Skip to content

Commit 9eba96e

Browse files
ThePassionateThePassionate
committed
crypto/mbedtls: add patch for mbedtls cipher-wrap with key ID support
Add patch file and build system integration (CMakeLists.txt and Makefile) to support AES cipher wrapping with key ID functionality in the mbedtls third-party library. Signed-off-by: makejian <[email protected]>
1 parent f31991a commit 9eba96e

File tree

3 files changed

+271
-0
lines changed

3 files changed

+271
-0
lines changed

‎crypto/mbedtls/0004-mbedtls-cipher-wrap-support-aes-with-keyid.patch‎

Lines changed: 268 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,268 @@
1+
diff --git a/include/mbedtls/cipher.h b/include/mbedtls/cipher.h
2+
index 970a343802..6002668ac0 100644
3+
--- a/include/mbedtls/cipher.h
4+
+++ b/include/mbedtls/cipher.h
5+
@@ -101,9 +101,19 @@ typedef enum {
6+
MBEDTLS_CIPHER_AES_128_ECB, /**< AES cipher with 128-bit ECB mode. */
7+
MBEDTLS_CIPHER_AES_192_ECB, /**< AES cipher with 192-bit ECB mode. */
8+
MBEDTLS_CIPHER_AES_256_ECB, /**< AES cipher with 256-bit ECB mode. */
9+
+#if defined(MBEDTLS_AES_ALT)
10+
+ MBEDTLS_CIPHER_AES_128_ECB_KEYID, /**< AES cipher with 128-bit ECB mode in keyid type. */
11+
+ MBEDTLS_CIPHER_AES_192_ECB_KEYID, /**< AES cipher with 192-bit ECB mode in keyid type. */
12+
+ MBEDTLS_CIPHER_AES_256_ECB_KEYID, /**< AES cipher with 256-bit ECB mode in keyid type. */
13+
+#endif
14+
MBEDTLS_CIPHER_AES_128_CBC, /**< AES cipher with 128-bit CBC mode. */
15+
MBEDTLS_CIPHER_AES_192_CBC, /**< AES cipher with 192-bit CBC mode. */
16+
MBEDTLS_CIPHER_AES_256_CBC, /**< AES cipher with 256-bit CBC mode. */
17+
+#if defined(MBEDTLS_AES_ALT)
18+
+ MBEDTLS_CIPHER_AES_128_CBC_KEYID, /**< AES cipher with 128-bit CBC mode in keyid type. */
19+
+ MBEDTLS_CIPHER_AES_192_CBC_KEYID, /**< AES cipher with 192-bit CBC mode in keyid type. */
20+
+ MBEDTLS_CIPHER_AES_256_CBC_KEYID, /**< AES cipher with 256-bit CBC mode in keyid type. */
21+
+#endif
22+
MBEDTLS_CIPHER_AES_128_CFB128, /**< AES cipher with 128-bit CFB128 mode. */
23+
MBEDTLS_CIPHER_AES_192_CFB128, /**< AES cipher with 192-bit CFB128 mode. */
24+
MBEDTLS_CIPHER_AES_256_CFB128, /**< AES cipher with 256-bit CFB128 mode. */
25+
diff --git a/library/cipher_wrap.c b/library/cipher_wrap.c
26+
index a05c66e9ec..5c8738501a 100644
27+
--- a/library/cipher_wrap.c
28+
+++ b/library/cipher_wrap.c
29+
@@ -202,6 +202,44 @@ static int aes_setkey_enc_wrap(void *ctx, const unsigned char *key,
30+
return mbedtls_aes_setkey_enc((mbedtls_aes_context *) ctx, key, key_bitlen);
31+
}
32+
33+
+#if defined(MBEDTLS_AES_ALT)
34+
+static int aes_set128key_dec_keyid_wrap(void *ctx, const unsigned char *key,
35+
+ unsigned int key_bitlen)
36+
+{
37+
+ return mbedtls_aes_set128key_dec_keyid((mbedtls_aes_context *) ctx, key, key_bitlen);
38+
+}
39+
+
40+
+static int aes_set192key_dec_keyid_wrap(void *ctx, const unsigned char *key,
41+
+ unsigned int key_bitlen)
42+
+{
43+
+ return mbedtls_aes_set192key_dec_keyid((mbedtls_aes_context *) ctx, key, key_bitlen);
44+
+}
45+
+
46+
+static int aes_set256key_dec_keyid_wrap(void *ctx, const unsigned char *key,
47+
+ unsigned int key_bitlen)
48+
+{
49+
