From 58db65354beeb8fca3cba987a957a310e9c02753 Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Mon, 21 Mar 2022 12:12:37 +0100 Subject: [PATCH 01/13] Use the PSA-based HKDF functions Use the `mbedtls_psa_hkdf_extract` and `mbedtls_psa_hkdf_expand` functions in the HKDF handling. Signed-off-by: Gabor Mezei --- library/ssl_tls13_keys.c | 57 ++++++++++++++++++++++++++++++++-------- 1 file changed, 46 insertions(+), 11 deletions(-) diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index a5af5900b..d6a027a4c 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -136,7 +136,7 @@ static void ssl_tls13_hkdf_encode_label( *dst_len = total_hkdf_lbl_len; } -#if defined( MBEDTLS_TEST_HOOKS ) +#if defined(MBEDTLS_USE_PSA_CRYPTO) MBEDTLS_STATIC_TESTABLE psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg, @@ -312,7 +312,7 @@ cleanup: return( ( status == PSA_SUCCESS ) ? destroy_status : status ); } -#endif /* MBEDTLS_TEST_HOOKS */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ int mbedtls_ssl_tls13_hkdf_expand_label( mbedtls_md_type_t hash_alg, @@ -321,10 +321,15 @@ int mbedtls_ssl_tls13_hkdf_expand_label( const unsigned char *ctx, size_t ctx_len, unsigned char *buf, size_t buf_len ) { - const mbedtls_md_info_t *md_info; unsigned char hkdf_label[ SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN ]; size_t hkdf_label_len; +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_algorithm_t alg; +#else + const mbedtls_md_info_t *md_info; +#endif + if( label_len > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN ) { /* Should never happen since this is an internal @@ -345,9 +350,17 @@ int mbedtls_ssl_tls13_hkdf_expand_label( return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); } +#if defined(MBEDTLS_USE_PSA_CRYPTO) + alg = mbedtls_psa_translate_md( hash_alg ); + if( ! PSA_ALG_IS_HASH( alg ) ) + return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); + + alg = PSA_ALG_HMAC( alg ); +#else md_info = mbedtls_md_info_from_type( hash_alg ); if( md_info == NULL ) return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ ssl_tls13_hkdf_encode_label( buf_len, label, label_len, @@ -355,10 +368,18 @@ int mbedtls_ssl_tls13_hkdf_expand_label( hkdf_label, &hkdf_label_len ); - return( mbedtls_hkdf_expand( md_info, - secret, secret_len, - hkdf_label, hkdf_label_len, - buf, buf_len ) ); +#if defined(MBEDTLS_USE_PSA_CRYPTO) + return( psa_ssl_status_to_mbedtls( + mbedtls_psa_hkdf_expand( alg, + secret, secret_len, + hkdf_label, hkdf_label_len, + buf, buf_len ) ) ); +#else + return mbedtls_hkdf_expand( md_info, + secret, secret_len, + hkdf_label, hkdf_label_len, + buf, buf_len ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ } /* @@ -479,12 +500,22 @@ int mbedtls_ssl_tls13_evolve_secret( unsigned char tmp_secret[ MBEDTLS_MD_MAX_SIZE ] = { 0 }; unsigned char tmp_input [ MBEDTLS_ECP_MAX_BYTES ] = { 0 }; +#if defined(MBEDTLS_USE_PSA_CRYPTO) + size_t secret_len; + psa_algorithm_t alg = mbedtls_psa_translate_md( hash_alg ); + if( ! PSA_ALG_IS_HASH( alg ) ) + return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); + + alg = PSA_ALG_HMAC( alg ); + hlen = PSA_HASH_LENGTH( alg ); +#else const mbedtls_md_info_t *md_info; md_info = mbedtls_md_info_from_type( hash_alg ); if( md_info == NULL ) return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); hlen = mbedtls_md_get_size( md_info ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ /* For non-initial runs, call Derive-Secret( ., "derived", "") * on the old secret. */ @@ -514,14 +545,18 @@ int mbedtls_ssl_tls13_evolve_secret( /* HKDF-Extract takes a salt and input key material. * The salt is the old secret, and the input key material * is the input secret (PSK / ECDHE). */ +#if defined(MBEDTLS_USE_PSA_CRYPTO) + ret = psa_ssl_status_to_mbedtls( + mbedtls_psa_hkdf_extract( alg, + tmp_secret, hlen, + tmp_input, ilen, + secret_new, hlen, &secret_len ) ); +#else ret = mbedtls_hkdf_extract( md_info, tmp_secret, hlen, tmp_input, ilen, secret_new ); - if( ret != 0 ) - goto cleanup; - - ret = 0; +#endif /* MBEDTLS_USE_PSA_CRYPTO */ cleanup: From adfeadc6e5faa72ca6a4c5c4d434e2baab4c70a8 Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Mon, 21 Mar 2022 12:17:49 +0100 Subject: [PATCH 02/13] Extend PSA error translation Add new error codes to the PSA to mbedtls error translation. Signed-off-by: Gabor Mezei --- library/ssl_misc.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index be01eba33..eb3f2e97b 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -2137,6 +2137,10 @@ static inline int psa_ssl_status_to_mbedtls( psa_status_t status ) return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); case PSA_ERROR_INVALID_SIGNATURE: return( MBEDTLS_ERR_SSL_INVALID_MAC ); + case PSA_ERROR_INVALID_ARGUMENT: + return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); + case PSA_ERROR_BAD_STATE: + return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); default: return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ); } From 1bf075fffd15ea852928a541b605f0a4dd940a68 Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Mon, 21 Mar 2022 12:19:52 +0100 Subject: [PATCH 03/13] Use SSL error codes The `psa_ssl_status_to_mbedtls` function is not only used for cipher operations so transalte to TLS error codes. Signed-off-by: Gabor Mezei --- library/ssl_misc.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index eb3f2e97b..df4835b50 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -2132,9 +2132,9 @@ static inline int psa_ssl_status_to_mbedtls( psa_status_t status ) case PSA_SUCCESS: return( 0 ); case PSA_ERROR_INSUFFICIENT_MEMORY: - return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED ); + return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); case PSA_ERROR_NOT_SUPPORTED: - return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); + return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); case PSA_ERROR_INVALID_SIGNATURE: return( MBEDTLS_ERR_SSL_INVALID_MAC ); case PSA_ERROR_INVALID_ARGUMENT: From 892c4aa295f84e8c0b4acccf2b89538b75a56c0f Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Mon, 21 Mar 2022 12:21:43 +0100 Subject: [PATCH 04/13] Update hkdf test cases to handle PSA code Signed-off-by: Gabor Mezei --- tests/suites/test_suite_ssl.function | 36 ++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 855cfc77a..2e0f95b20 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4062,6 +4062,8 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST TEST_ASSERT( (size_t) desired_length <= sizeof(dst) ); TEST_ASSERT( (size_t) desired_length == expected->len ); + USE_PSA_INIT( ); + TEST_ASSERT( mbedtls_ssl_tls13_hkdf_expand_label( (mbedtls_md_type_t) hash_alg, secret->x, secret->len, @@ -4071,6 +4073,8 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST ASSERT_COMPARE( dst, (size_t) desired_length, expected->x, (size_t) expected->len ); + + USE_PSA_DONE( ); } /* END_CASE */ @@ -4094,6 +4098,8 @@ void ssl_tls13_traffic_key_generation( int hash_alg, TEST_ASSERT( expected_client_write_key->len == expected_server_write_key->len && expected_client_write_key->len == (size_t) desired_key_len ); + USE_PSA_INIT( ); + TEST_ASSERT( mbedtls_ssl_tls13_make_traffic_keys( (mbedtls_md_type_t) hash_alg, client_secret->x, @@ -4118,6 +4124,8 @@ void ssl_tls13_traffic_key_generation( int hash_alg, keys.iv_len, expected_server_write_iv->x, (size_t) desired_iv_len ); + + USE_PSA_DONE( ); } /* END_CASE */ @@ -4148,6 +4156,8 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST TEST_ASSERT( (size_t) desired_length <= sizeof(dst) ); TEST_ASSERT( (size_t) desired_length == expected->len ); + USE_PSA_INIT( ); + TEST_ASSERT( mbedtls_ssl_tls13_derive_secret( (mbedtls_md_type_t) hash_alg, secret->x, secret->len, @@ -4158,6 +4168,8 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST ASSERT_COMPARE( dst, desired_length, expected->x, desired_length ); + + USE_PSA_DONE( ); } /* END_CASE */ @@ -4180,6 +4192,8 @@ void ssl_tls13_derive_early_secrets( int hash_alg, traffic_expected->len == md_size && exporter_expected->len == md_size ); + USE_PSA_INIT( ); + TEST_ASSERT( mbedtls_ssl_tls13_derive_early_secrets( md_type, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); @@ -4188,6 +4202,8 @@ void ssl_tls13_derive_early_secrets( int hash_alg, traffic_expected->x, traffic_expected->len ); ASSERT_COMPARE( secrets.early_exporter_master_secret, md_size, exporter_expected->x, exporter_expected->len ); + + USE_PSA_DONE( ); } /* END_CASE */ @@ -4210,6 +4226,8 @@ void ssl_tls13_derive_handshake_secrets( int hash_alg, client_expected->len == md_size && server_expected->len == md_size ); + USE_PSA_INIT( ); + TEST_ASSERT( mbedtls_ssl_tls13_derive_handshake_secrets( md_type, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); @@ -4218,6 +4236,8 @@ void ssl_tls13_derive_handshake_secrets( int hash_alg, client_expected->x, client_expected->len ); ASSERT_COMPARE( secrets.server_handshake_traffic_secret, md_size, server_expected->x, server_expected->len ); + + USE_PSA_DONE( ); } /* END_CASE */ @@ -4242,6 +4262,8 @@ void ssl_tls13_derive_application_secrets( int hash_alg, server_expected->len == md_size && exporter_expected->len == md_size ); + USE_PSA_INIT( ); + TEST_ASSERT( mbedtls_ssl_tls13_derive_application_secrets( md_type, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); @@ -4252,6 +4274,8 @@ void ssl_tls13_derive_application_secrets( int hash_alg, server_expected->x, server_expected->len ); ASSERT_COMPARE( secrets.exporter_master_secret, md_size, exporter_expected->x, exporter_expected->len ); + + USE_PSA_DONE( ); } /* END_CASE */ @@ -4272,12 +4296,16 @@ void ssl_tls13_derive_resumption_secrets( int hash_alg, transcript->len == md_size && resumption_expected->len == md_size ); + USE_PSA_INIT( ); + TEST_ASSERT( mbedtls_ssl_tls13_derive_resumption_master_secret( md_type, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); ASSERT_COMPARE( secrets.resumption_master_secret, md_size, resumption_expected->x, resumption_expected->len ); + + USE_PSA_DONE( ); } /* END_CASE */ @@ -4298,6 +4326,8 @@ void ssl_tls13_create_psk_binder( int hash_alg, transcript->len == md_size && binder_expected->len == md_size ); + USE_PSA_INIT( ); + TEST_ASSERT( mbedtls_ssl_tls13_create_psk_binder( NULL, /* SSL context for debugging only */ md_type, @@ -4308,6 +4338,8 @@ void ssl_tls13_create_psk_binder( int hash_alg, ASSERT_COMPARE( binder, md_size, binder_expected->x, binder_expected->len ); + + USE_PSA_DONE( ); } /* END_CASE */ @@ -4420,6 +4452,8 @@ void ssl_tls13_key_evolution( int hash_alg, { unsigned char secret_new[ MBEDTLS_MD_MAX_SIZE ]; + USE_PSA_INIT(); + TEST_ASSERT( mbedtls_ssl_tls13_evolve_secret( (mbedtls_md_type_t) hash_alg, secret->len ? secret->x : NULL, @@ -4428,6 +4462,8 @@ void ssl_tls13_key_evolution( int hash_alg, ASSERT_COMPARE( secret_new, (size_t) expected->len, expected->x, (size_t) expected->len ); + + USE_PSA_DONE(); } /* END_CASE */ From 1e64f7a643bf96fa1140fb6375640ee67d8f5c84 Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Mon, 21 Mar 2022 16:57:44 +0100 Subject: [PATCH 05/13] Use MBEDTLS_USE_PSA_CRYPTO macro guard for testing instead of MBEDTLS_PSA_CRYPTO_C Signed-off-by: Gabor Mezei --- library/ssl_tls13_invasive.h | 6 +++--- tests/suites/test_suite_ssl.function | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/library/ssl_tls13_invasive.h b/library/ssl_tls13_invasive.h index a025dbee3..c04eff741 100644 --- a/library/ssl_tls13_invasive.h +++ b/library/ssl_tls13_invasive.h @@ -20,13 +20,13 @@ #include "common.h" -#if defined(MBEDTLS_PSA_CRYPTO_C) +#if defined(MBEDTLS_USE_PSA_CRYPTO) #include "psa/crypto.h" #endif #if defined(MBEDTLS_TEST_HOOKS) -#if defined(MBEDTLS_PSA_CRYPTO_C) +#if defined(MBEDTLS_USE_PSA_CRYPTO) /** * \brief Take the input keying material \p ikm and extract from it a @@ -87,7 +87,7 @@ psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t alg, const unsigned char *info, size_t info_len, unsigned char *okm, size_t okm_len ); -#endif /* MBEDTLS_PSA_CRYPTO_C */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ #endif /* MBEDTLS_TEST_HOOKS */ diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 