Remove mentions of MBEDTLS_KEY_EXCHANGE_RSA_PSK that were not guarded by the
configuration option MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED. This finishes the
removal of library code that supports the RSA-PSK key exchange in TLS 1.2.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Remove the configuration option MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED and all
code guarded by it. This remove support for the RSA-PSK key exchange in TLS
1.2.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The test cases removed by this commit are specific to RSA-PSK, not
incidentally using RSA-PSK when testing other features, so there is no loss
of test coverage.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Remove generate key brainpool160r1 & SECP224K1 test cases
as they are scheduled to be removed in 4.0 .
Signed-off-by: Waleed Elmelegy <waleed.elmelegy@arm.com>
This fixes accesses to uninitialized memory in test code if
`psa_crypto_init()` fails.
A lot of those were pointed out by Coverity. I quickly reviewed all calls to
`MD_PSA_INIT()` manually, rather than follow any particular list.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
generate_test_code.py doesn't support UTF-8 in .function files (but does
in .data files) when run in a non-UTF-8 locale with Python <=3.6.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
mbedtls_ecp_gen_key() generates a private key and calculates the public key.
Calculating the public key takes most of the CPU time. But the PSA key store
doesn't store the key, in order to simplify the plumbing when drivers are
involved. So the time spent calculating the public key is a waste.
Instead, call mbedtls_ecp_gen_privkey(), which does not calculate the public
key.
This also saves 8 instructions in a sample arm thumb build.
Resolves#9732.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Run the function on a few different curves with shorter, just-right and
larger buffer sizes. Perform some basic sanity checks on the output (which
is random).
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit improves the makefile error message when using make, it no
longer incorrectly reports that CMakeLists.txt cannot be found instead
of exported.make.
Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
This commit updates the GCM buffer overlap documentation to explicity
state that alternative implementations may not support input/output
buffer overlap for GCM encrypt/decrypt functions.
Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
This commit fixes an issue with GCM testing to handle edge cases by
replacing malloc with calloc. Additionally, fix an issue where different
buffers were used for encryption.
Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
This commit adds test cases for input and output buffer overlap. The
data for the test cases is a duplicate of existing encrypt/decrypt test
cases.
The two test functions gcm_<encrypt/decrypt>_input_output_buffer_overlap
are modified to use a single malloc buffer rounded to the nearest
128-bits/16-bytes for input and output.
Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
Skip 6144-bit and 8192-bit FFDH tests in MSan or Valgrind test
configurations. These test cases are slow and sometimes trigger GnuTLS's
built-in timeout (which cannot be configured until more recent versions).
Resolves#9742.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
