mirror of
https://github.com/dolphin-emu/dolphin.git
synced 2025-07-23 06:09:50 -06:00
Externals: Update mbedtls to 2.28.0
This commit is contained in:
8
Externals/mbedtls/include/CMakeLists.txt
vendored
8
Externals/mbedtls/include/CMakeLists.txt
vendored
@ -3,14 +3,20 @@ option(INSTALL_MBEDTLS_HEADERS "Install mbed TLS headers." ON)
|
||||
if(INSTALL_MBEDTLS_HEADERS)
|
||||
|
||||
file(GLOB headers "mbedtls/*.h")
|
||||
file(GLOB psa_headers "psa/*.h")
|
||||
|
||||
install(FILES ${headers}
|
||||
DESTINATION include/mbedtls
|
||||
PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
|
||||
|
||||
install(FILES ${psa_headers}
|
||||
DESTINATION include/psa
|
||||
PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
|
||||
|
||||
endif(INSTALL_MBEDTLS_HEADERS)
|
||||
|
||||
# Make config.h available in an out-of-source build. ssl-opt.sh requires it.
|
||||
if (NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR})
|
||||
if (ENABLE_TESTING AND NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR})
|
||||
link_to_source(mbedtls)
|
||||
link_to_source(psa)
|
||||
endif()
|
||||
|
41
Externals/mbedtls/include/mbedtls/aes.h
vendored
41
Externals/mbedtls/include/mbedtls/aes.h
vendored
@ -20,7 +20,8 @@
|
||||
* <https://ieeexplore.ieee.org/servlet/opac?punumber=4375278>.
|
||||
*/
|
||||
|
||||
/* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved.
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -34,18 +35,17 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_AES_H
|
||||
#define MBEDTLS_AES_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
@ -55,17 +55,22 @@
|
||||
#define MBEDTLS_AES_DECRYPT 0 /**< AES decryption. */
|
||||
|
||||
/* Error codes in range 0x0020-0x0022 */
|
||||
#define MBEDTLS_ERR_AES_INVALID_KEY_LENGTH -0x0020 /**< Invalid key length. */
|
||||
#define MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH -0x0022 /**< Invalid data input length. */
|
||||
/** Invalid key length. */
|
||||
#define MBEDTLS_ERR_AES_INVALID_KEY_LENGTH -0x0020
|
||||
/** Invalid data input length. */
|
||||
#define MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH -0x0022
|
||||
|
||||
/* Error codes in range 0x0021-0x0025 */
|
||||
#define MBEDTLS_ERR_AES_BAD_INPUT_DATA -0x0021 /**< Invalid input data. */
|
||||
/** Invalid input data. */
|
||||
#define MBEDTLS_ERR_AES_BAD_INPUT_DATA -0x0021
|
||||
|
||||
/* MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE -0x0023 /**< Feature not available. For example, an unsupported AES key size. */
|
||||
/** Feature not available. For example, an unsupported AES key size. */
|
||||
#define MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE -0x0023
|
||||
|
||||
/* MBEDTLS_ERR_AES_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_AES_HW_ACCEL_FAILED -0x0025 /**< AES hardware accelerator failed. */
|
||||
/** AES hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_AES_HW_ACCEL_FAILED -0x0025
|
||||
|
||||
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
||||
!defined(inline) && !defined(__cplusplus)
|
||||
@ -170,6 +175,7 @@ void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx );
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key,
|
||||
unsigned int keybits );
|
||||
|
||||
@ -188,6 +194,7 @@ int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key,
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key,
|
||||
unsigned int keybits );
|
||||
|
||||
@ -208,6 +215,7 @@ int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key,
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_xts_setkey_enc( mbedtls_aes_xts_context *ctx,
|
||||
const unsigned char *key,
|
||||
unsigned int keybits );
|
||||
@ -228,6 +236,7 @@ int mbedtls_aes_xts_setkey_enc( mbedtls_aes_xts_context *ctx,
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_xts_setkey_dec( mbedtls_aes_xts_context *ctx,
|
||||
const unsigned char *key,
|
||||
unsigned int keybits );
|
||||
@ -256,6 +265,7 @@ int mbedtls_aes_xts_setkey_dec( mbedtls_aes_xts_context *ctx,
|
||||
|
||||
* \return \c 0 on success.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
|
||||
int mode,
|
||||
const unsigned char input[16],
|
||||
@ -303,6 +313,7 @@ int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
|
||||
* \return #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH
|
||||
* on failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx,
|
||||
int mode,
|
||||
size_t length,
|
||||
@ -347,6 +358,7 @@ int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx,
|
||||
* smaller than an AES block in size (16 Bytes) or if \p
|
||||
* length is larger than 2^20 blocks (16 MiB).
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_crypt_xts( mbedtls_aes_xts_context *ctx,
|
||||
int mode,
|
||||
size_t length,
|
||||
@ -395,6 +407,7 @@ int mbedtls_aes_crypt_xts( mbedtls_aes_xts_context *ctx,
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx,
|
||||
int mode,
|
||||
size_t length,
|
||||
@ -439,6 +452,7 @@ int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx,
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx,
|
||||
int mode,
|
||||
size_t length,
|
||||
@ -493,6 +507,7 @@ int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx,
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx,
|
||||
size_t length,
|
||||
size_t *iv_off,
|
||||
@ -507,10 +522,6 @@ int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx,
|
||||
* \brief This function performs an AES-CTR encryption or decryption
|
||||
* operation.
|
||||
*
|
||||
* This function performs the operation defined in the \p mode
|
||||
* parameter (encrypt/decrypt), on the input data buffer
|
||||
* defined in the \p input parameter.
|
||||
*
|
||||
* Due to the nature of CTR, you must use the same key schedule
|
||||
* for both encryption and decryption operations. Therefore, you
|
||||
* must use the context initialized with mbedtls_aes_setkey_enc()
|
||||
@ -579,6 +590,7 @@ int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx,
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx,
|
||||
size_t length,
|
||||
size_t *nc_off,
|
||||
@ -599,6 +611,7 @@ int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx,
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
|
||||
const unsigned char input[16],
|
||||
unsigned char output[16] );
|
||||
@ -614,6 +627,7 @@ int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx,
|
||||
const unsigned char input[16],
|
||||
unsigned char output[16] );
|
||||
@ -663,6 +677,7 @@ MBEDTLS_DEPRECATED void mbedtls_aes_decrypt( mbedtls_aes_context *ctx,
|
||||
* \return \c 0 on success.
|
||||
* \return \c 1 on failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_CRITICAL
|
||||
int mbedtls_aes_self_test( int verbose );
|
||||
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
8
Externals/mbedtls/include/mbedtls/aesni.h
vendored
8
Externals/mbedtls/include/mbedtls/aesni.h
vendored
@ -7,7 +7,7 @@
|
||||
* functions; you must not call them directly.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -21,19 +21,17 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_AESNI_H
|
||||
#define MBEDTLS_AESNI_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "aes.h"
|
||||
#include "mbedtls/aes.h"
|
||||
|
||||
#define MBEDTLS_AESNI_AES 0x02000000u
|
||||
#define MBEDTLS_AESNI_CLMUL 0x00000002u
|
||||
|
9
Externals/mbedtls/include/mbedtls/arc4.h
vendored
9
Externals/mbedtls/include/mbedtls/arc4.h
vendored
@ -7,7 +7,7 @@
|
||||
* security risk. We recommend considering stronger ciphers instead.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -22,14 +22,12 @@
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*
|
||||
*/
|
||||
#ifndef MBEDTLS_ARC4_H
|
||||
#define MBEDTLS_ARC4_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -37,7 +35,8 @@
|
||||
#include <stddef.h>
|
||||
|
||||
/* MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED -0x0019 /**< ARC4 hardware accelerator failed. */
|
||||
/** ARC4 hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED -0x0019
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
29
Externals/mbedtls/include/mbedtls/aria.h
vendored
29
Externals/mbedtls/include/mbedtls/aria.h
vendored
@ -9,7 +9,8 @@
|
||||
* Korean, but see http://210.104.33.10/ARIA/index-e.html in English)
|
||||
* and also described by the IETF in <em>RFC 5794</em>.
