From da5abbf89965c0643f45447119245486b2f8a395 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 9 Mar 2020 18:51:37 +0100 Subject: [PATCH 01/10] Add a discussion of the PSA Crypto API Text copied from README.md in Mbed Crypto. --- README.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/README.md b/README.md index f8bb3461a6..3c35004e48 100644 --- a/README.md +++ b/README.md @@ -3,6 +3,8 @@ README for Mbed TLS Mbed TLS is a C library that implements cryptographic primitives, X.509 certificate manipulation and the SSL/TLS and DTLS protocols. Its small code footprint makes it suitable for embedded systems. +Mbed TLS includes a reference implementation of the [PSA Cryptography API](#psa-cryptography-api). + Configuration ------------- @@ -193,6 +195,40 @@ Mbed TLS can be ported to many different architectures, OS's and platforms. Befo - [What external dependencies does Mbed TLS rely on?](https://tls.mbed.org/kb/development/what-external-dependencies-does-mbedtls-rely-on) - [How do I configure Mbed TLS](https://tls.mbed.org/kb/compiling-and-building/how-do-i-configure-mbedtls) +PSA cryptography API +-------------------- + +### PSA API design + +Arm's [Platform Security Architecture (PSA)](https://developer.arm.com/architectures/security-architectures/platform-security-architecture) is a holistic set of threat models, security analyses, hardware and firmware architecture specifications, and an open source firmware reference implementation. PSA provides a recipe, based on industry best practice, that allows security to be consistently designed in, at both a hardware and firmware level. + +The [PSA cryptography API](https://armmbed.github.io/mbed-crypto/psa/#application-programming-interface) provides access to a set of cryptographic primitives. It has a dual purpose. First, it can be used in a PSA-compliant platform to build services, such as secure boot, secure storage and secure communication. Second, it can also be used independently of other PSA components on any platform. + +The design goals of the PSA cryptography API include: + +* The API distinguishes caller memory from internal memory, which allows the library to be implemented in an isolated space for additional security. Library calls can be implemented as direct function calls if isolation is not desired, and as remote procedure calls if isolation is desired. +* The structure of internal data is hidden to the application, which allows substituting alternative implementations at build time or run time, for example, in order to take advantage of hardware accelerators. +* All access to the keys happens through handles, which allows support for external cryptoprocessors that is transparent to applications. +* The interface to algorithms is generic, favoring algorithm agility. +* The interface is designed to be easy to use and hard to accidentally misuse. + +Arm welcomes feedback on the design of the API. If you think something could be improved, please open an issue on our Github repository. Alternatively, if you prefer to provide your feedback privately, please email us at [`mbed-crypto@arm.com`](mailto:mbed-crypto@arm.com). All feedback received by email is treated confidentially. + +### PSA implementation in Mbed TLS + +Mbed TLS includes a reference implementation of the PSA Cryptography API. + +There are currently a few deviations where the library does not yet implement the latest version of the specification. Please refer to the [compliance issues on Github](https://github.com/ARMmbed/mbed-crypto/labels/compliance) for an up-to-date list. + +### Upcoming features + +Future releases of this library will include: + +* A driver programming interface, which makes it possible to use hardware accelerators instead of the default software implementation for chosen algorithms. +* Support for external keys to be stored and manipulated exclusively in a separate cryptoprocessor. +* A configuration mechanism to compile only the algorithms you need for your application. +* A wider set of cryptographic algorithms. + License ------- From 8b13d26eaa5b22b65dfa0504ac8c3b50d3ea2561 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 9 Mar 2020 19:18:15 +0100 Subject: [PATCH 02/10] Add a note about PSA crypto being less mature --- README.