mbedtls icon indicating copy to clipboard operation
mbedtls copied to clipboard

Driver-only hashes: EC J-PAKE

Open mpg opened this issue 3 years ago • 0 comments

The EC J-PAKE module uses MD in order to compute a hash at various points. This doesn't work when hashes are only provided by drivers; this is task is to make it work.

  • [ ] Store a mbedtls_md_type_t instead of a mbedtls_md_info_t * in the context structure (we can because it's a private member) and adapt users. We can use mbedtls_hash_info_get_size() from library/hash_info.h to replace mbedtls_md_get_size().
  • [ ] For each invocation of mbedtls_md(), add an alternative based on PSA, to be used only when MD_C is not available (in order to preserve backwards compatibility: the PSA version requires psa_crypto_init() to have been called, we don't want to impose this requirement on existing code, but we can impose it in builds where this just didn't work at all before). Possibly create a very small helper function for that, see compute_hash() in rsa.c in #6141.
  • [ ] Adjust the dependency in check_config.h: ECJPAKE now only requires MD_C || PSA_CRYPTO_C (in addition to ECP_C as before). Adjust the description in mbedtls_config.h with a warning (as in #6141).
  • [ ] Remove the unset ECJPAKE_C lines from all.sh components component_test_crypto_full_no_md() and component_test_psa_crypto_config_accel_hash_use_psa().
  • [ ] Adjust dependencies in test_suite_ecjpake.function, replacing MBEDTLS_SHA256_C with MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA (from legacy_or_psa.h which needs to be #included in the .function file).
  • [ ] Fix any issue that may arise.
  • [ ] Check test coverage for test_suite_ecjpake: see docs/architecture/psa-migration/outcome-analysis.sh (don't forget to remove unset ECJPAKE_C in reference_config() and edit SUITES in your copy).

mpg avatar Jul 28 '22 11:07 mpg