From 0231c7d145929b6ad9d0f08abb532d6dca82135a Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Thu, 16 Nov 2023 18:34:58 +0000 Subject: [PATCH 01/15] Introduce function to return library/core directory Add crypto_core_directory in build_tree.py so that the libary/core directory can be returned based on what repository we are in. Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index a657a5138..4a42d9a2b 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -21,6 +21,14 @@ def looks_like_mbedtls_root(path: str) -> bool: def looks_like_root(path: str) -> bool: return looks_like_tf_psa_crypto_root(path) or looks_like_mbedtls_root(path) +def crypto_core_directory() -> str: + if looks_like_tf_psa_crypto_root(os.path.curdir): + return "core" + elif looks_like_mbedtls_root(os.path.curdir): + return "library" + else: + raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') + def check_repo_path(): """ Check that the current working directory is the project root, and throw From 372e532d3e46dabeb61c776f0add8f3e2f1a7ab8 Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Wed, 22 Nov 2023 17:00:34 +0000 Subject: [PATCH 02/15] Improve implementation of crypto_core_directory Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index 4a42d9a2b..9c0b5ba96 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -7,6 +7,7 @@ import os import inspect +from typing import Optional def looks_like_tf_psa_crypto_root(path: str) -> bool: """Whether the given directory looks like the root of the PSA Crypto source tree.""" @@ -21,10 +22,12 @@ def looks_like_mbedtls_root(path: str) -> bool: def looks_like_root(path: str) -> bool: return looks_like_tf_psa_crypto_root(path) or looks_like_mbedtls_root(path) -def crypto_core_directory() -> str: - if looks_like_tf_psa_crypto_root(os.path.curdir): +def crypto_core_directory(root: Optional[str] = None) -> str: + if root is None: + root = guess_mbedtls_root() + if looks_like_tf_psa_crypto_root(root): return "core" - elif looks_like_mbedtls_root(os.path.curdir): + elif looks_like_mbedtls_root(root): return "library" else: raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') From d9903421d8ee4c751d9f944b327faebc606e3aaa Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Wed, 22 Nov 2023 17:18:22 +0000 Subject: [PATCH 03/15] Rename guess_mbedtls_root to guess_project_root Rename for consistency. Also, replace all calls to this function with correct name. Signed-off-by: Thomas Daubney --- scripts/audit-validity-dates.py | 2 +- scripts/framework_dev/build_tree.py | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/scripts/audit-validity-dates.py b/scripts/audit-validity-dates.py index 96b705a28..ab09b4a1e 100755 --- a/scripts/audit-validity-dates.py +++ b/scripts/audit-validity-dates.py @@ -265,7 +265,7 @@ class Auditor: @staticmethod def find_test_dir(): """Get the relative path for the Mbed TLS test directory.""" - return os.path.relpath(build_tree.guess_mbedtls_root() + '/tests') + return os.path.relpath(build_tree.guess_project_root() + '/tests') class TestDataAuditor(Auditor): diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index 9c0b5ba96..da455a7f2 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -24,7 +24,7 @@ def looks_like_root(path: str) -> bool: def crypto_core_directory(root: Optional[str] = None) -> str: if root is None: - root = guess_mbedtls_root() + root = guess_project_root() if looks_like_tf_psa_crypto_root(root): return "core" elif looks_like_mbedtls_root(root): @@ -55,10 +55,10 @@ def chdir_to_root() -> None: raise Exception('Mbed TLS source tree not found') -def guess_mbedtls_root(): - """Guess mbedTLS source code directory. +def guess_project_root(): + """Guess project source code directory. - Return the first possible mbedTLS root directory + Return the first possible project root directory. """ dirs = set({}) for frame in inspect.stack(): @@ -71,4 +71,4 @@ def guess_mbedtls_root(): dirs.add(d) if looks_like_root(d): return d - raise Exception('Mbed TLS source tree not found') + raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') From acf4569625dd505bf09ba8502fb40506e87f0309 Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Thu, 23 Nov 2023 10:14:12 +0000 Subject: [PATCH 04/15] Introduce project_crypto_name in build_tree.py Add new function to build_tree.py to return the crypto name for the project; either tfpsacrypto or mbedcrypto. Deploy this function where needed. Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index da455a7f2..f506c4142 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -32,6 +32,16 @@ def crypto_core_directory(root: Optional[str] = None) -> str: else: raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') +def project_crypto_name(root: Optional[str] = None) -> str: + if root is None: + root = guess_project_root() + if looks_like_tf_psa_crypto_root(root): + return "tfpsacrypto" + elif looks_like_mbedtls_root(root): + return "mbedcrypto" + else: + raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') + def check_repo_path(): """ Check that the current working directory is the project root, and throw From 415486a63b76be43b3e1c2e7da05a77d615b900e Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Fri, 24 Nov 2023 10:48:44 +0000 Subject: [PATCH 05/15] Use os.path.join in crypto_core_directory Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index f506c4142..fa309d3e6 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -26,9 +26,9 @@ def crypto_core_directory(root: Optional[str] = None) -> str: if root is None: root = guess_project_root() if looks_like_tf_psa_crypto_root(root): - return "core" + return os.path.join(root, "core") elif looks_like_mbedtls_root(root): - return "library" + return os.path.join(root, "library") else: raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') From ebae927a747f2959dd5df3b3bfabd855f08b4903 Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Fri, 24 Nov 2023 10:54:56 +0000 Subject: [PATCH 06/15] Add documentation for new public functions Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index fa309d3e6..4e0ae1953 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -23,6 +23,7 @@ def looks_like_root(path: str) -> bool: return looks_like_tf_psa_crypto_root(path) or looks_like_mbedtls_root(path) def crypto_core_directory(root: Optional[str] = None) -> str: + """Return the path of the library code for either TF-PSA-Crypto or Mbed TLS.""" if root is None: root = guess_project_root() if looks_like_tf_psa_crypto_root(root): @@ -33,6 +34,7 @@ def crypto_core_directory(root: Optional[str] = None) -> str: raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') def project_crypto_name(root: Optional[str] = None) -> str: + """Return the crypto library filename for either TF-PSA-Crypto or Mbed TLS.""" if root is None: root = guess_project_root() if looks_like_tf_psa_crypto_root(root): From f880d037c03d81c5d417fc033929a5d1ff606c71 Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Thu, 30 Nov 2023 13:56:09 +0000 Subject: [PATCH 07/15] Rename project_crypto_name Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index 4e0ae1953..c2a370d7e 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -33,7 +33,7 @@ def crypto_core_directory(root: Optional[str] = None) -> str: else: raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') -def project_crypto_name(root: Optional[str] = None) -> str: +def crypto_library_filename(root: Optional[str] = None) -> str: """Return the crypto library filename for either TF-PSA-Crypto or Mbed TLS.""" if root is None: root = guess_project_root() From 176d3a6f90698a1880d43aee7f19e2290867f6df Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Thu, 30 Nov 2023 13:59:30 +0000 Subject: [PATCH 08/15] Improve documentation of crypto_core_directory Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index c2a370d7e..ff8d57594 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -23,7 +23,10 @@ def looks_like_root(path: str) -> bool: return looks_like_tf_psa_crypto_root(path) or looks_like_mbedtls_root(path) def crypto_core_directory(root: Optional[str] = None) -> str: - """Return the path of the library code for either TF-PSA-Crypto or Mbed TLS.""" + """ + Return the path of the directory containing the PSA crypto core + for either TF-PSA-Crypto or Mbed TLS. + """ if root is None: root = guess_project_root() if looks_like_tf_psa_crypto_root(root): From d2eedbd27d4a509e2db13da41a2efc57334a30b1 Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Thu, 30 Nov 2023 17:25:55 +0000 Subject: [PATCH 09/15] Introduce guess_mbedtls_root Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index ff8d57594..1868a0f89 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -48,8 +48,7 @@ def crypto_library_filename(root: Optional[str] = None) -> str: raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') def check_repo_path(): - """ - Check that the current working directory is the project root, and throw + """Check that the current working directory is the project root, and throw an