Hi,
i wanted to ask if the hardware accelerators and TRNG of the Hardware
Security Engine (HSE) of NXP S32K3XX microcontrollers are supported by the
mbedTLS Library ? because i can't find it in the "MBEDTLS HARDWARE
CRYPTOGRAPHY SUPPORT" list.
Best regards,
Ben
+ Mbed TLS mailing list for visibility…
Regards,
Shebu
From: Rehan Malak via TF-M <tf-m(a)lists.trustedfirmware.org>
Sent: Monday, July 10, 2023 9:44 AM
To: Antonio De Angelis <Antonio.DeAngelis(a)arm.com>; tf-m(a)lists.trustedfirmware.org
Subject: [TF-M] Re: [EXTERNAL] Re: mbedtls_platform_setup/teardown in TF-M ?
Hi Antonio,
Thanks a lot for your answer !
Looking at the MbedTLS github link you sent (and the one therein)
- https://github.com/Mbed-TLS/mbedtls/issues/6228 PSA: separate driver initialization with a nicer fixed ordering
- https://github.com/Mbed-TLS/mbedtls/issues/6007 Define the PSA subsystem initialization interface in Mbed TLS
it seems that for the best would be indeed to provide feedback to the MbedTLS/PSA team such that TF-M could just run the adequate psa_* functions.
Thanks !
Rehan
Intrinsic ID
________________________________
From: Antonio De Angelis <Antonio.DeAngelis(a)arm.com<mailto:Antonio.DeAngelis@arm.com>>
Sent: Saturday, July 8, 2023 12:13 AM
To: tf-m(a)lists.trustedfirmware.org<mailto:tf-m@lists.trustedfirmware.org> <tf-m(a)lists.trustedfirmware.org<mailto:tf-m@lists.trustedfirmware.org>>; Rehan Malak <Rehan.Malak(a)intrinsic-id.com<mailto:Rehan.Malak@intrinsic-id.com>>
Subject: [EXTERNAL] Re: mbedtls_platform_setup/teardown in TF-M ?
Hi Rehan,
This looks like a non-PSA standardized feature specific to mbed TLS. We don't have any platform in TF-M that requires such setup/teardown so I can't comment from experience, but to me it looks like this would be an mbed TLS specific feature that needs to be hooked underneath the service and into the library. The most natural choice would be indeed to have them as part of the psa_crypto_init() and lower functions, but at this stage I think is not possible to implement this without patching the source code (i.e. there are no options to allow this at build time in TF-M, at least).
Note also that mbed TLS has a on open ongoing issue to better define the initialisation sequence for the various operations in psa_crypto_init(): PSA: separate driver initialization with a nicer fixed ordering · Issue #6228 · Mbed-TLS/mbedtls (github.com)<https://github.com/Mbed-TLS/mbedtls/issues/6228> It might be a good place to start to provide feedback regarding this particular aspect of custom platform initialisation if is not being considered there.
To conclude, if you want to propose a patch for TF-M to allow such functions to be plugged in (in the meantime that mbed TLS agrees on the long term course of action), I will be happy to review it.
Thanks,
Antonio
________________________________
From: Rehan Malak via TF-M <tf-m(a)lists.trustedfirmware.org<mailto:tf-m@lists.trustedfirmware.org>>
Sent: Friday, July 7, 2023 13:15
To: tf-m(a)lists.trustedfirmware.org<mailto:tf-m@lists.trustedfirmware.org> <tf-m(a)lists.trustedfirmware.org<mailto:tf-m@lists.trustedfirmware.org>>
Subject: [TF-M] mbedtls_platform_setup/teardown in TF-M ?
Dear TF-M developers,
I am currently adapting a basic MbedTLS / PSA Crypto example such that it would run on the NS side with TF-M doing the crypto.
At the end, this is very similar to this psa_sign_verify_message_test from the NS crypto test suite :
https://git.trustedfirmware.org/TF-M/tf-m-tests.git/tree/test/secure_fw/sui…
But my build config of MbedTLS has MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT enabled because I have a custom mbedtls_platform_setup / mbedtls_platform_teardown.
