Skip to content

Commit 64b10f4

Browse files
0xc01700xc0170
authored
Merge pull request #12767 from Patater/update-to-tls-2.21.0
Upgrade to Mbed TLS 2.21.0 and Mbed Crypto 3.1.0
2 parents 3db7cd4 + 65e9124 commit 64b10f4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

100 files changed

+8883
-7640
lines changed

‎TESTS/mbed-crypto/sanity/main.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -262,13 +262,13 @@ void test_crypto_asymmetric_sign_verify(void)
262262
psa_set_key_algorithm(&attributes, alg);
263263
psa_set_key_type(&attributes, key_type);
264264
TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_import_key(&attributes, key, sizeof(key), &key_handle));
265-
TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_asymmetric_sign(key_handle, alg, input, sizeof(input),
266-
signature, sizeof(signature), &signature_len));
265+
TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_sign_hash(key_handle, alg, input, sizeof(input),
266+
signature, sizeof(signature), &signature_len));
267267
TEST_ASSERT_EQUAL(sizeof(signature), signature_len);
268268
TEST_ASSERT_EQUAL_HEX8_ARRAY(expected_signature, signature, signature_len);
269269

270-
TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_asymmetric_verify(key_handle, alg, input, sizeof(input),
271-
signature, signature_len));
270+
TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_verify_hash(key_handle, alg, input, sizeof(input),
271+
signature, signature_len));
272272
TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_destroy_key(key_handle));
273273
}
274274

‎TESTS/psa/attestation/main.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ static void check_initial_attestation_get_token()
9898
TEST_ASSERT_EQUAL(status, PSA_SUCCESS);
9999
status = psa_attestation_inject_key(private_key_data,
100100
sizeof(private_key_data),
101-
PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP256R1),
101+
PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP_R1),
102102
exported,
103103
sizeof(exported),
104104
&exported_length);

‎TESTS/psa/crypto_access_control/COMPONENT_NSPE/main.cpp

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -348,7 +348,7 @@ void test_use_other_partition_key_aead(void)
348348
void test_use_other_partition_key_asymmetric_sign_verify(void)
349349
{
350350
static const psa_key_id_t key_id = 999;
351-
static const psa_key_type_t key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP256R1);
351+
static const psa_key_type_t key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP_R1);
352352
static const psa_algorithm_t key_alg = PSA_ALG_ECDSA(PSA_ALG_SHA_256);
353353
static const psa_key_usage_t key_usage = PSA_KEY_USAGE_SIGN | PSA_KEY_USAGE_VERIFY;
354354
static const size_t key_bits = 256;
@@ -373,12 +373,12 @@ void test_use_other_partition_key_asymmetric_sign_verify(void)
373373
TEST_ASSERT_NOT_EQUAL(0, key_handle);
374374

375375
/* try to asymmetric sign using the key that was created by the test partition */
376-
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_HANDLE, psa_asymmetric_sign(key_handle, key_alg, input, sizeof(input),
377-
signature, sizeof(signature), &len));
376+
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_HANDLE, psa_sign_hash(key_handle, key_alg, input, sizeof(input),
377+
signature, sizeof(signature), &len));
378378

379379
/* try to asymmetric verify using the key that was created by the test partition */
380-
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_HANDLE, psa_asymmetric_verify(key_handle, key_alg, input, sizeof(input),
381-
signature, sizeof(signature)));
380+
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_HANDLE, psa_verify_hash(key_handle, key_alg, input, sizeof(input),
381+
signature, sizeof(signature)));
382382

383383
/* via test partition - destroy the key created by the test partition */
384384
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));

‎components/TARGET_PSA/services/attestation/COMPONENT_PSA_SRV_IMPL/attest_crypto.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -58,13 +58,13 @@ t_cose_crypto_pub_key_sign(int32_t cose_alg_id,
5858
return T_COSE_ERR_NO_KID;
5959
}
6060

