I have a strong preference for the library, the tests and companion
programs to build out of the box on officially supported platforms. On
platforms that don't work out of the box, users should be able to drop
in platform support code in the form of #defines or extra modules to
link with.
Ok, we don't have an official list of supported platforms. But inasmuch
as we do have officially supported platforms, they include Linux and
other modern Unix-like or POSIX environments, Windows, and Mbed OS. Mbed
OS is a special case because Mbed TLS is part of the build tree there,
so the mbedtls tree doesn't have to contain Mbed OS support.
This doesn't mean that the library should have a timing module. I think
the timing wrappers that the library needs, i.e.
mbedtls_timing_{get,set}_delay, should be in platform.c.
For platform features that are only used by test or sample programs, I
think we should have a separate platform support file, and separate
#defines so that you can build the library even if you can't build all
the programs. For example, it makes sense to build DTLS support without
having the timing functions used by the benchmark program.
--
Gilles Peskine
Mbed TLS developer
On 21/04/2020 10:46, Manuel Pegourie-Gonnard via mbed-tls wrote:
> Hi all,
>
> So personally I'm quite strongly inclined to remove timing.c from the
> library, and move most of its content elsewhere, with one possible
> exception:
>
>> - mbedtls_timing_set_delay() and mbedtls_timing_get_delay() are an example
>> implementation (only for Unix and Windows) of timer callbacks for DTLS, only
>> used in programs/ssl/*.c
> Since timer callbacks are a hard requirement for using DTLS, and it seems
> quite desirable to be able to support DTLS out of the box at least on
> some platforms, I was thinking this pair of function (and the associated
> context type) could be kept in the library, in a new module that would
> be called something like ssl_dtls_timer.c.
>
> This would be somewhat similar to ssl_cookies.c, ssl_tickets.c and
> ssl_cache.c: they all provide implementations of callbacks that can be
> used with the main SSL/(D)TLS module, but users are obviously free to
> compile them out and use their own implementation if the one we provide
> does not meet their needs.
>
> As it happens, all three of these support modules work best if
> MBEDTLS_HAVE_TIME is defined, but can work without it.
>
> For the new ssl_dtls_timer.c I'm suggesting, the situation would be
> different: the module could have a hard dependency on MBEDTLS_HAVE_TIME,
> but work better on selected platforms (say, C11, POSIX and
> Windows) where we know how to access sub-second timing information. (Or
> alternatively, have a hard dependency on C11-or-Posix-or-Windows.)
>
> For the record, mbedtls_ssl_conf_handshake_timeout() accepts timeout
> values in milliseconds, but recommended values for use over the general
> internet start at 1 second:
> https://tools.ietf.org/html/rfc6347#section-4.2.4.1
> So it might make sense to provide this module even when we only have
> second resolution - we'd just have to work out how the timer function
> would behave when passed sub-second values. (My first thought it
> rounding up to the next second would be quite OK.)
>
> What do you'all think? Personnally, I don't have a strong opinion
> between the three following options, though I have a slight preference
> for the first one:
>
> 1. Provide ssl_dtls_timer.c in the library with hard dep on HAVE_TIME
> and enhanced features with C11/Posix/Windows.
> 2. Provide ssl_dtls_timer.c in the library with hard dep on
> C11/Posix/Windows.
> 3. Move it all out of the library and let the thing live somewhere under
> programs/ as it's only used by example/testing programs.
>
> Note though that we could also choose to go with option 3 for Mbed TLS
> 3.0, see how it goes, and later switch to option 2 or 1 if we want, as
> adding modules can be done at any time. (In the same vein, we could
> start with 2 and switch to 1 at any time as well.)
>
> Regards,
> Manuel.
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
Hi,
> [I'm assuming didn't mean to reply on the list and not just to me, so I'm replying on the list.]
Oops, I misinterpreted the information presented by my mail client, you did reply on the list. Sorry for the noise (and for breaking the thread by not replying to the correct email.)
Manuel.
Hi again,
In the first email of the thread I tried giving a fair exposition of the
question, now I'm going to give my personal opinion.
Similarly to what I suggested for timing.c, I'm inclined to remove net.c as
such, move most of its content (net_bind(), net_accept(), etc.) out of the
library (most probably into a new file in programs/ssl, shared by SSL
examples), and keep in the library only the 3 functions that can be used as
SSL callbacks (and a supporting context type), but in a new module named for
example ssl_io_sockets.c.
This would also be similar to the other SSL modules that provide a
reference/example implementation of some SSL callback but can easily be
disabled (or jsut disregarded) in favour of a custom implementation for custom
needs or unsupported platforms. Just like the current net_sockets.c, this new
reduced module would probably only be supported on platforms with sockets,
which is Posix platforms and Windows.
Advantages include:
- Reduce the amount of code and API surface in the library. Things like
binding and accepting are hardly related to (D)TLS so there is little
justification for having them in the library. Also, things in the library are
bound by API stability rules which are sometimes a constraint.
- It would clarify that we're not providing a general-purpose socket
abstraction, as general socket management would be out of the library, and
only the bits for plugging a socket into our SSL layer would be in the
library.
- (By the way currently net_sockets.h includes ssl.h, so it's already quite
specific to our SSL module rather than generic, but moving the remaining
bits of it into the SSL namespace would make that clearer.)
- User would still have the convenience (on supported platforms) of
ready-for-use callbacks. If you have an application already working with
sockets without TLS, then we provide all the bits needed to turn that into an
application using TLS on top of those sockets.
I think that would be a good compromise between convenience for users, and
reduced surface for the library.
Regards,
Manuel.
Hi,
I support this.
Could certs.c live in `tests/data_files`? We should also make sure this file is automatically synced with the actual CRT and key files in that directory. There is a script which does that, but IIRC it's not called as part of the CI, which lead to certs.c and the data files get out of sync multiple times in the past.
Best
Hanno
________________________________
From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> on behalf of Manuel Pegourie-Gonnard via mbed-tls <mbed-tls(a)lists.trustedfirmware.org>
Sent: Monday, April 20, 2020 10:49 AM
To: mbed-tls(a)lists.trustedfirmware.org <mbed-tls(a)lists.trustedfirmware.org>
Cc: nd <nd(a)arm.com>
Subject: [mbed-tls] 3.0 plans - move certs.c out of the library
Hi all,
In this new installment of "let's discuss ideas for Mbed TLS 3.0" [1]:
should we move certs.c out of the library?
[1]: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/
Currently the X.509 library includes test certificates and keys, which are
enabled by default in config.h - `MBEDTLS_CERTS_C`.
These are used in the following places:
- in library/x509.c in mbedtls_x509_self_test()
- in tests/suites/test_suite_ssl.function
- in programs/fuzz and programs/ssl
In Mbed TLS 3.0, as part of our effort to clean up and minimize our API, we'd
like to remove certs.h and the certificates it contains from the library
(except perhaps one static cert for mbedtls_x509_self_test()). Tests and
example programs that need built-in certificates could still get them using
any mechanism, included a file certs.c similar to the current one - but this
file would no longer live in library or be included when building libmbedx509.
Reasons include:
- Including test certificates and keys in the library provides little value, as
users will want to use their own certificates and keys anyway.
- Shipping private keys as part of the library is bad practice, even under the
`mbedtls_test_` sub-namespace. There's a slight risk that some users could
use them for prototyping and then inadvertently keep using unsafe private keys
in production.
If you disagree or have concerns, please speak up! Also, if want to suggest
ideas for where the replacement to library/certs.c should live or how it
could be maintained, now's a good time as well!
Regards,
Manuel.
--
mbed-tls mailing list
mbed-tls(a)lists.trustedfirmware.org
https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
Hi all,
So personally I'm quite strongly inclined to remove timing.c from the
library, and move most of its content elsewhere, with one possible
exception:
> - mbedtls_timing_set_delay() and mbedtls_timing_get_delay() are an example
> implementation (only for Unix and Windows) of timer callbacks for DTLS, only
> used in programs/ssl/*.c
Since timer callbacks are a hard requirement for using DTLS, and it seems
quite desirable to be able to support DTLS out of the box at least on
some platforms, I was thinking this pair of function (and the associated
context type) could be kept in the library, in a new module that would
be called something like ssl_dtls_timer.c.
This would be somewhat similar to ssl_cookies.c, ssl_tickets.c and
ssl_cache.c: they all provide implementations of callbacks that can be
used with the main SSL/(D)TLS module, but users are obviously free to
compile them out and use their own implementation if the one we provide
does not meet their needs.
As it happens, all three of these support modules work best if
MBEDTLS_HAVE_TIME is defined, but can work without it.
For the new ssl_dtls_timer.c I'm suggesting, the situation would be
different: the module could have a hard dependency on MBEDTLS_HAVE_TIME,
but work better on selected platforms (say, C11, POSIX and
Windows) where we know how to access sub-second timing information. (Or
alternatively, have a hard dependency on C11-or-Posix-or-Windows.)