|
||||
*/
|
||||
/* Copyright (C) 2006-2018, ARM Limited, All Rights Reserved
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -23,15 +24,13 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_ARIA_H
|
||||
#define MBEDTLS_ARIA_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -39,7 +38,7 @@
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "platform_util.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#define MBEDTLS_ARIA_ENCRYPT 1 /**< ARIA encryption. */
|
||||
#define MBEDTLS_ARIA_DECRYPT 0 /**< ARIA decryption. */
|
||||
@ -51,25 +50,29 @@
|
||||
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#define MBEDTLS_ERR_ARIA_INVALID_KEY_LENGTH MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( -0x005C )
|
||||
#endif /* !MBEDTLS_DEPRECATED_REMOVED */
|
||||
#define MBEDTLS_ERR_ARIA_BAD_INPUT_DATA -0x005C /**< Bad input data. */
|
||||
/** Bad input data. */
|
||||
#define MBEDTLS_ERR_ARIA_BAD_INPUT_DATA -0x005C
|
||||
|
||||
#define MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH -0x005E /**< Invalid data input length. */
|
||||
/** Invalid data input length. */
|
||||
#define MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH -0x005E
|
||||
|
||||
/* MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE is deprecated and should not be used.
|
||||
*/
|
||||
#define MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE -0x005A /**< Feature not available. For example, an unsupported ARIA key size. */
|
||||
/** Feature not available. For example, an unsupported ARIA key size. */
|
||||
#define MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE -0x005A
|
||||
|
||||
/* MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED -0x0058 /**< ARIA hardware accelerator failed. */
|
||||
|
||||
#if !defined(MBEDTLS_ARIA_ALT)
|
||||
// Regular implementation
|
||||
//
|
||||
/** ARIA hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED -0x0058
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_ARIA_ALT)
|
||||
// Regular implementation
|
||||
//
|
||||
|
||||
/**
|
||||
* \brief The ARIA context-type definition.
|
||||
*/
|
||||
|
416
Externals/mbedtls/include/mbedtls/asn1.h
vendored
416
Externals/mbedtls/include/mbedtls/asn1.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Generic ASN.1 parsing
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_ASN1_H
|
||||
#define MBEDTLS_ASN1_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -33,7 +31,7 @@
|
||||
#include <stddef.h>
|
||||
|
||||
#if defined(MBEDTLS_BIGNUM_C)
|
||||
#include "bignum.h"
|
||||
#include "mbedtls/bignum.h"
|
||||
#endif
|
||||
|
||||
/**
|
||||
@ -48,13 +46,20 @@
|
||||
* ASN1 is a standard to specify data structures.
|
||||
* \{
|
||||
*/
|
||||
#define MBEDTLS_ERR_ASN1_OUT_OF_DATA -0x0060 /**< Out of data when parsing an ASN1 data structure. */
|
||||
#define MBEDTLS_ERR_ASN1_UNEXPECTED_TAG -0x0062 /**< ASN1 tag was of an unexpected value. */
|
||||
#define MBEDTLS_ERR_ASN1_INVALID_LENGTH -0x0064 /**< Error when trying to determine the length or invalid length. */
|
||||
#define MBEDTLS_ERR_ASN1_LENGTH_MISMATCH -0x0066 /**< Actual length differs from expected length. */
|
||||
#define MBEDTLS_ERR_ASN1_INVALID_DATA -0x0068 /**< Data is invalid. (not used) */
|
||||
#define MBEDTLS_ERR_ASN1_ALLOC_FAILED -0x006A /**< Memory allocation failed */
|
||||
#define MBEDTLS_ERR_ASN1_BUF_TOO_SMALL -0x006C /**< Buffer too small when writing ASN.1 data structure. */
|
||||
/** Out of data when parsing an ASN1 data structure. */
|
||||
#define MBEDTLS_ERR_ASN1_OUT_OF_DATA -0x0060
|
||||
/** ASN1 tag was of an unexpected value. */
|
||||
#define MBEDTLS_ERR_ASN1_UNEXPECTED_TAG -0x0062
|
||||
/** Error when trying to determine the length or invalid length. */
|
||||
#define MBEDTLS_ERR_ASN1_INVALID_LENGTH -0x0064
|
||||
/** Actual length differs from expected length. */
|
||||
#define MBEDTLS_ERR_ASN1_LENGTH_MISMATCH -0x0066
|
||||
/** Data is invalid. */
|
||||
#define MBEDTLS_ERR_ASN1_INVALID_DATA -0x0068
|
||||
/** Memory allocation failed */
|
||||
#define MBEDTLS_ERR_ASN1_ALLOC_FAILED -0x006A
|
||||
/** Buffer too small when writing ASN.1 data structure. */
|
||||
#define MBEDTLS_ERR_ASN1_BUF_TOO_SMALL -0x006C
|
||||
|
||||
/* \} name */
|
||||
|
||||
@ -75,6 +80,7 @@
|
||||
#define MBEDTLS_ASN1_OCTET_STRING 0x04
|
||||
#define MBEDTLS_ASN1_NULL 0x05
|
||||
#define MBEDTLS_ASN1_OID 0x06
|
||||
#define MBEDTLS_ASN1_ENUMERATED 0x0A
|
||||
#define MBEDTLS_ASN1_UTF8_STRING 0x0C
|
||||
#define MBEDTLS_ASN1_SEQUENCE 0x10
|
||||
#define MBEDTLS_ASN1_SET 0x11
|
||||
@ -89,6 +95,18 @@
|
||||
#define MBEDTLS_ASN1_CONSTRUCTED 0x20
|
||||
#define MBEDTLS_ASN1_CONTEXT_SPECIFIC 0x80
|
||||
|
||||
/* Slightly smaller way to check if tag is a string tag
|
||||
* compared to canonical implementation. */
|
||||
#define MBEDTLS_ASN1_IS_STRING_TAG( tag ) \
|
||||
( ( tag ) < 32u && ( \
|
||||
( ( 1u << ( tag ) ) & ( ( 1u << MBEDTLS_ASN1_BMP_STRING ) | \
|
||||
( 1u << MBEDTLS_ASN1_UTF8_STRING ) | \
|
||||
( 1u << MBEDTLS_ASN1_T61_STRING ) | \
|
||||
( 1u << MBEDTLS_ASN1_IA5_STRING ) | \
|
||||
( 1u << MBEDTLS_ASN1_UNIVERSAL_STRING ) | \
|
||||
( 1u << MBEDTLS_ASN1_PRINTABLE_STRING ) | \
|
||||
( 1u << MBEDTLS_ASN1_BIT_STRING ) ) ) != 0 ) )
|
||||
|
||||
/*
|
||||
* Bit masks for each of the components of an ASN.1 tag as specified in
|
||||
* ITU X.690 (08/2015), section 8.1 "General rules for encoding",
|
||||
@ -119,6 +137,10 @@
|
||||
( ( MBEDTLS_OID_SIZE(oid_str) != (oid_buf)->len ) || \
|
||||
memcmp( (oid_str), (oid_buf)->p, (oid_buf)->len) != 0 )
|
||||
|
||||
#define MBEDTLS_OID_CMP_RAW(oid_str, oid_buf, oid_buf_len) \
|
||||
( ( MBEDTLS_OID_SIZE(oid_str) != (oid_buf_len) ) || \
|
||||
memcmp( (oid_str), (oid_buf), (oid_buf_len) ) != 0 )
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
@ -176,119 +198,342 @@ mbedtls_asn1_named_data;
|
||||
* \brief Get the length of an ASN.1 element.
|
||||
* Updates the pointer to immediately behind the length.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param len The variable that will receive the value
|
||||
* \param p On entry, \c *p points to the first byte of the length,
|
||||
* i.e. immediately after the tag.
|
||||
* On successful completion, \c *p points to the first byte
|
||||
* after the length, i.e. the first byte of the content.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param len On successful completion, \c *len contains the length
|
||||
* read from the ASN.1 input.
|
||||
*
|
||||
* \return 0 if successful, MBEDTLS_ERR_ASN1_OUT_OF_DATA on reaching
|
||||
* end of data, MBEDTLS_ERR_ASN1_INVALID_LENGTH if length is
|
||||
* unparseable.
|
||||
* \return 0 if successful.
|
||||
* \return #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element
|
||||
* would end beyond \p end.
|
||||
* \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparseable.
|
||||
*/
|
||||
int mbedtls_asn1_get_len( unsigned char **p,
|
||||
const unsigned char *end,
|
||||
size_t *len );
|
||||
const unsigned char *end,
|
||||
size_t *len );
|
||||
|
||||
/**
|
||||
* \brief Get the tag and length of the tag. Check for the requested tag.
|
||||
* \brief Get the tag and length of the element.
|
||||
* Check for the requested tag.
|
||||
* Updates the pointer to immediately behind the tag and length.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param len The variable that will receive the length
|
||||
* \param tag The expected tag
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p points to the first byte
|
||||
* after the length, i.e. the first byte of the content.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param len On successful completion, \c *len contains the length
|
||||
* read from the ASN.1 input.
|
||||
* \param tag The expected tag.
