From 08c4362ad18f12ba5c291036ff0fec38f05bb9a5 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 15 Jan 2025 14:12:26 +0100 Subject: [PATCH 1/4] Update submodules Catch up with https://github.com/Mbed-TLS/mbedtls-framework/pull/104 = "Switch generate_psa_test.py to automatic dependencies for negative test cases" Signed-off-by: Gilles Peskine --- framework | 2 +- tf-psa-crypto | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/framework b/framework index 1ead596839..8296a73ce0 160000 --- a/framework +++ b/framework @@ -1 +1 @@ -Subproject commit 1ead5968394ac9e66b2ddb8fdb96faafcaa032de +Subproject commit 8296a73ce0cb31fadf411b6929a3201beece37a5 diff --git a/tf-psa-crypto b/tf-psa-crypto index 3671d64374..137b57776c 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 3671d643746853b4a49fe25dda7842d6c22c026b +Subproject commit 137b57776c3779fcc96e36141cf0fbe007e15674 From fe683e7a1b9de961698baa433ccb07cb8c67aa0c Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 9 Jan 2025 18:41:45 +0100 Subject: [PATCH 2/4] Remove test coverage exceptions that are no longer needed Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 47 ------------------------------- 1 file changed, 47 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 721ac4a7d6..36d58b9d0d 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -33,41 +33,6 @@ class CoverageTask(outcome_analysis.CoverageTask): r'.*\b(?:' + r'|'.join(words) + r')\b.*', re.DOTALL) - # generate_psa_tests.py generates test cases involving cryptographic - # mechanisms (key types, families, algorithms) that are declared but - # not implemented. Until we improve the Python scripts, ignore those - # test cases in the analysis. - # https://github.com/Mbed-TLS/mbedtls/issues/9572 - _PSA_MECHANISMS_NOT_IMPLEMENTED = [ - r'CBC_MAC', - r'DETERMINISTIC_DSA', - r'DET_DSA', - r'DSA', - r'ECC_KEY_PAIR\(BRAINPOOL_P_R1\) (?:160|192|224|320)-bit', - r'ECC_KEY_PAIR\(SECP_K1\) 225-bit', - r'ECC_PAIR\(BP_R1\) (?:160|192|224|320)-bit', - r'ECC_PAIR\(SECP_K1\) 225-bit', - r'ECC_PUBLIC_KEY\(BRAINPOOL_P_R1\) (?:160|192|224|320)-bit', - r'ECC_PUBLIC_KEY\(SECP_K1\) 225-bit', - r'ECC_PUB\(BP_R1\) (?:160|192|224|320)-bit', - r'ECC_PUB\(SECP_K1\) 225-bit', - r'ED25519PH', - r'ED448PH', - r'PEPPER', - r'PURE_EDDSA', - r'SECP_R2', - r'SECT_K1', - r'SECT_R1', - r'SECT_R2', - r'SHAKE256_512', - r'SHA_512_224', - r'SHA_512_256', - r'TWISTED_EDWARDS', - r'XTS', - ] - PSA_MECHANISM_NOT_IMPLEMENTED_SEARCH_RE = \ - _has_word_re(_PSA_MECHANISMS_NOT_IMPLEMENTED) - IGNORED_TESTS = { 'ssl-opt': [ # We don't run ssl-opt.sh with Valgrind on the CI because @@ -224,18 +189,6 @@ class CoverageTask(outcome_analysis.CoverageTask): 'PSA import DH_PUBLIC_KEY(RFC7919) 2048-bit group not supported', ], 'test_suite_psa_crypto_op_fail.generated': [ - # Ignore mechanisms that are not implemented, except - # for test cases that assume the mechanism is not supported. - _has_word_re(_PSA_MECHANISMS_NOT_IMPLEMENTED, - exclude=(r'.*: !(?:' + - r'|'.join(_PSA_MECHANISMS_NOT_IMPLEMENTED) + - r')\b')), - # Incorrect dependency generation. To be fixed as part of the - # resolution of https://github.com/Mbed-TLS/mbedtls/issues/9167 - # by forward-porting the commit - # "PSA test case generation: dependency inference class: operation fail" - # from https://github.com/Mbed-TLS/mbedtls/pull/9025 . - re.compile(r'.* with (?:DH|ECC)_(?:KEY_PAIR|PUBLIC_KEY)\(.*'), # We don't test this unusual, but sensible configuration. # https://github.com/Mbed-TLS/mbedtls/issues/9592 re.compile(r'.*: !ECDSA but DETERMINISTIC_ECDSA with ECC_.*'), From 13c418dceeb2fd2a6a6be3f5bde91842bba99d32 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 16 Jan 2025 19:49:12 +0100 Subject: [PATCH 3/4] Add ignore list entries for ECDH/FFDH algorithm without key type Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 36d58b9d0d..fd59822b59 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -196,6 +196,12 @@ class CoverageTask(outcome_analysis.CoverageTask): # key type disabled. Those dependencies don't really make sense. # https://github.com/Mbed-TLS/mbedtls/issues/9573 re.compile(r'.* !HMAC with HMAC'), + # We don't test with ECDH disabled but the key type enabled. + # https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/161 + re.compile(r'PSA key_agreement.* !ECDH with ECC_KEY_PAIR\(.*'), + # We don't test with FFDH disabled but the key type enabled. + # https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/160 + re.compile(r'PSA key_agreement.* !FFDH with DH_KEY_PAIR\(.*'), ], 'test_suite_psa_crypto_op_fail.misc': [ # We don't test this unusual, but sensible configuration. From 7dc570905e51dadad7fb7385b5c7c73a773f4571 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 20 Jan 2025 19:43:41 +0100 Subject: [PATCH 4/4] Update submodule Signed-off-by: Gilles Peskine --- tf-psa-crypto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf-psa-crypto b/tf-psa-crypto index 137b57776c..1bc29c97c9 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 137b57776c3779fcc96e36141cf0fbe007e15674 +Subproject commit 1bc29c97c99ad40aa9f17b5a873b391454c9c068