Upgrade to Mbed TLS 2.21.0 and Mbed Crypto 3.1.0 #12767
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Update Mbed OS's PSA Crypto service to work with Mbed Crypto 3.x. - psa_asymmetric_verify() is now called psa_verify_hash(). - psa_asymmetric_sign() is now called psa_sign_hash(). Compatibilty wrappers are provided via crypto_compat.h for source-level backwards compatibility.
|
Note that this includes the commit "crypto: Update the service for Mbed Crypto 3.x " from #12150 |
|
Please review events failures in Travis |
|
Updated with "crypto: Use updated ECC curve macros" commit, to use new ECC curve macros instead of old ones. |
|
@Patater, thank you for your changes. |
Test run: FAILEDSummary: 3 of 3 test jobs failed Failed test jobs:
|
|
Please ignore lts jobs here , will be restarted |
|
started new CI job |
Test run: FAILEDSummary: 1 of 3 test jobs failed Failed test jobs:
|
|
Ci restarted |
Test run: FAILEDSummary: 1 of 10 test jobs failed Failed test jobs:
|
|
example restarted |
0xc0170
approved these changes
Apr 8, 2020
|
@adbridge @andypowers @bulislaw Please review and approve for 5.15.2 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of changes
Upgrade to Mbed TLS 2.21.0 and Mbed Crypto 3.1.0
Impact of changes
Migration actions required
What behavior changes are being made?
For security and NIST SP 800-90A compliance reasons, CTR DRBG now grabs a nonce from the entropy source if needed to provide the maximum security strength. A previously unused-before-seeding member of the CTR DRBG context,
mbedtls_ctr_drbg_context::reseed_counter, is used to hold the number of bytes the user has requested to include from the nonce viambedtls_ctr_drbg_set_nonce_len(), or-1to indicate that the entropy nonce length was not set explicitly. This means applications that were depending on areseed_countervalue of0to mean "not yet seeded" will need to instead handle errors from calls tombedtls_ctr_drbg_seed().What is being deprecated?
A few PSA Crypto asymmetric cryptography functions and macros, key usage definitions, and error code definitions have been renamed to better reflect their operation and to improve readability.
Why is this being deprecated?
The PSA Crypto API continues to develop as it heads towards its 1.0 release. Mbed Crypto 3.0.0d0 implements more of PSA Crypto 1.0b3 than was implemented in Mbed Crypto 2.x, and this brings along some API deprecations.
Mbed Crypto includes backwards compatibility macros (by way of
psa/crypto_compat.h) to provide source-level backwards compatibility, although it's recommended to stop using the deprecated APIs as soon as you are able to.Migration
To avoid using deprecated APIs, users of PSA Crypto should update to the new version of API.
psa_asymmetric_sign()psa_sign_hash()psa_asymmetric_verify()psa_verify_hash()PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE()PSA_SIGNATURE_MAX_SIZE()PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE()PSA_SIGN_OUTPUT_SIZE()PSA_KEY_USAGE_SIGNPSA_KEY_USAGE_SIGN_HASHPSA_KEY_USAGE_VERIFYPSA_KEY_USAGE_VERIFY_HASHPSA_ERROR_UNKNOWN_ERRORPSA_ERROR_GENERIC_ERRORPSA_ERROR_OCCUPIED_SLOTPSA_ERROR_ALREADY_EXISTSPSA_ERROR_EMPTY_SLOTPSA_ERROR_DOES_NOT_EXISTPSA_ERROR_INSUFFICIENT_CAPACITYPSA_ERROR_INSUFFICIENT_DATAPSA_ERROR_TAMPERING_DETECTEDPSA_ERROR_CORRUPTION_DETECTEDDocumentation
Pull request type
Test results
Reviewers
CC @andypowers