Skip to content

apps/mbedtls-alt: Provide system alternative implementation for mbedtls #2572

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 19, 2024

Conversation

ThePassionate
Copy link
Contributor

@ThePassionate ThePassionate commented Sep 14, 2024

Summary

  1. provide aes-cmac alternative implemetation.
    The computing process and software algorithm of AESCMAC are already provided in the crypto module of NuttX, and the mbedtls-alt interface is provided for the convenience of the upper layer, which can be used to directly replace the implementation of the mbedtls interface. Drive capability is used imperceptibly, and that replacement has gone through the MBEDTLS internal selftest case.
  2. provide hardware random for PSA.
    There is a conflict between using the PSA random number interface provided by MBEDTLS and trying to use AES to drive the acceleration function. This is due to the fact that the software random number source of the PSA is a global variable, and the driving ability of AES is exposed through fd, and there will be cross-process call errors. So there is a need to provide the ability for PSA to also use random number driven.

Impact

  1. The Nuttx encrypted driver capability can be used to independently implement the MBEDTLS interface, which can provide a general interface without using the driver capability imperceptibly
  2. Provides the ability for mbedTLS to use hardware random number drivers, but does not directly verify driver performance. In order to solve the conflict between the PSA global software random number entropy source and the MBEDTLS AES using cryptographic drivers

Testing

ci & mbedselftest

`ap> mbedselftest cmac

AES 128 CMAC subkey #1: passed
AES 128 CMAC subkey #2: passed
AES 128 CMAC subkey #3: passed
AES 128 CMAC subkey #4: passed
AES 128 CMAC #1: passed
AES 128 CMAC #2: passed
AES 128 CMAC #3: passed
AES 128 CMAC #4: passed`

Signed-off-by: makejian <makejian@xiaomi.com>
Copy link
Contributor

@cederom cederom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @ThePassionate :-)

  1. Please update PR Summary and git commit messages with more detailed description why the change is needed, what it does and how.
  2. Please update PR Impact section - there are two important impacts one is provision of new encryption method (why it is called alternative if it also comes from mbedtls?) and second is providing entropy from /dev/random that may be considered insecure (inadequate entropy). What hardware random number generator did you use? Did you verify its entropy?
  3. Please update PR Testing section with test run logs.
  4. There are build errors, I have restarted CI lets see if that helps.

@ThePassionate
Copy link
Contributor Author

  • Please update PR Testing section with test run logs.

thanks, 3 and 4 i will verify in local and update after.

@cederom
Copy link
Contributor

cederom commented Sep 16, 2024

Thank you @ThePassionate :-)

@ThePassionate ThePassionate force-pushed the nuttx-20240914 branch 2 times, most recently from c65d849 to ec6d1ce Compare September 18, 2024 03:41
Signed-off-by: makejian <makejian@xiaomi.com>
@xiaoxiang781216 xiaoxiang781216 merged commit 9a1a8d3 into apache:master Sep 19, 2024
25 of 27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants