Skip to content

Commit 01c6192

Browse files
daverodgmandaverodgman
authored
Merge pull request Mbed-TLS#16 from ronald-cron-arm/configs-and-tests
Add two new configurations options and tests
2 parents 3a06eed + ea19548 commit 01c6192

File tree

14 files changed

+329
-8
lines changed

14 files changed

+329
-8
lines changed

‎CMakeLists.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,18 @@ endif()
5252
# Set the project root directory.
5353
set(PSA_CRYPTO_DIR ${CMAKE_CURRENT_SOURCE_DIR})
5454

55+
# Set-up configuration file
56+
set(PSA_CRYPTO_CONFIG_FILE include/psa/crypto_config.h CACHE STRING
57+
"PSA-Crypto configuration file, absolute path or path relative to the root directory")
58+
get_filename_component(PSA_CRYPTO_CONFIG_FILE_REALPATH
59+
${PSA_CRYPTO_CONFIG_FILE} REALPATH BASE_DIR ${PSA_CRYPTO_DIR})
60+
configure_file(${PSA_CRYPTO_CONFIG_FILE_REALPATH}
61+
${CMAKE_CURRENT_BINARY_DIR}/include/psa/crypto_config.h
62+
COPYONLY)
63+
install(FILES ${CMAKE_CURRENT_BINARY_DIR}/include/psa/crypto_config.h
64+
DESTINATION include/psa
65+
PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
66+
5567
option(ENABLE_PROGRAMS "Build PSA cryptography example programs." ON)
5668

5769
option(PSA_CRYPTO_FATAL_WARNINGS "Compiler warnings treated as errors" ON)
@@ -221,6 +233,7 @@ if(ENABLE_TESTING OR ENABLE_PROGRAMS)
221233
file(GLOB PSA_CRYPTO_TEST_FILES ${CMAKE_CURRENT_SOURCE_DIR}/tests/src/*.c ${CMAKE_CURRENT_SOURCE_DIR}/tests/src/drivers/*.c)
222234
add_library(psa_crypto_test OBJECT ${PSA_CRYPTO_TEST_FILES})
223235
target_include_directories(psa_crypto_test
236+
PRIVATE ${CMAKE_BINARY_DIR}/include
224237
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include
225238
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/drivers/builtin/include
226239
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/drivers/builtin/src

‎configs/ccm-aes-sha256-secp256r1.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
//#define PSA_CRYPTO_STD_FUNCTIONS
3636
#define PSA_CRYPTO_FS_IO
3737
#define PSA_CRYPTO_MEMORY_BUFFER_ALLOC
38+
//#define PSA_CRYPTO_PLATFORM_ZEROIZE
3839

3940
/** \} name SECTION: General configuration options */
4041

@@ -84,6 +85,7 @@
8485
//#define PSA_CRYPTO_HMAC_DRBG_HASH PSA_ALG_SHA_256
8586
//#define PSA_CRYPTO_KEY_SLOT_COUNT 32
8687
//#define PSA_CRYPTO_PLATFORM_ENTROPY
88+
//#define PSA_CRYPTO_HARDWARE_ENTROPY
8789
#define PSA_CRYPTO_ENTROPY_NV_SEED
8890
#define PSA_CRYPTO_ENTROPY_NV_SEED_FILE "seedfile"
8991

‎configs/ccm-aes-sha256.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
//#define PSA_CRYPTO_STD_FUNCTIONS
3535
#define PSA_CRYPTO_FS_IO
3636
#define PSA_CRYPTO_MEMORY_BUFFER_ALLOC
37+
//#define PSA_CRYPTO_PLATFORM_ZEROIZE
3738

3839
/** \} name SECTION: General configuration options */
3940

@@ -75,6 +76,7 @@
7576
//#define PSA_CRYPTO_HMAC_DRBG_HASH PSA_ALG_SHA_256
7677
//#define PSA_CRYPTO_KEY_SLOT_COUNT 32
7778
//#define PSA_CRYPTO_PLATFORM_ENTROPY
79+
//#define PSA_CRYPTO_HARDWARE_ENTROPY
7880
#define PSA_CRYPTO_ENTROPY_NV_SEED
7981
//#define PSA_CRYPTO_ENTROPY_NV_SEED_FILE "seedfile"
8082

‎configs/gcm-ccm-cbc-aes-sha256_512-secp256_384r1-rsa.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
//#define PSA_CRYPTO_STD_FUNCTIONS
3737
#define PSA_CRYPTO_FS_IO
3838
#define PSA_CRYPTO_MEMORY_BUFFER_ALLOC
39+
//#define PSA_CRYPTO_PLATFORM_ZEROIZE
3940