61-
crypto_ret = psa_asymmetric_sign(handle,
62-
PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256),
63-
hash_to_sign.ptr,
64-
hash_to_sign.len,
65-
signature_buffer.ptr,
66-
signature_buffer.len,
67-
&(signature->len));
61+
crypto_ret = psa_sign_hash(handle,
62+
PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256),
63+
hash_to_sign.ptr,
64+
hash_to_sign.len,
65+
signature_buffer.ptr,
66+
signature_buffer.len,
67+
&(signature->len));
6868

6969

7070
if (crypto_ret != PSA_SUCCESS)

‎components/TARGET_PSA/services/attestation/COMPONENT_PSA_SRV_IMPL/attest_crypto_keys.c

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -48,21 +48,12 @@ static psa_status_t get_curve(psa_key_type_t type, enum ecc_curve_t *curve_type)
4848
{
4949
psa_ecc_curve_t curve = PSA_KEY_TYPE_GET_CURVE(type);
5050
switch (curve) {
51-
case PSA_ECC_CURVE_SECP256R1:
51+
case PSA_ECC_CURVE_SECP_R1:
5252
*curve_type = P_256;
5353
break;
54-
case PSA_ECC_CURVE_SECP384R1:
55-
*curve_type = P_384;
56-
break;
57-
case PSA_ECC_CURVE_SECP521R1:
58-
*curve_type = P_521;
59-
break;
60-
case PSA_ECC_CURVE_CURVE25519:
54+
case PSA_ECC_CURVE_MONTGOMERY:
6155
*curve_type = X25519;
6256
break;
63-
case PSA_ECC_CURVE_CURVE448:
64-
*curve_type = X448;
65-
break;
6657
default:
6758
return (PSA_ERROR_NOT_SUPPORTED);
6859
}

‎components/TARGET_PSA/services/attestation/COMPONENT_PSA_SRV_IMPL/tfm_impl/attestation_core.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -942,7 +942,7 @@ attest_create_token(struct useful_buf_c *challenge,
942942

943943
/* Limitations of the current implementation:
944944
* - Token is not signed yet properly, just a fake signature is added to the
945-
* token due to lack of psa_asymmetric_sign() implementation in crypto
945+
* token due to lack of psa_sign_hash() implementation in crypto
946946
* service.
947947
*/
948948
enum psa_attest_err_t

‎components/TARGET_PSA/services/crypto/COMPONENT_PSA_SRV_IPC/crypto_platform_spe.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@ typedef enum psa_sec_function_s {
8787
PSA_AEAD_FINISH,
8888
PSA_AEAD_VERIFY,
8989
PSA_AEAD_ABORT,
90-
PSA_ASYMMETRIC_SIGN,
91-
PSA_ASYMMETRIC_VERIFY,
90+
PSA_SIGN_HASH,
91+
PSA_VERIFY_HASH,
9292
PSA_ASYMMETRIC_ENCRYPT,
9393
PSA_ASYMMETRIC_DECRYPT,
9494
PSA_KEY_DERIVATION_SETUP,

‎components/TARGET_PSA/services/crypto/COMPONENT_PSA_SRV_IPC/psa_crypto_spm.c

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1216,16 +1216,16 @@ psa_status_t psa_aead_abort(psa_aead_operation_t *operation)
12161216
return ipc_call(&operation->handle, &in_vec, 1, NULL, 0, true);
12171217
}
12181218

1219-
psa_status_t psa_asymmetric_sign(psa_key_handle_t handle,
1220-
psa_algorithm_t alg,
1221-
const uint8_t *hash,
1222-
size_t hash_length,
1223-
uint8_t *signature,
1224-
size_t signature_size,
1225-
size_t *signature_length)
1219+
psa_status_t psa_sign_hash(psa_key_handle_t handle,
1220+
psa_algorithm_t alg,
1221+
const uint8_t *hash,
1222+
size_t hash_length,
1223+
uint8_t *signature,
1224+
size_t signature_size,
1225+
size_t *signature_length)
12261226
{
12271227
psa_crypto_ipc_asymmetric_t psa_crypto_ipc = {
1228-
.func = PSA_ASYMMETRIC_SIGN,
1228+
.func = PSA_SIGN_HASH,
12291229
.handle = handle,
12301230
.alg = alg,
12311231
.input_length = 0,
@@ -1246,15 +1246,15 @@ psa_status_t psa_asymmetric_sign(psa_key_handle_t handle,
12461246
return (status);
12471247
}
12481248