And I can't see any place in TF-M where mbedtls_platform_setup/mbedtls_platform_teardown are called :
? -> mbedtls_platform_setup
? -> mbedtls_platform_teardown
At first, I tried to put this code into the psa_driver_wrapper_init/psa_driver_wrapper_free but I have a similar problem :
tfm_crypto_engine_init -> psa_crypto_init -> psa_driver_wrapper_init
? -> mbedtls_psa_crypto_free -> psa_driver_wrapper_free
Is there any cmake/Kconfig option or any C macros to hook TF-M initialization/shutdown with mbedtls_platform_setup/mbedtls_platform_teardown without patching TF-M ?
If not, could mbedtls_platform_setup be called here ? https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/secure_fw/…
or is there a nicer way of doing this ?
(btw, I am currently experimenting on qemu mps2-an521)
Thanks for any advice ! 🙂
Best regards,
Rehan MALAK
Intrinsic ID
Hello,
This is a question for integrators and packagers of Mbed TLS, especially
if you're integrating the library in some embedded OS or BSP.
To build, configure and test Mbed TLS, we use Python for several purposes:
* To configure the library with scripts/config.py, unless you use the
default configuration or write your own configuration from scratch.
* To generate some configuration-independent library source files, but
only if you use the development branch, not if you use a release or
an LTS branch.
* To generate some glue code for PSA drivers, if you use PSA drivers
and don't write the glue code by hand.
* To generate the unit test source files.
* (We have many more maintenance and test scripts but they're out of
scope here.)
(Python is not necessary, and will remain unnecessary, to configure and
build the library with a given set of hardware drivers, so that a
typical BSP will not have to depend on Python.)
For each of these purposes, how problematic is it if we require a recent
version of Python? We're currently planning to drop support for older
versions of Python as soon as they become unsupported upstream (so
officially dropping 3.8 now — although right now all scripts still work
on 3.5). This includes versions of Python that are still shipped in e.g.
Linux distributions that are themselves officially supported. Is there
demand for supporting older Python versions for some scripts?
Also, how problematic is it if some of these purposes require
third-party Python packages?
Best regards,
--
Gilles Peskine
Mbed TLS developer
Hi All,
A gentle reminder that the US-Europe timezone-friendly MBed TLS Tech forum
is next Monday at 4:30 PM UK time. Invite details can be found on the
online calendar here <https://www.trustedfirmware.org/meetings/>.
If you have any topics, please let Dave Rodgman know. :)
Best regards,
Don Harbin
TrustedFirmware Community Manager
don.harbin(a)linaro.org
FYI to all TF dev teams leveraging Open CI.
Best regards,
Don
---------- Forwarded message ---------
From: Glen Valante via Tf-openci-triage <
tf-openci-triage(a)lists.trustedfirmware.org>
Date: Fri, 23 Jun 2023 at 08:41
Subject: [Tf-openci-triage] FYI; Cambridge Lab Down
To: tf-openci-triage(a)lists.trustedfirmware.org <
tf-openci-triage(a)lists.trustedfirmware.org>
Hello All;
FYI; the Cambridge lab took a serious power hit and is down. They are
scrambling to get things back up, but it may take all weekend.
Expect LAVA failures and other strange results.
Thanks;
-g
--
[image: Linaro] <http://www.linaro.org>
Glen Valante | *Director Program & Project Management*
T: +1.508.517.3461 <1617-320-5000>
glen.valante(a)linaro.org | Skype: gvalante <callto:gvalante>
--
Tf-openci-triage mailing list -- tf-openci-triage(a)lists.trustedfirmware.org
To unsubscribe send an email to
tf-openci-triage-leave(a)lists.trustedfirmware.org
Dear sir/madam,
Hope you are doing good!
We are working on a lightweight TLS implementation for embedded hardware
and want to add our own algorithm inside mbedTLS. As per my knowledge, we
have to add a .h file in mbedtls/include/mbedtls and .c file in the
library. Also, we have to list our algorithm in library/CMakeLists.txt.
Except these, what should be the procedure?
Also, our task is during handshake, the receiver chooses our algorithm
instead of the default one for encryption and decryption. If someone could
help us regarding this then it would be great.
Thanks in advance.