4041
/** \} name SECTION: General configuration options */
4142

@@ -95,6 +96,7 @@
9596
//#define PSA_CRYPTO_HMAC_DRBG_HASH PSA_ALG_SHA_256
9697
//#define PSA_CRYPTO_KEY_SLOT_COUNT 32
9798
//#define PSA_CRYPTO_PLATFORM_ENTROPY
99+
//#define PSA_CRYPTO_HARDWARE_ENTROPY
98100
#define PSA_CRYPTO_ENTROPY_NV_SEED
99101
#define PSA_CRYPTO_ENTROPY_NV_SEED_FILE "seedfile"
100102

‎core/CMakeLists.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,8 @@ endif(USE_SHARED_PSA_CRYPTO_LIBRARY)
8383
foreach(target IN LISTS target_libraries)
8484
add_library(PSACrypto::${target} ALIAS ${target}) # add_subdirectory support
8585
target_include_directories(${target}
86+
PUBLIC $<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/include/>
87+
$<INSTALL_INTERFACE:include/>
8688
PUBLIC $<BUILD_INTERFACE:${PSA_CRYPTO_DIR}/include/>
8789
$<INSTALL_INTERFACE:include/>
8890
PUBLIC $<BUILD_INTERFACE:${PSA_CRYPTO_DIR}/drivers/builtin/include/>