1249-
psa_status_t psa_asymmetric_verify(psa_key_handle_t handle,
1250-
psa_algorithm_t alg,
1251-
const uint8_t *hash,
1252-
size_t hash_length,
1253-
const uint8_t *signature,
1254-
size_t signature_size)
1249+
psa_status_t psa_verify_hash(psa_key_handle_t handle,
1250+
psa_algorithm_t alg,
1251+
const uint8_t *hash,
1252+
size_t hash_length,
1253+
const uint8_t *signature,
1254+
size_t signature_size)
12551255
{
12561256
psa_crypto_ipc_asymmetric_t psa_crypto_ipc = {
1257-
.func = PSA_ASYMMETRIC_VERIFY,
1257+
.func = PSA_VERIFY_HASH,
12581258
.handle = handle,
12591259
.alg = alg,
12601260
.input_length = 0,

‎components/TARGET_PSA/services/crypto/COMPONENT_SPE/crypto_spe.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ extern "C" {
5959
#define psa_aead_finish psa_sec_aead_finish
6060
#define psa_aead_verify psa_sec_aead_verify
6161
#define psa_aead_abort psa_sec_aead_abort
62-
#define psa_asymmetric_sign psa_sec_asymmetric_sign
63-
#define psa_asymmetric_verify psa_sec_asymmetric_verify
62+
#define psa_sign_hash psa_sec_sign_hash
63+
#define psa_verify_hash psa_sec_verify_hash
6464
#define psa_asymmetric_encrypt psa_sec_asymmetric_encrypt
6565
#define psa_asymmetric_decrypt psa_sec_asymmetric_decrypt
6666
#define psa_key_derivation_setup psa_sec_key_derivation_setup

‎components/TARGET_PSA/services/crypto/COMPONENT_SPE/psa_crypto_partition.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -989,7 +989,7 @@ static void psa_asymmetric_operation(void)
989989
}
990990

991991
switch (psa_crypto.func) {
992-
case PSA_ASYMMETRIC_SIGN: {
992+
case PSA_SIGN_HASH: {
993993
uint8_t *signature = NULL;
994994
uint8_t *hash = NULL;
995995
size_t signature_length = 0,
@@ -1015,9 +1015,9 @@ static void psa_asymmetric_operation(void)
10151015
}
10161016

10171017
if (status == PSA_SUCCESS) {
1018-
status = psa_asymmetric_sign(psa_crypto.handle, psa_crypto.alg,
1019-
hash, hash_size,
1020-
signature, signature_size, &signature_length);
1018+
status = psa_sign_hash(psa_crypto.handle, psa_crypto.alg,
1019+
hash, hash_size,
1020+
signature, signature_size, &signature_length);
10211021

10221022
if (status == PSA_SUCCESS) {
10231023
psa_write(msg.handle, 0, signature, signature_length);
@@ -1030,7 +1030,7 @@ static void psa_asymmetric_operation(void)
10301030
break;
10311031
}
10321032

1033-
case PSA_ASYMMETRIC_VERIFY: {
1033+
case PSA_VERIFY_HASH: {
10341034
uint8_t *signature = NULL;
10351035
uint8_t *hash = NULL;
10361036
size_t signature_size = msg.in_size[1],
@@ -1060,9 +1060,9 @@ static void psa_asymmetric_operation(void)
10601060
}
10611061

10621062
if (status == PSA_SUCCESS) {
1063-
status = psa_asymmetric_verify(psa_crypto.handle, psa_crypto.alg,
1064-
hash, hash_size,
1065-
signature, signature_size);
1063+
status = psa_verify_hash(psa_crypto.handle, psa_crypto.alg,
1064+
hash, hash_size,
1065+
signature, signature_size);
10661066
}
10671067