Regards,
--
*Dr. Vishal J. Rathod*
*(Member - IEEE, ACM, IET)*
*Senior Project Engineer (SPE),*
*IoT R & D Group,*
*C-DAC, Electronic City,*
*Bengaluru, Karnataka, India.*
*Email ID: rathodvishal78(a)gmail.com <rathodvishal78(a)gmail.com> and *
vishalrathod(a)ieee.org
*Mobile - 9879957770*
Hi!
I am a new MbedTLS user and would like to say thanks to devs first!
From my point of view mbedtls_net_connect() could handle binding socket to a specified local client port.
Although it does not seem to be a common requirement and bloats API a little bit but otherwise user has to throw away mbedtls_net_connect()
and implement connection function by their hands.
Best,
Alex
Hi Ruchika,
as an addition to the previous answers, there is also the SecureMark-TLS benchmark from EEMBC that "Analyzes the costs associated with implementing TLS on an edge device using a common IoT cyphersuite comprised of ECC & ECDSA on the NIST secp256r1 curve, SHA256, and AES128-CCM/ECB", see: https://www.eembc.org/securemark/
It provides profiles to run benchmarks against Mbed TLS API, PSA Crypto API, and wolfSSL, see sources here: https://github.com/eembc/securemark-tls/tree/main/examples/selfhosted/profi…
The chosen cipher-suite is similar to the TF-M medium profile and it allows estimates of speed and power consumption for TLS on microcontrollers. It also allows to add - manually - footprint data.
Best
Stephan
From: Ruchika Gupta via psa-crypto <psa-crypto(a)lists.trustedfirmware.org>
Reply to: Ruchika Gupta <ruchika.gupta_1(a)nxp.com>
Date: Tuesday, 16 May 2023 at 13:40
To: "mbed-tls(a)lists.trustedfirmware.org" <mbed-tls(a)lists.trustedfirmware.org>, "psa-crypto(a)lists.trustedfirmware.org" <psa-crypto(a)lists.trustedfirmware.org>
Subject: [psa-crypto] Benchmark application for PSA crypto API's
Hi,
For mbedtls API’s, there is a benchmark application available. Are there any plans to implement benchmark application for PSA crypto APIs ?
Regards,
Ruchika
Hi,
For mbedtls API's, there is a benchmark application available. Are there any plans to implement benchmark application for PSA crypto APIs ?
Regards,
Ruchika
Hello,
In mbedLS v3.4.0, I came across a build error that there are no members for type and flag in psa_core_keyattributes_t structure.
The following functions in psa_crypto_core.h access private members type and flag of psa_core_keyattributes_t structure without the MBEDTLS_PRIBATE() private access.
* psa_is_key_slot_occupied()
* psa_key_slot_get_flags()
* psa_key_slot_set_flags()
* psa_key_slot_set_bits_in_flags()
* psa_key_slot_clear_bits()
Updating to private access for attribute struct members in psa_crypto_core.h fixed the build errors.
Regards,
Archanaa
Hi All,
A gentle reminder that the US-Europe timezone-friendly MBed TLS Tech forum
is next Monday at 4:30 PM UK time. Invite details can be found on the
online calendar here <https://www.trustedfirmware.org/meetings/>.
If you have any topics, please let Dave Rodgman know. :)
Best regards,
Don Harbin
TrustedFirmware Community Manager
don.harbin(a)linaro.org
This event has been canceled with a note:
"Cancelled due to Bank Holiday"
MBed TLS Technical Forum
Monday May 8, 2023 ⋅ 8:30am – 9:30am
Mountain Standard Time - Phoenix
Trusted Firmware is inviting you to a scheduled Zoom meeting.
Topic: MBed TLS Technical Forum
Time: Oct 25, 2021 04:30 PM London
Every 4 weeks on Mon, 20 occurrence(s)
Oct 25, 2021 04:30 PM
Nov 22, 2021 04:30 PM
Dec 20, 2021 04:30 PM
Jan 17, 2022 04:30 PM
Feb 14, 2022 04:30 PM
Mar 14, 2022 04:30 PM
Apr 11, 2022 04:30 PM
May 9, 2022 04:30 PM
Jun 6, 2022 04:30 PM
Jul 4, 2022 04:30 PM
Aug 1, 2022 04:30 PM
Aug 29, 2022 04:30 PM
Sep 26, 2022 04:30 PM
Oct 24, 2022 04:30 PM
Nov 21, 2022 04:30 PM
Dec 19, 2022 04:30 PM
Jan 16, 2023 04:30 PM
Feb 13, 2023 04:30 PM
Mar 13, 2023 04:30 PM
Apr 10, 2023 04:30 PM
Please download and import the following iCalendar (.ics) files to your
calendar system.