2e0f95b20..5e02d10c7 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3885,7 +3885,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ +/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ void psa_hkdf_extract( int alg, data_t *ikm, data_t *salt, @@ -3913,7 +3913,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ +/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ void psa_hkdf_extract_ret( int alg, int ret ) { int output_ret; @@ -3942,7 +3942,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ +/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ void psa_hkdf_expand( int alg, data_t *info, data_t *prk, @@ -3970,7 +3970,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ +/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ void psa_hkdf_expand_ret( int alg, int prk_len, int okm_len, int ret ) { int output_ret; From 5d9a1fe9e9a3dc7ea638a22e2b2a3856a12351e6 Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Thu, 24 Mar 2022 17:49:14 +0100 Subject: [PATCH 06/13] PSA code depends on MBEDTLS_SSL_PROTO_TLS1_3 With TLS 1.3 support MBEDTLS_PSA_CRYPTO_C is enabled so PSA support is always enabled. Signed-off-by: Gabor Mezei --- library/ssl_misc.h | 6 ++-- library/ssl_tls13_invasive.h | 10 +++---- library/ssl_tls13_keys.c | 37 ----------------------- tests/suites/test_suite_ssl.function | 44 ++++++++++++++-------------- 4 files changed, 28 insertions(+), 69 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index df4835b50..e274d5b1a 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -2085,7 +2085,7 @@ static inline int mbedtls_ssl_sig_alg_is_supported( #define MBEDTLS_SSL_SIG_ALG( hash ) #endif /* MBEDTLS_ECDSA_C && MBEDTLS_RSA_C */ #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ -#if defined(MBEDTLS_USE_PSA_CRYPTO) +#if defined(MBEDTLS_PSA_CRYPTO_C) /* Corresponding PSA algorithm for MBEDTLS_CIPHER_NULL. * Same value is used fo PSA_ALG_CATEGORY_CIPHER, hence it is * guaranteed to not be a valid PSA algorithm identifier. @@ -2115,9 +2115,7 @@ psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_typ psa_algorithm_t *alg, psa_key_type_t *key_type, size_t *key_size ); -#endif /* MBEDTLS_USE_PSA_CRYPTO */ -#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) /** * \brief Convert given PSA status to mbedtls error code. * @@ -2145,6 +2143,6 @@ static inline int psa_ssl_status_to_mbedtls( psa_status_t status ) return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ); } } -#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */ +#endif /* MBEDTLS_PSA_CRYPTO_C */ #endif /* ssl_misc.h */ diff --git a/library/ssl_tls13_invasive.h b/library/ssl_tls13_invasive.h index c04eff741..8a3a50170 100644 --- a/library/ssl_tls13_invasive.h +++ b/library/ssl_tls13_invasive.h @@ -20,14 +20,12 @@ #include "common.h" -#if defined(MBEDTLS_USE_PSA_CRYPTO) +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + #include "psa/crypto.h" -#endif #if defined(MBEDTLS_TEST_HOOKS) -#if defined(MBEDTLS_USE_PSA_CRYPTO) - /** * \brief Take the input keying material \p ikm and extract from it a * fixed-length pseudorandom key \p prk. @@ -87,8 +85,8 @@ psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t alg, const unsigned char *info, size_t info_len, unsigned char *okm, size_t okm_len ); -#endif /* MBEDTLS_USE_PSA_CRYPTO */ - #endif /* MBEDTLS_TEST_HOOKS */ +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ + #endif /* MBEDTLS_SSL_TLS13_INVASIVE_H */ diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index d6a027a4c..44db38ffa 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -136,8 +136,6 @@ static void ssl_tls13_hkdf_encode_label( *dst_len = total_hkdf_lbl_len; } -#if defined(MBEDTLS_USE_PSA_CRYPTO) - MBEDTLS_STATIC_TESTABLE psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg, const unsigned char *salt, size_t salt_len, @@ -312,8 +310,6 @@ cleanup: return( ( status == PSA_SUCCESS ) ? destroy_status : status ); } -#endif /* MBEDTLS_USE_PSA_CRYPTO */ - int mbedtls_ssl_tls13_hkdf_expand_label( mbedtls_md_type_t hash_alg, const unsigned char *secret, size_t secret_len, @@ -324,11 +320,7 @@ int mbedtls_ssl_tls13_hkdf_expand_label( unsigned char hkdf_label[ SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN ]; size_t hkdf_label_len; -#if defined(MBEDTLS_USE_PSA_CRYPTO) psa_algorithm_t alg; -#else - const mbedtls_md_info_t *md_info; -#endif if( label_len > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN ) { @@ -350,17 +342,11 @@ int mbedtls_ssl_tls13_hkdf_expand_label( return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); } -#if defined(MBEDTLS_USE_PSA_CRYPTO) alg = mbedtls_psa_translate_md( hash_alg ); if( ! PSA_ALG_IS_HASH( alg ) ) return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); alg = PSA_ALG_HMAC( alg ); -#else - md_info = mbedtls_md_info_from_type( hash_alg ); - if( md_info == NULL ) - return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); -#endif /* MBEDTLS_USE_PSA_CRYPTO */ ssl_tls13_hkdf_encode_label( buf_len, label, label_len, @@ -368,18 +354,11 @@ int mbedtls_ssl_tls13_hkdf_expand_label( hkdf_label, &hkdf_label_len ); -#if defined(MBEDTLS_USE_PSA_CRYPTO) return( psa_ssl_status_to_mbedtls( mbedtls_psa_hkdf_expand( alg, secret, secret_len, hkdf_label, hkdf_label_len, buf, buf_len ) ) ); -#else - return mbedtls_hkdf_expand( md_info, - secret, secret_len, - hkdf_label, hkdf_label_len, - buf, buf_len ); -#endif /* MBEDTLS_USE_PSA_CRYPTO */ } /* @@ -500,7 +479,6 @@ int mbedtls_ssl_tls13_evolve_secret( unsigned char tmp_secret[ MBEDTLS_MD_MAX_SIZE ] = { 0 }; unsigned char tmp_input [ MBEDTLS_ECP_MAX_BYTES ] = { 0 }; -#if defined(MBEDTLS_USE_PSA_CRYPTO) size_t secret_len; psa_algorithm_t alg = mbedtls_psa_translate_md( hash_alg ); if( ! PSA_ALG_IS_HASH( alg ) ) @@ -508,14 +486,6 @@ int mbedtls_ssl_tls13_evolve_secret( alg = PSA_ALG_HMAC( alg ); hlen = PSA_HASH_LENGTH( alg ); -#else - const mbedtls_md_info_t *md_info; - md_info = mbedtls_md_info_from_type( hash_alg ); - if( md_info == NULL ) - return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); - - hlen = mbedtls_md_get_size( md_info ); -#endif /* MBEDTLS_USE_PSA_CRYPTO */ /* For non-initial runs, call Derive-Secret( ., "derived", "") * on the old secret. */ @@ -545,18 +515,11 @@ int mbedtls_ssl_tls13_evolve_secret( /* HKDF-Extract takes a salt and input key material. * The salt is the old secret, and the input key material * is the input secret (PSK / ECDHE). */ -#if defined(MBEDTLS_USE_PSA_CRYPTO) ret = psa_ssl_status_to_mbedtls( mbedtls_psa_hkdf_extract( alg, tmp_secret, hlen, tmp_input, ilen, secret_new, hlen, &secret_len ) ); -#else - ret = mbedtls_hkdf_extract( md_info, - tmp_secret, hlen, - tmp_input, ilen, - secret_new ); -#endif /* MBEDTLS_USE_PSA_CRYPTO */ cleanup: diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 5e02d10c7..81a0f48a0 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3885,7 +3885,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ +/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ void psa_hkdf_extract( int alg, data_t *ikm, data_t *salt, @@ -3913,7 +3913,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ +/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ void psa_hkdf_extract_ret( int alg, int ret ) { int output_ret; @@ -3942,7 +3942,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ +/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ void psa_hkdf_expand( int alg, data_t *info, data_t *prk, @@ -3970,7 +3970,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ +/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3 */ void psa_hkdf_expand_ret( int alg, int prk_len, int okm_len, int ret ) { int output_ret; @@ -4062,7 +4062,7 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST TEST_ASSERT( (size_t) desired_length <= sizeof(dst) ); TEST_ASSERT( (size_t) desired_length == expected->len ); - USE_PSA_INIT( ); + PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_hkdf_expand_label( (mbedtls_md_type_t) hash_alg, @@ -4074,7 +4074,7 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST ASSERT_COMPARE( dst, (size_t) desired_length, expected->x, (size_t) expected->len ); - USE_PSA_DONE( ); + PSA_DONE( ); } /* END_CASE */ @@ -4098,7 +4098,7 @@ void ssl_tls13_traffic_key_generation( int hash_alg, TEST_ASSERT( expected_client_write_key->len == expected_server_write_key->len && expected_client_write_key->len == (size_t) desired_key_len ); - USE_PSA_INIT( ); + PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_make_traffic_keys( (mbedtls_md_type_t) hash_alg, @@ -4125,7 +4125,7 @@ void ssl_tls13_traffic_key_generation( int hash_alg, expected_server_write_iv->x, (size_t) desired_iv_len ); - USE_PSA_DONE( ); + PSA_DONE( ); } /* END_CASE */ @@ -4156,7 +4156,7 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST TEST_ASSERT( (size_t) desired_length <= sizeof(dst) ); TEST_ASSERT( (size_t) desired_length == expected->len ); - USE_PSA_INIT( ); + PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_secret( (mbedtls_md_type_t) hash_alg, @@ -4169,7 +4169,7 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST ASSERT_COMPARE( dst, desired_length, expected->x, desired_length ); - USE_PSA_DONE( ); + PSA_DONE( ); } /* END_CASE */ @@ -4192,7 +4192,7 @@ void ssl_tls13_derive_early_secrets( int hash_alg, traffic_expected->len == md_size && exporter_expected->len == md_size ); - USE_PSA_INIT( ); + PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_early_secrets( md_type, secret->x, transcript->x, transcript->len, @@ -4203,7 +4203,7 @@ void ssl_tls13_derive_early_secrets( int hash_alg, ASSERT_COMPARE( secrets.early_exporter_master_secret, md_size, exporter_expected->x, exporter_expected->len ); - USE_PSA_DONE( ); + PSA_DONE( ); } /* END_CASE */ @@ -4226,7 +4226,7 @@ void ssl_tls13_derive_handshake_secrets( int hash_alg, client_expected->len == md_size && server_expected->len == md_size ); - USE_PSA_INIT( ); + PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_handshake_secrets( md_type, secret->x, transcript->x, transcript->len, @@ -4237,7 +4237,7 @@ void ssl_tls13_derive_handshake_secrets( int hash_alg, ASSERT_COMPARE( secrets.server_handshake_traffic_secret, md_size, server_expected->x, server_expected->len ); - USE_PSA_DONE( ); + PSA_DONE( ); } /* END_CASE */ @@ -4262,7 +4262,7 @@ void ssl_tls13_derive_application_secrets( int hash_alg, server_expected->len == md_size && exporter_expected->len == md_size ); - USE_PSA_INIT( ); + PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_application_secrets( md_type, secret->x, transcript->x, transcript->len, @@ -4275,7 +4275,7 @@ void ssl_tls13_derive_application_secrets( int hash_alg, ASSERT_COMPARE( secrets.exporter_master_secret, md_size, exporter_expected->x, exporter_expected->len ); - USE_PSA_DONE( ); + PSA_DONE( ); } /* END_CASE */ @@ -4296,7 +4296,7 @@ void ssl_tls13_derive_resumption_secrets( int hash_alg, transcript->len == md_size && resumption_expected->len == md_size ); - USE_PSA_INIT( ); + PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_resumption_master_secret( md_type, secret->x, transcript->x, transcript->len, @@ -4305,7 +4305,7 @@ void ssl_tls13_derive_resumption_secrets( int hash_alg, ASSERT_COMPARE( secrets.resumption_master_secret, md_size, resumption_expected->x, resumption_expected->len ); - USE_PSA_DONE( ); + PSA_DONE( ); } /* END_CASE */ @@ -4326,7 +4326,7 @@ void ssl_tls13_create_psk_binder( int hash_alg, transcript->len == md_size && binder_expected->len == md_size ); - USE_PSA_INIT( ); + PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_create_psk_binder( NULL, /* SSL context for debugging only */ @@ -4339,7 +4339,7 @@ void ssl_tls13_create_psk_binder( int hash_alg, ASSERT_COMPARE( binder, md_size, binder_expected->x, binder_expected->len ); - USE_PSA_DONE( ); + PSA_DONE( ); } /* END_CASE */ @@ -4452,7 +4452,7 @@ void ssl_tls13_key_evolution( int hash_alg, { unsigned char secret_new[ MBEDTLS_MD_MAX_SIZE ]; - USE_PSA_INIT(); + PSA_INIT(); TEST_ASSERT( mbedtls_ssl_tls13_evolve_secret( (mbedtls_md_type_t) hash_alg, @@ -4463,7 +4463,7 @@ void ssl_tls13_key_evolution( int hash_alg, ASSERT_COMPARE( secret_new, (size_t) expected->len, expected->x, (size_t) expected->len ); - USE_PSA_DONE(); + PSA_DONE(); } /* END_CASE */ From 07732f701592ef687de046c6d23b47e55187c896 Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Sat, 26 Mar 2022 17:04:19 +0100 Subject: [PATCH 07/13] Translate from mbedtls_md_type_t to psa_algorithm_t Do the translation as early as possible from mbedtls_md_type_t to psa_algorithm_t. Signed-off-by: Gabor Mezei --- library/ssl_tls13_keys.c | 282 +++++++++++++++------------ library/ssl_tls13_keys.h | 44 ++--- tests/suites/test_suite_ssl.data | 91 ++++++--- tests/suites/test_suite_ssl.function | 107 +++++----- 4 files changed, 285 insertions(+), 239 deletions(-) diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index 44db38ffa..2ce654ba8 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -311,7 +311,7 @@ cleanup: } int mbedtls_ssl_tls13_hkdf_expand_label( - mbedtls_md_type_t hash_alg, + psa_algorithm_t hash_alg, const unsigned char *secret, size_t secret_len, const unsigned char *label, size_t label_len, const unsigned char *ctx, size_t ctx_len, @@ -320,8 +320,6 @@ int mbedtls_ssl_tls13_hkdf_expand_label( unsigned char hkdf_label[ SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN ]; size_t hkdf_label_len; - psa_algorithm_t alg; - if( label_len > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN ) { /* Should never happen since this is an internal @@ -342,12 +340,9 @@ int mbedtls_ssl_tls13_hkdf_expand_label( return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); } - alg = mbedtls_psa_translate_md( hash_alg ); - if( ! PSA_ALG_IS_HASH( alg ) ) + if( ! PSA_ALG_IS_HASH( hash_alg ) ) return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); - alg = PSA_ALG_HMAC( alg ); - ssl_tls13_hkdf_encode_label( buf_len, label, label_len, ctx, ctx_len, @@ -355,7 +350,7 @@ int mbedtls_ssl_tls13_hkdf_expand_label( &hkdf_label_len ); return( psa_ssl_status_to_mbedtls( - mbedtls_psa_hkdf_expand( alg, + mbedtls_psa_hkdf_expand( PSA_ALG_HMAC( hash_alg ), secret, secret_len, hkdf_label, hkdf_label_len, buf, buf_len ) ) ); @@ -378,7 +373,7 @@ int mbedtls_ssl_tls13_hkdf_expand_label( * keys in a single function call. */ int mbedtls_ssl_tls13_make_traffic_keys( - mbedtls_md_type_t hash_alg, + psa_algorithm_t hash_alg, const unsigned char *client_secret, const unsigned char *server_secret, size_t secret_len, size_t key_len, size_t iv_len, @@ -425,7 +420,7 @@ int mbedtls_ssl_tls13_make_traffic_keys( } int mbedtls_ssl_tls13_derive_secret( - mbedtls_md_type_t hash_alg, + psa_algorithm_t hash_alg, const unsigned char *secret, size_t secret_len, const unsigned char *label, size_t label_len, const unsigned char *ctx, size_t ctx_len, @@ -433,19 +428,30 @@ int mbedtls_ssl_tls13_derive_secret( unsigned char *dstbuf, size_t dstbuf_len ) { int ret; - unsigned char hashed_context[ MBEDTLS_MD_MAX_SIZE ]; - + unsigned char hashed_context[ PSA_HASH_MAX_SIZE ]; +/* const mbedtls_md_info_t *md_info; md_info = mbedtls_md_info_from_type( hash_alg ); if( md_info == NULL ) return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); - +*/ if( ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED ) { +/* ret = mbedtls_md( md_info, ctx, ctx_len, hashed_context ); if( ret != 0 ) return( ret ); ctx_len = mbedtls_md_get_size( md_info ); +*/ + psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; + + status = psa_hash_compute( hash_alg, ctx, ctx_len, hashed_context, + PSA_HASH_LENGTH( hash_alg ), &ctx_len ); + if( status != PSA_SUCCESS ) + { + ret = psa_ssl_status_to_mbedtls( status ); + return ret; + } } else { @@ -466,26 +472,25 @@ int mbedtls_ssl_tls13_derive_secret( label, label_len, hashed_context, ctx_len, dstbuf, dstbuf_len ) ); + } int mbedtls_ssl_tls13_evolve_secret( - mbedtls_md_type_t hash_alg, + psa_algorithm_t hash_alg, const unsigned char *secret_old, const unsigned char *input, size_t input_len, unsigned char *secret_new ) { int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; size_t hlen, ilen; - unsigned char tmp_secret[ MBEDTLS_MD_MAX_SIZE ] = { 0 }; + unsigned char tmp_secret[ PSA_MAC_MAX_SIZE ] = { 0 }; unsigned char tmp_input [ MBEDTLS_ECP_MAX_BYTES ] = { 0 }; - size_t secret_len; - psa_algorithm_t alg = mbedtls_psa_translate_md( hash_alg ); - if( ! PSA_ALG_IS_HASH( alg ) ) + + if( ! PSA_ALG_IS_HASH( hash_alg ) ) return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); - alg = PSA_ALG_HMAC( alg ); - hlen = PSA_HASH_LENGTH( alg ); + hlen = PSA_HASH_LENGTH( hash_alg ); /* For non-initial runs, call Derive-Secret( ., "derived", "") * on the old secret. */ @@ -516,7 +521,7 @@ int mbedtls_ssl_tls13_evolve_secret( * The salt is the old secret, and the input key material * is the input secret (PSK / ECDHE). */ ret = psa_ssl_status_to_mbedtls( - mbedtls_psa_hkdf_extract( alg, + mbedtls_psa_hkdf_extract( PSA_ALG_HMAC( hash_alg ), tmp_secret, hlen, tmp_input, ilen, secret_new, hlen, &secret_len ) ); @@ -529,18 +534,17 @@ int mbedtls_ssl_tls13_evolve_secret( } int mbedtls_ssl_tls13_derive_early_secrets( - mbedtls_md_type_t md_type, + psa_algorithm_t hash_alg, unsigned char const *early_secret, unsigned char const *transcript, size_t transcript_len, mbedtls_ssl_tls13_early_secrets *derived ) { int ret; - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); + size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); /* We should never call this function with an unknown hash, * but add an assertion anyway. */ - if( md_info == 0 ) + if( ! PSA_ALG_IS_HASH( hash_alg ) ) return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); /* @@ -558,24 +562,24 @@ int mbedtls_ssl_tls13_derive_early_secrets( */ /* Create client_early_traffic_secret */ - ret = mbedtls_ssl_tls13_derive_secret( md_type, - early_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + early_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_e_traffic ), transcript, transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->client_early_traffic_secret, - md_size ); + hash_len ); if( ret != 0 ) return( ret ); /* Create early exporter */ - ret = mbedtls_ssl_tls13_derive_secret( md_type, - early_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + early_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( e_exp_master ), transcript, transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->early_exporter_master_secret, - md_size ); + hash_len ); if( ret != 0 ) return( ret ); @@ -583,18 +587,17 @@ int mbedtls_ssl_tls13_derive_early_secrets( } int mbedtls_ssl_tls13_derive_handshake_secrets( - mbedtls_md_type_t md_type, + psa_algorithm_t hash_alg, unsigned char const *handshake_secret, unsigned char const *transcript, size_t transcript_len, mbedtls_ssl_tls13_handshake_secrets *derived ) { int ret; - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); + size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); /* We should never call this function with an unknown hash, * but add an assertion anyway. */ - if( md_info == 0 ) + if( ! PSA_ALG_IS_HASH( hash_alg ) ) return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); /* @@ -616,13 +619,13 @@ int mbedtls_ssl_tls13_derive_handshake_secrets( * Derive-Secret( ., "c hs traffic", ClientHello...ServerHello ) */ - ret = mbedtls_ssl_tls13_derive_secret( md_type, - handshake_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + handshake_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_hs_traffic ), transcript, transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->client_handshake_traffic_secret, - md_size ); + hash_len ); if( ret != 0 ) return( ret ); @@ -631,13 +634,13 @@ int mbedtls_ssl_tls13_derive_handshake_secrets( * Derive-Secret( ., "s hs traffic", ClientHello...ServerHello ) */ - ret = mbedtls_ssl_tls13_derive_secret( md_type, - handshake_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + handshake_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_hs_traffic ), transcript, transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->server_handshake_traffic_secret, - md_size ); + hash_len ); if( ret != 0 ) return( ret ); @@ -645,18 +648,17 @@ int mbedtls_ssl_tls13_derive_handshake_secrets( } int mbedtls_ssl_tls13_derive_application_secrets( - mbedtls_md_type_t md_type, + psa_algorithm_t hash_alg, unsigned char const *application_secret, unsigned char const *transcript, size_t transcript_len, mbedtls_ssl_tls13_application_secrets *derived ) { int ret; - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); + size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); /* We should never call this function with an unknown hash, * but add an assertion anyway. */ - if( md_info == 0 ) + if( ! PSA_ALG_IS_HASH( hash_alg ) ) return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); /* Generate {client,server}_application_traffic_secret_0 @@ -677,33 +679,33 @@ int mbedtls_ssl_tls13_derive_application_secrets( * */ - ret = mbedtls_ssl_tls13_derive_secret( md_type, - application_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + application_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_ap_traffic ), transcript, transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->client_application_traffic_secret_N, - md_size ); + hash_len ); if( ret != 0 ) return( ret ); - ret = mbedtls_ssl_tls13_derive_secret( md_type, - application_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + application_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_ap_traffic ), transcript, transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->server_application_traffic_secret_N, - md_size ); + hash_len ); if( ret != 0 ) return( ret ); - ret = mbedtls_ssl_tls13_derive_secret( md_type, - application_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + application_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( exp_master ), transcript, transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->exporter_master_secret, - md_size ); + hash_len ); if( ret != 0 ) return( ret ); @@ -715,27 +717,26 @@ int mbedtls_ssl_tls13_derive_application_secrets( * This is not integrated with mbedtls_ssl_tls13_derive_application_secrets() * because it uses the transcript hash up to and including ClientFinished. */ int mbedtls_ssl_tls13_derive_resumption_master_secret( - mbedtls_md_type_t md_type, + psa_algorithm_t hash_alg, unsigned char const *application_secret, unsigned char const *transcript, size_t transcript_len, mbedtls_ssl_tls13_application_secrets *derived ) { int ret; - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); + size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); /* We should never call this function with an unknown hash, * but add an assertion anyway. */ - if( md_info == 0 ) + if( ! PSA_ALG_IS_HASH( hash_alg ) ) return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); - ret = mbedtls_ssl_tls13_derive_secret( md_type, - application_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + application_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_master ), transcript, transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->resumption_master_secret, - md_size ); + hash_len ); if( ret != 0 ) return( ret ); @@ -747,16 +748,13 @@ int mbedtls_ssl_tls13_key_schedule_stage_application( mbedtls_ssl_context *ssl ) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; mbedtls_ssl_handshake_params *handshake = ssl->handshake; - mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac; -#if defined(MBEDTLS_DEBUG_C) - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); -#endif /* MBEDTLS_DEBUG_C */ + psa_algorithm_t const hash_alg = mbedtls_psa_translate_md( + handshake->ciphersuite_info->mac ); /* * Compute MasterSecret */ - ret = mbedtls_ssl_tls13_evolve_secret( md_type, + ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, handshake->tls13_master_secrets.handshake, NULL, 0, handshake->tls13_master_secrets.app ); @@ -767,24 +765,28 @@ int mbedtls_ssl_tls13_key_schedule_stage_application( mbedtls_ssl_context *ssl ) } MBEDTLS_SSL_DEBUG_BUF( 4, "Master secret", - handshake->tls13_master_secrets.app, md_size ); + handshake->tls13_master_secrets.app, PSA_HASH_LENGTH( hash_alg ) ); return( 0 ); } -static int ssl_tls13_calc_finished_core( mbedtls_md_type_t md_type, +static int