10681068
mbedtls_free(signature);

‎features/frameworks/TARGET_PSA/pal/pal_mbed_os_intf.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ static void psa_attestation_inject_key_for_test(void)
6363
psa_attestation_destroy_key_for_test();
6464
psa_attestation_inject_key(private_key_data,
6565
sizeof(private_key_data),
66-
PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP256R1),
66+
PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP_R1),
6767
exported,
6868
sizeof(exported),
6969
&exported_length);

‎features/mbedtls/VERSION.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
mbedtls-2.20.0d0
1+
mbedtls-2.21.0

‎features/mbedtls/importer/Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@
2727
#
2828

2929
# Set the mbed TLS release to import (this can/should be edited before import)
30-
MBED_TLS_RELEASE ?= mbedtls-2.20.0d0
31-
MBED_TLS_REPO_URL ?= git@github.com:ARMmbed/mbedtls-restricted.git
30+
MBED_TLS_RELEASE ?= mbedtls-2.21.0
31+
MBED_TLS_REPO_URL ?= git@github.com:ARMmbed/mbedtls.git
3232

3333
# Translate between mbed TLS namespace and mbed namespace
3434
TARGET_PREFIX:=../

‎features/mbedtls/inc/mbedtls/check_config.h

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,14 @@
342342
#error "MBEDTLS_PKCS11_C defined, but not all prerequisites"
343343
#endif
344344

345+
#if defined(MBEDTLS_PKCS11_C)
346+
#if defined(MBEDTLS_DEPRECATED_REMOVED)
347+
#error "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS"
348+
#elif defined(MBEDTLS_DEPRECATED_WARNING)
349+
#warning "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS"
350+
#endif
351+
#endif /* MBEDTLS_PKCS11_C */
352+
345353
#if defined(MBEDTLS_PLATFORM_EXIT_ALT) && !defined(MBEDTLS_PLATFORM_C)
346354
#error "MBEDTLS_PLATFORM_EXIT_ALT defined, but not all prerequisites"
347355
#endif
@@ -769,6 +777,22 @@
769777
#error "MBEDTLS_HAVE_INT32/MBEDTLS_HAVE_INT64 and MBEDTLS_HAVE_ASM cannot be defined simultaneously"
770778
#endif /* (MBEDTLS_HAVE_INT32 || MBEDTLS_HAVE_INT64) && MBEDTLS_HAVE_ASM */
771779

780+
#if defined(MBEDTLS_SSL_PROTO_SSL3)
781+
#if defined(MBEDTLS_DEPRECATED_REMOVED)
782+
#error "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS"
783+
#elif defined(MBEDTLS_DEPRECATED_WARNING)
784+
#warning "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS"
785+
#endif
786+
#endif /* MBEDTLS_SSL_PROTO_SSL3 */
787+
788+
#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
789+
#if defined(MBEDTLS_DEPRECATED_REMOVED)
790+
#error "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS"
791+
#elif defined(MBEDTLS_DEPRECATED_WARNING)
792+
#warning "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS"
793+
#endif
794+
#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
795+
772796
/*
773797
* Avoid warning from -pedantic. This is a convenient place for this
774798
* workaround since this is included by every single file before the

‎features/mbedtls/inc/mbedtls/config.h

Lines changed: 20 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -249,27 +249,27 @@
249249
/**
250250
* \def MBEDTLS_DEPRECATED_WARNING
251251
*
252-
* Mark deprecated functions so that they generate a warning if used.
253-
* Functions deprecated in one version will usually be removed in the next
254-
* version. You can enable this to help you prepare the transition to a new
255-
* major version by making sure your code is not using these functions.
252+
* Mark deprecated functions and features so that they generate a warning if
253+
* used. Functionality deprecated in one version will usually be removed in the
254+
* next version. You can enable this to help you prepare the transition to a
255+
* new major version by making sure your code is not using this functionality.
256256
*
257257
* This only works with GCC and Clang. With other compilers, you may want to
258258
* use MBEDTLS_DEPRECATED_REMOVED
259259
*
260-
* Uncomment to get warnings on using deprecated functions.
260+
* Uncomment to get warnings on using deprecated functions and features.
261261
*/
262262
//#define MBEDTLS_DEPRECATED_WARNING
263263

