Update Mbed TLS and Mbed Crypto to latest as of 2019-12-20 #12150

Patater · 2019-12-20T12:04:20Z

Summary of changes

Upgrade to Mbed TLS 2.20.0d1 and Mbed Crypto 3.0.0d0.

Migration actions required

None

Documentation

None

Pull request type

[] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[] Feature update (New feature / Functionality change / New API)
[X] Major update (Breaking change E.g. Return code change / API behaviour change)

Test results

[] No Tests required for this change (E.g docs only update)
[X] Covered by existing mbed-os tests (Greentea or Unittest)
[] Tests / results supplied as part of this PR

Release Notes

What behavior changes are being made?
For security and NIST SP 800-90A compliance reasons, CTR DRBG now grabs a nonce from the entropy source if needed to provide the maximum security strength. A previously unused-before-seeding member of the CTR DRBG context, mbedtls_ctr_drbg_context::reseed_counter, is used to hold the number of bytes the user has requested to include from the nonce via mbedtls_ctr_drbg_set_nonce_len(), or -1 to indicate that the entropy nonce length was not set explicitly. This means applications that were depending on a reseed_counter value of 0 to mean "not yet seeded" will need to instead handle errors from calls to mbedtls_ctr_drbg_seed().

What is being deprecated?
A few PSA Crypto asymmetric cryptography functions and macros, key usage definitions, and error code definitions have been renamed to better reflect their operation and to improve readability.

Why is this being deprecated?
The PSA Crypto API continues to develop as it heads towards its 1.0 release. Mbed Crypto 3.0.0d0 implements more of PSA Crypto 1.0b3 than was implemented in Mbed Crypto 2.x, and this brings along some API deprecations.

Mbed Crypto includes backwards compatibility macros (by way of psa/crypto_compat.h) to provide source-level backwards compatibility, although it's recommended to stop using the deprecated APIs as soon as you are able to.

Migration
To avoid using deprecated APIs, users of PSA Crypto should update to the new version of API.

Old	New
`psa_asymmetric_sign()`	`psa_sign_hash()`
`psa_asymmetric_verify()`	`psa_verify_hash()`
`PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE()`	`PSA_SIGNATURE_MAX_SIZE()`
`PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE()`	`PSA_SIGN_OUTPUT_SIZE()`
`PSA_KEY_USAGE_SIGN`	`PSA_KEY_USAGE_SIGN_HASH`
`PSA_KEY_USAGE_VERIFY`	`PSA_KEY_USAGE_VERIFY_HASH`
`PSA_ERROR_UNKNOWN_ERROR`	`PSA_ERROR_GENERIC_ERROR`
`PSA_ERROR_OCCUPIED_SLOT`	`PSA_ERROR_ALREADY_EXISTS`
`PSA_ERROR_EMPTY_SLOT`	`PSA_ERROR_DOES_NOT_EXIST`
`PSA_ERROR_INSUFFICIENT_CAPACITY`	`PSA_ERROR_INSUFFICIENT_DATA`
`PSA_ERROR_TAMPERING_DETECTED`	`PSA_ERROR_CORRUPTION_DETECTED`

ciarmcom · 2019-12-20T14:00:43Z

@Patater, thank you for your changes.
@ARMmbed/mbed-os-tls @ARMmbed/mbed-os-crypto @ARMmbed/mbed-os-maintainers please review.

Patater · 2019-12-20T15:13:13Z

CI Started

mbed-ci · 2019-12-20T15:33:31Z

Test run: FAILED

Summary: 3 of 4 test jobs failed
Build number : 1
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-IAR
jenkins-ci/mbed-os-ci_build-ARM
jenkins-ci/mbed-os-ci_build-GCC_ARM

Update Mbed OS's PSA Crypto service to work with Mbed Crypto 3.x. - psa_asymmetric_verify() is now called psa_verify_hash(). - psa_asymmetric_sign() is now called psa_sign_hash(). Compatibilty wrappers are provided via crypto_compat.h for source-level backwards compatibility.

Patater · 2019-12-20T16:02:11Z

CI Started

mbed-ci · 2019-12-20T16:59:25Z

Test run: FAILED

Summary: 2 of 11 test jobs failed
Build number : 2
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_cloud-client-pytest
jenkins-ci/mbed-os-ci_greentea-test

bulislaw · 2019-12-23T10:51:26Z

It's a major change of crypto and i think some APIs moved, do we need a release note?

adbridge · 2019-12-23T16:41:03Z

It's a major change of crypto and i think some APIs moved, do we need a release note?

@Patater That is mandatory for a major change. All sections of the template header should be filled in please.

gilles-peskine-arm · 2019-12-26T17:42:23Z

@adbridge @bulislaw I can write some release notes. I'm not familiar with Mbed OS documentation and release processes, can you point me to some guidelines or examples and let me know where to submit the text?

bulislaw · 2019-12-27T09:13:58Z

Hey @gilles-peskine-arm have a look here #11687 you guys in TLS tend to write the best release notes :)

0xc0170

As requested previously, please add release notes for this update.

Patater · 2020-01-07T12:24:05Z

@bulislaw @0xc0170 I've updated this PR with release notes describing the API changes. No breaking change knowingly intended with this PR, but there are new PSA Crypto API deprecations.