For the record, mbedtls_ssl_conf_handshake_timeout() accepts timeout
values in milliseconds, but recommended values for use over the general
internet start at 1 second:
https://tools.ietf.org/html/rfc6347#section-4.2.4.1
So it might make sense to provide this module even when we only have
second resolution - we'd just have to work out how the timer function
would behave when passed sub-second values. (My first thought it
rounding up to the next second would be quite OK.)
What do you'all think? Personnally, I don't have a strong opinion
between the three following options, though I have a slight preference
for the first one:
1. Provide ssl_dtls_timer.c in the library with hard dep on HAVE_TIME
and enhanced features with C11/Posix/Windows.
2. Provide ssl_dtls_timer.c in the library with hard dep on
C11/Posix/Windows.
3. Move it all out of the library and let the thing live somewhere under
programs/ as it's only used by example/testing programs.
Note though that we could also choose to go with option 3 for Mbed TLS
3.0, see how it goes, and later switch to option 2 or 1 if we want, as
adding modules can be done at any time. (In the same vein, we could
start with 2 and switch to 1 at any time as well.)
Regards,
Manuel.
Hi Torsten,
[I'm assuming didn't mean to reply on the list and not just to me, so I'm
replying on the list.]
> On 20/04/2020 11:51, Manuel Pegourie-Gonnard via mbed-tls wrote:
>> For reference, this module includes the following functions, which are used
>> in the following places:
>>
>> - mbedtls_timing_hardclock() implements cycle counting (on selected
>> architectures, not including M-class), used only in
>> programs/test/benchmark.c
>
> I used mbedtls_timing_hardclock() for my own benchmarking experiments on
> Linux and Windows, but couldn't get it to run on the target machine. So
> I've use my own ms counter instead. So, it could be easily removed as
> part of the library.
>
Good to know, thanks for sharing this data point.
> Question: How do you want to do the benchmarking instead? With the same
> code, but outside the library?
>
Yes, I was thinking that the functions that are only used in benchmark.c
could be defined in benchmark.c, and the functions that are only used in
udp_proxy.c could be defined in udp_proxy.c.
(Or actually for the latter, we might want to start using them in
ssl_client2.c and ssl_server2.c as well, as including millisecond
timestamps in the debug output would be usefull to debug some issues. In
that case, we'll probably put those functions in a new file, used by
udp_proxy, ssl_client2 and ssl_server2 (just like query_config.c is
currently used by ssl_client2, ssl_server2 and
query_compile_time_config).)
Regards,
Manuel.
Hi Torsten,
> this will be a long mail. Sorry for that.
>
On the contrary, thank you so much for this extensive and well though-out
feedback, that's very helpful!
I'll try to complement Gilles's reply, and skip the points he already answered
unless I have something to add, as I'm generally in full agreement with what
he wrote.
> 3. For certification and evaluation purposes I need some test vectors
> for each crypto function on target. While I know about the
> comprehensive self-test program I'm now talking about built-in
> functions like mbedtls_sha512_self_test(), etc to be enabled with
> #define MBEDTLS_SELF_TEST.
>
> These self-tests are very different in coverage. For SHA-384 and
> SHA-512 they are fine, for HMAC-SHA-384 and HMAC-SHA-512 I couldn't
> find any as well as for HKDF-HMAC-SHA-256 (in RFC 5869) or
> HKDF-HMAC-SHA-384/512 (official test vectors difficult to find).
> AES-CTR and AES-XTS are only tested with key length 128 bit, not with
> 256 bit. AES-CCM is not tested with 256 bit and even for 128 bit,
> the test vector from the standard NIST SP 800-38C with long
> additional data is not used.
> The builtin self-test for GCM is the best I've seen with mbedtls:
> all three key lengths are tested as well as the IUF-interface and
> the comfort function. Bravo!
>
Indeed so far we don't have clear guidelines on self-test functions, and we
should try to have more consistency here. Since this is incremental,
backwards-compatible improvements, it can be done at any time (unlike some API
improvements that can only be done when preparing major versions).
Contributions in this area are certainly welcome!
> 7. While at Elliptic Curve Cryptography: I assume that some of you
> know that projectives coordinates as outer interface to ECC are
> dangerous, see David Naccache, Nigel P. Smart, Jacques Stern:
> Projective Coordinates Leak, Eurocrypt 2004, pp. 257–267.
Yes, and as it happens this was revisited recently by researchers, and brought
back to our attention:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi…
> you have Jacobian coordinates, i.e. projective coordinates, as outer
> interface. In the comment, its is noted that only the affine part is
> used, but can this be assured? In all circumstances?
>
In practice, I'm pretty confident this is the case, because both
ecp_normalize_jac() and ecp_normalize_mxz() set Z to 1, these functions are
always called before returning data, and if we forgot to call those functions,
we'd get incorrect X and Y coordinates and fail unit test and interop tests.
But as a matter of principle, I agree that exposing Jacobian coordinates in
the API was a poor decision. Fortunately, we already intended to start phasing
out the existing ECP interface in 3.0 (to which extend exactly is still to be
discussed), and in the future is should be fully removed in favour of the PSA
Crypto API, which doesn't have this problem.
> 8. In my personal opinion the definition
> [...]
> mbedtls_ecp_keypair;
>
> is dangerous. Why not differentiate between private and public key
> and domain parameters?
I agree, and I think it's a generally accepted opinion in the crypto
implementation community that private and public keys should be clearly
distinguished from one another, for example by using distinct types (in typed
languages).
This is by the way a long-standing problem that existed in the RSA module from
the start, and when ECC was added it followed a similar pattern.
Again, I think the transition of the PSA Crypto API is going to be the answer
here, as it will provide much cleaner key management.
> 9. Regarding ECC examples: I found it very difficult that there isn't
> a single example with known test vectors as in the relevant crypto
> standards, i.e. FIPS 186-4 and ANSI X9.62-2005, with raw public
> keys. What I mean are (defined) curves, public key value Q=(Qx,Qy)
> and known signature values r and s. In the example ecdsa.c you
> generate your own key pair and read/write the signature in
> serialized form. In the example programs/pkey/pk_sign.c and
> pk_verify.c you use a higher interface pk.h and keys in PEM format.
>
> So, it took me a while for a program to verify (all) known answer
> tests in the standards (old standards as ANSI X9.62 1998 have more
> detailed known answer tests). One needs this interface with raw
> public keys for example for CAVP tests, see The FIPS 186-4 Elliptic
> Curve Digital Signature Algorithm Validation System (ECDSA2VS).
>
> 11. In the moment, there is no single known answer tests for ECDSA
> (which could be activated with #define MBEDTLS_SELF_TEST). I
> wouldn't say that you need an example for every curve and hash
> combination, as it is done in ECDSA2VS CAVP, but one example for
> one of the NIST curves and one for Curve25519 and - if I have a
> wish free - one for Brainpool would be fine. And this would solve
> #9 above.
>
I might be misunderstanding, but isn't the function
ecdsa_prim_test_vectors() in tests/suites/test_suite_ecdsa.function close to
what you're looking for? I mean, except for the fact that it's not in the
self-test function, and that it's using data from RFCs rather than from NIST
or ANSI?
But I agree this is a bit messy and could be made cleaner.
Also, if you ever feel like contributing your dream self-test function for
ECDSA as PR, this will be a very welcome contribution!
> 13. Feature request: Since it was irrelevant for my task (only
> verification, no generation) I didn't have a detailed look a your
> ECC side-channel countermeasures. But obviously you use the same
> protected code for scalar multiplication in verify and sign,
> right? Wouldn't it be possible to use Shamir's trick in
> verification with fast unprotected multi-scalar multiplication. In
> the moment, mbedtls_ecdsa_verify is a factor 4-5 slower than
> mbedtls_ecdsa_sign, while OpenSSLs verify is faster than sign.
>
Yes, this was done to save both on code size and developer time, but I agree
it's suboptimal for performance. As Gilles wrote, as a general rule we tend to
favour code size and security/maintainability over performance, but in that
instance if we provide an option for a verify-only ECDSA build (which I agree
we should), then we're likely to reach smaller code size by having a
standalone unprotected implementation of multi-scalar multiplication, so that
would probably be a great option: better performance _and_ smaller code.
Unfortunately we're already quite busy with other things, so this kind of
optimisation will probably have to wait for a bit more, but we're taking good
note of the suggestion and will try to implement it in the future.
Again, thanks for this comprehensive and useful feedback.
Regards,
Manuel.
On 20/04/2020 11:51, Manuel Pegourie-Gonnard via mbed-tls wrote:
> [ Context: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/ ]
>
> Currently the crypto library includes a module called timing.c, enabled by
> default in config.h (but disabled by config.py baremetal), containing various
> functions related to timing (not to be confused with the time abstration
> present in the platorm module).
>
> In Mbed TLS 3.0, as part of our effort to clean up and minimize our API,
> we're considering removing (parts of) this module from the library, and
> moving its parts to a variety of other places, such as example programs (or
> a library/file shared by them, like the current query_config mechanism).