exception if not. """ if not all(os.path.isdir(d) for d in ["include", "library", "tests"]): @@ -69,7 +68,6 @@ def chdir_to_root() -> None: return raise Exception('Mbed TLS source tree not found') - def guess_project_root(): """Guess project source code directory. @@ -87,3 +85,16 @@ def guess_project_root(): if looks_like_root(d): return d raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') + +def guess_mbedtls_root(root: Optional[str] = None) -> str: + """Guess Mbed TLS source code directory. + + Return the first possible Mbed TLS root directory. + Raise an exception if we are not in Mbed TLS. + """ + if root is None: + root = guess_project_root() + if looks_like_mbedtls_root(root): + return root + else: + raise Exception('Mbed TLS source tree not found') From 19da414938b5db0ea560ee4b458264c79241e321 Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Thu, 30 Nov 2023 17:33:54 +0000 Subject: [PATCH 10/15] Introduce guess_tf_psa_crypto_root Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index 1868a0f89..86c838900 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -98,3 +98,16 @@ def guess_mbedtls_root(root: Optional[str] = None) -> str: return root else: raise Exception('Mbed TLS source tree not found') + +def guess_tf_psa_crypto_root(root: Optional[str] = None) -> str: + """Guess TF-PSA-Crypto source code directory. + + Return the first possible TF-PSA-Crypto root directory. + Raise an exception if we are not in TF-PSA-Crypto. + """ + if root is None: + root = guess_project_root() + if looks_like_tf_psa_crypto_root(root): + return root + else: + raise Exception('TF-PSA-Crypto source tree not found') From a62109a82213cf50ff4e15e21ccfbdb5dcbbee68 Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Fri, 1 Dec 2023 09:52:35 +0000 Subject: [PATCH 11/15] Remove trailing whitespace Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index 86c838900..14790fc9c 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -24,7 +24,7 @@ def looks_like_root(path: str) -> bool: def crypto_core_directory(root: Optional[str] = None) -> str: """ - Return the path of the directory containing the PSA crypto core + Return the path of the directory containing the PSA crypto core for either TF-PSA-Crypto or Mbed TLS. """ if root is None: From f8d03139d41bf41178559dcb63ed057ea35ea109 Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Fri, 1 Dec 2023 17:18:38 +0000 Subject: [PATCH 12/15] Modify crypto_core_directory to also return a relative path Signed-off-by: Thomas Daubney --- scripts/framework_dev/build_tree.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/scripts/framework_dev/build_tree.py b/scripts/framework_dev/build_tree.py index 14790fc9c..ec67e4cdf 100644 --- a/scripts/framework_dev/build_tree.py +++ b/scripts/framework_dev/build_tree.py @@ -22,16 +22,23 @@ def looks_like_mbedtls_root(path: str) -> bool: def looks_like_root(path: str) -> bool: return looks_like_tf_psa_crypto_root(path) or looks_like_mbedtls_root(path) -def crypto_core_directory(root: Optional[str] = None) -> str: +def crypto_core_directory(root: Optional[str] = None, relative: Optional[bool] = False) -> str: """ Return the path of the directory containing the PSA crypto core for either TF-PSA-Crypto or Mbed TLS. + + Returns either the full path or relative path depending on the + "relative" boolean argument. """ if root is None: root = guess_project_root() if looks_like_tf_psa_crypto_root(root): + if relative: + return "core" return os.path.join(root, "core") elif looks_like_mbedtls_root(root): + if relative: + return "library" return os.path.join(root, "library") else: raise Exception('Neither Mbed TLS nor TF-PSA-Crypto source tree found') From ebd330453ea1e4471a38cb5c3d2275913d1a48c6 Mon Sep 17 00:00:00 2001 From: Thomas Daubney Date: Fri, 1 Dec 2023 18:27:25 +0000 Subject: [PATCH 13/15] Use guess_mbedtls_root in Mbed-TLS-only script Signed-off-by: Thomas Daubney --- scripts/audit-validity-dates.