Weekly:
https://linaro-org.zoom.us/meeting/tJEkceuurT4sGdaksikbUn6FARB9Kuk3ac2o/ics…
Join Zoom Meeting
https://linaro-org.zoom.us/j/95962635632?pwd=STFkQVltejAzRDJ6NmoxZjhmZC9RUT…
Meeting ID: 959 6263 5632
Passcode: 018366
One tap mobile
+13462487799,,95962635632# US (Houston)
+16699009128,,95962635632# US (San Jose)
Dial by your location
+1 346 248 7799 US (Houston)
+1 669 900 9128 US (San Jose)
+1 253 215 8782 US (Tacoma)
+1 312 626 6799 US (Chicago)
+1 646 558 8656 US (New York)
+1 301 715 8592 US (Washington DC)
877 853 5247 US Toll-free
888 788 0099 US Toll-free
Meeting ID: 959 6263 5632
Find your local number: https://linaro-org.zoom.us/u/aewUpnQu5y
Guests
nnac123(a)gmail.com
psa-crypto(a)lists.trustedfirmware.org
mbed-tls(a)lists.trustedfirmware.org
~~//~~
Invitation from Google Calendar: https://calendar.google.com/calendar/
You are receiving this email because you are an attendee on the event. To
stop receiving future updates for this event, decline this event.
Forwarding this invitation could allow any recipient to send a response to
the organizer, be added to the guest list, invite others regardless of
their own invitation status, or modify your RSVP.
Learn more https://support.google.com/calendar/answer/37135#forwarding
Hello,
To strengthen Mbed TLS against accidental misuse, we're going to enforce
a minimum size for RSA key generation. Currently the minimum is 128
bits, just to avoid some edge cases in the implementation. So for
example, if you want a 2048-bit key but accidentally pass a number of
bytes, the library will happily generate a 256-bit key. We want to
prevent this scenario.
What should the minimum be? If we make the minimum 2048 bits, will this
be a problem? We will not make the minimum any higher. But we're
considering enforcing only a minimum 1024 bits, which is over the record
from public breaks and largely resolves the risk of bits/bytes confusion.
Should we also enforce a minimum (perhaps lower) in the 2.28 long-time
support branch?
If you're using Mbed TLS to generate small RSA keys, please let us know
on the mailing list, on GitHub at
https://github.com/Mbed-TLS/mbedtls/issues/7556, or by private email.
Best regards,
--
Gilles Peskine
Mbed TLS developer
MBed TLS Technical Forum
Every 4 weeks from 9:30am to 10:30am on Monday
Mountain Standard Time - Phoenix
Trusted Firmware is inviting you to a scheduled Zoom meeting.
Topic: MBed TLS Technical Forum
Time: Oct 25, 2021 04:30 PM London
Every 4 weeks on Mon, 20 occurrence(s)
Oct 25, 2021 04:30 PM
Nov 22, 2021 04:30 PM
Dec 20, 2021 04:30 PM
Jan 17, 2022 04:30 PM
Feb 14, 2022 04:30 PM
Mar 14, 2022 04:30 PM
Apr 11, 2022 04:30 PM
May 9, 2022 04:30 PM
Jun 6, 2022 04:30 PM
Jul 4, 2022 04:30 PM
Aug 1, 2022 04:30 PM
Aug 29, 2022 04:30 PM
Sep 26, 2022 04:30 PM
Oct 24, 2022 04:30 PM
Nov 21, 2022 04:30 PM
Dec 19, 2022 04:30 PM
Jan 16, 2023 04:30 PM
Feb 13, 2023 04:30 PM
Mar 13, 2023 04:30 PM
Apr 10, 2023 04:30 PM
Please download and import the following iCalendar (.ics) files to your
calendar system.