>
> For reference, this module includes the following functions, which are used in
> the following places:
>
> - mbedtls_timing_hardclock() implements cycle counting (on selected
> architectures, not including M-class), used only in
> programs/test/benchmark.c
I used mbedtls_timing_hardclock() for my own benchmarking experiments on
Linux and Windows, but couldn't get it to run on the target machine. So
I've use my own ms counter instead. So, it could be easily removed as
part of the library.
Question: How do you want to do the benchmarking instead? With the same
code, but outside the library?
Torsten
Hi all,
[ Context: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/ ]
Currently the SSL/TLS library includes a module called net_sockets.c (formerly
net.c), enabled by default in config.h (but disabled by config.py baremetal),
that contains some networking functions based on POSIX or Windows sockets,
including functions suitable for use as I/O callbacks with our SSL/TLS
modules.
Those functions are used only in example/testing programs, but nowhere in the
library itself.
In Mbed TLS 3.0, as part of our effort to clean up and minimize our API,
we're considering removing (parts of) this module from the library, and
moving its parts to a variety of other places, such as example programs (or
a library/file shared by them, like the current query_config mechanism).
Reasons for removing this module from the library include:
- overall the module is less portable and perhaps of lesser quality than the
rest of the library
- it's currently entirely untested on Windows (despite being very
platform-specific)
- there are often confusions about whether the module is meant to be a
general-purpose networking library, or just provide basic support for our
example and test, as well a simple prototypes
- it's not our core area of expertise, let's do one thing and to it well
Reasons for keeping (parts of) it in the library include:
- having mbedtls_net_recv{,_timeout}() and mbedtls_net_send() available right
in the library makes it easier to test and develop prototype
- this module is listed as a component in our high-level design document [2],
so perhaps removing it from the library can be seen as a bigger change?
[2]: https://tls.mbed.org/high-level-design
What do you think? Should we remove the entire module from the library, keep
it all, or just keep some parts? In that case, which parts and where?
Regards,
Manuel.
[ Context: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/ ]
Currently the crypto library includes a module called timing.c, enabled by
default in config.h (but disabled by config.py baremetal), containing various
functions related to timing (not to be confused with the time abstration
present in the platorm module).
In Mbed TLS 3.0, as part of our effort to clean up and minimize our API,
we're considering removing (parts of) this module from the library, and
moving its parts to a variety of other places, such as example programs (or
a library/file shared by them, like the current query_config mechanism).
For reference, this module includes the following functions, which are used in
the following places:
- mbedtls_timing_hardclock() implements cycle counting (on selected
architectures, not including M-class), used only in
programs/test/benchmark.c
- mbedtls_timing_get_timer() is a millisecond counter (only for Unix and
Windows), used only in programs/test/udp_proxy.c
- mbedtls_set_alarm() is an abstraction of alarm() (only for Unix and
Windows), used only in programs/test/benchmark.c
- mbedtls_timing_set_delay() and mbedtls_timing_get_delay() are an example
implementation (only for Unix and Windows) of timer callbacks for DTLS, only
used in programs/ssl/*.c
Reasons for removing this module from the library include:
- overall the module is less portable and of lesser quality than the rest of
the library
- it's also very hard to test and we've lost a lot of time and energy to that,
with very limited success
- it doesn't really belong in libmbedcrypto
- it's not our core area of expertise, let's do one thing and to it well
Reasons for keeping (parts of) it in the library include:
- for mbedtls_timing_set_delay() and mbedtls_timing_get_delay(): they're
convenient to have for DTLS examples and prototyping, we could keep them in
some place in libmbedtls (not libmbedcrypto).
What do you think? Should we remove the entire module from the library, or
keep some parts? In that case, which parts and where should they live?
Regards,
Manuel.
Hi all,
In this new installment of "let's discuss ideas for Mbed TLS 3.0" [1]:
should we move certs.c out of the library?
[1]: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/
Currently the X.509 library includes test certificates and keys, which are
enabled by default in config.h - `MBEDTLS_CERTS_C`.
These are used in the following places:
- in library/x509.c in mbedtls_x509_self_test()
- in tests/suites/test_suite_ssl.function
- in programs/fuzz and programs/ssl
In Mbed TLS 3.0, as part of our effort to clean up and minimize our API, we'd
like to remove certs.h and the certificates it contains from the library
(except perhaps one static cert for mbedtls_x509_self_test()). Tests and
example programs that need built-in certificates could still get them using
any mechanism, included a file certs.c similar to the current one - but this
file would no longer live in library or be included when building libmbedx509.
Reasons include:
- Including test certificates and keys in the library provides little value, as
users will want to use their own certificates and keys anyway.
- Shipping private keys as part of the library is bad practice, even under the
`mbedtls_test_` sub-namespace. There's a slight risk that some users could
use them for prototyping and then inadvertently keep using unsafe private keys
in production.
If you disagree or have concerns, please speak up! Also, if want to suggest
ideas for where the replacement to library/certs.c should live or how it
could be maintained, now's a good time as well!
Regards,
Manuel.
Hi all,
I would like to bring up the following:
(How) Shall the APIs for PSKs and TLS session resumption be modified in Mbed TLS 3.0?
The motivation for this question is the consolidation of PSKs, ticket-based resumption
and session-id-based resumption in TLS 1.3. Now, while there will be no TLS 1.3 support
in Mbed TLS 3.0 as it stands, I think it would be beneficial to make the API amenable
to TLS 1.3 as much as possible already now.
Finding the right API here is non-trivial, and I'll describe first how the
current API works and how TLS 1.2 and 1.3 differ, before making suggestions
on how the Mbed TLS 3 API might look like. The mail is therefore quite long,
but I hope you'll bear with me.
# Session Resumption in Mbed TLS 2.X
Recall how resumption works in Mbed TLS 2.X on the client:
1. Establish a connection as usual
2. Store established session for later re-use
`mbedtls_ssl_session_save()` saves connection parameters relevant for
session resumption in an instance of `mbedtls_ssl_session`.
Optional:
2.1: Serialize session for offline storage
2.2: Deserialize session
3. Loading a stored session
`mbedtls_ssl_session_load()` is called on the stored session after initialization
and before running the handshake via `mbedtls_ssl_handshake()`.
4. Connect using stored session
Run `mbedtls_ssl_handshake()` as usual.
To my knowledge, the following is transparent to the user:
* The means by which resumption is achieved, which can be either id- or ticket-based.
* Whether the session was resumed or not - there is a silent fallback to a full
handshake when session resumption is rejected by the server.
On the server, ticket- and id-based resumption are configured independently as follows:
- ID-based resumption is controlled via `mbedtls_ssl_conf_session_cache()`
- Ticket-based resumption is controlled via `mbedtls_ssl_conf_session_tickets_cb()`.
# PSKs in Mbed TLS 2.X
Coming to PSKs: First, recall that, under the hood, resumed connections establish
a master secret purely on the basis of a previous master secret, without resorting to
asymmetric crypto. The same is true for PSK-based connections, and this observation is
embodied in TLS 1.3 which, as mentioned, consolidates resumption and PSKs.
In TLS 1.2, though, PSKs and session resumption are different, and consequently
Mbed TLS handles them through a separate API `mbedtls_ssl_conf_psk()`, which
takes the PSK identifier and the PSK itself.
Side-question: Should this apply to the SSL configuration or the SSL context?
It seems to me that somebody might want to run multiple PSK-based
connections with different PSKs, but same configuration otherwise.
At the moment, this would require a configuration per connection.
Maybe this decision of what belongs at the level of the config
could be thoroughly discussed independently?
# PSKs in TLS 1.3
In TLS 1.3, all kinds of resumptions are hanlded ander the umbrella of PSKs:
The client offers PSK identities in its ClientHello, the server picks one or
leaves it, and the master secret for the connection is derived from the PSK
associated with the PSK identity.
Underlying this is some form of translation
`PSK-Identity -> PSK`
on the server which allows to derive the PSK from the PSK identity.
How this mapping is realized is entirely implementation-specific,
but it can take at least the following forms, giving back all forms
of session resumption:
- 'PSK Identity -> PSK' via database lookup:
This subsumes classical PSKs and ID-based resumption,
since the data necessary to resume a session is stored
on the server.
- 'PSK Identity -> PSK' via AEAD:
The PSK can be encoded in the PSK identity itself by using some
authenticated encryption of the PSK as the PSK identity, the key
for which resides on the server.
This subsumes Ticket-based resumption.
There are the following noteworthy differences, though:
1. In TLS 1.2, the server provides a 'PSK identity hint' and the
client picks a particular PSK identity. In TLS 1.3, the client
offers a _list_ of PSKs, and the server picks one or none.
2. In TLS 1.2, the server can issue only a single session ticket.
In TLS 1.3, the server can issue as many session tickets as
he wishes, and the client can use any of those for later
session resumption.
This has the following consequences for the API:
1. The PSK-configuration API must allow the configuration
of multiple PSKs on the client.
2. There must be a means to export more than one session ticket
for later resumption.
