Upon further consideration we think that a remote attacker close to the
victim might be able to have precise enough timing information to
exploit the side channel as well. Update the Changelog to reflect this.
Signed-off-by: Janos Follath <janos.follath@arm.com>
The signature and naming of the Montgomrey initialisation function in
development and in the LTS was different. Align them for easier
readability and maintenance.
Signed-off-by: Janos Follath <janos.follath@arm.com>
Fix // comments stopping on 'n' instead of newlines. Also allow
backslash-newline in // comments.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Any timing variance dependant on the output of this function enables a
Bleichenbacher attack. It is extremely difficult to use safely.
In the Marvin attack paper
(https://people.redhat.com/~hkario/marvin/marvin-attack-paper.pdf) the
author suggests that implementations of PKCS 1.5 decryption that don't
include a countermeasure should be considered inherently dangerous.
They suggest that all libraries implement the same countermeasure, as
implementing different countermeasures across libraries enables the
Bleichenbacher attack as well.
This is extremely fragile and therefore we don't implement it. The use
of PKCS 1.5 in Mbed TLS implements the countermeasures recommended in
the TLS standard (7.4.7.1 of RFC 5246) and is not vulnerable.
Add a warning to PKCS 1.5 decryption to warn users about this.
Signed-off-by: Janos Follath <janos.follath@arm.com>
So far we needed it only locally here, but we will need calculating RR
for safe unblinding in RSA as well.
Signed-off-by: Janos Follath <janos.follath@arm.com>
`psa_collect_statuses.py` runs `make RECORD_PSA_STATUS_COVERAGE_LOG=1`,
which builds with `RECORD_PSA_STATUS_COVERAGE_LOG`. In this mode, the build
includes wrappers for PSA functions, which conflict with the newly
introduced wrappers that are enabled whenever `MBEDTLS_TEST_HOOKS` is
enabled. In the future, the collect-statuses mechanism should use the new
generic wrapper mechanism. For the time being, keep the old wrappers and
avoid the new wrappers when doing the collect-statuses build.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
For now, only instrument the one function for which buffer copying has been
implemented, namely `psa_cipher_encrypt`.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Code in unit tests (`tests/suites/*.function`) and in test support
code (`tests/src/**.c`) will now go through the wrapper functions when they
call a PSA API function and `MBEDTLS_TEST_HOOKS` is enabled.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Commit files generated by `tests/scripts/generate_psa_wrappers.py`. As of
this commit, the new code is neither useful (the wrappers just call the
underlying functions) nor used (the wrapper functions are not called from
anywhere). This will change in subsequent commits.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The new script `tests/scripts/generate_psa_wrappers.py` generates the
implementation of wrapper functions for PSA API functions, as well as a
header that defines macros that redirect calls to the wrapper functions. By
default, the wrapper functions just call the underlying library function.
With `--log`, the wrapper functions log the arguments and return values.
This commit only introduces the new script. Subsequent commits will
integrate the wrappers in the build.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The Base class generates trivial wrappers that just call the underlying
function. It is meant as a base class to construct useful wrapper generators.
The Logging class generates wrappers that can log the inputs and outputs to
a function.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Add MBEDTLS_PSA_COPY_CALLER_BUFFERS to query_config.c,
version_features.c and mbedTLS.vcxproj via their respective scripts.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Make sure that we don't enable memory poisoning when
MBEDTLS_PSA_COPY_CALLER_BUFFERS is disabled.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Specifically:
* Move the creation of the pointer to the copied buffer into the
DECLARE() macro, to solve warnings about potentially skipping
initialization.
* Reorder the arguments of the FREE() macro - having a different order
made it confusing, so keep the order the same throughout.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Note that enabling MBEDTLS_PSA_COPY_CALLER_BUFFERS allows full buffer
overlap support, whereas without it, overlap support is reduced to that
documented in the function descriptions.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
* Separate initialization from allocation.
* Rewrite description of macros to fit the new interface.
* Use a longer name to store the local copy objects, to reduce the risk
of shadowing.
* Use different names for the original and the copy. Append the suffix
'_external' to the original argument and use the previous name
for the copy.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Previously the return from psa_crypto_local_output_free() had a fixed
name, which meant that multiple outputs would cause redefinitions of the
same variable.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
* Set swapped pointers to NULL when the buffers are freed.
* Change example name <buffer> to <input> and <output> to reduce
confusion.
* Document assumptions of FREE_LOCAL_ macros.
* Add comment on error case in FREE_LOCAL_OUTPUT(), explaining why it's
okay to mask the existing status code.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