Weekly:
https://linaro-org.zoom.us/meeting/tJEkceuurT4sGdaksikbUn6FARB9Kuk3ac2o/ics…
Join Zoom Meeting
https://linaro-org.zoom.us/j/95962635632?pwd=STFkQVltejAzRDJ6NmoxZjhmZC9RUT…
Meeting ID: 959 6263 5632
Passcode: 018366
One tap mobile
+13462487799,,95962635632# US (Houston)
+16699009128,,95962635632# US (San Jose)
Dial by your location
+1 346 248 7799 US (Houston)
+1 669 900 9128 US (San Jose)
+1 253 215 8782 US (Tacoma)
+1 312 626 6799 US (Chicago)
+1 646 558 8656 US (New York)
+1 301 715 8592 US (Washington DC)
877 853 5247 US Toll-free
888 788 0099 US Toll-free
Meeting ID: 959 6263 5632
Find your local number: https://linaro-org.zoom.us/u/aewUpnQu5y
Guests
psa-crypto(a)lists.trustedfirmware.org
mbed-tls(a)lists.trustedfirmware.org
nnac123(a)gmail.com
View all guest info
https://calendar.google.com/calendar/event?action=VIEW&eid=ZGExMnNqcDB1MDFm…
Reply for mbed-tls(a)lists.trustedfirmware.org and view more details
https://calendar.google.com/calendar/event?action=VIEW&eid=ZGExMnNqcDB1MDFm…
Your attendance is optional.
~~//~~
Invitation from Google Calendar: https://calendar.google.com/calendar/
You are receiving this email because you are an attendee on the event. To
stop receiving future updates for this event, decline this event.
Forwarding this invitation could allow any recipient to send a response to
the organizer, be added to the guest list, invite others regardless of
their own invitation status, or modify your RSVP.
Learn more https://support.google.com/calendar/answer/37135#forwarding
Hello,
using mbed TLS pavkaged with esp32 toolchain, for doing eap-tls with server certificate verification using CA cert.
Mbed TLS rejects certificate in mbedtls_x509_crt_check_key_usage (x509_crt.c), because usage_may variable is 0.
usage is set by mbedtls_ssl_check_cert_usage (ssl_tls.c) to MBEDTLS_X509_KU_DIGITAL_SIGNATURE because my keys are ECDHE-ECDSA.
Is this the expected behaviour ?
Thanks in advance
François
Hello,
I was working on packaging up mbedtls for [tea, a new package manager](https://tea.xyz/) and ran into an error validating the built products. I was hoping maybe someone more knowledgeable could take a quick look.
I followed the homebrew formula here: https://github.com/Homebrew/homebrew-core/blob/af8e7e97432944a65c0f985132a7…
Here's the PR for adding it to tea: https://github.com/teaxyz/pantry/pull/1822
For some reason I'm not getting the expected checksum from `generic_sum`. Any help would be much appreciated. Thanks!
-Joe
Hi Team,
I want to implement TLS over UART using MbedTLS library, But the issue i am facing right now is There are no example codes or any reference document for briefing how to import the libraries and what changes should be done to do so.
I tried to use some examples for Lwip examples but i am getting errors while importing library like platform error, timing_alt.h error.
Please help me out in urgent.
Thanks !!
I have created an http server following the example for server1 under FreeRTOS and Lwip running on a STM32H753 using the Stm32CubeIDE. Everything seem to work correctly, however, I am experiencing a small memory leak over each successive TLS connection of 160 bytes. It is obvious that I must not be freeing a context, but as I am following the example very closely, except for running the code in a FreeRTOS thread, I must be missing something fundemental. Has anyone on this list experienced a similar issue or have any ideas on how to debug it?
Hi All,
A gentle reminder that the Asia-Europe timezone-friendly MBed TLS Tech
forum is next Monday at 10:00am PM UK time. Invite details can be found on
the online calendar here <https://www.trustedfirmware.org/meetings/>.
If you have any topics, please let Dave Rodgman know. :)
Best regards,
Don Harbin
TrustedFirmware Community Manager
don.harbin(a)linaro.org
Hi
What's the best way to shutdown a network connection for when say an embedded device is shutting down or going to reboot?