+ return mbedtls_aes_set256key_dec_keyid((mbedtls_aes_context *) ctx, key, key_bitlen);
50+
+}
51+
+
52+
+static int aes_set128key_enc_keyid_wrap(void *ctx, const unsigned char *key,
53+
+ unsigned int key_bitlen)
54+
+{
55+
+ return mbedtls_aes_set128key_enc_keyid((mbedtls_aes_context *) ctx, key, key_bitlen);
56+
+}
57+
+
58+
+static int aes_set192key_enc_keyid_wrap(void *ctx, const unsigned char *key,
59+
+ unsigned int key_bitlen)
60+
+{
61+
+ return mbedtls_aes_set256key_enc_keyid((mbedtls_aes_context *) ctx, key, key_bitlen);
62+
+}
63+
+
64+
+static int aes_set256key_enc_keyid_wrap(void *ctx, const unsigned char *key,
65+
+ unsigned int key_bitlen)
66+
+{
67+
+ return mbedtls_aes_set256key_enc_keyid((mbedtls_aes_context *) ctx, key, key_bitlen);
68+
+}
69+
+#endif
70+
+
71+
static void *aes_ctx_alloc(void)
72+
{
73+
mbedtls_aes_context *aes = mbedtls_calloc(1, sizeof(mbedtls_aes_context));
74+
@@ -248,6 +286,89 @@ static const mbedtls_cipher_base_t aes_info = {
75+
aes_ctx_free
76+
};
77+
78+
+#if defined(MBEDTLS_AES_ALT)
79+
+static const mbedtls_cipher_base_t aes_128keyid_info = {
80+
+ MBEDTLS_CIPHER_ID_AES,
81+
+ aes_crypt_ecb_wrap,
82+
+#if defined(MBEDTLS_CIPHER_MODE_CBC)
83+
+ aes_crypt_cbc_wrap,
84+
+#endif
85+
+#if defined(MBEDTLS_CIPHER_MODE_CFB)
86+
+ aes_crypt_cfb128_wrap,
87+
+#endif
88+
+#if defined(MBEDTLS_CIPHER_MODE_OFB)
89+
+ aes_crypt_ofb_wrap,
90+
+#endif
91+
+#if defined(MBEDTLS_CIPHER_MODE_CTR)
92+
+ aes_crypt_ctr_wrap,
93+
+#endif
94+
+#if defined(MBEDTLS_CIPHER_MODE_XTS)
95+
+ NULL,
96+
+#endif
97+
+#if defined(MBEDTLS_CIPHER_MODE_STREAM)
98+
+ NULL,
99+
+#endif
100+
+ aes_set128key_enc_keyid_wrap,
101+
+ aes_set128key_dec_keyid_wrap,
102+
+ aes_ctx_alloc,
103+
+ aes_ctx_free
104+
+};
105+
+
106+
+static const mbedtls_cipher_base_t aes_192keyid_info = {
107+
+ MBEDTLS_CIPHER_ID_AES,
108+
+ aes_crypt_ecb_wrap,
109+
+#if defined(MBEDTLS_CIPHER_MODE_CBC)
110+
+ aes_crypt_cbc_wrap,
111+
+#endif
112+
+#if defined(MBEDTLS_CIPHER_MODE_CFB)
113+
+ aes_crypt_cfb128_wrap,
114+
+#endif
115+
+#if defined(MBEDTLS_CIPHER_MODE_OFB)
116+
+ aes_crypt_ofb_wrap,
117+
+#endif
118+
+#if defined(MBEDTLS_CIPHER_MODE_CTR)
119+
+ aes_crypt_ctr_wrap,
120+
+#endif
121+
+#if defined(MBEDTLS_CIPHER_MODE_XTS)
122+
+ NULL,
123+
+#endif
124+
+#if defined(MBEDTLS_CIPHER_MODE_STREAM)
125+
+ NULL,
126+
+#endif
127+
+ aes_set192key_enc_keyid_wrap,
128+
+ aes_set192key_dec_keyid_wrap,
129+
+ aes_ctx_alloc,
130+
+ aes_ctx_free
131+
+};
132+
+
133+
+static const mbedtls_cipher_base_t aes_256keyid_info = {
134+
+ MBEDTLS_CIPHER_ID_AES,
135+
+ aes_crypt_ecb_wrap,
136+
+#if defined(MBEDTLS_CIPHER_MODE_CBC)
137+
+ aes_crypt_cbc_wrap,
138+
+#endif
139+
+#if defined(MBEDTLS_CIPHER_MODE_CFB)
140+
+ aes_crypt_cfb128_wrap,
141+
+#endif
142+
+#if defined(MBEDTLS_CIPHER_MODE_OFB)
143+
+ aes_crypt_ofb_wrap,
144+
+#endif
145+
+#if defined(MBEDTLS_CIPHER_MODE_CTR)
146+
+ aes_crypt_ctr_wrap,
147+
+#endif
148+
+#if defined(MBEDTLS_CIPHER_MODE_XTS)
149+
+ NULL,
150+
+#endif
151+
+#if defined(MBEDTLS_CIPHER_MODE_STREAM)
152+
+ NULL,
153+
+#endif
154+
+ aes_set256key_enc_keyid_wrap,
155+
+ aes_set256key_dec_keyid_wrap,
156+
+ aes_ctx_alloc,
157+
+ aes_ctx_free
158+
+};
159+
+#endif
160+
+
161+