# API considerations for Mbed TLS 3.X
## Part 1: Load/Save API
In essence, keep the flow of `mbedtls_ssl_session_load/save()`,
but make the following adjustments. Whether the target structure
remains `mbedtls_ssl_session` and how it looks like internally
isn't relevant at this point and is up to discussion.
1. It must be possible 'save' a session multiple times, which
in TLS 1.3 amounts to exporting the tickets issued by the
server one-by-one.
This can be realized in a variety of ways, for example:
- Allow calling `mbedtls_ssl_session_save()` multiple
times, and modify its semantics from the idempotent
nature of Mbed TLS 2.X to iterating through the available
tickets, and returning an error when no more tickets
are available.
This has the benefit that it likely requires no code
change for users migrating from Mbed TLS 2.X, since
a change is needed only when an application stores
a single session multiple times, which could be done
by calling `mbedtls_ssl_session_save()` multiple times
before, while now one would need to call it once and
manually replicate the obtained session structure.
On the negative side, this wastes memory for applications
not interested in session resumption, or those that only
need a single ticket. We don't want the server to be able
to flood the client with arbitrarily many tickets.
- Allow registering a callback that's triggered whenever
a new ticket arrives.
The drawback of this is that it is larger deviation
from the Mbed TLS 2.X API. On the positive side, applications
that don't need tickets, or only need a limited number of
such, can simply drop further tickets and thereby prevent
allocating RAM for them.
2. It must be possible to 'load' multiple sessions, meaning
that the client should offer any of them to the server for
resumption.
## Part 2: Consolidation with PSK
Make it possible to setup an `mbedtls_ssl_session` (or whatever
it will be called) structure manually from an externally PSK
provisioned PSK, and allow loading this session for resumption
as above, via one of potentially many calls to `mbedtls_ssl_session_load()`.
There are multiple variants to this, for example:
1. Make `mbedtls_ssl_session` transparent so users can build
it manually by filling the respective fields.
2. Provide a helper API to build a session from a PSK.
The old API `mbedtls_ssl_conf_psk()` can then be _derived_ from
this for convenience, building a session from the provided PSK
and loading it, in a single API.
Before going into further details and making the mail even
longer: What do you think of this approach? Do you see
alternatives?
Best,
Hanno
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
Wow! First, thanks for this extensive feedback! That's very helpful, and appreciated.
I'm going to reply to a few points. On a general note, you can see headlines for the main topics we're currently planning to work on in the Mbed TLS roadmap at https://developer.trustedfirmware.org/w/mbed-tls/roadmap/ . Please note that everything I write is based on current plans, which may change through the TrustedFirmware planning process or if real life shows that a current plan is not doable.
Over time, we're transitioning the API for the crypto part of the library from the current mbedtls_xxx functions to psa_xxx, which have a somewhat different philosophy: less exposure of internals, more protection against misuse, no reliance on malloc. Mbed TLS 3.0 will start the transition.
On 14/04/2020 21:10, Torsten Schuetze via mbed-tls wrote
1. I really missed an Initialize, Update, Finalize (IUF) interface for
CCM.
For GCM, we have mbedtls_gcm_init(), mbedtls_gcm_setkey(),
mbedtls_gcm_starts(), mbedtls_gcm_update() iterated,
mbedtls_gcm_finish(), mbedtls_gcm_free() or the comfort functions
mbedtls_gcm_crypt_and_tag() and mbedtls_gcm_auth_decrypt(). For
CCM, only mbedtls_ccm_init(), mbedtls_ccm_setkey(),
mbedtls_ccm_encrypt_and_tag() or mbedtls_ccm_auth_decrypt() and
mbedtls_ccm_free(). With this interface it was only possible to
encrypt and tag 128 kByte on my target system, while with GCM I
could encrypt much larger files.
see Github issue #662 and my comment there
In Mbed TLS 3.0, mbedtls_ccm_xxx() will not be a public interface anymore. We are planning to add support for multipart CCM in the psa_aead_xxx() interface (the prototypes are already in psa/crypto.h but their implementation is planned for some time in the next few months). We are not currently planning to add support for multipart CCM through mbedtls_cipher_xxx(), which in Mbed TLS 3 will be legacy functions. However, we would probably accept such support if it was contributed externally.
2. The next step, of course, is to integrate this into the higher
mbedtls_cipher layer.
Regarding higher, abstract layers: I often didn't understand which
interface I was supposed to use. In general, I like to use the
lowest available interface, for example, #include
"mbedtls/sha512.h" when I want to use sha512. However, if I need
HMAC-SHA-512 or HKDF-HMAC-SHA-512 then I have to use the interface
in md.h. For hash functions this is fine. Almost all hash functions
are supported via md.h. (I missed SHA-512/256 which is sometimes
preferable to SHA-256 on 64bit systems).
But with cipher.h, I can only access Chacha20Poly1305 and AES-GCM,
not AES-CCM.
In Mbed TLS 3, there will generally be a single public layer. Exposing lower layers helps with code size on resource-constrained devices, but it also has downsides, including locking down the APIs.
4. That I couldn't configure AES-256 only, i.e. without AES-128 and
AES-192, was to be expected (and the code overhead is not that
much). But in modern modes of operations nobody needs AES
decryption, only the forward direction. Sometimes modern
publications as Schwabe/Stoffelen "All the AES you need on
Cortex-M3 and M4" provide only the forward direction.
So, it would be fine if one could configure an AES (ECB) encryption
only without decryption.
Of course, this is only possible if we don't use CBC mode, etc.
This wouldn't only save the AES decryption code but also the rather
large T-tables for decryption.
For information, there is a branch of Mbed TLS called "baremetal", forked from Mbed TLS 2.16, which you can find on GitHub: https://github.com/ARMmbed/mbedtls/blob/baremetal . This branch is optimized for small code size, sometimes at the expense of speed and often at the expense of features. It has build options MBEDTLS_AES_ONLY_ENCRYPT and MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH. However I would not recommend using it in production because Arm (who still maintain this branch even after Mbed TLS itself has moved to TrustedFirmware) does not make any promise of stability. A feature that you rely on may be removed without notice.
I mention this branch because eventually, we do plan to port the improvements that don't sacrifice features to the Mbed TLS development branch. I can't give a timeline for this however.
With the current Mbed TLS, if you don't use CBC, I think you can save some code in aes.o by defining MBEDTLS_AES_DECRYPT_ALT and MBEDTLS_AES_SETKEY_DEC_ALT and providing functions mbedtls_aes_setkey_dec() and mbedtls_internal_aes_decrypt() that do nothing.
5. Regarding AES or better the AES context-type definition
[snip]
6. In general, the contexts of mbedTLS are rather full of
implementation specific details. Most extreme is mbedtls_ecp_group
in ecp.h. Wouldn't it be clearer if one separates the standard
things (domain parameters in this case) from implementation
specific details?
As a general design principle, context types in Mbed TLS 3 will be opaque. This will let us, for example, redesign mbedtls_aes_context and mbedtls_cipher_context.
9. Regarding ECC examples: I found it very difficult that there isn't
a single example with known test vectors as in the relevant crypto
standards, i.e. FIPS 186-4 and ANSI X9.62-2005, with raw public
keys. What I mean are (defined) curves, public key value Q=(Qx,Qy)
and known signature values r and s. In the example ecdsa.c you
generate your own key pair and read/write the signature in
serialized form. In the example programs/pkey/pk_sign.c and
pk_verify.c you use a higher interface pk.h and keys in PEM format.
So, it took me a while for a program to verify (all) known answer
tests in the standards (old standards as ANSI X9.62 1998 have more
detailed known answer tests). One needs this interface with raw
public keys for example for CAVP tests, see The FIPS 186-4 Elliptic
Curve Digital Signature Algorithm Validation System (ECDSA2VS).
11. In the moment, there is no single known answer tests for ECDSA
(which could be activated with #define MBEDTLS_SELF_TEST). I
wouldn't say that you need an example for every curve and hash
combination, as it is done in ECDSA2VS CAVP, but one example for
one of the NIST curves and one for Curve25519 and - if I have a
wish free - one for Brainpool would be fine. And this would solve
#9 above.
I don't get the point here. ECDSA is randomized, so you can't have a known answer test. The test suite does have known answer tests for deterministic ECDSA.
10. While debugging mbedtls_ecdsa_verify() in my example program, I
found out, that the ECDSA, ECC and MPI operations are very, let's
say, nested. So, IMHO there is a lot of function call overhead and
special cases. It would be interesting to see what's the
performance impact of a clean, straight-forward
mbedtls_ecdsa_verify without restartable code, etc. to the current
one.
As far as I remember, the refactoring done to add the restartable code had no measurable impact on performance. What does have a significant impact on performance is that the bignum module uses malloc all the time. We would like to completely rewrite bignum operations at some point during the 3.x series, not only for performance but also because its design makes it hard not to leak information through side channels.
