mbedtls
mbedtls copied to clipboard
Driver-only hashes: EC J-PAKE
The EC J-PAKE module uses MD in order to compute a hash at various points. This doesn't work when hashes are only provided by drivers; this is task is to make it work.
- [ ] Store a
mbedtls_md_type_tinstead of ambedtls_md_info_t *in the context structure (we can because it's a private member) and adapt users. We can usembedtls_hash_info_get_size()fromlibrary/hash_info.hto replacembedtls_md_get_size(). - [ ] For each invocation of
mbedtls_md(), add an alternative based on PSA, to be used only whenMD_Cis not available (in order to preserve backwards compatibility: the PSA version requirespsa_crypto_init()to have been called, we don't want to impose this requirement on existing code, but we can impose it in builds where this just didn't work at all before). Possibly create a very small helper function for that, seecompute_hash()inrsa.cin #6141. - [ ] Adjust the dependency in
check_config.h: ECJPAKE now only requiresMD_C || PSA_CRYPTO_C(in addition toECP_Cas before). Adjust the description inmbedtls_config.hwith a warning (as in #6141). - [ ] Remove the
unset ECJPAKE_Clines fromall.shcomponentscomponent_test_crypto_full_no_md()andcomponent_test_psa_crypto_config_accel_hash_use_psa(). - [ ] Adjust dependencies in
test_suite_ecjpake.function, replacingMBEDTLS_SHA256_CwithMBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA(fromlegacy_or_psa.hwhich needs to be#included in the.functionfile). - [ ] Fix any issue that may arise.
- [ ] Check test coverage for
test_suite_ecjpake: seedocs/architecture/psa-migration/outcome-analysis.sh(don't forget to removeunset ECJPAKE_Cinreference_config()and editSUITESin your copy).