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3c35004e48..6708b3658b 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ README for Mbed TLS Mbed TLS is a C library that implements cryptographic primitives, X.509 certificate manipulation and the SSL/TLS and DTLS protocols. Its small code footprint makes it suitable for embedded systems. -Mbed TLS includes a reference implementation of the [PSA Cryptography API](#psa-cryptography-api). +Mbed TLS includes a reference implementation of the [PSA Cryptography API](#psa-cryptography-api). This is currently a preview for evaluation purposes only. Configuration ------------- @@ -217,6 +217,9 @@ Arm welcomes feedback on the design of the API. If you think something could be ### PSA implementation in Mbed TLS Mbed TLS includes a reference implementation of the PSA Cryptography API. +This implementation is not yet as mature as the rest of the library. Some parts of the code have not been reviewed as thoroughly, and some parts of the PSA implementation are not yet well optimized for code size. + +The X.509 and TLS code can use PSA cryptography for a limited subset of operations. To enable this support, activate the compilation option `MBEDTLS_USE_PSA_CRYPTO` in `config.h`. There are currently a few deviations where the library does not yet implement the latest version of the specification. Please refer to the [compliance issues on Github](https://github.com/ARMmbed/mbed-crypto/labels/compliance) for an up-to-date list. From ed3aa130e378a666902512cdb826acbe93562898 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 9 Mar 2020 19:20:47 +0100 Subject: [PATCH 03/10] Remove references to Mbed Crypto --- README.md | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) diff --git a/README.md b/README.md index 6708b3658b..08f19281bd 100644 --- a/README.md +++ b/README.md @@ -25,23 +25,6 @@ The main systems used for development are CMake and GNU Make. Those systems are The Make and CMake build systems create three libraries: libmbedcrypto, libmbedx509, and libmbedtls. Note that libmbedtls depends on libmbedx509 and libmbedcrypto, and libmbedx509 depends on libmbedcrypto. As a result, some linkers will expect flags to be in a specific order, for example the GNU linker wants `-lmbedtls -lmbedx509 -lmbedcrypto`. Also, when loading shared libraries using dlopen(), you'll need to load libmbedcrypto first, then libmbedx509, before you can load libmbedtls. -### Getting files form git: the Crypto submodule - -The Mbed Crypto library now has its own git repository, which the Mbed TLS build systems are using as a git submodule in order to build libmbedcrypto as a subproject of Mbed TLS. When cloning the Mbed TLS repository, you need to make sure you're getting the submodule as well: - - git clone --recursive https://github.com/ARMmbed/mbedtls.git - -Alternatively, if you already have an existing clone of the Mbed TLS -repository, you can initialise and update the submodule with: - - git submodule update --init crypto - -After these steps, your clone is now ready for building the libraries as detailed in the following sections. - -Note that building libmbedcrypto as a subproject of Mbed TLS does not enable the PSA-specific tests and utility programs. To use these programs, build Mbed Crypto as a standalone project. - -Please note that for now, Mbed TLS can only use versions of libmbedcrypto that were built as a subproject of Mbed TLS, not versions that were built standalone from the Mbed Crypto repository. This restriction will be removed in the future. - ### Make We require GNU Make. To build the library and the sample programs, GNU Make and a C compiler are sufficient. Some of the more advanced build targets require some Unix/Linux tools. @@ -152,7 +135,7 @@ on the build mode as seen above), it's merely prepended to it. #### Mbed TLS as a subproject -Mbed TLS, like Mbed Crypto, supports being built as a CMake subproject. One can +Mbed TLS, supports being built as a CMake subproject. One can use `add_subdirectory()` from a parent CMake project to include Mbed TLS as a subproject. From a10cbda6092b5c84470814e5d7133ea2fccc2242 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 9 Mar 2020 19:21:51 +0100 Subject: [PATCH 04/10] Adapt the "Documentation" section from Mbed Crypto --- README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/README.md b/README.md index 08f19281bd..9e9bfb7d2d 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,19 @@ Mbed TLS should build out of the box on most systems. Some platform specific opt Compiler options can be set using conventional environment variables such as `CC` and `CFLAGS` when using the Make and CMake build system (see below). +Documentation +------------- + +Documentation for the Mbed TLS interfaces in the default library configuration is available as part of the [Mbed TLS documentation](https://tls.mbed.org/api/). + +To generate a local copy of the library documentation in HTML