psa_generate_key_custom #9446
Merged
psa_generate_key_custom #9446
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
gilles-peskine-arm
added
bug
needs-review
6 tasks
valeriosetti
previously approved these changes
Aug 5, 2024
There was a problem hiding this comment.
This looks like a faithful forward-port of #9235 + the removal of "old" _key_ext stuff.
I would just ask @tom-cosgrove-arm to check the 2 last commits as they modify the Perl scripts and corresponding generated code for psasim. They look good to me, but having a second check might help :)
There seems to be a conflict with all.sh (due to #8226 I guess), but it should be easy to fix.
Implement `psa_generate_key_custom()` and `psa_key_derivation_output_key_custom()`. These functions replace `psa_generate_key_ext()` and `psa_key_derivation_output_key_ext()`. They have the same functionality, but a slightly different interface: the `ext` functions use a structure with a flexible array member to pass variable-length data, while the `custom` functions use a separate parameter. Keep the `ext` functions for backward compatibility with Mbed TLS 3.6.0. But make them a thin wrapper around the new `custom` functions. Duplicate the test code and data. The test cases have to be duplicated anyway, and the test functions are individually more readable this way. Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Replace references to the deprecated functions `psa_generate_key_ext()` and `psa_key_derivation_output_key_ext()` by their replacements Implement `psa_generate_key_custom()` and `psa_key_derivation_output_key_custom()`. Signed-off-by: Gilles Peskine <[email protected]>
Don't formally deprecate them because we don't do that in a long-time support branch. But do point readers away from them. Signed-off-by: Gilles Peskine <[email protected]>
We know it's a thin wrapper around psa_generate_key_custom, so we just need to check that it's passing the information through, we don't need coverage of the parameter interpretation. Signed-off-by: Gilles Peskine <[email protected]>
Document psa_generate_key_ext() and psa_key_derivation_output_key_ext() as deprecated in favor of psa_generate_key_custom() and psa_key_derivation_output_key_custom(), and no longer declared in C++ builds. Resolves Mbed-TLS#9020. Signed-off-by: Gilles Peskine <[email protected]>
In public headers, we want to avoid things that are not standard C++, including features that GCC and Clang support as extensions, such as flexible array members. So compile with `-pedantic`. Non-regression for Mbed-TLS#9020. Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Remove the experimental functions psa_generate_key_ext() and psa_key_derivation_output_key_ext(), which require a flexible array member and therefore break C++ code that includes Mbed TLS headers. They have been replaced by psa_generate_key_custom() and psa_key_derivation_output_key_custom(). Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
force-pushed
the
psa_generate_key_custom-development-forward_then_remove
branch
from
e92e117 to
7db1bcd
Compare
|
I've rebased on top of the latest |
valeriosetti
approved these changes
Aug 5, 2024
gilles-peskine-arm
added
approved
|
Gatekeeper note — the 3.6 backport is waiting on #9444. |
tom-cosgrove-arm
approved these changes
Aug 6, 2024
There was a problem hiding this comment.
I would just ask @tom-cosgrove-arm to check the 2 last commits as they modify the Perl scripts and corresponding generated code for
psasim. They look good to me, but having a second check might help :)
They look good to me too - thanks
| @@ -65,7 +65,7 @@ component_test_cmake_out_of_source () { | |||
| mkdir "$OUT_OF_SOURCE_DIR" | |||
| cd "$OUT_OF_SOURCE_DIR" | |||
| # Note: Explicitly generate files as these are turned off in releases | |||
| cmake -D CMAKE_BUILD_TYPE:String=Check -D GEN_FILES=ON "$MBEDTLS_ROOT_DIR" | |||
| cmake -D CMAKE_BUILD_TYPE:String=Check -D GEN_FILES=ON _D TEST_CPP=1 "$MBEDTLS_ROOT_DIR" | |||
There was a problem hiding this comment.
@gilles-peskine-arm Is this meant to be _D before TEST_CPP=1
There was a problem hiding this comment.
Oops, clearly a typo for -D (I do have _ on Shift+- on my keyboard). I wonder what cmake is doing there.
5 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Migrate from
psa_generate_key_ext()andpsa_key_derivation_output_key_ext()topsa_generate_key_custom()andpsa_key_derivation_output_key_custom():The API now matches the current state of ARM-software/psa-api#194.
Note to reviewers: I made this pull request by rebasing #9235 then adding commits to remove the old functions and fix problems that didn't arise in 3.6. I experimented a bit with writing a neater history where the existing functions and tests are modified rather than having commits to add the new stuff then commits to remove the old stuff. But this ended up with a giant commit that changes a lot of things, which wouldn't be very helpful in the history, and would be more of a pain to review.
If you'd like to rely on
git range-diff, it's a bit overwhelmed by the amount of patches that have moved (due to files being moved undertf-psa-crypto, the order in which the files are listed has changed). But you do get something useful withPR checklist