‎drivers/builtin/config_psa_ext.h‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
/**
2+
* \file config_psa_ext.h
3+
* \brief PSA crypto configurations to Mbed TLS configurations extension
4+
*
5+
* Extension of the translation of the PSA crypto configurations to the Mbed
6+
* TLS ones handling the PSA-Crypto specific configuration options.
7+
*/
8+
/*
9+
* Copyright The Mbed TLS Contributors
10+
* SPDX-License-Identifier: Apache-2.0
11+
*
12+
* Licensed under the Apache License, Version 2.0 (the "License"); you may
13+
* not use this file except in compliance with the License.
14+
* You may obtain a copy of the License at
15+
*
16+
* http://www.apache.org/licenses/LICENSE-2.0
17+
*
18+
* Unless required by applicable law or agreed to in writing, software
19+
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
20+
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
21+
* See the License for the specific language governing permissions and
22+
* limitations under the License.
23+
*/
24+
25+
#if defined(PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
26+
#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
27+
#endif
28+
29+
#if defined(PSA_CRYPTO_SPM)
30+
#define MBEDTLS_PSA_CRYPTO_SPM
31+
#endif
32+
33+
#if !defined(PSA_CRYPTO_STD_FUNCTIONS)
34+
#include <psa/platform.h>
35+
#define MBEDTLS_PLATFORM_C
36+
#define MBEDTLS_PLATFORM_MEMORY
37+
#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
38+
#define MBEDTLS_PLATFORM_PRINTF_MACRO psa_crypto_printf
39+
#define MBEDTLS_PLATFORM_FPRINTF_MACRO psa_crypto_fprintf
40+
#define MBEDTLS_PLATFORM_SNPRINTF_MACRO psa_crypto_snprintf
41+
#define MBEDTLS_PLATFORM_SETBUF_MACRO psa_crypto_setbuf
42+
#if defined(PSA_CRYPTO_MEMORY_BUFFER_ALLOC)
43+
#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
44+
#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 8
45+
#else
46+
#define MBEDTLS_PLATFORM_CALLOC_MACRO psa_crypto_calloc
47+
#define MBEDTLS_PLATFORM_FREE_MACRO psa_crypto_free
48+
#endif
49+
#endif /* !PSA_CRYPTO_STD_FUNCTIONS */
50+
51+
#if defined(PSA_CRYPTO_FS_IO)
52+
#define MBEDTLS_FS_IO
53+
#endif
54+
55+
#if defined(PSA_CRYPTO_PLATFORM_ZEROIZE)
56+
#define MBEDTLS_PLATFORM_ZEROIZE_ALT
57+
#define mbedtls_platform_zeroize psa_crypto_platform_zeroize
58+
#endif
59+
60+
#if defined(PSA_CRYPTO_BUILTIN_KEYS)
61+
#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
62+
#endif
63+
64+
#if defined(PSA_CRYPTO_STORAGE_C)
65+
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
66+
#endif
67+
68+
#if defined(PSA_CRYPTO_ITS_FILE_C)
69+
#define MBEDTLS_PSA_ITS_FILE_C
70+
#endif
71+
72+
#if defined(PSA_CRYPTO_EXTERNAL_RNG)
73+
#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
74+
#else /* PSA_CRYPTO_EXTERNAL_RNG */
75+
#define MBEDTLS_ENTROPY_C
76+
77+
#if defined(PSA_CRYPTO_HMAC_DRBG_HASH)
78+
#define MBEDTLS_HMAC_DRBG_C
79+
#define MBEDTLS_MD_C
80+
81+
/*
82+
* The macro PSA_CRYPTO_HMAC_DRBG_HASH defines the hash algorithm (SHA-256 or
83+
* SHA-512) to be used for HMAC for the PSA DRBG. It defines it using the PSA
84+
* macro identifying the hash algorithm. Those macros are not part of the
85+
* configuration macros thus they may not be defined at that point. As we need
86+
* to use the value of PSA_CRYPTO_HMAC_DRBG_HASH, which is equal to
87+
* PSA_ALG_SHA_256 or PSA_ALG_SHA_512 we need those macros to be defined. Their
88+
* specific values are not important here, they just have to be different.
89+
*/
90+
#if !defined(PSA_ALG_SHA_256)
91+
#define PSA_ALG_SHA_256 1
92+
#define PSA_ALG_SHA_512 2
93+
#define UNDEFINE_PSA_ALG_SHA_256_512
94+
#endif
95+
96+
#if (PSA_CRYPTO_HMAC_DRBG_HASH == PSA_ALG_SHA_256)
97+
#define MBEDTLS_PSA_HMAC_DRBG_MD_TYPE MBEDTLS_MD_SHA256
98+
#if !defined(MBEDTLS_SHA256_C)
99+
#define MBEDTLS_SHA256_C
100+
#endif
101+
#endif /* PSA_CRYPTO_HMAC_DRBG_HASH == PSA_ALG_SHA_256 */
102+
103+
#if (PSA_CRYPTO_HMAC_DRBG_HASH == PSA_ALG_SHA_512)
104+
#if !defined(MBEDTLS_SHA512_C)
105+
#define MBEDTLS_SHA512_C
106+
#endif
107+
#define MBEDTLS_PSA_HMAC_DRBG_MD_TYPE MBEDTLS_MD_SHA512
108+
#endif /* PSA_CRYPTO_HMAC_DRBG_HASH == PSA_ALG_SHA_512 */
109+
110+
/* Clean-up of the dummy values for PSA_ALG_SHA_256 and PSA_ALG_SHA_512 */
111+
#if defined(UNDEFINE_PSA_ALG_SHA_256_512)
112+
#undef PSA_ALG_SHA_256
113+
#undef PSA_ALG_SHA_512
114+
#undef UNDEFINE_PSA_ALG_SHA_256_512
115+
#endif
116+
117+
#else /* PSA_CRYPTO_HMAC_DRBG_HASH */
118+
119+
#define MBEDTLS_CTR_DRBG_C
120+
#if !defined(MBEDTLS_AES_C)
121+
#define MBEDTLS_AES_C
122+
#endif
123+
124+
#endif /* !PSA_CRYPTO_HMAC_DRBG_HASH */
125+
126+
#if !defined(PSA_CRYPTO_PLATFORM_ENTROPY)
127+
#define MBEDTLS_NO_PLATFORM_ENTROPY
128+
#endif
129+
130+
#if defined(PSA_CRYPTO_HARDWARE_ENTROPY)
131+
#define MBEDTLS_ENTROPY_HARDWARE_ALT
132+
#define mbedtls_hardware_poll psa_crypto_hardware_entropy
133+
#endif
134+
135+
#if defined(PSA_CRYPTO_ENTROPY_NV_SEED)
136+
#define MBEDTLS_PLATFORM_C
137+
#define MBEDTLS_ENTROPY_NV_SEED
138+
#if !defined(PSA_CRYPTO_STD_FUNCTIONS) || !defined(PSA_CRYPTO_FS_IO)
139+
#include <psa/platform.h>
140+
#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO psa_crypto_platform_entropy_nv_seed_read
141+
#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO psa_crypto_platform_entropy_nv_seed_write
142+
#endif
143+
#endif /* PSA_CRYPTO_ENTROPY_NV_SEED */
144+
145+
#endif /* !PSA_CRYPTO_EXTERNAL_RNG */
146+
147+
#if defined(PSA_CRYPTO_KEY_SLOT_COUNT)
148+
#define MBEDTLS_PSA_KEY_SLOT_COUNT PSA_CRYPTO_KEY_SLOT_COUNT
149+
#endif
150+
151+
#if defined(PSA_CRYPTO_ENTROPY_NV_SEED_FILE)
152+
#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE PSA_CRYPTO_ENTROPY_NV_SEED_FILE
153+
#endif

‎include/CMakeLists.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
file(GLOB psa_headers "psa/*.h")
22

3+
# Do not install the default configuration file as a specific one may have
4+
# been defined through the PSA_CRYPTO_CONFIG_FILE cached variable.
5+
list(REMOVE_ITEM psa_headers "${CMAKE_CURRENT_SOURCE_DIR}/psa/crypto_config.h")
6+
37
install(FILES ${psa_headers}
48
DESTINATION include/psa
59
PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