|
||||
*
|
||||
* \return 0 if successful, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if tag did
|
||||
* not match requested tag, or another specific ASN.1 error code.
|
||||
* \return 0 if successful.
|
||||
* \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the data does not start
|
||||
* with the requested tag.
|
||||
* \return #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element
|
||||
* would end beyond \p end.
|
||||
* \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparseable.
|
||||
*/
|
||||
int mbedtls_asn1_get_tag( unsigned char **p,
|
||||
const unsigned char *end,
|
||||
size_t *len, int tag );
|
||||
const unsigned char *end,
|
||||
size_t *len, int tag );
|
||||
|
||||
/**
|
||||
* \brief Retrieve a boolean ASN.1 tag and its value.
|
||||
* Updates the pointer to immediately behind the full tag.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param val The variable that will receive the value
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p points to the first byte
|
||||
* beyond the ASN.1 element.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param val On success, the parsed value (\c 0 or \c 1).
|
||||
*
|
||||
* \return 0 if successful or a specific ASN.1 error code.
|
||||
* \return 0 if successful.
|
||||
* \return An ASN.1 error code if the input does not start with
|
||||
* a valid ASN.1 BOOLEAN.
|
||||
*/
|
||||
int mbedtls_asn1_get_bool( unsigned char **p,
|
||||
const unsigned char *end,
|
||||
int *val );
|
||||
const unsigned char *end,
|
||||
int *val );
|
||||
|
||||
/**
|
||||
* \brief Retrieve an integer ASN.1 tag and its value.
|
||||
* Updates the pointer to immediately behind the full tag.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param val The variable that will receive the value
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p points to the first byte
|
||||
* beyond the ASN.1 element.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param val On success, the parsed value.
|
||||
*
|
||||
* \return 0 if successful or a specific ASN.1 error code.
|
||||
* \return 0 if successful.
|
||||
* \return An ASN.1 error code if the input does not start with
|
||||
* a valid ASN.1 INTEGER.
|
||||
* \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does
|
||||
* not fit in an \c int.
|
||||
*/
|
||||
int mbedtls_asn1_get_int( unsigned char **p,
|
||||
const unsigned char *end,
|
||||
int *val );
|
||||
const unsigned char *end,
|
||||
int *val );
|
||||
|
||||
/**
|
||||
* \brief Retrieve an enumerated ASN.1 tag and its value.
|
||||
* Updates the pointer to immediately behind the full tag.
|
||||
*
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p points to the first byte
|
||||
* beyond the ASN.1 element.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param val On success, the parsed value.
|
||||
*
|
||||
* \return 0 if successful.
|
||||
* \return An ASN.1 error code if the input does not start with
|
||||
* a valid ASN.1 ENUMERATED.
|
||||
* \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does
|
||||
* not fit in an \c int.
|
||||
*/
|
||||
int mbedtls_asn1_get_enum( unsigned char **p,
|
||||
const unsigned char *end,
|
||||
int *val );
|
||||
|
||||
/**
|
||||
* \brief Retrieve a bitstring ASN.1 tag and its value.
|
||||
* Updates the pointer to immediately behind the full tag.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param bs The variable that will receive the value
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p is equal to \p end.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param bs On success, ::mbedtls_asn1_bitstring information about
|
||||
* the parsed value.
|
||||
*
|
||||
* \return 0 if successful or a specific ASN.1 error code.
|
||||
* \return 0 if successful.
|
||||
* \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains
|
||||
* extra data after a valid BIT STRING.
|
||||
* \return An ASN.1 error code if the input does not start with
|
||||
* a valid ASN.1 BIT STRING.
|
||||
*/
|
||||
int mbedtls_asn1_get_bitstring( unsigned char **p, const unsigned char *end,
|
||||
mbedtls_asn1_bitstring *bs);
|
||||
mbedtls_asn1_bitstring *bs );
|
||||
|
||||
/**
|
||||
* \brief Retrieve a bitstring ASN.1 tag without unused bits and its
|
||||
* value.
|
||||
* Updates the pointer to the beginning of the bit/octet string.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param len Length of the actual bit/octect string in bytes
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p points to the first byte
|
||||
* of the content of the BIT STRING.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param len On success, \c *len is the length of the content in bytes.
|
||||
*
|
||||
* \return 0 if successful or a specific ASN.1 error code.
|
||||
* \return 0 if successful.
|
||||
* \return #MBEDTLS_ERR_ASN1_INVALID_DATA if the input starts with
|
||||
* a valid BIT STRING with a nonzero number of unused bits.
|
||||
* \return An ASN.1 error code if the input does not start with
|
||||
* a valid ASN.1 BIT STRING.
|
||||
*/
|
||||
int mbedtls_asn1_get_bitstring_null( unsigned char **p, const unsigned char *end,
|
||||
size_t *len );
|
||||
int mbedtls_asn1_get_bitstring_null( unsigned char **p,
|
||||
const unsigned char *end,
|
||||
size_t *len );
|
||||
|
||||
/**
|
||||
* \brief Parses and splits an ASN.1 "SEQUENCE OF <tag>"
|
||||
* Updated the pointer to immediately behind the full sequence tag.
|
||||
* \brief Parses and splits an ASN.1 "SEQUENCE OF <tag>".
|
||||
* Updates the pointer to immediately behind the full sequence tag.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param cur First variable in the chain to fill
|
||||
* \param tag Type of sequence
|
||||
* This function allocates memory for the sequence elements. You can free
|
||||
* the allocated memory with mbedtls_asn1_sequence_free().
|
||||
*
|
||||
* \return 0 if successful or a specific ASN.1 error code.
|
||||
* \note On error, this function may return a partial list in \p cur.
|
||||
* You must set `cur->next = NULL` before calling this function!
|
||||
* Otherwise it is impossible to distinguish a previously non-null
|
||||
* pointer from a pointer to an object allocated by this function.
|
||||
*
|
||||
* \note If the sequence is empty, this function does not modify
|
||||
* \c *cur. If the sequence is valid and non-empty, this
|
||||
* function sets `cur->buf.tag` to \p tag. This allows
|
||||
* callers to distinguish between an empty sequence and
|
||||
* a one-element sequence.
|
||||
*
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p is equal to \p end.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param cur A ::mbedtls_asn1_sequence which this function fills.
|
||||
* When this function returns, \c *cur is the head of a linked
|
||||
* list. Each node in this list is allocated with
|
||||
* mbedtls_calloc() apart from \p cur itself, and should
|
||||
* therefore be freed with mbedtls_free().
|
||||
* The list describes the content of the sequence.
|
||||
* The head of the list (i.e. \c *cur itself) describes the
|
||||
* first element, `*cur->next` describes the second element, etc.
|
||||
* For each element, `buf.tag == tag`, `buf.len` is the length
|
||||
* of the content of the content of the element, and `buf.p`
|
||||
* points to the first byte of the content (i.e. immediately
|
||||
* past the length of the element).
|
||||
* Note that list elements may be allocated even on error.
|
||||
* \param tag Each element of the sequence must have this tag.
|
||||
*
|
||||
* \return 0 if successful.
|
||||
* \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains
|
||||
* extra data after a valid SEQUENCE OF \p tag.
|
||||
* \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the input starts with
|
||||
* an ASN.1 SEQUENCE in which an element has a tag that
|
||||
* is different from \p tag.
|
||||
* \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if a memory allocation failed.
|
||||
* \return An ASN.1 error code if the input does not start with
|
||||
* a valid ASN.1 SEQUENCE.
|
||||
*/
|
||||
int mbedtls_asn1_get_sequence_of( unsigned char **p,
|
||||
const unsigned char *end,
|
||||
mbedtls_asn1_sequence *cur,
|
||||
int tag);
|
||||
const unsigned char *end,
|
||||
mbedtls_asn1_sequence *cur,
|
||||
int tag );
|
||||
/**
|
||||
* \brief Free a heap-allocated linked list presentation of
|
||||
* an ASN.1 sequence, including the first element.
|
||||
*
|
||||
* There are two common ways to manage the memory used for the representation
|
||||
* of a parsed ASN.1 sequence:
|
||||
* - Allocate a head node `mbedtls_asn1_sequence *head` with mbedtls_calloc().
|
||||
* Pass this node as the `cur` argument to mbedtls_asn1_get_sequence_of().
|
||||
* When you have finished processing the sequence,
|
||||
* call mbedtls_asn1_sequence_free() on `head`.
|
||||
* - Allocate a head node `mbedtls_asn1_sequence *head` in any manner,
|
||||
* for example on the stack. Make sure that `head->next == NULL`.
|
||||
* Pass `head` as the `cur` argument to mbedtls_asn1_get_sequence_of().
|
||||
* When you have finished processing the sequence,
|
||||
* call mbedtls_asn1_sequence_free() on `head->cur`,
|
||||
* then free `head` itself in the appropriate manner.
|
||||
*
|
||||
* \param seq The address of the first sequence component. This may
|
||||
* be \c NULL, in which case this functions returns
|
||||
* immediately.
|
||||
*/
|
||||
void mbedtls_asn1_sequence_free( mbedtls_asn1_sequence *seq );
|
||||
|
||||
/**
|
||||
* \brief Traverse an ASN.1 SEQUENCE container and
|
||||
* call a callback for each entry.
|
||||
*
|
||||
* This function checks that the input is a SEQUENCE of elements that
|
||||
* each have a "must" tag, and calls a callback function on the elements
|
||||
* that have a "may" tag.
|
||||
*
|
||||
* For example, to validate that the input is a SEQUENCE of `tag1` and call
|
||||
* `cb` on each element, use
|
||||
* ```
|
||||
* mbedtls_asn1_traverse_sequence_of(&p, end, 0xff, tag1, 0, 0, cb, ctx);
|
||||
* ```
|
||||
*
|
||||
* To validate that the input is a SEQUENCE of ANY and call `cb` on
|
||||
* each element, use
|
||||
* ```
|
||||
* mbedtls_asn1_traverse_sequence_of(&p, end, 0, 0, 0, 0, cb, ctx);
|
||||
* ```
|
||||
*
|
||||
* To validate that the input is a SEQUENCE of CHOICE {NULL, OCTET STRING}
|
||||
* and call `cb` on each element that is an OCTET STRING, use
|
||||
* ```
|
||||
* mbedtls_asn1_traverse_sequence_of(&p, end, 0xfe, 0x04, 0xff, 0x04, cb, ctx);
|
||||
* ```
|
||||
*
|
||||
* The callback is called on the elements with a "may" tag from left to
|
||||
* right. If the input is not a valid SEQUENCE of elements with a "must" tag,
|
||||
* the callback is called on the elements up to the leftmost point where
|
||||
* the input is invalid.
|
||||
*
|
||||
* \warning This function is still experimental and may change
|
||||
* at any time.
|
||||
*
|
||||
* \param p The address of the pointer to the beginning of
|
||||
* the ASN.1 SEQUENCE header. This is updated to
|
||||
* point to the end of the ASN.1 SEQUENCE container
|
||||
* on a successful invocation.
|
||||
* \param end The end of the ASN.1 SEQUENCE container.
|
||||
* \param tag_must_mask A mask to be applied to the ASN.1 tags found within
|
||||
* the SEQUENCE before comparing to \p tag_must_value.
|
||||
* \param tag_must_val The required value of each ASN.1 tag found in the
|
||||
* SEQUENCE, after masking with \p tag_must_mask.
|
||||
* Mismatching tags lead to an error.
|
||||
* For example, a value of \c 0 for both \p tag_must_mask
|
||||
* and \p tag_must_val means that every tag is allowed,
|
||||
* while a value of \c 0xFF for \p tag_must_mask means
|
||||
* that \p tag_must_val is the only allowed tag.
|
||||
* \param tag_may_mask A mask to be applied to the ASN.1 tags found within
|
||||
* the SEQUENCE before comparing to \p tag_may_value.
|
||||
* \param tag_may_val The desired value of each ASN.1 tag found in the
|
||||
* SEQUENCE, after masking with \p tag_may_mask.
|
||||
* Mismatching tags will be silently ignored.
|
||||
* For example, a value of \c 0 for \p tag_may_mask and
|
||||
* \p tag_may_val means that any tag will be considered,
|
||||
* while a value of \c 0xFF for \p tag_may_mask means
|
||||
* that all tags with value different from \p tag_may_val
|
||||
* will be ignored.
|
||||
* \param cb The callback to trigger for each component
|
||||
* in the ASN.1 SEQUENCE that matches \p tag_may_val.
|
||||
* The callback function is called with the following
|
||||
* parameters:
|
||||
* - \p ctx.
|
||||
* - The tag of the current element.
|
||||
* - A pointer to the start of the current element's
|
||||
* content inside the input.
|
||||
* - The length of the content of the current element.
|
||||
* If the callback returns a non-zero value,
|
||||
* the function stops immediately,
|
||||
* forwarding the callback's return value.
|
||||
* \param ctx The context to be passed to the callback \p cb.