12. Just a minor issue: I only needed ECDSA signature verification,
therefore I only included MBEDTLS_ASN1_PARSE_C. But it is not
possible to compile without MBEDTLS_ASN1_WRITE_C needed for ECDSA
signature generation.
I'm not sure if I've written it down anywhere, but I'd like to remove the dependency of ECDSA on ASN1 altogether. Parsing and writing a SEQUENCE of two INTEGERs can be done with ad hoc code. Likewise for what little ASN1 the RSA module uses. And then asn1*.o can move out of libmbedcrypto and libpsacrypto, and into libmbedx509 where it belongs.
Having only signature verification would be useful, indeed. That may happen with the bignum rewrite I mentioned above, if signature verification ends up using some faster non-constant-time code (this is also relevant for #13).
14. Design question: In the moment, both GCM and CCM use their own
implementation of CTR encryption which is very simple. But then we
have mbedtls_aes_crypt_ctr() in aes.h which is very simple, too.
Let's assume at one day we have a performance optimized CTR
encryption (for example from Schwabe & Stoffelen) with all fancy
stuff like counter-mode caching etc. Then this would have to be
replaced at three places at minimum. While isn't the code at this
point more modularized? Is this a dedicated design decision?
Having a single implementation of CTR is on the PSA roadmap because if there's a hardware accelerator that does it, we want to use it everywhere it's relevant.
In Mbed TLS (or more precisely in its ancestor PolarSSL, if not _its_ ancestor XySSL), there was a conscious design decision to make each .c file as independent from the others as possible, which explains why camellia_ctr is completely independent from aes_ctr. But I don't know why ccm and gcm reimplement ctr.
Why do I find at so many places
for( i = 0; i < 16; i++ )
y[i] ^= b[i];
instead of a fast 128-bit XOR macro with 32bit aligned data?
As a programmer who doesn't write compilers, I think this is the right way to xor 16 bytes, and it's the compiler's job to optimize it to word or vector operations if possible. Admittedly this does mean the compiler has to know that the data is well-aligned, which can be hard to guarantee and easy to forget.
So, that's it for the moment. I hope I could give some hints for the
further development of mbedTLS. Feel free to discuss any of the above
points. It's clear to me that we cannot have both: clear and simple to
understand code and performance records.
Right. Also maintainable code and minimal code size, because minimal code size comes from letting the application developer #ifdef out everything that they don't care about, but this is a nightmare to test. It's one of the topics we're thinking about for Mbed TLS 3 and beyond.
In general, Mbed TLS is primarily targeted at embedded systems, and is likely to privilege 1. security (including side channel resistance) and 2. code size. This doesn't mean that we don't care about performance, just that it isn't our top priority. That being said, we also do have some code that's optimized for performance (without compromising security) and not code size: the library already includes X25519 from Project Everest (https://project-everest.github.io/) (turn it on with MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED). This is code that's formally proven not only for functional correctness, but also for side channel resistance; the implementation has aggressive inlining which makes it very fast, but obviously also large in terms of code size. Hopefully other algorithms will follow soon.
Ciao,
Torsten
Once again, thanks for the detailed feedback, and I hope we can improve Mbed TLS for everyone!
--
Gilles Peskine
Mbed TLS developer
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
>From the perspective of an application developer whose platform doesn't
have a native malloc, the advantage for Mbed TLS to include its own
malloc is one less dependency to integrate (so one less source of
potential incompatibilities, one less component to integrate into the
build, one less set of parameters to configure, one less feed of
security updates to keep up with, etc.).
I expect that choosing the Mbed TLS allocator would give poorer
performance and higher RAM consumption than choosing the best allocator
that exists out there. But it gives better time to market, and
potentially a better security posture (the highest-performance allocator
may or may not turn out to be actively maintained).
--
Gilles Peskine
Mbed TLS developer
On 16/04/2020 14:19, Janos Follath via mbed-tls wrote:
> Hi,
>
> Thank you for sharing your view, it makes perfect sense.
>
> You mention that you would consider keeping the module internally for the sake of baremetal applications. How would this serve the user better than choosing a third party malloc implementation? (Assuming that there are better implementation out there than ours, which I haven't confirmed, but it is not hard to imagine that such exists.)
>
> Regards,
> Janos
>
>
> On 15/04/2020, 21:11, "mbed-tls on behalf of Gilles Peskine via mbed-tls" <mbed-tls-bounces(a)lists.trustedfirmware.org on behalf of mbed-tls(a)lists.trustedfirmware.org> wrote:
>
> On 09/04/2020 13:17, Janos Follath via mbed-tls wrote:
> > Hi,
> >
> > Based on what I read on this thread it seems an accepted point of view that the toolchain provided C standard library implementations are less trusted than the toolchains themselves. Can somebody please help me understand the reasoning behind this distinction?
>
> Well, I disagree with this statement. I trust the toolchain to implement
> the C standard library correctly, and with good performance for the
> target platform. I do not want to provide my own implementation of
> standard functions.
>
> I only trust the toolchain to be functionally correct. I don't know
> about its security. I certainly can't rely on the toolchain to have
> security characteristics that are not guaranteed by the language
> definition. For example, I do trust memset_s() to zero out sensitive
> memory if the toolchain provides it, but I don't trust memset() for this
> task.
>
> On the topic at hand, my personal opinion of memory_buffer_alloc is that
> it doesn't belong in Mbed TLS. I hope that when PSA crypto is a
> standalone product, it won't use malloc internally, and so it certainly
> won't provide a malloc implementation. I wouldn't necessarily say the
> same thing of Mbed TLS 4.0: it's difficult to design an X.509 interface
> that doesn't use malloc. But if we can do it, I think we should.
>
> I recognize that there are many bare-metal applications that don't use
> malloc themselves, but use Mbed TLS. For their sake, it does make some
> sense for Mbed TLS to have its own malloc implementation. But the focus
> is for internal use, not on serving as a general-purpose allocator for
> applications that also use malloc for non-mbedtls-related purposes.
>
> --
> Gilles Peskine
> Mbed TLS developer
>
>
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
> --
> mbed-tls mailing list
> mbed-tls(a)lists.trustedfirmware.org
> https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
>
>
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
Hi,
Thank you for sharing your view, it makes perfect sense.
You mention that you would consider keeping the module internally for the sake of baremetal applications. How would this serve the user better than choosing a third party malloc implementation? (Assuming that there are better implementation out there than ours, which I haven't confirmed, but it is not hard to imagine that such exists.)
Regards,
Janos
On 15/04/2020, 21:11, "mbed-tls on behalf of Gilles Peskine via mbed-tls" <mbed-tls-bounces(a)lists.trustedfirmware.org on behalf of mbed-tls(a)lists.trustedfirmware.org> wrote:
On 09/04/2020 13:17, Janos Follath via mbed-tls wrote:
> Hi,
>
> Based on what I read on this thread it seems an accepted point of view that the toolchain provided C standard library implementations are less trusted than the toolchains themselves. Can somebody please help me understand the reasoning behind this distinction?
Well, I disagree with this statement. I trust the toolchain to implement
the C standard library correctly, and with good performance for the
target platform. I do not want to provide my own implementation of
standard functions.
I only trust the toolchain to be functionally correct. I don't know
about its security. I certainly can't rely on the toolchain to have
security characteristics that are not guaranteed by the language
definition. For example, I do trust memset_s() to zero out sensitive
memory if the toolchain provides it, but I don't trust memset() for this
task.
On the topic at hand, my personal opinion of memory_buffer_alloc is that
it doesn't belong in Mbed TLS. I hope that when PSA crypto is a
standalone product, it won't use malloc internally, and so it certainly
won't provide a malloc implementation. I wouldn't necessarily say the
same thing of Mbed TLS 4.0: it's difficult to design an X.509 interface
that doesn't use malloc. But if we can do it, I think we should.
I recognize that there are many bare-metal applications that don't use
malloc themselves, but use Mbed TLS. For their sake, it does make some
sense for Mbed TLS to have its own malloc implementation. But the focus
is for internal use, not on serving as a general-purpose allocator for
applications that also use malloc for non-mbedtls-related purposes.
--
Gilles Peskine
Mbed TLS developer
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
--
mbed-tls mailing list
mbed-tls(a)lists.trustedfirmware.org
https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
Hi Gilles,
Thanks for this precision, as well as the reminder of the existing github issue.
With no opposition here in a week, and none on github for nearly 3 months either, plus no opposition when we marked it as deprecated in 2.21 in February, I'm also moving this to the "Accepted" section on the wiki discussion tracking page: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/ - but again, it's still time to voice concerns until we've actually removed it from the code base.
Regards,
Manuel.
Hi Gilles,
Thanks for your feedback and for providing a link to the existing issue, which I completely forgot about - I'll reference that in the wiki as well.
Since it's been a week, with one agreement and no opposition, I'm also moving this to the "Accepted" section in the summary wiki page: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/ - though again, it you have concerns it's still time to voice them.
Regards,
Manuel.