‎include/psa/crypto_config.h‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,23 @@
114114
*/
115115
//#define PSA_CRYPTO_MEMORY_BUFFER_ALLOC
116116

117+
/**
118+
* Uncomment the macro to let PSA-Crypto use your alternate implementation of
119+
* psa_crypto_platform_zeroize() instead of the default implementation.
120+
*
121+
* psa_crypto_platform_zeroize() is a widely used function across the library
122+
* to zero a block of memory. The implementation is expected to be secure in the
123+
* sense that it has been written to prevent the compiler from removing calls
124+
* to psa_crypto_platform_zeroize() as part of redundant code elimination
125+
* optimizations. However, it is difficult to guarantee that calls to
126+
* psa_crypto_platform_zeroize() will not be optimized by the compiler as older
127+
* versions of the C language standards do not provide a secure implementation
128+
* of memset(). Therefore, PSA_CRYPTO_PLATFORM_ZEROIZE enables users to provide
129+
* their own implementation of psa_crypto_platform_zeroize(), for
130+
* example by using directives specific to their compiler.
131+
*/
132+
//#define PSA_CRYPTO_PLATFORM_ZEROIZE
133+
117134
/** \} name SECTION: General configuration options */
118135

119136
/**
@@ -323,6 +340,18 @@
323340
*/
324341
#define PSA_CRYPTO_PLATFORM_ENTROPY
325342

343+
/**
344+
* \def PSA_CRYPTO_HARDWARE_ENTROPY
345+
*
346+
* Uncomment the macro to let PSA-Crypto use your own hardware entropy
347+
* collector.
348+
*
349+
* Your hardware entropy collector function must be called
350+
* \c psa_crypto_hardware_entropy(), see include/psa/platform.h for its
351+
* prototype.
352+
*/
353+
//#define PSA_CRYPTO_HARDWARE_ENTROPY
354+
326355
/**
327356
* \def PSA_CRYPTO_ENTROPY_NV_SEED
328357
*

‎include/psa/platform.h‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,25 @@ int psa_crypto_fprintf(FILE *stream, const char *format, ...) PSA_CRYPTO_PRINTF_
7979
int psa_crypto_snprintf(char *s, size_t n, const char *format, ...) PSA_CRYPTO_PRINTF_ATTRIBUTE(3, 4);
8080
void psa_crypto_setbuf(FILE *stream, char *buf);
8181

82+
/**
83+
* \brief Poll entropy from a hardware source
84+
*
85+
* \warning This is not provided by PSA-Crypto.
86+
* See \c PSA_CRYPTO_HARDWARE_ENTROPY in crypto_config.h.
87+
*
88+
* \param[in] data Pointer to function-specific data. NULL must be accepted.
89+
* \param[out] output Buffer to write data in
90+
* \param size Size of \p output
91+
* \param[out] len Number of bytes written in \p output. As far as possible,
92+
* should be \p size but may be as low as 0.
93+
*
94+
* \return 0 if no critical failure occured, a negative value
95+
* otherwise.
96+
*/
97+
int psa_crypto_hardware_entropy(void *data,
98+
unsigned char *output, size_t size,
99+
size_t *len);
100+
82101
/**
83102
* \brief Read an entropy seed from a Non-Volatile (NV) storage.
84103
*
@@ -134,9 +153,9 @@ int psa_crypto_platform_entropy_nv_seed_write(unsigned char *buf, size_t buf_len
134153
* heap before freeing the heap object.
135154
*
136155
* It is extremely difficult to guarantee that calls to
137-
* mbedtls_platform_zeroize() are not removed by aggressive
138-
* compiler optimizations in a portable way. By disabling the
139-
* PSA_CRYPTO_STD_FUNCTIONS configuration option, users of the
156+
* psa_crypto_platform_zeroize() are not removed by aggressive
157+
* compiler optimizations in a portable way. By enabling the
158+
* PSA_CRYPTO_PLATFORM_ZEROIZE configuration option, users of the
140159
* psa-crypto library can provide their own implementation suitable for
141160
* their platform and needs.
142161
*

‎programs/psa/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ if(GEN_FILES)
1111
OUTPUT
1212
${CMAKE_CURRENT_BINARY_DIR}/psa_constant_names_generated.c
1313
COMMAND
14-
${MBEDTLS_PYTHON_EXECUTABLE}
14+
${PSA_CRYPTO_PYTHON_EXECUTABLE}
1515
${CMAKE_CURRENT_SOURCE_DIR}/../../scripts/generate_psa_constants.py
1616
${CMAKE_CURRENT_BINARY_DIR}
1717
WORKING_DIRECTORY

0 commit comments

Comments
 (0)