- add quotes to the $@ parameter in helper_crypto_client_build()
- instead of copying mbedtls_config.h to build static libraries,
we rely on the already existing backup/cleanup mechanism which
is available in all.sh.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Add DEBUG=1 in test_psasim() to helpers and final make to build
the libraries and the final binaries with debug symbols
enabled.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Instead of copying the entire library & include folders twice
to build libraries for client and server:
- change the main config file (mbedtls_config.h)
- build in the root library folder
- move the generated library in the psasim folder
- use those library for linking the client/server binaries
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
The goal is to keep psasim as simple as possible:
- do not build a separate lib for psa-ff; build those source
files as part of server or client
- do not have lot of different makefiles: just 1 that does all
we need
- do not have several subfolders for headers: only 1 is enough
for this kind of project
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This is necessary because otherwise the library is not able to
find the seedfile at runtime and it fails the initialization.
However since this test runs on a standard PC we can rely on
platform entropy as source of entropy.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This commit implements the first useful IPC communication between
the client and the server. The implemented command is simple,
psa_crypto_init(), and its return value is sent back to the client.
Note: the newly added file psa_functions_codes.h is temporary
and it's probably the one that needs to be automatically
generated by a python script to support all crypto functions.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Ensure that both server and client can call mbedtls_version_get_string_full()
to verify that they are linked against proper libraries.
Note: each side (client/server) performs the call against its own
MbedTLS library. There is no IPC communication involved in this
test. Client/server communication will come later.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
It includes changes to:
- tests/Makefile: build the library for client and server in different
folders. It mimica the libtestdriver1 behavior (without functions
renaming though).
- tests/scripts/all.sh: helper function to build for client and
server with some default configuration for each of them.
- crypto_spe.h: this is dummy file taken from the already existing
tests. It's just meant to pacify the compiler, not to provide
something useful. It will likely be changed in the future.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This is a temporary fix that will be reverted once the framework
repository will have CI checks.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This should be CRYPTO_CLIENT and not CRYPTO_C as this function
can be used even when CRYPTO_C is not defined.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
A bug existed previously where this guarantee was not met,
causing some issues in multi-threaded code.
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
If psa_get_and_lock_key_slot fails, the slot must be wiped.
This fixes a bug where a pointer to some valid key slot can
be incorrectly returned
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
With multipart AEAD, if we attempt to add zero length additional data,
then with the buffer sharing fixes this can now lead to undefined
behaviour when using gcm. Fix this by returning early, as there is
nothing to do if the input length is zero.
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
Like `openssl rsa`, `openssl genrsa` changed its output format from PKCS8 to
PKCS1 in OpenSSL 3.0. Note that the makefile instructions assume older
OpenSSL. Convert the files that were generated with OpenSSL 3.x and hence
were not in the intended format. The files are converted, not regenerated,
so the key material is the same.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
With OpenSSL 3.0.2 (which I used to generate the previous set of "pkcs1" DER
files), the output of `openssl rsa -outform DER` is actually a
PKCS#8-encoded key, despite what the documentation says. This is a change
from OpenSSL 1.x, where the output is a PKCS#1-encoded key. OpenSSL 3.0.8
documents the output as PKCS#8.
Change to `openssl pkey`, which seems more reliable. The documentation
states that the output is PKCS#8, but the output is actually consistently
PKCS#1 at least from 1.0.2g to 3.3.0.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
When PSA is available, we exercise the parsed RSA key with PKCS#1v1.5
signature, which requires the modulus size in bytes to be at least
tLen + 11 (per RFC 8017 §9.2) where tLen = hLen + oidLen + 6 and
hLen = 32, oidLen = 9 for SHA-512 or SHA3-512. 10 is the DER overhead
(3 ASN.1 type-length headers with lengths <128). Replace 512-bit test
cases (good enough for SHA-256 but not SHA-384 and up) by 768-bit and
up (good enough for SHA-512).
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
These are sufficiently large for PKCS#1v1.5 signature with SHA-512 or
SHA3-512. Cover some non-word-aligned sizes.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The previous commit had:
- one obvious mistake (-f NULL with default -e runs nothing)
- one unforeseen issue: OPENSSL_NEXT skips static ECDH
- arguably scope creep: the stated goal was to simplify the full
invocation (in particular, make it obvious that everything is run
without having to remember the default value of EXCLUDE), but it also
made an unrelated change: running most tests with OPENSSL_NEXT (hence
the previous point).
This commit should fix all this, in particular it switches back to
running most tests with OPENSSL and using OPENSSL_NEXT only when needed.
Hopefully in the future we'll do the opposite: most tests will run with
a recent OpenSSL, and only those that need an older one will use
something older. But that will be another PR.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
RSA needs ASN1 functions to parse/write private and public keys,
but there is no guards in the code for that. So we need to enable
ASN1 support whenever RSA is enabled.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Prepare this component for PSA_CRYPTO_CONFIG to be on by default.
Rename it so that the name is still accurate when we remove legacy symbols
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