Hi all,
Since this list of old options was probably not controversial in the first place and there has been no opposition in more than a week (a time that was sufficient for other thread in the same series to get several reactions), I'm moving this from "Under discussion" to "Accepted" in the summary wiki page: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/
This is not meant to shut down discussion and if you disagree or have concerns it's still time to voice them - this is just to simplify tracking of the discussions.
Best regards,
Manuel.
On 09/04/2020 13:17, Janos Follath via mbed-tls wrote:
> Hi,
>
> Based on what I read on this thread it seems an accepted point of view that the toolchain provided C standard library implementations are less trusted than the toolchains themselves. Can somebody please help me understand the reasoning behind this distinction?
Well, I disagree with this statement. I trust the toolchain to implement
the C standard library correctly, and with good performance for the
target platform. I do not want to provide my own implementation of
standard functions.
I only trust the toolchain to be functionally correct. I don't know
about its security. I certainly can't rely on the toolchain to have
security characteristics that are not guaranteed by the language
definition. For example, I do trust memset_s() to zero out sensitive
memory if the toolchain provides it, but I don't trust memset() for this
task.
On the topic at hand, my personal opinion of memory_buffer_alloc is that
it doesn't belong in Mbed TLS. I hope that when PSA crypto is a
standalone product, it won't use malloc internally, and so it certainly
won't provide a malloc implementation. I wouldn't necessarily say the
same thing of Mbed TLS 4.0: it's difficult to design an X.509 interface
that doesn't use malloc. But if we can do it, I think we should.
I recognize that there are many bare-metal applications that don't use
malloc themselves, but use Mbed TLS. For their sake, it does make some
sense for Mbed TLS to have its own malloc implementation. But the focus
is for internal use, not on serving as a general-purpose allocator for
applications that also use malloc for non-mbedtls-related purposes.
--
Gilles Peskine
Mbed TLS developer
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
Yes, we should remove it. Unlike other features, I think we should
remove HAVEGE _especially_ if someone is using it, because unlike the
rest of the library, I cannot vouch for its security. I don't even know
if our havege.c is implementing the HAVEGE specification correctly. And
I cannot think of a platform where HAVEGE would give a useful amount of
entropy, and where there isn't already a proper hardware RNG or an OS
kernel with its own entropy gathering built with knowledge of the actual
platform.
(Also noted on https://github.com/ARMmbed/mbedtls/issues/2599 .)
--
Gilles Peskine
Mbed TLS developer
On 08/04/2020 12:41, Manuel Pegourie-Gonnard via mbed-tls wrote:
> Hi all,
>
> In this new installment of "let's discuss ideas for Mbed TLS 3.0" [1]:
> should we remove havege.c from the code base?
>
> [1]: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/
>
> The crypto library currently includes an implementation of the HAVEGE entropy
> gatherer [2], which is disabled in the default build (MBEDTLS_HAVEGE_C in
> config.h), but used as a source by our entropy module if enabled.
>
> [2]: https://www.irisa.fr/caps/projects/hipsor/
>
> We'd like to drop this module and remove it from the code base entirely for
> the following reasons:
>
> - HAVEGE was designed for superscalar processors with high
> microarchitectural complexity, and is unsuitable for microcontrollers (or
> virtualized environments). We feel like when a complex enough CPU is used for
> HAVEGE to stand a chance of being secure, it's very likely that an operating
> system is also available, which probably already manages a random generator
> better that what we can do in user space.
>
> - On a more practical note, our implementation relies on `timing_hardclock()`
> provided by timing.c only for a limited number of architectures and
> environments (funnily enough, not including any Arm architecture), with a
> silent fallback to a definition relying on `gettimeofday()` which is clearly
> not high-resolution enough to make HAVEGE secure.
>
> - As with any random source, it is very difficult to assess whether HAVEGE is
> actually secure on any given platform. Further, the maintenance team
> doesn't have any specific knowledge of HAVEGE and there hasn't been any
> independent evaluation of our implementation of it.
>
> - As a result of the above points, we're afraid people using our HAVEGE
> implementation on the wrong platforms, might be getting a false sense of
> security, which might prevent them from using more secure options, such as the
> OS RNG (when using an OS) or a hardware RNG (on microcontrollers).
>
> If you're using MBEDTLS_HAVEGE_C or know someone who does, or if for any other
> reason you think we shouldn't drop it in Mbed TLS 3.0, please speak up now!
>
> Regards,
> Manuel.
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
Hello,
As noted in https://github.com/ARMmbed/mbedtls/issues/3006, I'm aware of
only one project that is using Mbed TLS's pkcs11-helper support:
OpenVPN. But this support has been removed from the development version.
--
Gilles Peskine
Mbed TLS developer
On 08/04/2020 12:37, Manuel Pegourie-Gonnard via mbed-tls wrote:
> Hi all,
>
> In this new installment of "let's discuss ideas for Mbed TLS 3.0" [1]:
> should we remove pkcs11.c from the code base?
>
> [1]: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/
>
> The X.509 library currently includes a module called "pkcs11", excluded from
> the default build, which provides a few wrappers around libpkcs11-helper [2],
> a library that "simplifies the interaction with PKCS#11 providers for end-user
> applications". In practice, it supports the use of X.509 certificates
> associated with an RSA key (not ECDSA) managed by libpkcs11-helper.
>
> [2]: https://github.com/OpenSC/pkcs11-helper
>
> We'd like to drop this module and remove it from the code base entirely for
> the following reasons:
>
> - It has limited functionality, and soon PSA Crypto will provide more flexible
> support for secure management of private keys (not just RSA, and not just
> associated with X.509 certificates).
>
> - It currently has not automated tests so we're not even sure if it still
> works properly.
>
> - The documentation is scarce and no member of the current maintenance team
> knows for sure how it's supposed to work.
>
> - We never receive any support request about it so we're not sure if anyone is
> still using it. (As a weaker signal in the same direction, we deprecated it
> in 2.21.0, released 2020-02-20, and nobody complained so far.)
>
> If you're using MBEDTLS_PKCS11_C or know someone who does, or if for any other
> reason you think we shouldn't drop it in Mbed TLS 3.0, please speak up now!
>
> Regards,
> Manuel.
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
Hello,
We're planning to make some changes to the way you can run Mbed TLS unit
tests on embedded platforms. We want to make it easier to run the tests
on platforms that have limited space for code and don't have a
filesystem to read data from.
At the moment, there are two ways to build the test suites. If you run
'make test', this builds one a host executable using host_test.function
for each test_suite_*.function and one “compiled” data file for each
test_suite_*.data, and the executable reads the compiled data file at
runtime. It's also possible to build an executable with
target_test.function, which includes calls to the Mbed-tools Greentea
library to communicate over the serial port, and you can use the script
mbedtls_test.py to run the tests with Greentea. Neither method works
directly for embedded platforms other than Mbed OS.
If you've run the Mbed TLS unit tests without reading the .datax file
from the filesystem, and without using Mbed OS and Greentea, how did you
do it? If you haven't run the unit tests but would like to do so, what
changes would you like to see what Mbed TLS provides?
I have a few more specific questions:
• Does Mbed TLS need to include some abstraction for serial
communication? If not, what would the interface of the test functions
be? (Tests can currently take inputs that are zero-terminated text
string, binary string with length, or int, and we'd like to add the
possibility to add other integer types such as uint64_t, but nothing
more complex. The outcome of a test is pass/fail/skip, and if fail/skip
location information about the failure.)
• Is it useful to have a way to build the test data into the executable,
so that the only interaction that the executable needs is to write out
the test results? It's more convenient but doesn't work everywhere (the
biggest test suite has >200kB of test data).
• Should test executables be self-contained in their reporting
(including error messages)? Or should they minimize code size, and then
you'd need an extra host-side script to make sense of results?
• The current .function-to-.c transformation script
(generate_test_code.py) generates a single C file with all of the test
code (but not the test data). Is this a useful requirement?
We welcome any thoughts you may have on the topic.
--
Gilles Peskine
Mbed TLS developer
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
Hi Dan,
Thank you for explaining, I see it now. I think we definitely should leave the choice open for Mbed TLS users and I agree that such a joint stdlib implementation project would be a much better place for a toolchain independent memory allocator.
Regards,
Janos
On 09/04/2020, 14:31, "mbed-tls on behalf of Dan Handley via mbed-tls" <mbed-tls-bounces(a)lists.trustedfirmware.org on behalf of mbed-tls(a)lists.trustedfirmware.org> wrote:
Hi Janos
It's not so much that the toolchain stdlib implementations are less trusted from a security point of view, it's that there is variation in their non-functional characteristics, e.g.
* security
* robustness
* code size
* performance
* open-ness
* ...
If you remove this variation it's easier to reason about the non-functional characteristics of the code. This is perhaps more important for projects that build final executable images but may also be important for libraries, especially ones that export executable link libraries like Mbed TLS.
On the other hand, Mbed TLS is deployed in many other places than Trusted Firmware and it may be hard to choose a stdlib implementation that works for all users. Perhaps the compromise is to create a shared stdlib implementation for Trusted Firmware deployments but leave the choice open for other Mbed TLS users?