264264
/**
265265
* \def MBEDTLS_DEPRECATED_REMOVED
266266
*
267-
* Remove deprecated functions so that they generate an error if used.
268-
* Functions deprecated in one version will usually be removed in the next
269-
* version. You can enable this to help you prepare the transition to a new
270-
* major version by making sure your code is not using these functions.
267+
* Remove deprecated functions and features so that they generate an error if
268+
* used. Functionality deprecated in one version will usually be removed in the
269+
* next version. You can enable this to help you prepare the transition to a
270+
* new major version by making sure your code is not using this functionality.
271271
*
272-
* Uncomment to get errors on using deprecated functions.
272+
* Uncomment to get errors on using deprecated functions and features.
273273
*/
274274
//#define MBEDTLS_DEPRECATED_REMOVED
275275

@@ -1587,6 +1587,9 @@
15871587
* Enable support for receiving and parsing SSLv2 Client Hello messages for the
15881588
* SSL Server module (MBEDTLS_SSL_SRV_C).
15891589
*
1590+
* \deprecated This option is deprecated and will be removed in a future
1591+
* version of Mbed TLS.
1592+
*
15901593
* Uncomment this macro to enable support for SSLv2 Client Hello messages.
15911594
*/
15921595
//#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
@@ -1618,6 +1621,9 @@
16181621
* Requires: MBEDTLS_MD5_C
16191622
* MBEDTLS_SHA1_C
16201623
*
1624+
* \deprecated This option is deprecated and will be removed in a future
1625+
* version of Mbed TLS.
1626+
*
16211627
* Comment this macro to disable support for SSL 3.0
16221628
*/
16231629
//#define MBEDTLS_SSL_PROTO_SSL3
@@ -2828,7 +2834,10 @@
28282834
/**
28292835
* \def MBEDTLS_PKCS11_C
28302836
*
2831-
* Enable wrapper for PKCS#11 smartcard support.
2837+
* Enable wrapper for PKCS#11 smartcard support via the pkcs11-helper library.
2838+
*
2839+
* \deprecated This option is deprecated and will be removed in a future
2840+
* version of Mbed TLS.
28322841
*
28332842
* Module: library/pkcs11.c
28342843
* Caller: library/pk.c

‎features/mbedtls/inc/mbedtls/error.h

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,10 @@
5252
* For historical reasons, low-level error codes are divided in even and odd,
5353
* even codes were assigned first, and -1 is reserved for other errors.
5454
*
55-
* Low-level module errors (0x0002-0x007E, 0x0003-0x007F)
55+
* Low-level module errors (0x0002-0x007E, 0x0001-0x007F)
5656
*
5757
* Module Nr Codes assigned
58+
* ERROR 2 0x006E 0x0001
5859
* MPI 7 0x0002-0x0010
5960
* GCM 3 0x0012-0x0014 0x0013-0x0013
6061
* BLOWFISH 3 0x0016-0x0018 0x0017-0x0017
@@ -86,7 +87,7 @@
8687
* CHACHA20 3 0x0051-0x0055
8788
* POLY1305 3 0x0057-0x005B
8889
* CHACHAPOLY 2 0x0054-0x0056
89-
* PLATFORM 1 0x0070-0x0072
90+
* PLATFORM 2 0x0070-0x0072
9091
*
9192
* High-level module nr (3 bits - 0x0...-0x7...)
9293
* Name ID Nr of Errors
@@ -112,6 +113,9 @@
112113
extern "C" {
113114
#endif
114115

116+
#define MBEDTLS_ERR_ERROR_GENERIC_ERROR -0x0001 /**< Generic error */
117+
#define MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED -0x006E /**< This is a bug in the library */
118+
115119
/**
116120
* \brief Translate a mbed TLS error code into a string representation,
117121
* Result is truncated if necessary and always includes a terminating

0 commit comments

Comments
 (0)