static const mbedtls_cipher_info_t aes_128_ecb_info = {
162+
MBEDTLS_CIPHER_AES_128_ECB,
163+
MBEDTLS_MODE_ECB,
164+
@@ -281,6 +402,41 @@ static const mbedtls_cipher_info_t aes_256_ecb_info = {
165+
&aes_info
166+
};
167+
168+
+#if defined(MBEDTLS_AES_ALT)
169+
+static const mbedtls_cipher_info_t aes_128_ecb_keyid_info = {
170+
+ MBEDTLS_CIPHER_AES_128_ECB,
171+
+ MBEDTLS_MODE_ECB,
172+
+ 32,
173+
+ "AES-128-ECB-KEYID",
174+
+ 0,
175+
+ 0,
176+
+ 16,
177+
+ &aes_128keyid_info
178+
+};
179+
+
180+
+static const mbedtls_cipher_info_t aes_192_ecb_keyid_info = {
181+
+ MBEDTLS_CIPHER_AES_192_ECB,
182+
+ MBEDTLS_MODE_ECB,
183+
+ 32,
184+
+ "AES-192-ECB-KEYID",
185+
+ 0,
186+
+ 0,
187+
+ 16,
188+
+ &aes_192keyid_info
189+
+};
190+
+
191+
+static const mbedtls_cipher_info_t aes_256_ecb_keyid_info = {
192+
+ MBEDTLS_CIPHER_AES_256_ECB,
193+
+ MBEDTLS_MODE_ECB,
194+
+ 32,
195+
+ "AES-256-ECB-KEYID",
196+
+ 0,
197+
+ 0,
198+
+ 16,
199+
+ &aes_256keyid_info
200+
+};
201+
+#endif
202+
+
203+
#if defined(MBEDTLS_CIPHER_MODE_CBC)
204+
static const mbedtls_cipher_info_t aes_128_cbc_info = {
205+
MBEDTLS_CIPHER_AES_128_CBC,
206+
@@ -314,6 +470,41 @@ static const mbedtls_cipher_info_t aes_256_cbc_info = {
207+
16,
208+
&aes_info
209+
};
210+
+
211+
+#if defined(MBEDTLS_AES_ALT)
212+
+static const mbedtls_cipher_info_t aes_128_cbc_keyid_info = {
213+
+ MBEDTLS_CIPHER_AES_128_CBC_KEYID,
214+
+ MBEDTLS_MODE_CBC,
215+
+ 32,
216+
+ "AES-128-CBC-KEYID",
217+
+ 16,
218+
+ 0,
219+
+ 16,
220+
+ &aes_128keyid_info
221+
+};
222+
+
223+
+static const mbedtls_cipher_info_t aes_192_cbc_keyid_info = {
224+
+ MBEDTLS_CIPHER_AES_192_CBC_KEYID,
225+
+ MBEDTLS_MODE_CBC,
226+
+ 32,
227+
+ "AES-192-CBC-KEYID",
228+
+ 16,
229+
+ 0,
230+
+ 16,
231+
+ &aes_192keyid_info
232+
+};
233+
+
234+
+static const mbedtls_cipher_info_t aes_256_cbc_keyid_info = {
235+
+ MBEDTLS_CIPHER_AES_256_CBC_KEYID,
236+
+ MBEDTLS_MODE_CBC,
237+
+ 32,
238+
+ "AES-256-CBC-KEYID",
239+
+ 16,
240+
+ 0,
241+
+ 16,
242+
+ &aes_256keyid_info
243+
+};
244+
+#endif
245+
#endif /* MBEDTLS_CIPHER_MODE_CBC */
246+
247+
#if defined(MBEDTLS_CIPHER_MODE_CFB)
248+
@@ -2358,10 +2549,20 @@ const mbedtls_cipher_definition_t mbedtls_cipher_definitions[] =
249+
{ MBEDTLS_CIPHER_AES_128_ECB, &aes_128_ecb_info },
250+
{ MBEDTLS_CIPHER_AES_192_ECB, &aes_192_ecb_info },
251+
{ MBEDTLS_CIPHER_AES_256_ECB, &aes_256_ecb_info },
252+
+#if defined(MBEDTLS_AES_ALT)
253+
+ { MBEDTLS_CIPHER_AES_128_ECB_KEYID, &aes_128_ecb_keyid_info },
254+
+ { MBEDTLS_CIPHER_AES_192_ECB_KEYID, &aes_192_ecb_keyid_info },
255+
+ { MBEDTLS_CIPHER_AES_256_ECB_KEYID, &aes_256_ecb_keyid_info },
256+
+#endif
257+
#if defined(MBEDTLS_CIPHER_MODE_CBC)
258+
{ MBEDTLS_CIPHER_AES_128_CBC, &aes_128_cbc_info },
259+
{ MBEDTLS_CIPHER_AES_192_CBC, &aes_192_cbc_info },
260+
{ MBEDTLS_CIPHER_AES_256_CBC, &aes_256_cbc_info },
261+
+#if defined(MBEDTLS_AES_ALT)
262+
+ { MBEDTLS_CIPHER_AES_128_CBC_KEYID, &aes_128_cbc_keyid_info },
263+
+ { MBEDTLS_CIPHER_AES_192_CBC_KEYID, &aes_192_cbc_keyid_info },
264+
+ { MBEDTLS_CIPHER_AES_256_CBC_KEYID, &aes_256_cbc_keyid_info },
265+
+#endif
266+
#endif
267+
#if defined(MBEDTLS_CIPHER_MODE_CFB)
268+
{ MBEDTLS_CIPHER_AES_128_CFB128, &aes_128_cfb128_info },

