 +1632,57 @@ component_test_full_no_cipher_with_crypto_config() { common_test_full_no_cipher_with_psa_crypto 1 "full no CIPHER" } +component_test_full_no_ccm() { + msg "build: full no PSA_WANT_ALG_CCM" + + # Full config enables: + # - USE_PSA_CRYPTO so that TLS code dispatches cipher/AEAD to PSA + # - CRYPTO_CONFIG so that PSA_WANT config symbols are evaluated + scripts/config.py full + + # Disable PSA_WANT_ALG_CCM so that CCM is not supported in PSA. CCM_C is still + # enabled, but not used from TLS since USE_PSA is set. + # This is helpful to ensure that TLS tests below have proper dependencies. + # + # Note: also PSA_WANT_ALG_CCM_STAR_NO_TAG is enabled, but it does not cause + # PSA_WANT_ALG_CCM to be re-enabled. + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM + + make tests + + msg "test: full no PSA_WANT_ALG_CCM" + ( cd tests; ./test_suite_ssl ) +} + +component_test_full_no_ccm_star_no_tag() { + msg "build: full no PSA_WANT_ALG_CCM_STAR_NO_TAG" + + # Full config enables CRYPTO_CONFIG so that PSA_WANT config symbols are evaluated + scripts/config.py full + + # Disable CCM_STAR_NO_TAG, which is the target of this test, as well as all + # other components that enable MBEDTLS_PSA_BUILTIN_CIPHER internal symbol. + # This basically disables all unauthenticated ciphers on the PSA side, while + # keeping AEADs enabled. + # + # Note: PSA_WANT_ALG_CCM is enabled, but it does not cause + # PSA_WANT_ALG_CCM_STAR_NO_TAG to be re-enabled. + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM_STAR_NO_TAG + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_STREAM_CIPHER + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CTR + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CFB + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_OFB + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_ECB_NO_PADDING + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_NO_PADDING + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_PKCS7 + + make tests + + # Ensure MBEDTLS_PSA_BUILTIN_CIPHER was not enabled + msg "verify: full no PSA_WANT_ALG_CCM_STAR_NO_TAG" + not grep mbedtls_psa_cipher library/psa_crypto_cipher.o +} + component_test_full_no_bignum () { msg "build: full minus bignum" scripts/config.py full From 51d5b196a1d98ed5f4de93145c93b5d1471b9be5 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 8 Nov 2023 10:56:54 +0100 Subject: [PATCH 04/13] all.sh: accelerate also CCM* in test_psa_crypto_config_accel_cipher_aead Signed-off-by: Valerio Setti --- tests/scripts/all.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 9f5712e7ae..b18dd494b2 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -3756,7 +3756,7 @@ component_test_psa_crypto_config_accel_cipher_aead () { msg "build: crypto config with accelerated cipher and AEAD" loc_accel_list="ALG_ECB_NO_PADDING ALG_CBC_NO_PADDING ALG_CBC_PKCS7 ALG_CTR ALG_CFB \ - ALG_OFB ALG_XTS ALG_STREAM_CIPHER \ + ALG_OFB ALG_XTS ALG_STREAM_CIPHER ALG_CCM_STAR_NO_TAG \ ALG_GCM ALG_CCM ALG_CHACHA20_POLY1305 ALG_CMAC \ KEY_TYPE_DES KEY_TYPE_AES KEY_TYPE_ARIA KEY_TYPE_CHACHA20 KEY_TYPE_CAMELLIA" From a765eaa33e6e35bc24aa45f8082aded641ceddfa Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 8 Nov 2023 11:09:42 +0100 Subject: [PATCH 05/13] test_driver_extension: fix acceleration support for CCM and CCM* Signed-off-by: Valerio Setti --- .../test/drivers/crypto_config_test_driver_extension.h | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/include/test/drivers/crypto_config_test_driver_extension.h b/tests/include/test/drivers/crypto_config_test_driver_extension.h index 5ee949ab89..768a9a69f3 100644 --- a/tests/include/test/drivers/crypto_config_test_driver_extension.h +++ b/tests/include/test/drivers/crypto_config_test_driver_extension.h @@ -537,6 +537,14 @@ #endif #endif +#if defined(PSA_WANT_ALG_CCM_STAR_NO_TAG) +#if defined(MBEDTLS_PSA_ACCEL_ALG_CCM_STAR_NO_TAG) +#undef MBEDTLS_PSA_ACCEL_ALG_CCM_STAR_NO_TAG +#else +#define MBEDTLS_PSA_ACCEL_ALG_CCM_STAR_NO_TAG 1 +#endif +#endif + #if defined(PSA_WANT_ALG_CBC_MAC) #if defined(MBEDTLS_PSA_ACCEL_ALG_CBC_MAC) #undef MBEDTLS_PSA_ACCEL_ALG_CBC_MAC From a56eb46ce6b49e6a33fefb148f1c4ab707ada265 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 8 Nov 2023 11:30:15 +0100 Subject: [PATCH 06/13] adjust_legacy_from_psa: fix comment Signed-off-by: Valerio Setti --- include/mbedtls/config_adjust_legacy_from_psa.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/mbedtls/config_adjust_legacy_from_psa.h b/include/mbedtls/config_adjust_legacy_from_psa.h index ba623a8bc3..bf87c364e0 100644 --- a/include/mbedtls/config_adjust_legacy_from_psa.h +++ b/include/mbedtls/config_adjust_legacy_from_psa.h @@ -859,7 +859,7 @@ #define MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG 1 #define MBEDTLS_CCM_C #endif -#endif /* PSA_WANT_ALG_CCM */ +#endif /* PSA_WANT_ALG_CCM_STAR_NO_TAG */ #if defined(PSA_WANT_ALG_GCM) #if !defined(MBEDTLS_PSA_ACCEL_ALG_GCM) || \ From ff2b06a23597b17da4f669fbe604fa8f4776249b Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 8 Nov 2023 12:35:36 +0100 Subject: [PATCH 07/13] all.sh: improve components for without CCM/CCM* Signed-off-by: Valerio Setti --- tests/scripts/all.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index b18dd494b2..38c0698676 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -1648,10 +1648,10 @@ component_test_full_no_ccm() { # PSA_WANT_ALG_CCM to be re-enabled. scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM - make tests + make msg "test: full no PSA_WANT_ALG_CCM" - ( cd tests; ./test_suite_ssl ) + make test } component_test_full_no_ccm_star_no_tag() { @@ -1676,11 +1676,13 @@ component_test_full_no_ccm_star_no_tag() { scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_NO_PADDING scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_PKCS7 - make tests + make # Ensure MBEDTLS_PSA_BUILTIN_CIPHER was not enabled - msg "verify: full no PSA_WANT_ALG_CCM_STAR_NO_TAG" not grep mbedtls_psa_cipher library/psa_crypto_cipher.o + + msg "test: full no PSA_WANT_ALG_CCM_STAR_NO_TAG" + make test } component_test_full_no_bignum () { From a4b60593c17aa01e7857cc6b8675d39e39e810a2 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 8 Nov 2023 12:36:02 +0100 Subject: [PATCH 08/13] psa_exercise_key: replace legacy symbols with PSA_WANT ones Signed-off-by: Valerio Setti --- tests/include/test/psa_exercise_key.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/include/test/psa_exercise_key.h b/tests/include/test/psa_exercise_key.h index 0f3ee3db63..bd523d1262 100644 --- a/tests/include/test/psa_exercise_key.h +++ b/tests/include/test/psa_exercise_key.h @@ -46,11 +46,11 @@ * * For simplicity's sake, stick to block ciphers with 16-byte blocks. */ -#if defined(MBEDTLS_AES_C) +#if defined(PSA_WANT_KEY_TYPE_AES) #define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_AES -#elif defined(MBEDTLS_ARIA_C) +#elif defined(PSA_WANT_KEY_TYPE_ARIA) #define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_ARIA -#elif defined(MBEDTLS_CAMELLIA_C) +#elif defined(PSA_WANT_KEY_TYPE_CAMELLIA) #define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_CAMELLIA #undef KNOWN_SUPPORTED_BLOCK_CIPHER #endif @@ -81,13 +81,13 @@ * * This is used in some smoke tests. */ -#if defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_CTR) +#if defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(PSA_WANT_ALG_CTR) #define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_CTR -#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_CBC) +#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(PSA_WANT_ALG_CBC_NO_PADDING) #define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_CBC_NO_PADDING -#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_CFB) +#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(PSA_WANT_ALG_CFB) #define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_CFB -#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_OFB) +#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(PSA_WANT_ALG_OFB) #define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_OFB #else #undef KNOWN_SUPPORTED_BLOCK_CIPHER_ALG From 951faf6e7b1437e9015512d950773f2135a6a890 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 8 Nov 2023 12:59:12 +0100 Subject: [PATCH 09/13] ChangeLog: add change log for CCM/CCM* coupling removal Signed-off-by: Valerio Setti --- ChangeLog.d/8482.txt | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 ChangeLog.d/8482.txt diff --git a/ChangeLog.d/8482.txt b/ChangeLog.d/8482.txt new file mode 100644 index 0000000000..623d2e3c9b --- /dev/null +++ b/ChangeLog.d/8482.txt @@ -0,0 +1,6 @@ +Default behavior changes + * PSA_WANT_ALG_CCM and PSA_WANT_ALG_CCM_STAR_NO_TAG are no more synonyms and + they are now treated separately. This means that they should be + individually enabled in order to enable relative support; also the + corresponding MBEDTLS_PSA_ACCEL symbol should be defined in case + acceleration is required. From a50b89ebab26ed826884d700c65faea3c4e8bddf Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 8 Nov 2023 15:58:47 +0100 Subject: [PATCH 10/13] all.sh: disable CCM_STAR_NO_TAG in test_psa_crypto_config_accel_aead() Signed-off-by: Valerio Setti --- tests/scripts/all.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 38c0698676..5e150f2e0a 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -3713,6 +3713,9 @@ component_test_psa_crypto_config_accel_aead () { scripts/config.py unset MBEDTLS_CCM_C scripts/config.py unset MBEDTLS_CHACHAPOLY_C + # Disable CCM_STAR_NO_TAG because this re-enables CCM_C. + scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM_STAR_NO_TAG + # Build # ----- From 4809057ddf6c9aa863dc6d1da79a6ab3e633318d Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Thu, 9 Nov 2023 11:25:57 +0100 Subject: [PATCH 11/13] changelog: use better wording and modify changelog section Signed-off-by: Valerio Setti --- ChangeLog.d/8482.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/8482.txt b/ChangeLog.d/8482.txt index 623d2e3c9b..a39223299f 100644 --- a/ChangeLog.d/8482.txt +++ b/ChangeLog.d/8482.txt @@ -1,6 +1,6 @@ -Default behavior changes +Changes * PSA_WANT_ALG_CCM and PSA_WANT_ALG_CCM_STAR_NO_TAG are no more synonyms and they are now treated separately. This means that they should be - individually enabled in order to enable relative support; also the + individually enabled in order to enable respective support; also the corresponding MBEDTLS_PSA_ACCEL symbol should be defined in case acceleration is required. From 5e378d70e61a13b1801389c34b27d0fe4e5d115f Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Thu, 9 Nov 2023 11:28:28 +0100 Subject: [PATCH 12/13] ssl_misc: remove DES from the list of key types supporting CBC Signed-off-by: Valerio Setti --- library/ssl_misc.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index 4ddd9c4bb4..8482ee1515 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -255,8 +255,7 @@ uint32_t mbedtls_ssl_get_extension_mask(unsigned int extension_type); #if defined(MBEDTLS_SSL_HAVE_CBC) && \ (defined(MBEDTLS_SSL_HAVE_AES) || \ defined(MBEDTLS_SSL_HAVE_CAMELLIA) || \ - defined(MBEDTLS_SSL_HAVE_ARIA) || \ - defined(MBEDTLS_DES_C)) + defined(MBEDTLS_SSL_HAVE_ARIA)) #define MBEDTLS_SSL_SOME_SUITES_USE_CBC #endif From 776981ba422d5cf82fa012ffe97d2c4eb2bd9aee Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Thu, 9 Nov 2023 11:32:47 +0100 Subject: [PATCH 13/13] psa_exercise_key: add missing #else for KNOWN_SUPPORTED_BLOCK_CIPHER Signed-off-by: Valerio Setti --- tests/include/test/psa_exercise_key.h | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/include/test/psa_exercise_key.h b/tests/include/test/psa_exercise_key.h index bd523d1262..a658d17730 100644 --- a/tests/include/test/psa_exercise_key.h +++ b/tests/include/test/psa_exercise_key.h @@ -52,6 +52,7 @@ #define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_ARIA #elif defined(PSA_WANT_KEY_TYPE_CAMELLIA) #define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_CAMELLIA +#else #undef KNOWN_SUPPORTED_BLOCK_CIPHER #endif