mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-02-13 06:40:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tls: psa_pake: enforce not empty passwords

Browse Source 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
This commit is contained in:
Valerio Setti 2022-11-17 18:17:01 +01:00
parent 819de86895
commit aca21b717c
3 changed files with 19 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/mbedtls/ecjpake.h
View File

@ -113,7 +113,7 @@ void mbedtls_ecjpake_init( mbedtls_ecjpake_context *ctx );
* \param curve The identifier of the elliptic curve to use, * \param curve The identifier of the elliptic curve to use,
* for example #MBEDTLS_ECP_DP_SECP256R1. * for example #MBEDTLS_ECP_DP_SECP256R1.
* \param secret The pre-shared secret (passphrase). This must be * \param secret The pre-shared secret (passphrase). This must be
* a readable buffer of length \p len Bytes. It need * a readable not empty buffer of length \p len Bytes. It need
* only be valid for the duration of this call. * only be valid for the duration of this call.
* \param len The length of the pre-shared secret \p secret. * \param len The length of the pre-shared secret \p secret.
* *

3
include/mbedtls/ssl.h
View File

@ -3824,9 +3824,10 @@ void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
* \note The SSL context needs to be already set up. The right place * \note The SSL context needs to be already set up. The right place
* to call this function is between \c mbedtls_ssl_setup() or * to call this function is between \c mbedtls_ssl_setup() or
* \c mbedtls_ssl_reset() and \c mbedtls_ssl_handshake(). * \c mbedtls_ssl_reset() and \c mbedtls_ssl_handshake().
* Password cannot be empty (see RFC 8236).
* *
* \param ssl SSL context * \param ssl SSL context
* \param pw EC J-PAKE password (pre-shared secret) * \param pw EC J-PAKE password (pre-shared secret). It cannot be empty
* \param pw_len length of pw in bytes * \param pw_len length of pw in bytes
* *
* \return 0 on success, or a negative error code. * \return 0 on success, or a negative error code.

35
library/ssl_tls.c
View File

@ -1634,18 +1634,18 @@ int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
else else
psa_role = PSA_PAKE_ROLE_CLIENT; psa_role = PSA_PAKE_ROLE_CLIENT;
/* Empty password is not valid */
if( ( pw == NULL) || ( pw_len == 0 ) )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
if( pw_len > 0 ) psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
{ psa_set_key_algorithm( &attributes, PSA_ALG_JPAKE );
psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE ); psa_set_key_type( &attributes, PSA_KEY_TYPE_PASSWORD );
psa_set_key_algorithm( &attributes, PSA_ALG_JPAKE );
psa_set_key_type( &attributes, PSA_KEY_TYPE_PASSWORD );
status = psa_import_key( &attributes, pw, pw_len, status = psa_import_key( &attributes, pw, pw_len,
&ssl->handshake->psa_pake_password ); &ssl->handshake->psa_pake_password );
if( status != PSA_SUCCESS ) if( status != PSA_SUCCESS )
return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
}
psa_pake_cs_set_algorithm( &cipher_suite, PSA_ALG_JPAKE ); psa_pake_cs_set_algorithm( &cipher_suite, PSA_ALG_JPAKE );
psa_pake_cs_set_primitive( &cipher_suite, psa_pake_cs_set_primitive( &cipher_suite,
@ -1669,16 +1669,13 @@ int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
} }
if( pw_len > 0 ) psa_pake_set_password_key( &ssl->handshake->psa_pake_ctx,
ssl->handshake->psa_pake_password );
if( status != PSA_SUCCESS )
{ {
psa_pake_set_password_key( &ssl->handshake->psa_pake_ctx, psa_destroy_key( ssl->handshake->psa_pake_password );
ssl->handshake->psa_pake_password ); psa_pake_abort( &ssl->handshake->psa_pake_ctx );
if( status != PSA_SUCCESS ) return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
{
psa_destroy_key( ssl->handshake->psa_pake_password );
psa_pake_abort( &ssl->handshake->psa_pake_ctx );
return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
}
} }
ssl->handshake->psa_pake_ctx_is_ok = 1; ssl->handshake->psa_pake_ctx_is_ok = 1;