ssl_tls13_calc_finished_core( psa_algorithm_t hash_alg, unsigned char const *base_key, unsigned char const *transcript, - unsigned char *dst ) + unsigned char *dst, + size_t *dst_len ) { - const mbedtls_md_info_t* const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); - unsigned char finished_key[MBEDTLS_MD_MAX_SIZE]; + mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; + size_t hash_len = PSA_HASH_LENGTH( hash_alg ); + unsigned char finished_key[PSA_MAC_MAX_SIZE]; int ret; + psa_algorithm_t alg; /* We should never call this function with an unknown hash, * but add an assertion anyway. */ - if( md_info == 0 ) + if( ! PSA_ALG_IS_HASH( hash_alg ) ) return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); /* TLS 1.3 Finished message @@ -805,20 +807,37 @@ static int ssl_tls13_calc_finished_core( mbedtls_md_type_t md_type, */ ret = mbedtls_ssl_tls13_hkdf_expand_label( - md_type, base_key, md_size, + hash_alg, base_key, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( finished ), NULL, 0, - finished_key, md_size ); + finished_key, hash_len ); if( ret != 0 ) goto exit; - ret = mbedtls_md_hmac( md_info, finished_key, md_size, transcript, md_size, dst ); - if( ret != 0 ) + alg = PSA_ALG_HMAC( hash_alg ); + psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE ); + psa_set_key_algorithm( &attributes, alg ); + psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC ); + + status = psa_import_key( &attributes, finished_key, hash_len, &key ); + if( status != PSA_SUCCESS ) + { + ret = psa_ssl_status_to_mbedtls( status ); goto exit; + } + + status = psa_mac_compute( key, alg, transcript, hash_len, + dst, hash_len, dst_len ); + ret = psa_ssl_status_to_mbedtls( status ); exit: + status = psa_destroy_key( key ); + if( ret == 0 ) + ret = psa_ssl_status_to_mbedtls( status ); + mbedtls_platform_zeroize( finished_key, sizeof( finished_key ) ); + return( ret ); } @@ -839,9 +858,10 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl, &ssl->handshake->tls13_hs_secrets; mbedtls_md_type_t const md_type = ssl->handshake->ciphersuite_info->mac; - const mbedtls_md_info_t* const md_info = - mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); + + psa_algorithm_t hash_alg = mbedtls_psa_translate_md( + ssl->handshake->ciphersuite_info->mac ); + size_t const hash_lem = PSA_HASH_LENGTH( hash_alg ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_tls13_calculate_verify_data" ) ); @@ -856,7 +876,7 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl, base_key_len = sizeof( tls13_hs_secrets->server_handshake_traffic_secret ); } - if( dst_len < md_size ) + if( dst_len < hash_lem ) { ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; goto exit; @@ -872,12 +892,11 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl, } MBEDTLS_SSL_DEBUG_BUF( 4, "handshake hash", transcript, transcript_len ); - ret = ssl_tls13_calc_finished_core( md_type, base_key, transcript, dst ); + ret = ssl_tls13_calc_finished_core( hash_alg, base_key, transcript, dst, actual_len ); if( ret != 0 ) goto exit; - *actual_len = md_size; - MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, md_size ); + MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, hash_lem ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls13_calculate_verify_data" ) ); exit: @@ -888,7 +907,7 @@ exit: } int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, - const mbedtls_md_type_t md_type, + const psa_algorithm_t hash_alg, unsigned char const *psk, size_t psk_len, int psk_type, unsigned char const *transcript, @@ -897,8 +916,8 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, int ret = 0; unsigned char binder_key[MBEDTLS_MD_MAX_SIZE]; unsigned char early_secret[MBEDTLS_MD_MAX_SIZE]; - mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); + size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); + size_t actual_len; #if !defined(MBEDTLS_DEBUG_C) ssl = NULL; /* make sure we don't use it except for debug */ @@ -907,7 +926,7 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, /* We should never call this function with an unknown hash, * but add an assertion anyway. */ - if( md_info == 0 ) + if( ! PSA_ALG_IS_HASH( hash_alg ) ) return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); /* @@ -921,7 +940,7 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, * v */ - ret = mbedtls_ssl_tls13_evolve_secret( md_type, + ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, NULL, /* Old secret */ psk, psk_len, /* Input */ early_secret ); @@ -933,20 +952,20 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, if( psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION ) { - ret = mbedtls_ssl_tls13_derive_secret( md_type, - early_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + early_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_binder ), NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, - binder_key, md_size ); + binder_key, hash_len ); MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'res binder'" ) ); } else { - ret = mbedtls_ssl_tls13_derive_secret( md_type, - early_secret, md_size, + ret = mbedtls_ssl_tls13_derive_secret( hash_alg, + early_secret, hash_len, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( ext_binder ), NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, - binder_key, md_size ); + binder_key, hash_len ); MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'ext binder'" ) ); } @@ -961,11 +980,12 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, * but with the BaseKey being the binder_key. */ - ret = ssl_tls13_calc_finished_core( md_type, binder_key, transcript, result ); + ret = ssl_tls13_calc_finished_core( hash_alg, binder_key, transcript, + result, &actual_len ); if( ret != 0 ) goto exit; - MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder", result, md_size ); + MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder", result, actual_len ); exit: @@ -1155,7 +1175,7 @@ int mbedtls_ssl_tls13_populate_transform( mbedtls_ssl_transform *transform, int mbedtls_ssl_tls13_key_schedule_stage_early( mbedtls_ssl_context *ssl ) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_md_type_t md_type; + psa_algorithm_t hash_alg; mbedtls_ssl_handshake_params *handshake = ssl->handshake; if( handshake->ciphersuite_info == NULL ) @@ -1164,9 +1184,9 @@ int mbedtls_ssl_tls13_key_schedule_stage_early( mbedtls_ssl_context *ssl ) return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); } - md_type = handshake->ciphersuite_info->mac; + hash_alg = mbedtls_psa_translate_md( handshake->ciphersuite_info->mac ); - ret = mbedtls_ssl_tls13_evolve_secret( md_type, NULL, NULL, 0, + ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, NULL, NULL, 0, handshake->tls13_master_secrets.early ); if( ret != 0 ) { @@ -1185,8 +1205,9 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl, int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; mbedtls_md_type_t md_type; - mbedtls_md_info_t const *md_info; - size_t md_size; + + psa_algorithm_t hash_alg; + size_t hash_len; unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE]; size_t transcript_len; @@ -1205,8 +1226,9 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl, iv_len = cipher_info->iv_size; md_type = ciphersuite_info->mac; - md_info = mbedtls_md_info_from_type( md_type ); - md_size = mbedtls_md_get_size( md_info ); + + hash_alg = mbedtls_psa_translate_md( ciphersuite_info->mac ); + hash_len = PSA_HASH_LENGTH( hash_alg ); ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type, transcript, @@ -1220,7 +1242,7 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl, return( ret ); } - ret = mbedtls_ssl_tls13_derive_handshake_secrets( md_type, + ret = mbedtls_ssl_tls13_derive_handshake_secrets( hash_alg, handshake->tls13_master_secrets.handshake, transcript, transcript_len, tls13_hs_secrets ); if( ret != 0 ) @@ -1232,10 +1254,10 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl, MBEDTLS_SSL_DEBUG_BUF( 4, "Client handshake traffic secret", tls13_hs_secrets->client_handshake_traffic_secret, - md_size ); + hash_len ); MBEDTLS_SSL_DEBUG_BUF( 4, "Server handshake traffic secret", tls13_hs_secrets->server_handshake_traffic_secret, - md_size ); + hash_len ); /* * Export client handshake traffic secret @@ -1245,7 +1267,7 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl, ssl->f_export_keys( ssl->p_export_keys, MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET, tls13_hs_secrets->client_handshake_traffic_secret, - md_size, + hash_len, handshake->randbytes, handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ ); @@ -1253,16 +1275,16 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl, ssl->f_export_keys( ssl->p_export_keys, MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET, tls13_hs_secrets->server_handshake_traffic_secret, - md_size, + hash_len, handshake->randbytes, handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ ); } - ret = mbedtls_ssl_tls13_make_traffic_keys( md_type, + ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg, tls13_hs_secrets->client_handshake_traffic_secret, tls13_hs_secrets->server_handshake_traffic_secret, - md_size, key_len, iv_len, traffic_keys ); + hash_len, key_len, iv_len, traffic_keys ); if( ret != 0 ) { MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret ); @@ -1299,11 +1321,8 @@ int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl ) psa_status_t status = PSA_ERROR_GENERIC_ERROR; #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED && MBEDTLS_ECDH_C */ mbedtls_ssl_handshake_params *handshake = ssl->handshake; - mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac; -#if defined(MBEDTLS_DEBUG_C) - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); -#endif /* MBEDTLS_DEBUG_C */ + psa_algorithm_t const hash_alg = mbedtls_psa_translate_md( + handshake->ciphersuite_info->mac ); #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) /* @@ -1353,7 +1372,7 @@ int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl ) /* * Compute the Handshake Secret */ - ret = mbedtls_ssl_tls13_evolve_secret( md_type, + ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, handshake->tls13_master_secrets.early, handshake->premaster, handshake->pmslen, handshake->tls13_master_secrets.handshake ); @@ -1364,7 +1383,8 @@ int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl ) } MBEDTLS_SSL_DEBUG_BUF( 4, "Handshake secret", - handshake->tls13_master_secrets.handshake, md_size ); + handshake->tls13_master_secrets.handshake, + PSA_HASH_LENGTH( hash_alg ) ); #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) mbedtls_platform_zeroize( handshake->premaster, sizeof( handshake->premaster ) ); @@ -1392,8 +1412,9 @@ int mbedtls_ssl_tls13_generate_application_keys( /* Variables relating to the hash for the chosen ciphersuite. */ mbedtls_md_type_t md_type; - mbedtls_md_info_t const *md_info; - size_t md_size; + + psa_algorithm_t hash_alg; + size_t hash_len; /* Variables relating to the cipher for the chosen ciphersuite. */ mbedtls_cipher_info_t const *cipher_info; @@ -1409,8 +1430,9 @@ int mbedtls_ssl_tls13_generate_application_keys( iv_len = cipher_info->iv_size; md_type = handshake->ciphersuite_info->mac; - md_info = mbedtls_md_info_from_type( md_type ); - md_size = mbedtls_md_get_size( md_info ); + + hash_alg = mbedtls_psa_translate_md( handshake->ciphersuite_info->mac ); + hash_len = PSA_HASH_LENGTH( hash_alg ); /* Compute current handshake transcript. It's the caller's responsiblity * to call this at the right time, that is, after the ServerFinished. */ @@ -1423,7 +1445,7 @@ int mbedtls_ssl_tls13_generate_application_keys( /* Compute application secrets from master secret and transcript hash. */ - ret = mbedtls_ssl_tls13_derive_application_secrets( md_type, + ret = mbedtls_ssl_tls13_derive_application_secrets( hash_alg, handshake->tls13_master_secrets.app, transcript, transcript_len, app_secrets ); @@ -1439,10 +1461,10 @@ int mbedtls_ssl_tls13_generate_application_keys( /* Derive first epoch of IV + Key for application traffic. */ - ret = mbedtls_ssl_tls13_make_traffic_keys( md_type, + ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg, app_secrets->client_application_traffic_secret_N, app_secrets->server_application_traffic_secret_N, - md_size, key_len, iv_len, traffic_keys ); + hash_len, key_len, iv_len, traffic_keys ); if( ret != 0 ) { MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret ); @@ -1451,11 +1473,11 @@ int mbedtls_ssl_tls13_generate_application_keys( MBEDTLS_SSL_DEBUG_BUF( 4, "Client application traffic secret", app_secrets->client_application_traffic_secret_N, - md_size ); + hash_len ); MBEDTLS_SSL_DEBUG_BUF( 4, "Server application traffic secret", app_secrets->server_application_traffic_secret_N, - md_size ); + hash_len ); /* * Export client/server application traffic secret 0 @@ -1464,7 +1486,7 @@ int mbedtls_ssl_tls13_generate_application_keys( { ssl->f_export_keys( ssl->p_export_keys, MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET, - app_secrets->client_application_traffic_secret_N, md_size, + app_secrets->client_application_traffic_secret_N, hash_len, handshake->randbytes, handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by @@ -1472,7 +1494,7 @@ int mbedtls_ssl_tls13_generate_application_keys( ssl->f_export_keys( ssl->p_export_keys, MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET, - app_secrets->server_application_traffic_secret_N, md_size, + app_secrets->server_application_traffic_secret_N, hash_len, handshake->randbytes, handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by diff --git a/library/ssl_tls13_keys.h b/library/ssl_tls13_keys.h index da967c398..928fa5850 100644 --- a/library/ssl_tls13_keys.h +++ b/library/ssl_tls13_keys.h @@ -114,7 +114,7 @@ extern const struct mbedtls_ssl_tls13_labels_struct mbedtls_ssl_tls13_labels; */ int mbedtls_ssl_tls13_hkdf_expand_label( - mbedtls_md_type_t hash_alg, + psa_algorithm_t hash_alg, const unsigned char *secret, size_t secret_len, const unsigned char *label, size_t label_len, const unsigned char *ctx, size_t ctx_len, @@ -152,7 +152,7 @@ int mbedtls_ssl_tls13_hkdf_expand_label( */ int mbedtls_ssl_tls13_make_traffic_keys( - mbedtls_md_type_t hash_alg, + psa_algorithm_t hash_alg, const unsigned char *client_secret, const unsigned char *server_secret, size_t secret_len, size_t key_len, size_t iv_len, @@ -202,7 +202,7 @@ int mbedtls_ssl_tls13_make_traffic_keys( * \returns A negative error code on failure. */ int mbedtls_ssl_tls13_derive_secret( - mbedtls_md_type_t hash_alg, + psa_algorithm_t hash_alg, const unsigned char *secret, size_t secret_len, const unsigned char *label, size_t label_len, const unsigned char *ctx, size_t ctx_len, @@ -235,14 +235,14 @@ int mbedtls_ssl_tls13_derive_secret( * is omitted here. Its calculation is part of the separate routine * mbedtls_ssl_tls13_create_psk_binder(). * - * \param md_type The hash algorithm associated with the PSK for which + * \param hash_alg The hash algorithm associated with the PSK for which * early data key material is being derived. * \param early_secret The early secret from which the early data key material * should be derived. This must be a readable buffer whose * length is the digest size of the hash algorithm * represented by \p md_size. * \param transcript The transcript of the handshake so far, calculated with - * respect to \p md_type. This must be a readable buffer + * respect to \p hash_alg. This must be a readable buffer * whose length is the digest size of the hash algorithm * represented by \p md_size. * \param derived The address of the structure in which to store @@ -252,7 +252,7 @@ int mbedtls_ssl_tls13_derive_secret( * \returns A negative error code on failure. */ int mbedtls_ssl_tls13_derive_early_secrets( - mbedtls_md_type_t md_type, + psa_algorithm_t hash_alg, unsigned char const *early_secret, unsigned char const *transcript, size_t transcript_len, mbedtls_ssl_tls13_early_secrets *derived ); @@ -280,14 +280,14 @@ int mbedtls_ssl_tls13_derive_early_secrets( * the client and server secret derived by this function need to be * further processed by mbedtls_ssl_tls13_make_traffic_keys(). * - * \param md_type The hash algorithm associated with the ciphersuite + * \param hash_alg The hash algorithm associated with the ciphersuite * that's being used for the connection. * \param handshake_secret The handshake secret from which the handshake key * material should be derived. This must be a readable * buffer whose length is the digest size of the hash * algorithm represented by \p md_size. * \param transcript The transcript of the handshake so far, calculated - * with respect to \p md_type. This must be a readable + * with respect to \p hash_alg. This must be a readable * buffer whose length is the digest size of the hash * algorithm represented by \p md_size. * \param derived The address of the structure in which to @@ -297,7 +297,7 @@ int mbedtls_ssl_tls13_derive_early_secrets( * \returns A negative error code on failure. */ int mbedtls_ssl_tls13_derive_handshake_secrets( - mbedtls_md_type_t md_type, + psa_algorithm_t hash_alg, unsigned char const *handshake_secret, unsigned char const *transcript, size_t transcript_len, mbedtls_ssl_tls13_handshake_secrets *derived ); @@ -329,7 +329,7 @@ int mbedtls_ssl_tls13_derive_handshake_secrets( * the client and server secret derived by this function need to be * further processed by mbedtls_ssl_tls13_make_traffic_keys(). * - * \param md_type The hash algorithm associated with the ciphersuite + * \param hash_alg The hash algorithm associated with the ciphersuite * that's being used for the connection. * \param master_secret The master secret from which the application key * material should be derived. This must be a readable @@ -337,9 +337,9 @@ int mbedtls_ssl_tls13_derive_handshake_secrets( * algorithm represented by \p md_size. * \param transcript The transcript of the handshake up to and including * the ServerFinished message, calculated with respect - * to \p md_type. This must be a readable buffer whose + * to \p hash_alg. This must be a readable buffer whose * length is the digest size of the hash algorithm - * represented by \p md_type. + * represented by \p hash_alg. * \param derived The address of the structure in which to * store the application key material. * @@ -347,7 +347,7 @@ int mbedtls_ssl_tls13_derive_handshake_secrets( * \returns A negative error code on failure. */ int mbedtls_ssl_tls13_derive_application_secrets( - mbedtls_md_type_t md_type, + psa_algorithm_t hash_alg, unsigned char const *master_secret, unsigned char const *transcript, size_t transcript_len, mbedtls_ssl_tls13_application_secrets *derived ); @@ -358,7 +358,7 @@ int mbedtls_ssl_tls13_derive_application_secrets( * This is a small wrapper invoking mbedtls_ssl_tls13_derive_secret() * with the appropriate labels from the standard. * - * \param md_type The hash algorithm used in the application for which + * \param hash_alg The hash algorithm used in the application for which * key material is being derived. * \param application_secret The application secret from which the resumption master * secret should be derived. This must be a readable @@ -366,9 +366,9 @@ int mbedtls_ssl_tls13_derive_application_secrets( * algorithm represented by \p md_size. * \param transcript The transcript of the handshake up to and including * the ClientFinished message, calculated with respect - * to \p md_type. This must be a readable buffer whose + * to \p hash_alg. This must be a readable buffer whose * length is the digest size of the hash algorithm - * represented by \p md_type. + * represented by \p hash_alg. * \param transcript_len The length of \p transcript in Bytes. * \param derived The address of the structure in which to * store the resumption master secret. @@ -377,7 +377,7 @@ int mbedtls_ssl_tls13_derive_application_secrets( * \returns A negative error code on failure. */ int mbedtls_ssl_tls13_derive_resumption_master_secret( - mbedtls_md_type_t md_type, + psa_algorithm_t hash_alg, unsigned char const *application_secret, unsigned char const *transcript, size_t transcript_len, mbedtls_ssl_tls13_application_secrets *derived ); @@ -450,7 +450,7 @@ int mbedtls_ssl_tls13_derive_resumption_master_secret( */ int mbedtls_ssl_tls13_evolve_secret( - mbedtls_md_type_t hash_alg, + psa_algorithm_t hash_alg, const unsigned char *secret_old, const unsigned char *input, size_t input_len, unsigned char *secret_new ); @@ -463,7 +463,7 @@ int mbedtls_ssl_tls13_evolve_secret( * * \param ssl The SSL context. This is used for debugging only and may * be \c NULL if MBEDTLS_DEBUG_C is disabled. - * \param md_type The hash algorithm associated to the PSK \p psk. + * \param hash_alg The hash algorithm associated to the PSK \p psk. * \param psk The buffer holding the PSK for which to create a binder. * \param psk_len The size of \p psk in bytes. * \param psk_type This indicates whether the PSK \p psk is externally @@ -472,17 +472,17 @@ int mbedtls_ssl_tls13_evolve_secret( * \param transcript The handshake transcript up to the point where the * PSK binder calculation happens. This must be readable, * and its size must be equal to the digest size of - * the hash algorithm represented by \p md_type. + * the hash algorithm represented by \p hash_alg. * \param result The address at which to store the PSK binder on success. * This must be writable, and its size must be equal to the * digest size of the hash algorithm represented by - * \p md_type. + * \p hash_alg. * * \returns \c 0 on success. * \returns A negative error code on failure. */ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, - const mbedtls_md_type_t md_type, + const psa_algorithm_t hash_alg, unsigned char const *psk, size_t psk_len, int psk_type, unsigned char const *transcript, diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 0c6e3133e..438345459 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -4379,18 +4379,20 @@ ssl_decrypt_non_etm_cbc:MBEDTLS_CIPHER_CAMELLIA_128_CBC:MBEDTLS_MD_SHA384:1:255 SSL TLS 1.3 Key schedule: Secret evolution #1 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Initial secret to Early Secret -depends_on:MBEDTLS_SSL_PROTO_TLS1_3 -ssl_tls13_key_evolution:MBEDTLS_MD_SHA256:"":"":"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_key_evolution:PSA_ALG_SHA_256:"":"":"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a" SSL TLS 1.3 Key schedule: Secret evolution #2 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Early secret to Handshake Secret -ssl_tls13_key_evolution:MBEDTLS_MD_SHA256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":"df4a291baa1eb7cfa6934b29b474baad2697e29f1f920dcc77c8a0a088447624":"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_key_evolution:PSA_ALG_SHA_256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":"df4a291baa1eb7cfa6934b29b474baad2697e29f1f920dcc77c8a0a088447624":"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a" SSL TLS 1.3 Key schedule: Secret evolution #3 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Handshake secret to Master Secret -ssl_tls13_key_evolution:MBEDTLS_MD_SHA256:"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a":"":"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_key_evolution:PSA_ALG_SHA_256:"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a":"":"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #1 Extract depends_on:PSA_WANT_ALG_SHA_256 @@ -4477,120 +4479,144 @@ SSL TLS 1.3 Key schedule: HKDF Expand Label #1 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Server handshake traffic secret -> Server traffic key # HKDF-Expand-Label(server_handshake_secret, "key", "", 16) -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_key:"":16:"844780a7acad9f980fa25c114e43402a" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_key:"":16:"844780a7acad9f980fa25c114e43402a" SSL TLS 1.3 Key schedule: HKDF Expand Label #2 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Server handshake traffic secret -> Server traffic IV # HKDF-Expand-Label(server_handshake_secret, "iv", "", 12) -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_iv:"":12:"4c042ddc120a38d1417fc815" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_iv:"":12:"4c042ddc120a38d1417fc815" SSL TLS 1.3 Key schedule: HKDF Expand Label #3 