mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-02-04 15:39:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use MD_LIGHT rather than md5.h in pem.c

Browse Source 
But, for now, still guard things with MBEDTLS_MD5_C, as md.c can only
compute MD5 hashes when MBEDTLS_MD5_C is defined. We'll change the
guards once that has changed.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2023-03-06 23:58:50 +01:00
parent ec000c1a00
commit 8316209c02
3 changed files with 29 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/mbedtls/build_info.h
View File

@ -87,6 +87,12 @@
#define MBEDTLS_MD_LIGHT
#endif
/* Auto-enable MBEDTLS_MD_LIGHT it one module needs it.
*/
#if defined(MBEDTLS_PEM_PARSE_C)
#define MBEDTLS_MD_LIGHT
#endif
/* If MBEDTLS_PSA_CRYPTO_C is defined, make sure MBEDTLS_PSA_CRYPTO_CLIENT
* is defined as well to include all PSA code.
*/

33
library/pem.c
View File

@ -25,7 +25,7 @@
#include "mbedtls/base64.h"
#include "mbedtls/des.h"
#include "mbedtls/aes.h"
#include "mbedtls/md5.h"
#include "mbedtls/md.h"
#include "mbedtls/cipher.h"
#include "mbedtls/platform_util.h"
#include "mbedtls/error.h"
@ -99,26 +99,33 @@ static int pem_pbkdf1(unsigned char *key, size_t keylen,
unsigned char *iv,
const unsigned char *pwd, size_t pwdlen)
{
mbedtls_md5_context md5_ctx;
mbedtls_md_context_t md5_ctx;
const mbedtls_md_info_t *md5_info;
unsigned char md5sum[16];
size_t use_len;
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
mbedtls_md5_init(&md5_ctx);
mbedtls_md_init(&md5_ctx);
/* Prepare the context. (setup() errors gracefully on NULL info.) */
md5_info = mbedtls_md_info_from_type(MBEDTLS_MD_MD5);
if ((ret = mbedtls_md_setup(&md5_ctx, md5_info, 0)) != 0) {
goto exit;
}
/*
* key[ 0..15] = MD5(pwd || IV)
*/
if ((ret = mbedtls_md5_starts(&md5_ctx)) != 0) {
if ((ret = mbedtls_md_starts(&md5_ctx)) != 0) {
goto exit;
}
if ((ret = mbedtls_md5_update(&md5_ctx, pwd, pwdlen)) != 0) {
if ((ret = mbedtls_md_update(&md5_ctx, pwd, pwdlen)) != 0) {
goto exit;
}
if ((ret = mbedtls_md5_update(&md5_ctx, iv, 8)) != 0) {
if ((ret = mbedtls_md_update(&md5_ctx, iv, 8)) != 0) {
goto exit;
}
if ((ret = mbedtls_md5_finish(&md5_ctx, md5sum)) != 0) {
if ((ret = mbedtls_md_finish(&md5_ctx, md5sum)) != 0) {
goto exit;
}
@ -132,19 +139,19 @@ static int pem_pbkdf1(unsigned char *key, size_t keylen,
/*
* key[16..23] = MD5(key[ 0..15] || pwd || IV])
*/
if ((ret = mbedtls_md5_starts(&md5_ctx)) != 0) {
if ((ret = mbedtls_md_starts(&md5_ctx)) != 0) {
goto exit;
}
if ((ret = mbedtls_md5_update(&md5_ctx, md5sum, 16)) != 0) {
if ((ret = mbedtls_md_update(&md5_ctx, md5sum, 16)) != 0) {
goto exit;
}
if ((ret = mbedtls_md5_update(&md5_ctx, pwd, pwdlen)) != 0) {
if ((ret = mbedtls_md_update(&md5_ctx, pwd, pwdlen)) != 0) {
goto exit;
}
if ((ret = mbedtls_md5_update(&md5_ctx, iv, 8)) != 0) {
if ((ret = mbedtls_md_update(&md5_ctx, iv, 8)) != 0) {
goto exit;
}
if ((ret = mbedtls_md5_finish(&md5_ctx, md5sum)) != 0) {
if ((ret = mbedtls_md_finish(&md5_ctx, md5sum)) != 0) {
goto exit;
}
@ -156,7 +163,7 @@ static int pem_pbkdf1(unsigned char *key, size_t keylen,
memcpy(key + 16, md5sum, use_len);
exit:
mbedtls_md5_free(&md5_ctx);
mbedtls_md_free(&md5_ctx);
mbedtls_platform_zeroize(md5sum, 16);
return ret;

5
tests/scripts/all.sh
View File

@ -2529,8 +2529,9 @@ component_test_psa_crypto_config_accel_hash_use_psa () {
make CFLAGS="$ASAN_CFLAGS -Werror -I../tests/include -I../tests -I../../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS" all
# There's a risk of something getting re-enabled via config_psa.h;
# make sure it did not happen.
not grep mbedtls_md library/md.o
# make sure it did not happen. Note: it's OK for MD_LIGHT to be enabled,
# but not the full MD_C (for now), so check mbedtls_md_hmac for that.
not grep mbedtls_md_hmac library/md.o
not grep mbedtls_md5 library/md5.o
not grep mbedtls_sha1 library/sha1.o
not grep mbedtls_sha256 library/sha256.o