0xc0170 · 2020-01-07T12:42:27Z

CI restarted

mbed-ci · 2020-01-07T15:25:56Z

Test run: FAILED

Summary: 1 of 11 test jobs failed
Build number : 3
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_cloud-client-pytest

0xc0170 · 2020-01-07T15:39:03Z

mbed-os-ci_cloud-client restarted

0xc0170 · 2020-01-08T12:34:48Z

@Patater It was at least 2x restarted. The failures are most probably valid and related to these changes. Please verify

Patater · 2020-01-10T12:26:43Z

@Patater It was at least 2x restarted. The failures are most probably valid and related to these changes. Please verify

I found a bug in Client's PAL that will need to be fixed before we can merge this. I raised a PR to fix the issue in Client.

Patater · 2020-01-23T17:28:02Z

The fix to Client will be released with version 4.3.0 of Client.

0xc0170 · 2020-02-06T09:12:11Z

The fix to Client will be released with version 4.3.0 of Client.

It was released this week, shall we progress with this PR now?

Patater · 2020-02-06T12:06:36Z

The fix to Client will be released with version 4.3.0 of Client.

It was released this week, shall we progress with this PR now?

Yes, please. Could we kick off CI and see if, now that CI will be testing with 4.3.0, anything will break?

Thanks!

0xc0170 · 2020-02-07T14:51:40Z

CI started

mbed-ci · 2020-02-07T17:13:43Z

Test run: SUCCESS

Summary: 11 of 11 test jobs passed
Build number : 4
Build artifacts

Patater added 2 commits December 20, 2019 11:54

crypto: Update to Mbed Crypto 3.0.0d0

3cff077

tls: Update Mbed TLS to 2.20.0d1

cfc9e9f

ciarmcom requested review from a team December 20, 2019 14:00

ciarmcom added the needs: review label Dec 20, 2019

dgreen-arm approved these changes Dec 20, 2019

View reviewed changes

Patater force-pushed the update-tls-crypto-20191220 branch from 37d6ae7 to 689274b Compare December 20, 2019 16:01

Patater mentioned this pull request Dec 20, 2019

Fix some pylint warnings ARMmbed/mbed-crypto#334

Merged

0xc0170 added needs: work and removed needs: review labels Jan 2, 2020

0xc0170 requested changes Jan 2, 2020

View reviewed changes

0xc0170 self-requested a review January 7, 2020 12:41

0xc0170 approved these changes Jan 7, 2020

View reviewed changes

0xc0170 added needs: CI and removed needs: work labels Jan 7, 2020

0xc0170 added the release-version: 6.0.0-alpha-1 First pre-release version of 6.0.0 label Jan 7, 2020

0xc0170 added needs: work needs: preceding PR and removed needs: CI needs: work labels Jan 8, 2020

mergify bot added the needs: work label Jan 20, 2020

adbridge added release-version: 6.0.0-alpha-2 Second pre-release version of 6.0.0 and removed release-version: 6.0.0-alpha-1 First pre-release version of 6.0.0 labels Jan 22, 2020

0xc0170 added needs: CI and removed needs: preceding PR needs: work labels Feb 7, 2020

mergify bot added ready for merge and removed needs: CI labels Feb 7, 2020

0xc0170 added the BREAKING-CHANGE label Feb 10, 2020

0xc0170 merged commit deb4995 into ARMmbed:master Feb 10, 2020

mergify bot removed the ready for merge label Feb 10, 2020

Patater mentioned this pull request Apr 7, 2020

Upgrade to Mbed TLS 2.21.0 and Mbed Crypto 3.1.0 #12767

Merged

Update Mbed TLS and Mbed Crypto to latest as of 2019-12-20 #12150

Update Mbed TLS and Mbed Crypto to latest as of 2019-12-20 #12150

Uh oh!

Conversation

Patater commented Dec 20, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of changes

Migration actions required

Documentation

Pull request type

Test results

Release Notes

Uh oh!

ciarmcom commented Dec 20, 2019

Uh oh!

Patater commented Dec 20, 2019

Uh oh!

mbed-ci commented Dec 20, 2019

Test run: FAILED

Uh oh!

Patater commented Dec 20, 2019

Uh oh!

mbed-ci commented Dec 20, 2019

Test run: FAILED

Uh oh!

bulislaw commented Dec 23, 2019

Uh oh!

adbridge commented Dec 23, 2019

Uh oh!

gilles-peskine-arm commented Dec 26, 2019

Uh oh!

bulislaw commented Dec 27, 2019

Uh oh!

0xc0170 left a comment

Choose a reason for hiding this comment

Uh oh!

Patater commented Jan 7, 2020

Uh oh!

0xc0170 commented Jan 7, 2020

Uh oh!

mbed-ci commented Jan 7, 2020

Test run: FAILED

Uh oh!

0xc0170 commented Jan 7, 2020

Uh oh!

0xc0170 commented Jan 8, 2020

Uh oh!

Patater commented Jan 10, 2020

Uh oh!

Patater commented Jan 23, 2020

Uh oh!

0xc0170 commented Feb 6, 2020

Uh oh!

Patater commented Feb 6, 2020

Uh oh!

0xc0170 commented Feb 7, 2020

Uh oh!

mbed-ci commented Feb 7, 2020

Test run: SUCCESS

Uh oh!

Uh oh!

Patater commented Dec 20, 2019 •

edited

Loading