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Client handshake traffic secret -> Client traffic key # HKDF-Expand-Label(client_handshake_secret, "key", "", 16) -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_key:"":16:"7154f314e6be7dc008df2c832baa1d39" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_key:"":16:"7154f314e6be7dc008df2c832baa1d39" SSL TLS 1.3 Key schedule: HKDF Expand Label #4 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Client handshake traffic secret -> Client traffic IV # HKDF-Expand-Label(client_handshake_secret, "iv", "", 12) -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_iv:"":12:"71abc2cae4c699d47c600268" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_iv:"":12:"71abc2cae4c699d47c600268" SSL TLS 1.3 Key schedule: HKDF Expand Label #5 (RFC 8448) # Vector from RFC 8448 # Server handshake traffic secret -> Server traffic IV # HKDF-Expand-Label(server_handshake_secret, "iv", "", 12) -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_iv:"":12:"5d313eb2671276ee13000b30" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_iv:"":12:"5d313eb2671276ee13000b30" SSL TLS 1.3 Key schedule: HKDF Expand Label #6 (RFC 8448) # Vector from RFC 8448 # Server handshake traffic secret -> Server traffic Key # HKDF-Expand-Label(server_handshake_secret, "key", "", 16) -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_key:"":16:"3fce516009c21727d0f2e4e86ee403bc" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_key:"":16:"3fce516009c21727d0f2e4e86ee403bc" SSL TLS 1.3 Key schedule: HKDF Expand Label #7 (RFC 8448) # Vector from RFC 8448 # Client handshake traffic secret -> Client traffic IV # HKDF-Expand-Label(client_handshake_secret, "iv", "", 12) -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_iv:"":12:"5bd3c71b836e0b76bb73265f" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_iv:"":12:"5bd3c71b836e0b76bb73265f" SSL TLS 1.3 Key schedule: HKDF Expand Label #8 (RFC 8448) # Vector from RFC 8448 # Client handshake traffic secret -> Client traffic Key # HKDF-Expand-Label(client_handshake_secret, "key", "", 16) -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_key:"":16:"dbfaa693d1762c5b666af5d950258d01" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_key:"":16:"dbfaa693d1762c5b666af5d950258d01" SSL TLS 1.3 Key schedule: HKDF Expand Label #9 (RFC 8448) # Calculation of finished_key -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":tls13_label_finished:"":32:"5ace394c26980d581243f627d1150ae27e37fa52364e0a7f20ac686d09cd0e8e" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":tls13_label_finished:"":32:"5ace394c26980d581243f627d1150ae27e37fa52364e0a7f20ac686d09cd0e8e" SSL TLS 1.3 Key schedule: HKDF Expand Label #10 (RFC 8448) # Calculation of resumption key -ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"7df235f2031d2a051287d02b0241b0bfdaf86cc856231f2d5aba46c434ec196c":tls13_label_resumption:"0000":32:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"7df235f2031d2a051287d02b0241b0bfdaf86cc856231f2d5aba46c434ec196c":tls13_label_resumption:"0000":32:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3" SSL TLS 1.3 Key schedule: Traffic key generation #1 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Client/Server handshake traffic secrets -> Client/Server traffic {Key,IV} -ssl_tls13_traffic_key_generation:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_traffic_key_generation:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268" SSL TLS 1.3 Key schedule: Traffic key generation #2 (RFC 8448) # Vector RFC 8448 # Client/Server handshake traffic secrets -> Client/Server traffic {Key,IV} -ssl_tls13_traffic_key_generation:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_traffic_key_generation:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268" SSL TLS 1.3 Key schedule: Derive-Secret( ., "derived", "") # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Derive-Secret( Early-Secret, "derived", "") # Tests the case where context isn't yet hashed (empty string here, # but still needs to be hashed) -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":tls13_label_derived:"":32:MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED:"6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":tls13_label_derived:"":32:MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED:"6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba" SSL TLS 1.3 Key schedule: Derive-Secret( ., "s ap traffic", hash) #1 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Derive-Secret( MasterSecret, "s ap traffic", hash) # Tests the case where context is already hashed -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d":tls13_label_s_ap_traffic:"22844b930e5e0a59a09d5ac35fc032fc91163b193874a265236e568077378d8b":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fc35ea70693069a277956afa23b8f4543ce68ac595f2aace05cd7a1c92023d5" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d":tls13_label_s_ap_traffic:"22844b930e5e0a59a09d5ac35fc032fc91163b193874a265236e568077378d8b":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fc35ea70693069a277956afa23b8f4543ce68ac595f2aace05cd7a1c92023d5" SSL TLS 1.3 Key schedule: Derive-Secret( ., "c e traffic", hash) # Vector from RFC 8448 -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_c_e_traffic:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_c_e_traffic:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62" SSL TLS 1.3 Key schedule: Derive-Secret( ., "e exp master", hash) # Vector from RFC 8448 -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_e_exp_master:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_e_exp_master:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df" SSL TLS 1.3 Key schedule: Derive-Secret( ., "c hs traffic", hash) # Vector from RFC 8448 -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_c_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_c_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f" SSL TLS 1.3 Key schedule: Derive-Secret( ., "s hs traffic", hash) # Vector from RFC 8448 -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_s_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_s_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803" SSL TLS 1.3 Key schedule: Derive-Secret( ., "c ap traffic", hash) # Vector from RFC 8448 -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_c_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_c_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1" SSL TLS 1.3 Key schedule: Derive-Secret( ., "s ap traffic", hash) #2 # Vector from RFC 8448 -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_s_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_s_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691" SSL TLS 1.3 Key schedule: Derive-Secret( ., "exp master", hash) # Vector from RFC 8448 -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_exp_master:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_exp_master:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4" SSL TLS 1.3 Key schedule: Derive-Secret( ., "res master", hash) # Vector from RFC 8448 -ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_res_master:"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_res_master:"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406" SSL TLS 1.3 Key schedule: Early secrets derivation helper # Vector from RFC 8448 -ssl_tls13_derive_early_secrets:MBEDTLS_MD_SHA256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62":"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_early_secrets:PSA_ALG_SHA_256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62":"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df" SSL TLS 1.3 Key schedule: Handshake secrets derivation helper # Vector from RFC 8448 -ssl_tls13_derive_handshake_secrets:MBEDTLS_MD_SHA256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_handshake_secrets:PSA_ALG_SHA_256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803" SSL TLS 1.3 Record Encryption, tls13.ulfheim.net Example #1 # - Server App Key: 0b6d22c8ff68097ea871c672073773bf @@ -4650,17 +4676,20 @@ ssl_tls13_record_protection:MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:MBED SSL TLS 1.3 Key schedule: Application secrets derivation helper # Vector from RFC 8448 -ssl_tls13_derive_application_secrets:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1":"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691":"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_application_secrets:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1":"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691":"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4" SSL TLS 1.3 Key schedule: Resumption secrets derivation helper # Vector from RFC 8448 -ssl_tls13_derive_resumption_secrets:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_derive_resumption_secrets:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406" SSL TLS 1.3 Key schedule: PSK binder # Vector from RFC 8448 # For the resumption PSK, see Section 3, 'generate resumption secret "tls13 resumption"' # For all other data, see Section 4, 'construct a ClientHello handshake message:' -ssl_tls13_create_psk_binder:MBEDTLS_MD_SHA256:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3":MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:"63224b2e4573f2d3454ca84b9d009a04f6be9e05711a8396473aefa01e924a14":"3add4fb2d8fdf822a0ca3cf7678ef5e88dae990141c5924d57bb6fa31b9e5f9d" +depends_on:PSA_WANT_ALG_SHA_256 +ssl_tls13_create_psk_binder:PSA_ALG_SHA_256:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3":MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:"63224b2e4573f2d3454ca84b9d009a04f6be9e05711a8396473aefa01e924a14":"3add4fb2d8fdf822a0ca3cf7678ef5e88dae990141c5924d57bb6fa31b9e5f9d" SSL TLS_PRF MBEDTLS_SSL_TLS_PRF_NONE ssl_tls_prf:MBEDTLS_SSL_TLS_PRF_NONE:"":"":"test tls_prf label":"":MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 81a0f48a0..cc7baba76 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4065,7 +4065,7 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_hkdf_expand_label( - (mbedtls_md_type_t) hash_alg, + (psa_algorithm_t) hash_alg, secret->x, secret->len, lbl, lbl_len, ctx->x, ctx->len, @@ -4101,7 +4101,7 @@ void ssl_tls13_traffic_key_generation( int hash_alg, PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_make_traffic_keys( - (mbedtls_md_type_t) hash_alg, + (psa_algorithm_t) hash_alg, client_secret->x, server_secret->x, client_secret->len /* == server_secret->len */, @@ -4159,7 +4159,7 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_secret( - (mbedtls_md_type_t) hash_alg, + (psa_algorithm_t) hash_alg, secret->x, secret->len, lbl, lbl_len, ctx->x, ctx->len, @@ -4183,24 +4183,23 @@ void ssl_tls13_derive_early_secrets( int hash_alg, mbedtls_ssl_tls13_early_secrets secrets; /* Double-check that we've passed sane parameters. */ - mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); - TEST_ASSERT( md_info != 0 && - secret->len == md_size && - transcript->len == md_size && - traffic_expected->len == md_size && - exporter_expected->len == md_size ); + psa_algorithm_t alg = (psa_algorithm_t) hash_alg; + size_t const hash_len = PSA_HASH_LENGTH( alg ); + TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && + secret->len == hash_len && + transcript->len == hash_len && + traffic_expected->len == hash_len && + exporter_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_early_secrets( - md_type, secret->x, transcript->x, transcript->len, + alg, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); - ASSERT_COMPARE( secrets.client_early_traffic_secret, md_size, + ASSERT_COMPARE( secrets.client_early_traffic_secret, hash_len, traffic_expected->x, traffic_expected->len ); - ASSERT_COMPARE( secrets.early_exporter_master_secret, md_size, + ASSERT_COMPARE( secrets.early_exporter_master_secret, hash_len, exporter_expected->x, exporter_expected->len ); PSA_DONE( ); @@ -4217,24 +4216,23 @@ void ssl_tls13_derive_handshake_secrets( int hash_alg, mbedtls_ssl_tls13_handshake_secrets secrets; /* Double-check that we've passed sane parameters. */ - mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); - TEST_ASSERT( md_info != 0 && - secret->len == md_size && - transcript->len == md_size && - client_expected->len == md_size && - server_expected->len == md_size ); + psa_algorithm_t alg = (psa_algorithm_t) hash_alg; + size_t const hash_len = PSA_HASH_LENGTH( alg ); + TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && + secret->len == hash_len && + transcript->len == hash_len && + client_expected->len == hash_len && + server_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_handshake_secrets( - md_type, secret->x, transcript->x, transcript->len, + alg, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); - ASSERT_COMPARE( secrets.client_handshake_traffic_secret, md_size, + ASSERT_COMPARE( secrets.client_handshake_traffic_secret, hash_len, client_expected->x, client_expected->len ); - ASSERT_COMPARE( secrets.server_handshake_traffic_secret, md_size, + ASSERT_COMPARE( secrets.server_handshake_traffic_secret, hash_len, server_expected->x, server_expected->len ); PSA_DONE( ); @@ -4252,27 +4250,26 @@ void ssl_tls13_derive_application_secrets( int hash_alg, mbedtls_ssl_tls13_application_secrets secrets; /* Double-check that we've passed sane parameters. */ - mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); - TEST_ASSERT( md_info != 0 && - secret->len == md_size && - transcript->len == md_size && - client_expected->len == md_size && - server_expected->len == md_size && - exporter_expected->len == md_size ); + psa_algorithm_t alg = (psa_algorithm_t) hash_alg; + size_t const hash_len = PSA_HASH_LENGTH( alg ); + TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && + secret->len == hash_len && + transcript->len == hash_len && + client_expected->len == hash_len && + server_expected->len == hash_len && + exporter_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_application_secrets( - md_type, secret->x, transcript->x, transcript->len, + alg, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); - ASSERT_COMPARE( secrets.client_application_traffic_secret_N, md_size, + ASSERT_COMPARE( secrets.client_application_traffic_secret_N, hash_len, client_expected->x, client_expected->len ); - ASSERT_COMPARE( secrets.server_application_traffic_secret_N, md_size, + ASSERT_COMPARE( secrets.server_application_traffic_secret_N, hash_len, server_expected->x, server_expected->len ); - ASSERT_COMPARE( secrets.exporter_master_secret, md_size, + ASSERT_COMPARE( secrets.exporter_master_secret, hash_len, exporter_expected->x, exporter_expected->len ); PSA_DONE( ); @@ -4288,21 +4285,20 @@ void ssl_tls13_derive_resumption_secrets( int hash_alg, mbedtls_ssl_tls13_application_secrets secrets; /* Double-check that we've passed sane parameters. */ - mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); - TEST_ASSERT( md_info != 0 && - secret->len == md_size && - transcript->len == md_size && - resumption_expected->len == md_size ); + psa_algorithm_t alg = (psa_algorithm_t) hash_alg; + size_t const hash_len = PSA_HASH_LENGTH( alg ); + TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && + secret->len == hash_len && + transcript->len == hash_len && + resumption_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_resumption_master_secret( - md_type, secret->x, transcript->x, transcript->len, + alg, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); - ASSERT_COMPARE( secrets.resumption_master_secret, md_size, + ASSERT_COMPARE( secrets.resumption_master_secret, hash_len, resumption_expected->x, resumption_expected->len ); PSA_DONE( ); @@ -4319,24 +4315,23 @@ void ssl_tls13_create_psk_binder( int hash_alg, unsigned char binder[ MBEDTLS_MD_MAX_SIZE ]; /* Double-check that we've passed sane parameters. */ - mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; - mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); - size_t const md_size = mbedtls_md_get_size( md_info ); - TEST_ASSERT( md_info != 0 && - transcript->len == md_size && - binder_expected->len == md_size ); + psa_algorithm_t alg = (psa_algorithm_t) hash_alg; + size_t const hash_len = PSA_HASH_LENGTH( alg ); + TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && + transcript->len == hash_len && + binder_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_create_psk_binder( NULL, /* SSL context for debugging only */ - md_type, + alg, psk->x, psk->len, psk_type, transcript->x, binder ) == 0 ); - ASSERT_COMPARE( binder, md_size, + ASSERT_COMPARE( binder, hash_len, binder_expected->x, binder_expected->len ); PSA_DONE( ); @@ -4455,7 +4450,7 @@ void ssl_tls13_key_evolution( int hash_alg, PSA_INIT(); TEST_ASSERT( mbedtls_ssl_tls13_evolve_secret( - (mbedtls_md_type_t) hash_alg, + (psa_algorithm_t) hash_alg, secret->len ? secret->x : NULL, input->len ? input->x : NULL, input->len, secret_new ) == 0 ); From ed6d6589b37998b0b54495872debd9ee6429283f Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Sat, 26 Mar 2022 17:28:06 +0100 Subject: [PATCH 08/13] Use hash algoritm for parameter instead of HMAC To be compatible with the other functions `mbedtls_psa_hkdf_extract` and `mbedtls_psa_hkdf_expand` use hash algorithm for parameter. Signed-off-by: Gabor Mezei --- library/ssl_tls13_invasive.h | 13 ++++------- library/ssl_tls13_keys.c | 14 ++++++----- tests/suites/test_suite_ssl.data | 40 ++++++++++++++------------------ 3 files changed, 30 insertions(+), 37 deletions(-) diff --git a/library/ssl_tls13_invasive.h b/library/ssl_tls13_invasive.h index 8a3a50170..4e39f90cf 100644 --- a/library/ssl_tls13_invasive.h +++ b/library/ssl_tls13_invasive.h @@ -30,10 +30,7 @@ * \brief Take the input keying material \p ikm and extract from it a * fixed-length pseudorandom key \p prk. * - * \param alg The HMAC algorithm to use - * (\c #PSA_ALG_HMAC( PSA_ALG_XXX ) value such that - * PSA_ALG_XXX is a hash algorithm and - * #PSA_ALG_IS_HMAC(\p alg) is true). + * \param hash_alg Hash algorithm to use. * \param salt An optional salt value (a non-secret random value); * if the salt is not provided, a string of all zeros * of the length of the hash provided by \p alg is used @@ -51,7 +48,7 @@ * \return An PSA_ERROR_* error for errors returned from the underlying * PSA layer. */ -psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg, +psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t hash_alg, const unsigned char *salt, size_t salt_len, const unsigned char *ikm, size_t ikm_len, unsigned char *prk, size_t prk_size, @@ -61,9 +58,7 @@ psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg, * \brief Expand the supplied \p prk into several additional pseudorandom * keys, which is the output of the HKDF. * - * \param alg The HMAC algorithm to use (\c #PSA_ALG_HMAC( PSA_ALG_XXX ) - * value such that PSA_ALG_XXX is a hash algorithm and - * #PSA_ALG_IS_HMAC(\p alg) is true). + * \param hash_alg Hash algorithm to use. * \param prk A pseudorandom key of \p prk_len bytes. \p prk is * usually the output from the HKDF extract step. * \param prk_len The length in bytes of \p prk. @@ -80,7 +75,7 @@ psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg, * \return An PSA_ERROR_* error for errors returned from the underlying * PSA layer. */ -psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t alg, +psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t hash_alg, const unsigned char *prk, size_t prk_len, const unsigned char *info, size_t info_len, unsigned char *okm, size_t okm_len ); diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index 2ce654ba8..5c851c712 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -137,7 +137,7 @@ static void ssl_tls13_hkdf_encode_label( } MBEDTLS_STATIC_TESTABLE -psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg, +psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t hash_alg, const unsigned char *salt, size_t salt_len, const unsigned char *ikm, size_t ikm_len, unsigned char *prk, size_t prk_size, @@ -148,6 +148,7 @@ psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg, psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t destroy_status = PSA_ERROR_CORRUPTION_DETECTED; + psa_algorithm_t alg = PSA_ALG_HMAC( hash_alg ); if( salt == NULL || salt_len == 0 ) { @@ -190,7 +191,7 @@ cleanup: } MBEDTLS_STATIC_TESTABLE -psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t alg, +psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t hash_alg, const unsigned char *prk, size_t prk_len, const unsigned char *info, size_t info_len, unsigned char *okm, size_t okm_len ) @@ -206,6 +207,7 @@ psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t alg, psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t destroy_status = PSA_ERROR_CORRUPTION_DETECTED; unsigned char t[PSA_MAC_MAX_SIZE]; + psa_algorithm_t alg = PSA_ALG_HMAC( hash_alg ); if( okm == NULL ) { @@ -350,7 +352,7 @@ int mbedtls_ssl_tls13_hkdf_expand_label( &hkdf_label_len ); return( psa_ssl_status_to_mbedtls( - mbedtls_psa_hkdf_expand( PSA_ALG_HMAC( hash_alg ), + mbedtls_psa_hkdf_expand( hash_alg, secret, secret_len, hkdf_label, hkdf_label_len, buf, buf_len ) ) ); @@ -521,7 +523,7 @@ int mbedtls_ssl_tls13_evolve_secret( * The salt is the old secret, and the input key material * is the input secret (PSK / ECDHE). */ ret = psa_ssl_status_to_mbedtls( - mbedtls_psa_hkdf_extract( PSA_ALG_HMAC( hash_alg ), + mbedtls_psa_hkdf_extract( hash_alg, tmp_secret, hlen, tmp_input, ilen, secret_new, hlen, &secret_len ) ); @@ -914,8 +916,8 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, unsigned char *result ) { int ret = 0; - unsigned char binder_key[MBEDTLS_MD_MAX_SIZE]; - unsigned char early_secret[MBEDTLS_MD_MAX_SIZE]; + unsigned char binder_key[PSA_MAC_MAX_SIZE]; + unsigned char early_secret[PSA_MAC_MAX_SIZE]; size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); size_t actual_len; diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 438345459..b8ca7ffe8 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -4396,84 +4396,80 @@ ssl_tls13_key_evolution:PSA_ALG_SHA_256:"fb9fc80689b3a5d02c33243bf69a1b1b2070558 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #1 Extract depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_256):"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"000102030405060708090a0b0c":"077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5" +psa_hkdf_extract:PSA_ALG_SHA_256:"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"000102030405060708090a0b0c":"077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #2 Extract depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_256):"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f":"606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf":"06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244" +psa_hkdf_extract:PSA_ALG_SHA_256:"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f":"606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf":"06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #3 Extract depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_256):"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"":"19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04" +psa_hkdf_extract:PSA_ALG_SHA_256:"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"":"19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #4 Extract depends_on:PSA_WANT_ALG_SHA_1 -psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_1):"0b0b0b0b0b0b0b0b0b0b0b":"000102030405060708090a0b0c":"9b6c18c432a7bf8f0e71c8eb88f4b30baa2ba243" +psa_hkdf_extract:PSA_ALG_SHA_1:"0b0b0b0b0b0b0b0b0b0b0b":"000102030405060708090a0b0c":"9b6c18c432a7bf8f0e71c8eb88f4b30baa2ba243" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #5 Extract depends_on:PSA_WANT_ALG_SHA_1 -psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_1):"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f":"606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf":"8adae09a2a307059478d309b26c4115a224cfaf6" +psa_hkdf_extract:PSA_ALG_SHA_1:"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f":"606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf":"8adae09a2a307059478d309b26c4115a224cfaf6" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #6 Extract depends_on:PSA_WANT_ALG_SHA_1 -psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_1):"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"":"da8c8a73c7fa77288ec6f5e7c297786aa0d32d01" +psa_hkdf_extract:PSA_ALG_SHA_1:"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"":"da8c8a73c7fa77288ec6f5e7c297786aa0d32d01" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #7 Extract depends_on:PSA_WANT_ALG_SHA_1 -psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_1):"0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c":"":"2adccada18779e7c2077ad2eb19d3f3e731385dd" +psa_hkdf_extract:PSA_ALG_SHA_1:"0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c":"":"2adccada18779e7c2077ad2eb19d3f3e731385dd" SSL TLS 1.3 Key schedule: HKDF extract fails with wrong hash alg psa_hkdf_extract_ret:0:PSA_ERROR_INVALID_ARGUMENT SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #1 Expand depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_256):"f0f1f2f3f4f5f6f7f8f9":"077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5":"3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865" +psa_hkdf_expand:PSA_ALG_SHA_256:"f0f1f2f3f4f5f6f7f8f9":"077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5":"3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #2 Expand depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_256):"b0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff":"06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244":"b11e398dc80327a1c8e7f78c596a49344f012eda2d4efad8a050cc4c19afa97c59045a99cac7827271cb41c65e590e09da3275600c2f09b8367793a9aca3db71cc30c58179ec3e87c14c01d5c1f3434f1d87" +psa_hkdf_expand:PSA_ALG_SHA_256:"b0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff":"06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244":"b11e398dc80327a1c8e7f78c596a49344f012eda2d4efad8a050cc4c19afa97c59045a99cac7827271cb41c65e590e09da3275600c2f09b8367793a9aca3db71cc30c58179ec3e87c14c01d5c1f3434f1d87" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #3 Expand depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_256):"":"19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04":"8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8" +psa_hkdf_expand:PSA_ALG_SHA_256:"":"19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04":"8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #4 Expand depends_on:PSA_WANT_ALG_SHA_1 -psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_1):"f0f1f2f3f4f5f6f7f8f9":"9b6c18c432a7bf8f0e71c8eb88f4b30baa2ba243":"085a01ea1b10f36933068b56efa5ad81a4f14b822f5b091568a9cdd4f155fda2c22e422478d305f3f896" +psa_hkdf_expand:PSA_ALG_SHA_1:"f0f1f2f3f4f5f6f7f8f9":"9b6c18c432a7bf8f0e71c8eb88f4b30baa2ba243":"085a01ea1b10f36933068b56efa5ad81a4f14b822f5b091568a9cdd4f155fda2c22e422478d305f3f896" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #5 Expand depends_on:PSA_WANT_ALG_SHA_1 -psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_1):"b0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff":"8adae09a2a307059478d309b26c4115a224cfaf6":"0bd770a74d1160f7c9f12cd5912a06ebff6adcae899d92191fe4305673ba2ffe8fa3f1a4e5ad79f3f334b3b202b2173c486ea37ce3d397ed034c7f9dfeb15c5e927336d0441f4c4300e2cff0d0900b52d3b4" +psa_hkdf_expand:PSA_ALG_SHA_1:"b0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff":"8adae09a2a307059478d309b26c4115a224cfaf6":"0bd770a74d1160f7c9f12cd5912a06ebff6adcae899d92191fe4305673ba2ffe8fa3f1a4e5ad79f3f334b3b202b2173c486ea37ce3d397ed034c7f9dfeb15c5e927336d0441f4c4300e2cff0d0900b52d3b4" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #6 Expand depends_on:PSA_WANT_ALG_SHA_1 -psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_1):"":"da8c8a73c7fa77288ec6f5e7c297786aa0d32d01":"0ac1af7002b3d761d1e55298da9d0506b9ae52057220a306e07b6b87e8df21d0ea00033de03984d34918" +psa_hkdf_expand:PSA_ALG_SHA_1:"":"da8c8a73c7fa77288ec6f5e7c297786aa0d32d01":"0ac1af7002b3d761d1e55298da9d0506b9ae52057220a306e07b6b87e8df21d0ea00033de03984d34918" SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #7 Expand depends_on:PSA_WANT_ALG_SHA_1 -psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_1):"":"2adccada18779e7c2077ad2eb19d3f3e731385dd":"2c91117204d745f3500d636a62f64f0ab3bae548aa53d423b0d1f27ebba6f5e5673a081d70cce7acfc48" +psa_hkdf_expand:PSA_ALG_SHA_1:"":"2adccada18779e7c2077ad2eb19d3f3e731385dd":"2c91117204d745f3500d636a62f64f0ab3bae548aa53d423b0d1f27ebba6f5e5673a081d70cce7acfc48" SSL TLS 1.3 Key schedule: HKDF expand fails with NULL okm depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_expand_ret:PSA_ALG_HMAC(PSA_ALG_SHA_256):32:0:PSA_ERROR_INVALID_ARGUMENT +psa_hkdf_expand_ret:PSA_ALG_SHA_256:32:0:PSA_ERROR_INVALID_ARGUMENT SSL TLS 1.3 Key schedule: HKDF expand fails with invalid alg psa_hkdf_expand_ret:0:32:32:PSA_ERROR_INVALID_ARGUMENT -SSL TLS 1.3 Key schedule: HKDF expand fails with incompatible alg -depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_expand_ret:PSA_ALG_SHA_256:32:32:PSA_ERROR_INVALID_ARGUMENT - SSL TLS 1.3 Key schedule: HKDF expand fails with prk_len < hash_len depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_expand_ret:PSA_ALG_HMAC(PSA_ALG_SHA_256):16:32:PSA_ERROR_INVALID_ARGUMENT +psa_hkdf_expand_ret:PSA_ALG_SHA_256:16:32:PSA_ERROR_INVALID_ARGUMENT SSL TLS 1.3 Key schedule: HKDF expand fails with okm_len / hash_len > 255 -psa_hkdf_expand_ret:PSA_ALG_HMAC(PSA_ALG_SHA_256):32:8192:PSA_ERROR_INVALID_ARGUMENT +psa_hkdf_expand_ret:PSA_ALG_SHA_256:32:8192:PSA_ERROR_INVALID_ARGUMENT SSL TLS 1.3 Key schedule: HKDF expand fails with key import depends_on:PSA_WANT_ALG_SHA_256 -psa_hkdf_expand_ret:PSA_ALG_HMAC(PSA_ALG_SHA_256):32:32:PSA_ERROR_INSUFFICIENT_MEMORY +psa_hkdf_expand_ret:PSA_ALG_SHA_256:32:32:PSA_ERROR_INSUFFICIENT_MEMORY SSL TLS 1.3 Key schedule: HKDF Expand Label #1 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) From c09437526c09c11dbe908ca9cbf71b975faebc40 Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Tue, 29 Mar 2022 17:08:15 +0200 Subject: [PATCH 09/13] Remove commented out code Signed-off-by: Gabor Mezei --- library/ssl_tls13_keys.c | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index 5c851c712..1da8de69b 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -431,20 +431,8 @@ int mbedtls_ssl_tls13_derive_secret( { int ret; unsigned char hashed_context[ PSA_HASH_MAX_SIZE ]; -/* - const mbedtls_md_info_t *md_info; - md_info = mbedtls_md_info_from_type( hash_alg ); - if( md_info == NULL ) - return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); -*/ if( ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED ) { -/* - ret = mbedtls_md( md_info, ctx, ctx_len, hashed_context ); - if( ret != 0 ) - return( ret ); - ctx_len = mbedtls_md_get_size( md_info ); -*/ psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; status = psa_hash_compute( hash_alg, ctx, ctx_len, hashed_context, From 29e7ca89d580fd3ff458fced33cf2b7855956deb Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Tue, 29 Mar 2022 17:08:49 +0200 Subject: [PATCH 10/13] Fix typo Signed-off-by: Gabor Mezei --- library/ssl_tls13_keys.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index 1da8de69b..d7deaba8d 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -851,7 +851,7 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl, psa_algorithm_t hash_alg = mbedtls_psa_translate_md( ssl->handshake->ciphersuite_info->mac ); - size_t const hash_lem = PSA_HASH_LENGTH( hash_alg ); + size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_tls13_calculate_verify_data" ) ); @@ -866,7 +866,7 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl, base_key_len = sizeof( tls13_hs_secrets->server_handshake_traffic_secret ); } - if( dst_len < hash_lem ) + if( dst_len < hash_len ) { ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; goto exit; @@ -886,7 +886,7 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl, if( ret != 0 ) goto exit; - MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, hash_lem ); + MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, hash_len ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls13_calculate_verify_data" ) ); exit: From 55c49a33359265d0b52223bb8b4eb1beee6a2f7a Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Tue, 29 Mar 2022 17:09:15 +0200 Subject: [PATCH 11/13] Use proper macro guard Signed-off-by: Gabor Mezei --- library/ssl_misc.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index e274d5b1a..df4835b50 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -2085,7 +2085,7 @@ static inline int mbedtls_ssl_sig_alg_is_supported( #define MBEDTLS_SSL_SIG_ALG( hash ) #endif /* MBEDTLS_ECDSA_C && MBEDTLS_RSA_C */ #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ -#if defined(MBEDTLS_PSA_CRYPTO_C) +#if defined(MBEDTLS_USE_PSA_CRYPTO) /* Corresponding PSA algorithm for MBEDTLS_CIPHER_NULL. * Same value is used fo PSA_ALG_CATEGORY_CIPHER, hence it is * guaranteed to not be a valid PSA algorithm identifier. @@ -2115,7 +2115,9 @@ psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_typ psa_algorithm_t *alg, psa_key_type_t *key_type, size_t *key_size ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ +#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) /** * \brief Convert given PSA status to mbedtls error code. * @@ -2143,6 +2145,6 @@ static inline int psa_ssl_status_to_mbedtls( psa_status_t status ) return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ); } } -#endif /* MBEDTLS_PSA_CRYPTO_C */ +#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */ #endif /* ssl_misc.h */ From cb5ef6a532f891f331980cc0adfade30d66671f2 Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Tue, 29 Mar 2022 17:10:01 +0200 Subject: [PATCH 12/13] Remove duplicated includes Signed-off-by: Gabor Mezei --- library/ssl_misc.h | 5 ----- 1 file changed, 5 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index df4835b50..e0af4dfca 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -52,11 +52,6 @@ #include "mbedtls/ecjpake.h" #endif -#if defined(MBEDTLS_USE_PSA_CRYPTO) -#include "psa/crypto.h" -#include "mbedtls/psa_util.h" -#endif /* MBEDTLS_USE_PSA_CRYPTO */ - #include "common.h" #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ From e42d8bf83b88c17e248c8c1219303a5f9a30c450 Mon Sep 17 00:00:00 2001 From: Gabor Mezei Date: Wed, 30 Mar 2022 11:33:06 +0200 Subject: [PATCH 13/13] Add macro guard for header file Some of the macros are used by the test data files and must be moved before the macros guard. Signed-off-by: Gabor Mezei --- library/ssl_tls13_keys.h | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/library/ssl_tls13_keys.h b/library/ssl_tls13_keys.h index 928fa5850..d56067cef 100644 --- a/library/ssl_tls13_keys.h +++ b/library/ssl_tls13_keys.h @@ -44,6 +44,14 @@ MBEDTLS_SSL_TLS1_3_LABEL( client_cv , "TLS 1.3, client CertificateVerify" ) \ MBEDTLS_SSL_TLS1_3_LABEL( server_cv , "TLS 1.3, server CertificateVerify" ) +#define MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED 0 +#define MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED 1 + +#define MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL 0 +#define MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION 1 + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + #define MBEDTLS_SSL_TLS1_3_LABEL( name, string ) \ const unsigned char name [ sizeof(string) - 1 ]; @@ -158,10 +166,6 @@ int mbedtls_ssl_tls13_make_traffic_keys( size_t key_len, size_t iv_len, mbedtls_ssl_key_set *keys ); - -#define MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED 0 -#define MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED 1 - /** * \brief The \c Derive-Secret function from the TLS 1.3 standard RFC 8446. * @@ -455,9 +459,6 @@ int mbedtls_ssl_tls13_evolve_secret( const unsigned char *input, size_t input_len, unsigned char *secret_new ); -#define MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL 0 -#define MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION 1 - /** * \brief Calculate a TLS 1.3 PSK binder. * @@ -637,4 +638,6 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context *ssl, size_t *actual_len, int which ); +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ + #endif /* MBEDTLS_SSL_TLS1_3_KEYS_H */