mbedtls
mbedtls copied to clipboard
Driver-only hashes: PKCS5
PKCS#5, aka RFC 8018, is a standard for password-based encryption. It defines PBKDF2-HMAC and uses it to derived encryption keys from passwords. It can optionally be used by pkparse.c in order to parse some types of encrypted keys. Currently our implementation (pkcs5.c) uses MD to compute HMACs, so it doesn't work when hashes are provided only by drivers; this task is to make it work.
- [ ] Adjust the signature of
mbedtls_pkcs5_pbkdf2_hmac()so that it takes anmbedtls_md_type_trather than anmbedtls_md_context_tas its first parameter. This frees callers from having to bother withmd_info,md_init(),md_setup(),md_free()and centralizes use of MD in one place. Adapt callers including theself_testfunction. (Note: this is similar to what was done withmgf_mask()in #6141.) - [ ] Provide an implementation of
mbedtls_pkcs5_pbkdf2_hmac()based on PSA, to be used only whenMD_Cis not available (in order to preserve backwards compatibility: the PSA version requirespsa_crypto_init()to have been called, we don't want to impose this requirement on existing code, but we can impose it in builds where this just didn't work at all before). (Again, this is similar tomgf_mask()in #6141.) - [ ] Adjust the dependency in
check_config.h: PKCS5 now only requiresMD_C || PSA_CRYPTO_C(plusCIPHER_Cas before). - [ ] Remove the
unset PKCS5_Clines fromall.shcomponentscomponent_test_crypto_full_no_md()andcomponent_test_psa_crypto_config_accel_hash_use_psa(). - [ ] Adjust dependencies in
test_suite_pkcs5.data, replacingMBEDTLS_SHAxxx_CwithMBEDTLS_HAS_ALG_SHA_xxx_VIA_MD_OR_PSA(fromlegacy_or_psa.hwhich needs to be#included in the.functionfile). - [ ] Similarly adjust hash dependencies in
test_suite_pkparse.datafor tests that depend onPKCS5_C(again,legacy_or_psa.hneeds to be#included in the.functionfile). - [ ] Fix any issue that may arise.
- [ ] Check test coverage for
test_suite_pkcs5andtest_suite_pkparse: seedocs/architecture/psa-migration/outcome-analysis.sh(don't forget to removeunse PKCS5_Cinreference_config()and editSUITESin your copy).
Depends on: #6141, for fixed definitions of VIA_MD_OR_PSA macros (could also just cherry-pick the commit "Fix definition of MD_OR_PSA macros" from that PR).