Regards
Dan
> -----Original Message-----
> From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> On Behalf Of
> Janos Follath via mbed-tls
> Sent: 09 April 2020 12:18
> To: mbed-tls(a)lists.trustedfirmware.org
> Subject: Re: [mbed-tls] 3.0 plans: remove memory_buffer_alloc.c from the code
> base
>
> Hi,
>
> Based on what I read on this thread it seems an accepted point of view that
> the toolchain provided C standard library implementations are less trusted
> than the toolchains themselves. Can somebody please help me understand the
> reasoning behind this distinction?
>
> Regards,
> Janos
>
> On 09/04/2020, 12:07, "Dan Handley via mbed-tls" <mbed-
> tls(a)lists.trustedfirmware.org> wrote:
>
> Hi
>
> There has already been some discussion about a shared C standard library
> implementation, at least for TF-A and TF-M. So far there's been general
> agreement that this is a good idea but no actual commitment from anyone to
> make this happen, since each project is reasonably happy with what they've
> got.
>
> Regarding MBEDTLS_MEMORY_BUFFER_ALLOC_C, TF-A at least enables this so
> removing this from the codebase would be an issue there. Memory allocators
> are probably not the core expertise of other Trusted Firmware projects either
> but it needs to be if they're going to use them!
>
> I propose that we move this allocator into a new shared
> TrustedFirmware.org standard C library project and work with the other
> projects to ensure it has the correct initial maintainers. This will probably
> have to be driven by the maintainers of whichever project is most motivated
> to make this happen. It sounds like that could be Mbed TLS and this will need
> to be done before any separation of the PSA Crypto implementation. In the
> short term, as we move C stdlib functionality out of the other projects and
> into this new project, we will need to support multiple implementations of
> some functions. Eventually we should move towards a common implementation,
> and I agree we should look at what security-oriented implementations are
> already available.
>
> I also agree it would make sense for Mbed TLS to not use the toolchain-
> provided stdlib implementation by default, but only once it uses a default
> implementation it trusts.
>
> Regards
>
> Dan.
>
> > -----Original Message-----
> > From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> On Behalf
> Of
> > Ronald Cron via mbed-tls
> > Sent: 09 April 2020 08:47
> > To: mbed-tls(a)lists.trustedfirmware.org
> > Subject: Re: [mbed-tls] 3.0 plans: remove memory_buffer_alloc.c from
> the code
> > base
> >
> > Hi, I think this is related to the more general need for an
> implementation of
> > the C standard library for trusted firmware projects. As far as I know
> TF-A
> > and TF-M don't use the standard library provided by compilation
> toolchains.
> > The rationale is to have complete control over the trusted firmware
> code.
> > Currently they both have their own partial implementation of the parts
> of the
> > C standard library they need.
> >
> > This memory_buffer_alloc.c module in question here is another partial
> > implementation of the C standard library. Currently TF-A and TF-M don't
> > use/provide dynamic memory allocations but PSA-FF explicitly mentions
> that an
> > SPM implementation may support dynamic memory allocation. Thus it is
> possible
> > that TF-M at some point consider providing dynamic memory allocation
> support.
> >
> > All of this to say that a possible way forward may be to remove
> > memory_buffer_alloc.c from the code base when there is a C standard
> library
> > implementation common to trustedfirmware.org projects (is there already
> a
> > security oriented open source implementation out there ?).
> >
> > In Mbed TLS, it would also make sense to me to, by default, not use C
> > standard libraries provided by compilation toolchains
> > (MBEDTLS_PLATFORM_NO_STD_FUNCTIONS defined by default).
> >
> > Thanks, Ronald.
> >
> >
> > -----Original Message-----
> > From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> On Behalf
> Of
> > Manuel Pegourie-Gonnard via mbed-tls
> > Sent: 08 April 2020 12:42
> > To: mbed-tls(a)lists.trustedfirmware.org
> > Cc: nd <nd(a)arm.com>
> > Subject: [mbed-tls] 3.0 plans: remove memory_buffer_alloc.c from the
> code
> > base
> >
> > Hi all,
> >
> > In this new installment of "let's discuss ideas for Mbed TLS 3.0" [1]:
> > should we remove memory_buffer_alloc.c from the code base?
> >
> > [1]: https://developer.trustedfirmware.org/w/mbed-tls/tech-plans-3.0/
> >
> > Currently the crypto library includes a module called
> memory_buffer_alloc.c,
> > disabled in the default build (config.h option
> MBEDTLS_MEMORY_BUFFER_ALLOC_C),
> > which provides implementations of calloc() and free() based on a user-
> > provided buffer (which could be static or on the stack), suitable for
> use in
> > the rest of the crypto, X.509 and TLS libraries as replacements to the
> > standard functions.
> >
> > In addition to providing replacement calloc() and free(), the module
> also
> > offers some facilities for measurement and debugging.
> >
> > We're considering dropping this module and removing it from the code
> base
> > entirely for the following reasons:
> >
> > - Memory allocators are not our core area of expertise.
> >
> > - This allocator is pretty basic and has a large allocation overhead.
> For
> > example for ECC computations, the overhead can be as large as the
> actual
> > memory used.
> >
> > - Using this allocator also tends to slow things down, so we don't run
> many
> > tests with it enabled.
> >
> > - In the future when we split between PSA Crypto on one side and Mbed
> TLS and
> > X.509 on the other, it's unclear on which side this allocator should
> fall.
> > Which can be taken as a sign that it doesn't really belong here.
> >
> > On the other hand, we're hesitating for the following reasons:
> >
> > - We know from bug reports and questions that some people are using it.
> >
> > - Unlike other modules we'd like to drop, there isn't a strong security
> > incentive to dropping this allocator, it's merely a matter of how we
> spend
> > our maintenance resources.
> >
> > What do you think? Should we keep maintaining this allocator as part of
> Mbed
> > TLS? Should we drop it and focus on our core instead? If you're using
> this
> > allocator, why did you pick it over other alternatives?
> >
> > Regards,
> > Manuel.
> > --
> > mbed-tls mailing list
> > mbed-tls(a)lists.trustedfirmware.org
> > https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
> > IMPORTANT NOTICE: The contents of this email and any attachments are
> > confidential and may also be privileged. If you are not the intended
> > recipient, please notify the sender immediately and do not disclose the
> > contents to any other person, use it for any purpose, or store or copy
> the
> > information in any medium. Thank you.
> > --
> > mbed-tls mailing list
> > mbed-tls(a)lists.trustedfirmware.org
> > https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> --
> mbed-tls mailing list
> mbed-tls(a)lists.trustedfirmware.org
> https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
>
>
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> --
> mbed-tls mailing list
> mbed-tls(a)lists.trustedfirmware.org
> https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
--
mbed-tls mailing list
mbed-tls(a)lists.trustedfirmware.org
https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
Hi all,
this will be a long mail. Sorry for that.
In the past weeks I've been using mbedTLS 2.16.5 for implementing
crypto on an ARM Cortex M4 (STM32F479). This was my first experience
with mbedTLS, but I have some (almost 20 years) experience with
applied and high-assurance crypto. So maybe the following thoughts fit
into the discussion of plans for version 3.0 of Mbed TLS.
In the end, I achieved everything that was required for my project with
mbedTLS, but some things surprised me or it took a while to find out.
I'll enumerate the following points for easier reference. Nothing of
the following is meant to embarrass anyone, just my personal thoughts.
1. I really missed an Initialize, Update, Finalize (IUF) interface for
CCM.
For GCM, we have mbedtls_gcm_init(), mbedtls_gcm_setkey(),
mbedtls_gcm_starts(), mbedtls_gcm_update() iterated,
mbedtls_gcm_finish(), mbedtls_gcm_free() or the comfort functions
mbedtls_gcm_crypt_and_tag() and mbedtls_gcm_auth_decrypt(). For
CCM, only mbedtls_ccm_init(), mbedtls_ccm_setkey(),
mbedtls_ccm_encrypt_and_tag() or mbedtls_ccm_auth_decrypt() and
mbedtls_ccm_free(). With this interface it was only possible to
encrypt and tag 128 kByte on my target system, while with GCM I
could encrypt much larger files.
see Github issue #662 and my comment there
2. The next step, of course, is to integrate this into the higher
mbedtls_cipher layer.
Regarding higher, abstract layers: I often didn't understand which
interface I was supposed to use. In general, I like to use the
lowest available interface, for example, #include
"mbedtls/sha512.h" when I want to use sha512. However, if I need
HMAC-SHA-512 or HKDF-HMAC-SHA-512 then I have to use the interface
in md.h. For hash functions this is fine. Almost all hash functions
are supported via md.h. (I missed SHA-512/256 which is sometimes
preferable to SHA-256 on 64bit systems).
But with cipher.h, I can only access Chacha20Poly1305 and AES-GCM,
not AES-CCM.
3. For certification and evaluation purposes I need some test vectors
for each crypto function on target. While I know about the
comprehensive self-test program I'm now talking about built-in
functions like mbedtls_sha512_self_test(), etc to be enabled with
#define MBEDTLS_SELF_TEST.