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/audit-validity-dates.py b/scripts/audit-validity-dates.py index ab09b4a1e..96b705a28 100755 --- a/scripts/audit-validity-dates.py +++ b/scripts/audit-validity-dates.py @@ -265,7 +265,7 @@ class Auditor: @staticmethod def find_test_dir(): """Get the relative path for the Mbed TLS test directory.""" - return os.path.relpath(build_tree.guess_project_root() + '/tests') + return os.path.relpath(build_tree.guess_mbedtls_root() + '/tests') class TestDataAuditor(Auditor): From 4bcd1023d3448cbf81522d88cd0d8f5688fbc4c2 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 3 Jan 2024 20:50:56 +0100 Subject: [PATCH 14/15] Fix mixup between secp224r1 and secp224k1 in test scripts secp224k1 is the one with 225-bit private keys. The consequences of this mistake were: * We emitted positive test cases for hypothetical SECP_R1_225 and SECP_K1_224 curves, which were never executed. * We emitted useless not-supported test cases for SECP_R1_225 and SECP_K1_224. * We were missing positive test cases for SECP_R1_224 in automatically generated tests. * We were missing not-supported test cases for SECP_R1_224 and SECP_K1_225. Thus this didn't cause test failures, but it caused missing test coverage and some never-executed test cases. Signed-off-by: Gilles Peskine --- scripts/framework_dev/asymmetric_key_data.py | 4 ++-- scripts/framework_dev/crypto_knowledge.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/framework_dev/asymmetric_key_data.py b/scripts/framework_dev/asymmetric_key_data.py index ef3e3a05e..29d95d0e1 100644 --- a/scripts/framework_dev/asymmetric_key_data.py +++ b/scripts/framework_dev/asymmetric_key_data.py @@ -41,13 +41,13 @@ ASYMMETRIC_KEY_DATA = construct_asymmetric_key_data({ 'ECC(PSA_ECC_FAMILY_SECP_K1)': { 192: ("297ac1722ccac7589ecb240dc719842538ca974beb79f228", "0426b7bb38da649ac2138fc050c6548b32553dab68afebc36105d325b75538c12323cb0764789ecb992671beb2b6bef2f5"), - 224: ("0024122bf020fa113f6c0ac978dfbd41f749257a9468febdbe0dc9f7e8", + 225: ("0024122bf020fa113f6c0ac978dfbd41f749257a9468febdbe0dc9f7e8", "042cc7335f4b76042bed44ef45959a62aa215f7a5ff0c8111b8c44ed654ee71c1918326ad485b2d599fe2a6eab096ee26d977334d2bac6d61d"), 256: ("7fa06fa02d0e911b9a47fdc17d2d962ca01e2f31d60c6212d0ed7e3bba23a7b9", "045c39154579efd667adc73a81015a797d2c8682cdfbd3c3553c4a185d481cdc50e42a0e1cbc3ca29a32a645e927f54beaed14c9dbbf8279d725f5495ca924b24d"), }, 'ECC(PSA_ECC_FAMILY_SECP_R1)': { - 225: ("872f203b3ad35b7f2ecc803c3a0e1e0b1ed61cc1afe71b189cd4c995", + 224: ("872f203b3ad35b7f2ecc803c3a0e1e0b1ed61cc1afe71b189cd4c995", "046f00eadaa949fee3e9e1c7fa1247eecec86a0dce46418b9bd3117b981d4bd0ae7a990de912f9d060d6cb531a42d22e394ac29e81804bf160"), 256: ("49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee", "047772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b572590cdaf8f769361bcf34acfc11e5e074e8426bdde04be6e653945449617de45"), diff --git a/scripts/framework_dev/crypto_knowledge.py b/scripts/framework_dev/crypto_knowledge.py index 285d6c638..ebfd55cdb 100644 --- a/scripts/framework_dev/crypto_knowledge.py +++ b/scripts/framework_dev/crypto_knowledge.py @@ -131,8 +131,8 @@ class KeyType: 'PSA_DH_FAMILY_RFC7919': (2048, 3072, 4096, 6144, 8192), } # type: Dict[str, Tuple[int, ...]] ECC_KEY_SIZES = { - 'PSA_ECC_FAMILY_SECP_K1': (192, 224, 256), - 'PSA_ECC_FAMILY_SECP_R1': (225, 256, 384, 521), + 'PSA_ECC_FAMILY_SECP_K1': (192, 225, 256), + 'PSA_ECC_FAMILY_SECP_R1': (224, 256, 384, 521), 'PSA_ECC_FAMILY_SECP_R2': (160,), 'PSA_ECC_FAMILY_SECT_K1': (163, 233, 239, 283, 409, 571), 'PSA_ECC_FAMILY_SECT_R1': (163, 233, 283, 409, 571), From cee6a0669db86c09d0b12688820db32732b3d08f Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 3 Jan 2024 20:57:52 +0100 Subject: [PATCH 15/15] Add test data for secp192r1 Same generation methodology as b68a3588ac108799ece69faea399598c082e227c: ``` openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-192 -text |perl -0777 -pe 's/.*\npriv:([\n 0-9a-f:]*)pub:([\n 0-9a-f:]*).*/"$1","$2"/s or die; y/\n ://d; s/,/,\n /;' ``` Signed-off-by: Gilles Peskine --- scripts/framework_dev/asymmetric_key_data.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/framework_dev/asymmetric_key_data.py b/scripts/framework_dev/asymmetric_key_data.py index 29d95d0e1..8ca675878 100644 --- a/scripts/framework_dev/asymmetric_key_data.py +++ b/scripts/framework_dev/asymmetric_key_data.py @@ -47,6 +47,8 @@ ASYMMETRIC_KEY_DATA = construct_asymmetric_key_data({ "045c39154579efd667adc73a81015a797d2c8682cdfbd3c3553c4a185d481cdc50e42a0e1cbc3ca29a32a645e927f54beaed14c9dbbf8279d725f5495ca924b24d"), }, 'ECC(PSA_ECC_FAMILY_SECP_R1)': { + 192: ("d83b57a59c51358d9c8bbb898aff507f44dd14cf16917190", + "04e35fcbee11cec3154f80a1a61df7d7612de4f2fd70c5608d0ee3a4a1a5719471adb33966dd9b035fdb774feeba94b04c"), 224: ("872f203b3ad35b7f2ecc803c3a0e1e0b1ed61cc1afe71b189cd4c995", "046f00eadaa949fee3e9e1c7fa1247eecec86a0dce46418b9bd3117b981d4bd0ae7a990de912f9d060d6cb531a42d22e394ac29e81804bf160"), 256: ("49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee",