From bac592d53e8d088a55c8e0d5e20c7b897e1a3e83 Mon Sep 17 00:00:00 2001 From: Aditya Deshpande Date: Tue, 14 Feb 2023 14:55:49 +0000 Subject: Remove rand() from p256_generate_random() and move to an implementation based on mbedtls_ctr_drbg Signed-off-by: Aditya Deshpande --- 3rdparty/p256-m/README.md | 5 +++-- 3rdparty/p256-m/p256-m/p256-m.c | 34 ++++++++++++++++++++++++++++++---- 2 files changed, 33 insertions(+), 6 deletions(-) (limited to '3rdparty') diff --git a/3rdparty/p256-m/README.md b/3rdparty/p256-m/README.md index 5efbd12..497c401 100644 --- a/3rdparty/p256-m/README.md +++ b/3rdparty/p256-m/README.md @@ -1,3 +1,4 @@ -The files within the `p256-m/` subdirectory originate from the [p256-m GitHub repository](https://github.com/mpg/p256-m), which is distributed under the Apache 2.0 license. They are authored by Manuel Pégourié-Gonnard. The files `p256-m.c` and `.h` have been taken from the repository. p256-m is a minimalistic implementation of ECDH and ECDSA on NIST P-256, especially suited to constrained 32-bit environments. Mbed TLS documentation for integrating drivers uses p256-m as an example of a software accelerator, and describes how it can be integrated alongside Mbed TLS. +The files within the `p256-m/` subdirectory originate from the [p256-m GitHub repository](https://github.com/mpg/p256-m), which is distributed under the Apache 2.0 license. They are authored by Manuel Pégourié-Gonnard. p256-m is a minimalistic implementation of ECDH and ECDSA on NIST P-256, especially suited to constrained 32-bit environments. Mbed TLS documentation for integrating drivers uses p256-m as an example of a software accelerator, and describes how it can be integrated alongside Mbed TLS. -It should be noted that p256-m does not supply its own cryptographically secure RNG function. An implementation based on `rand()` (taken from `benchmark.c` in the p256-m repo) has been added to `p256-m.c` to support key generation. This means that while key generation will work, p256-m's key generation entry point should not be called in production builds. +The files `p256-m.c` and `.h`, along with the license, have been taken from the `p256-m` repository. +It should be noted that p256-m deliberately does not supply its own cryptographically secure RNG function. As a result, an RNG function using `mbedtls_ctr_dbrg` has been implemented and added to `p256m.c`. diff --git a/3rdparty/p256-m/p256-m/p256-m.c b/3rdparty/p256-m/p256-m/p256-m.c index 7f2f0f1..9e23a2d 100644 --- a/3rdparty/p256-m/p256-m/p256-m.c +++ b/3rdparty/p256-m/p256-m/p256-m.c @@ -6,7 +6,11 @@ */ #include "p256-m.h" +#include "mbedtls/entropy.h" +#include "mbedtls/ctr_drbg.h" +#include #include +#include /* * Zeroize memory - this should not be optimized away @@ -1149,14 +1153,36 @@ static int scalar_from_bytes(uint32_t s[8], const uint8_t p[32]) return -1; } -/* test version based on stdlib - never do this in production! */ +/* Using RNG functions from Mbed TLS as p256-m does not come with a + * cryptographically secure RNG function. + */ int p256_generate_random(uint8_t *output, unsigned output_size) { - for (unsigned i = 0; i < output_size; i++) { - output[i] = (uint8_t) rand(); +#if defined(MBEDTLS_CTR_DRBG_C) + mbedtls_entropy_context entropy; + mbedtls_ctr_drbg_context ctr_drbg; + char *personalization = "p256m"; + mbedtls_entropy_init(&entropy); + mbedtls_ctr_drbg_init(&ctr_drbg); + int ret; + + ret = mbedtls_ctr_drbg_seed(&ctr_drbg , mbedtls_entropy_func, &entropy, + (const unsigned char *) personalization, + strlen(personalization)); + if (ret != 0) { + goto exit; } - return 0; + ret = mbedtls_ctr_drbg_random(&ctr_drbg, output, output_size); + if (ret != 0) { + goto exit; + } + + return P256_SUCCESS; +#endif + +exit: + return P256_RANDOM_FAILED; } /* -- cgit v1.1