These self-tests are very different in coverage. For SHA-384 and
SHA-512 they are fine, for HMAC-SHA-384 and HMAC-SHA-512 I couldn't
find any as well as for HKDF-HMAC-SHA-256 (in RFC 5869) or
HKDF-HMAC-SHA-384/512 (official test vectors difficult to find).
AES-CTR and AES-XTS are only tested with key length 128 bit, not with
256 bit. AES-CCM is not tested with 256 bit and even for 128 bit,
the test vector from the standard NIST SP 800-38C with long
additional data is not used.
The builtin self-test for GCM is the best I've seen with mbedtls:
all three key lengths are tested as well as the IUF-interface and
the comfort function. Bravo!
4. That I couldn't configure AES-256 only, i.e. without AES-128 and
AES-192, was to be expected (and the code overhead is not that
much). But in modern modes of operations nobody needs AES
decryption, only the forward direction. Sometimes modern
publications as Schwabe/Stoffelen "All the AES you need on
Cortex-M3 and M4" provide only the forward direction.
So, it would be fine if one could configure an AES (ECB) encryption
only without decryption.
Of course, this is only possible if we don't use CBC mode, etc.
This wouldn't only save the AES decryption code but also the rather
large T-tables for decryption.
5. Regarding AES or better the AES context-type definition
typedef struct mbedtls_aes_context
{
int nr; /*!< The number of rounds. */
uint32_t *rk; /*!< AES round keys. */
uint32_t buf[68]; /*!< Unaligned data buffer. This buffer can
hold 32 extra Bytes, which can be
used for
one of the following purposes:
<ul><li>Alignment if VIA padlock is
used.</li>
<li>Simplifying key expansion in
the 256-bit
case by generating an extra
round key.
</li></ul> */
}
mbedtls_aes_context;
I really don't understand why we need additional 2176 bit in EVERY
AES context. I would understand 128 bit (one block size) or even 512
bit (for example for CTR optimization which is not used!). But 2176
bit in every AES context? The VIA padlock is not very common, I
suppose. But even if it were, this doesn't justify such memory
overhead.
How wasteful this is, one can see in the next type definition
/**
* \brief The AES XTS context-type definition.
*/
typedef struct mbedtls_aes_xts_context
{
mbedtls_aes_context crypt; /*!< The AES context to use for AES block
encryption or decryption. */
mbedtls_aes_context tweak; /*!< The AES context used for tweak
computation. */
} mbedtls_aes_xts_context;
The tweak context is for the encryption of exactly 128 bit, not
more.
6. In general, the contexts of mbedTLS are rather full of
implementation specific details. Most extreme is mbedtls_ecp_group
in ecp.h. Wouldn't it be clearer if one separates the standard
things (domain parameters in this case) from implementation
specific details?
7. While at Elliptic Curve Cryptography: I assume that some of you
know that projectives coordinates as outer interface to ECC are
dangerous, see David Naccache, Nigel P. Smart, Jacques Stern:
Projective Coordinates Leak, Eurocrypt 2004, pp. 257–267.
Therefore, the usual interface in ECC standards are either affine
points or compressed affine points (Okay, with the modern curves
Curve25519 and Curve 448 it's X only.).
Now with
/**
* \brief The ECP point structure, in Jacobian coordinates.
*
* \note All functions expect and return points satisfying
* the following condition: <code>Z == 0</code> or
* <code>Z == 1</code>. Other values of \p Z are
* used only by internal functions.
* The point is zero, or "at infinity", if <code>Z ==
0</code>.
* Otherwise, \p X and \p Y are its standard (affine)
* coordinates.
*/
typedef struct mbedtls_ecp_point
{
mbedtls_mpi X; /*!< The X coordinate of the ECP point. */
mbedtls_mpi Y; /*!< The Y coordinate of the ECP point. */
mbedtls_mpi Z; /*!< The Z coordinate of the ECP point. */
}
mbedtls_ecp_point;
you have Jacobian coordinates, i.e. projective coordinates, as outer
interface. In the comment, its is noted that only the affine part is
used, but can this be assured? In all circumstances?
8. In my personal opinion the definition
/**
* \brief The ECP key-pair structure.
*
* A generic key-pair that may be used for ECDSA and fixed ECDH, for
example.
*
* \note Members are deliberately in the same order as in the
* ::mbedtls_ecdsa_context structure.
*/
typedef struct mbedtls_ecp_keypair
{
mbedtls_ecp_group grp; /*!< Elliptic curve and base point */
mbedtls_mpi d; /*!< our secret value */
mbedtls_ecp_point Q; /*!< our public value */
}
mbedtls_ecp_keypair;
is dangerous. Why not differentiate between private and public key
and domain parameters? How often does it happen by accident with
this structure that you give the private key (unneeded and
dangerous) together with the public key to ECDSA signature
verification? Obviously this was known (and perhaps it happened) to
the authors of programs\ecdsa.c with the following comment
/*
* Transfer public information to verifying context
*
* We could use the same context for verification and signatures, but we
* chose to use a new one in order to make it clear that the verifying
* context only needs the public key (Q), and not the private key (d).
*/
What is sometimes useful, is to have the public key at hand when you
have performed a private key operation (as countermeasure against
fault attacks, verify after signing). But for ECC the verification
procedure if often too expensive (in contrast to cheap RSA verify).
9. Regarding ECC examples: I found it very difficult that there isn't
a single example with known test vectors as in the relevant crypto
standards, i.e. FIPS 186-4 and ANSI X9.62-2005, with raw public
keys. What I mean are (defined) curves, public key value Q=(Qx,Qy)
and known signature values r and s. In the example ecdsa.c you
generate your own key pair and read/write the signature in
serialized form. In the example programs/pkey/pk_sign.c and
pk_verify.c you use a higher interface pk.h and keys in PEM format.
So, it took me a while for a program to verify (all) known answer
tests in the standards (old standards as ANSI X9.62 1998 have more
detailed known answer tests). One needs this interface with raw
public keys for example for CAVP tests, see The FIPS 186-4 Elliptic
Curve Digital Signature Algorithm Validation System (ECDSA2VS).
10. While debugging mbedtls_ecdsa_verify() in my example program, I
found out, that the ECDSA, ECC and MPI operations are very, let's
say, nested. So, IMHO there is a lot of function call overhead and
special cases. It would be interesting to see what's the
performance impact of a clean, straight-forward
mbedtls_ecdsa_verify without restartable code, etc. to the current
one.
11. In the moment, there is no single known answer tests for ECDSA
(which could be activated with #define MBEDTLS_SELF_TEST). I
wouldn't say that you need an example for every curve and hash
combination, as it is done in ECDSA2VS CAVP, but one example for
one of the NIST curves and one for Curve25519 and - if I have a
wish free - one for Brainpool would be fine. And this would solve
#9 above.
12. Just a minor issue: I only needed ECDSA signature verification,
therefore I only included MBEDTLS_ASN1_PARSE_C. But it is not
possible to compile without MBEDTLS_ASN1_WRITE_C needed for ECDSA
signature generation.
13. Feature request: Since it was irrelevant for my task (only
verification, no generation) I didn't have a detailed look a your
ECC side-channel countermeasures. But obviously you use the same
protected code for scalar multiplication in verify and sign,
right? Wouldn't it be possible to use Shamir's trick in
verification with fast unprotected multi-scalar multiplication. In
the moment, mbedtls_ecdsa_verify is a factor 4-5 slower than
mbedtls_ecdsa_sign, while OpenSSLs verify is faster than sign.
14. Design question: In the moment, both GCM and CCM use their own
implementation of CTR encryption which is very simple. But then we
have mbedtls_aes_crypt_ctr() in aes.h which is very simple, too.
Let's assume at one day we have a performance optimized CTR
encryption (for example from Schwabe & Stoffelen) with all fancy
stuff like counter-mode caching etc. Then this would have to be
replaced at three places at minimum. While isn't the code at this
point more modularized? Is this a dedicated design decision?
Why do I find at so many places
for( i = 0; i < 16; i++ )
y[i] ^= b[i];
instead of a fast 128-bit XOR macro with 32bit aligned data?
So, that's it for the moment. I hope I could give some hints for the
further development of mbedTLS. Feel free to discuss any of the above
points. It's clear to me that we cannot have both: clear and simple to
understand code and performance records.
Ciao,
Torsten
Hi,
An Mbed TLS Security Advisory has been issued to accompany the release of Mbed TLS versions 2.16.6 and 2.7.15, which have just been released.
These releases of Mbed TLS address several security issues, provide bug fixes, and bring other minor changes. Full details are available in the release notes<https://tls.mbed.org/techupdates/releases/mbedtls-2.16.6-and-2.7.15-released> and in the 2020-04 security advisory<https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi…>.
We recommend all users to consider whether they are impacted, and to upgrade appropriately.
--
Janos Follath
Mbed TLS Developer
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.