‎crypto/mbedtls/CMakeLists.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ if(CONFIG_CRYPTO_MBEDTLS)
4242
${CMAKE_CURRENT_LIST_DIR}/0002-mbedtls-add-mbedtls-x509-crt-pool.patch
4343
&& patch -p1 -d ${MBEDTLS_DIR} <
4444
${CMAKE_CURRENT_LIST_DIR}/0003-Fix-MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT-warning.patch
45+
&& patch -p1 -d ${MBEDTLS_DIR} <
46+
${CMAKE_CURRENT_LIST_DIR}/0004-mbedtls-cipher-wrap-support-aes-with-keyid.patch
4547
DOWNLOAD_NO_PROGRESS true
4648
TIMEOUT 30)
4749

‎crypto/mbedtls/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ $(MBEDTLS_UNPACKNAME): $(MBEDTLS_ZIP)
7171
$(Q) patch -p1 -d $(MBEDTLS_UNPACKNAME) < 0001-mbedtls-entropy_poll-use-getrandom-to-get-the-system.patch
7272
$(Q) patch -p1 -d $(MBEDTLS_UNPACKNAME) < 0002-mbedtls-add-mbedtls-x509-crt-pool.patch
7373
$(Q) patch -p1 -d $(MBEDTLS_UNPACKNAME) < 0003-Fix-MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT-warning.patch
74+
$(Q) patch -p1 -d $(MBEDTLS_UNPACKNAME) < 0004-mbedtls-cipher-wrap-support-aes-with-keyid.patch
7475
$(Q) touch $(MBEDTLS_UNPACKNAME)
7576

7677
# Download and unpack tarball if no git repo found

0 commit comments

Comments
 (0)