format, tailored to your compile-time configuration: + +1. Make sure that [Doxygen](http://www.doxygen.nl/) is installed. We use version 1.8.11 but slightly older or more recent versions should work. +1. Run `make apidoc`. +1. Browse `apidoc/index.html` or `apidoc/modules.html`. + +For the PSA cryptography interfaces, please refer to the PSA Cryptography API documents linked from the [PSA cryptography interfaces documentation portal](https://armmbed.github.io/mbed-crypto/psa/#application-programming-interface) for an overview of the library's interfaces and a detailed description of the types, macros and functions that it provides. The API reference is available in [PDF](https://armmbed.github.io/mbed-crypto/PSA_Cryptography_API_Specification.pdf) and [HTML](https://armmbed.github.io/mbed-crypto/html/index.html) formats. + Compiling --------- From b05d89dced51a2642668e016f3207cf4aae16434 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 9 Mar 2020 19:23:51 +0100 Subject: [PATCH 05/10] Move the lone paragraph under "Configurations" to "Configuration" --- README.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 9e9bfb7d2d..fbe112c047 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,8 @@ Mbed TLS should build out of the box on most systems. Some platform specific opt Compiler options can be set using conventional environment variables such as `CC` and `CFLAGS` when using the Make and CMake build system (see below). +We provide some non-standard configurations focused on specific use cases in the `configs/` directory. You can read more about those in `configs/README.txt` + Documentation ------------- @@ -176,12 +178,6 @@ For machines with a Unix shell and OpenSSL (and optionally GnuTLS) installed, ad - `tests/scripts/key-exchanges.pl` test builds in configurations with a single key exchange enabled - `tests/scripts/all.sh` runs a combination of the above tests, plus some more, with various build options (such as ASan, full `config.h`, etc). -Configurations --------------- - -We provide some non-standard configurations focused on specific use cases in the `configs/` directory. You can read more about those in `configs/README.txt` - - Porting Mbed TLS ---------------- From cf63f594329d24493e3ea3f9ced640fdd1573689 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 9 Mar 2020 19:24:18 +0100 Subject: [PATCH 06/10] Improve the description of programs/ From Mbed Crypto. --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index fbe112c047..c6dfd3799d 100644 --- a/README.md +++ b/README.md @@ -163,7 +163,8 @@ The solution file `mbedTLS.sln` contains all the basic projects needed to build Example programs ---------------- -We've included example programs for a lot of different features and uses in [`programs/`](programs/README.md). Most programs only focus on a single feature or usage scenario, so keep that in mind when copying parts of the code. +We've included example programs for a lot of different features and uses in [`programs/`](programs/README.md). +Please note that the goal of these sample programs is to demonstrate specific features of the library, and the code may need to be adapted to build a real-world application. Tests ----- From 67698704e77fc81ed01f4885a967bc98bd23980d Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 9 Mar 2020 19:30:08 +0100 Subject: [PATCH 07/10] Add a note about supported compilers Adapted from the section in Mbed Crypto, with the addition of specific compiler versions. Only mention Python 3; Python 2 may still work but it is no longer supported upstream so we will not maintain compatibility anymore. --- README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/README.md b/README.md index c6dfd3799d..69200f2522 100644 --- a/README.md +++ b/README.md @@ -40,6 +40,15 @@ The main systems used for development are CMake and GNU Make. Those systems are The Make and CMake build systems create three libraries: libmbedcrypto, libmbedx509, and libmbedtls. Note that libmbedtls depends on libmbedx509 and libmbedcrypto, and libmbedx509 depends on libmbedcrypto. As a result, some linkers will expect flags to be in a specific order, for example the GNU linker wants `-lmbedtls -lmbedx509 -lmbedcrypto`. Also, when loading shared libraries using dlopen(), you'll need to load libmbedcrypto first, then libmbedx509, before you can load libmbedtls. +### Tool versions + +You need the following tools to build the library with the provided makefiles: + +* GNU Make or a build tool that CMake supports. +* A C99 toolchain (compiler, linker, archiver). We actively test with GCC 5.4, Clang 3.8, IAR8 and Visual Studio 2013. More recent versions should work. Slightly older versions may work. +* Python 3 to generate the test code. +* Perl to run the tests. + ### Make We require GNU Make. To build the library and the sample programs, GNU Make and a C compiler are sufficient. Some of the more advanced build targets require some Unix/Linux tools. From f6917cc26bc9f7a6fb1932302f2e880795c2e276 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 9 Mar 2020 19:32:10 +0100 Subject: [PATCH 08/10] config.py is Python, not Perl We missed this when we changed config.pl to config.py. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 69200f2522..375f9ae5e0 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ Mbed TLS includes a reference implementation of the [PSA Cryptography API](#psa- Configuration ------------- -Mbed TLS should build out of the box on most systems. Some platform specific options are available in the fully documented configuration file `include/mbedtls/config.h`, which is also the place where features can be selected. This file can be edited manually, or in a more programmatic way using the Perl script `scripts/config.py` (use `--help` for usage instructions). +Mbed TLS should build out of the box on most systems. Some platform specific options are available in the fully documented configuration file `include/mbedtls/config.h`, which is also the place where features can be selected. This file can be edited manually, or in a more programmatic way using the Python 3 script `scripts/config.py` (use `--help` for usage instructions). Compiler options can be set using conventional environment variables such as `CC` and `CFLAGS` when using the Make and CMake build system (see below). From 260b31d3e051f7a607362df3e663e89b413799f2 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 9 Mar 2020 19:37:46 +0100 Subject: [PATCH 09/10] Don't use the PSA specification as Mbed TLS documentation The Doxygen-generated manual includes PSA interfaces, so we don't need to tell people to read the specification instead. Do link to the specification portal, but from the PSA API section, not from the Mbed TLS documentation section. --- README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 375f9ae5e0..de1dd27adf 100644 --- a/README.md +++ b/README.md @@ -25,8 +25,6 @@ To generate a local copy of the library documentation in HTML format, tailored t 1. Run `make apidoc`. 1. Browse `apidoc/index.html` or `apidoc/modules.html`. -For the PSA cryptography interfaces, please refer to the PSA Cryptography API documents linked from the [PSA cryptography interfaces documentation portal](https://armmbed.github.io/mbed-crypto/psa/#application-programming-interface) for an overview of the library's interfaces and a detailed description of the types, macros and functions that it provides. The API reference is available in [PDF](https://armmbed.github.io/mbed-crypto/PSA_Cryptography_API_Specification.pdf) and [HTML](https://armmbed.github.io/mbed-crypto/html/index.html) formats. - Compiling --------- @@ -216,6 +214,10 @@ The design goals of the PSA cryptography API include: Arm welcomes feedback on the design of the API. If you think something could be improved, please open an issue on our Github repository. Alternatively, if you prefer to provide your feedback privately, please email us at [`mbed-crypto@arm.com`](mailto:mbed-crypto@arm.com). All feedback received by email is treated confidentially. +### PSA API documentation + +A browsable copy of the PSA Cryptography API documents is available on the [PSA cryptography interfaces documentation portal](https://armmbed.github.io/mbed-crypto/psa/#application-programming-interface) in [PDF](https://armmbed.github.io/mbed-crypto/PSA_Cryptography_API_Specification.pdf) and [HTML](https://armmbed.github.io/mbed-crypto/html/index.html) formats. + ### PSA implementation in Mbed TLS Mbed TLS includes a reference implementation of the PSA Cryptography API. From a4b99a2d5af12054b6a0041bb18eff480014074a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Thu, 19 Mar 2020 12:36:02 +0100 Subject: [PATCH 10/10] Fix extra coma in README.md Co-Authored-By: Andrzej Kurek --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index de1dd27adf..f868a0a806 100644 --- a/README.md +++ b/README.md @@ -157,7 +157,7 @@ on the build mode as seen above), it's merely prepended to it. #### Mbed TLS as a subproject -Mbed TLS, supports being built as a CMake subproject. One can +Mbed TLS supports being built as a CMake subproject. One can use `add_subdirectory()` from a parent CMake project to include Mbed TLS as a subproject.