I have the following code I call when I am going to kick off a reboot:
LOG_DEBUG("Network Manager: Ethernet is going down%s", networkManager->rebootInProgress ? "..." : " for reconfiguration...");
netifapi_dhcp_release_and_stop(&networkManager->networkInterfaceContext);
netifapi_netif_set_link_down(&networkManager->networkInterfaceContext);
netifapi_netif_set_down(&networkManager->networkInterfaceContext);
networkManager->ethernetLinkUp = false;
if (networkManager->rebootInProgress)
{
netifapi_netif_remove(&networkManager->networkInterfaceContext);
}
The trouble is that the link seems to come back up again as soon as it goes down and my state machine starts doing stuff like kicking off a new DHCP request etc, right about the time the hardware reboots.
I added in the call to netifapi_netif_remove() quite recently but it doesn't seem to make any difference.
I could put some more code in my link status state machine for an impending reboot, but this seems more complicated than it probably needs to be, as I'm probably not doing something I should be.
Gary Metalle
Senior Embedded Software Engineer
Hello,
What is the extent of PSA Crypto API 1.1 support available in mbedTLS today?
From the road map, API v1.0 is supported. I also see that PBKDF, which is in PSA API v1.1, is in development.
Regards,
Archanaa
This event has been canceled with a note:
"Bank Holiday - Cancelling "
MBed TLS Technical Forum
Monday Apr 10, 2023 ⋅ 8:30am – 9:30am
Mountain Standard Time - Phoenix
Trusted Firmware is inviting you to a scheduled Zoom meeting.
Topic: MBed TLS Technical Forum
Time: Oct 25, 2021 04:30 PM London
Every 4 weeks on Mon, 20 occurrence(s)
Oct 25, 2021 04:30 PM
Nov 22, 2021 04:30 PM
Dec 20, 2021 04:30 PM
Jan 17, 2022 04:30 PM
Feb 14, 2022 04:30 PM
Mar 14, 2022 04:30 PM
Apr 11, 2022 04:30 PM
May 9, 2022 04:30 PM
Jun 6, 2022 04:30 PM
Jul 4, 2022 04:30 PM
Aug 1, 2022 04:30 PM
Aug 29, 2022 04:30 PM
Sep 26, 2022 04:30 PM
Oct 24, 2022 04:30 PM
Nov 21, 2022 04:30 PM
Dec 19, 2022 04:30 PM
Jan 16, 2023 04:30 PM
Feb 13, 2023 04:30 PM
Mar 13, 2023 04:30 PM
Apr 10, 2023 04:30 PM
Please download and import the following iCalendar (.ics) files to your
calendar system.
Weekly:
https://linaro-org.zoom.us/meeting/tJEkceuurT4sGdaksikbUn6FARB9Kuk3ac2o/ics…
Join Zoom Meeting
https://linaro-org.zoom.us/j/95962635632?pwd=STFkQVltejAzRDJ6NmoxZjhmZC9RUT…
Meeting ID: 959 6263 5632
Passcode: 018366
One tap mobile
+13462487799,,95962635632# US (Houston)
+16699009128,,95962635632# US (San Jose)
Dial by your location
+1 346 248 7799 US (Houston)
+1 669 900 9128 US (San Jose)
+1 253 215 8782 US (Tacoma)
+1 312 626 6799 US (Chicago)
+1 646 558 8656 US (New York)
+1 301 715 8592 US (Washington DC)
877 853 5247 US Toll-free
888 788 0099 US Toll-free
Meeting ID: 959 6263 5632
Find your local number: https://linaro-org.zoom.us/u/aewUpnQu5y
Guests
nnac123(a)gmail.com
psa-crypto(a)lists.trustedfirmware.org
mbed-tls(a)lists.trustedfirmware.org
~~//~~
Invitation from Google Calendar: https://calendar.google.com/calendar/
You are receiving this email because you are an attendee on the event. To
stop receiving future updates for this event, decline this event.
Forwarding this invitation could allow any recipient to send a response to
the organizer, be added to the guest list, invite others regardless of
their own invitation status, or modify your RSVP.
Learn more https://support.google.com/calendar/answer/37135#forwarding