|
||||
*
|
||||
* \return \c 0 if successful the entire ASN.1 SEQUENCE
|
||||
* was traversed without parsing or callback errors.
|
||||
* \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input
|
||||
* contains extra data after a valid SEQUENCE
|
||||
* of elements with an accepted tag.
|
||||
* \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the input starts
|
||||
* with an ASN.1 SEQUENCE in which an element has a tag
|
||||
* that is not accepted.
|
||||
* \return An ASN.1 error code if the input does not start with
|
||||
* a valid ASN.1 SEQUENCE.
|
||||
* \return A non-zero error code forwarded from the callback
|
||||
* \p cb in case the latter returns a non-zero value.
|
||||
*/
|
||||
int mbedtls_asn1_traverse_sequence_of(
|
||||
unsigned char **p,
|
||||
const unsigned char *end,
|
||||
unsigned char tag_must_mask, unsigned char tag_must_val,
|
||||
unsigned char tag_may_mask, unsigned char tag_may_val,
|
||||
int (*cb)( void *ctx, int tag,
|
||||
unsigned char* start, size_t len ),
|
||||
void *ctx );
|
||||
|
||||
#if defined(MBEDTLS_BIGNUM_C)
|
||||
/**
|
||||
* \brief Retrieve a MPI value from an integer ASN.1 tag.
|
||||
* \brief Retrieve an integer ASN.1 tag and its value.
|
||||
* Updates the pointer to immediately behind the full tag.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param X The MPI that will receive the value
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p points to the first byte
|
||||
* beyond the ASN.1 element.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param X On success, the parsed value.
|
||||
*
|
||||
* \return 0 if successful or a specific ASN.1 or MPI error code.
|
||||
* \return 0 if successful.
|
||||
* \return An ASN.1 error code if the input does not start with
|
||||
* a valid ASN.1 INTEGER.
|
||||
* \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does
|
||||
* not fit in an \c int.
|
||||
* \return An MPI error code if the parsed value is too large.
|
||||
*/
|
||||
int mbedtls_asn1_get_mpi( unsigned char **p,
|
||||
const unsigned char *end,
|
||||
mbedtls_mpi *X );
|
||||
const unsigned char *end,
|
||||
mbedtls_mpi *X );
|
||||
#endif /* MBEDTLS_BIGNUM_C */
|
||||
|
||||
/**
|
||||
@ -296,10 +541,14 @@ int mbedtls_asn1_get_mpi( unsigned char **p,
|
||||
* Updates the pointer to immediately behind the full
|
||||
* AlgorithmIdentifier.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param alg The buffer to receive the OID
|
||||
* \param params The buffer to receive the params (if any)
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p points to the first byte
|
||||
* beyond the AlgorithmIdentifier element.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param alg The buffer to receive the OID.
|
||||
* \param params The buffer to receive the parameters.
|
||||
* This is zeroized if there are no parameters.
|
||||
*
|
||||
* \return 0 if successful or a specific ASN.1 or MPI error code.
|
||||
*/
|
||||
@ -313,9 +562,12 @@ int mbedtls_asn1_get_alg( unsigned char **p,
|
||||
* Updates the pointer to immediately behind the full
|
||||
* AlgorithmIdentifier.
|
||||
*
|
||||
* \param p The position in the ASN.1 data
|
||||
* \param end End of data
|
||||
* \param alg The buffer to receive the OID
|
||||
* \param p On entry, \c *p points to the start of the ASN.1 element.
|
||||
* On successful completion, \c *p points to the first byte
|
||||
* beyond the AlgorithmIdentifier element.
|
||||
* On error, the value of \c *p is undefined.
|
||||
* \param end End of data.
|
||||
* \param alg The buffer to receive the OID.
|
||||
*
|
||||
* \return 0 if successful or a specific ASN.1 or MPI error code.
|
||||
*/
|
||||
@ -339,15 +591,19 @@ mbedtls_asn1_named_data *mbedtls_asn1_find_named_data( mbedtls_asn1_named_data *
|
||||
/**
|
||||
* \brief Free a mbedtls_asn1_named_data entry
|
||||
*
|
||||
* \param entry The named data entry to free
|
||||
* \param entry The named data entry to free.
|
||||
* This function calls mbedtls_free() on
|
||||
* `entry->oid.p` and `entry->val.p`.
|
||||
*/
|
||||
void mbedtls_asn1_free_named_data( mbedtls_asn1_named_data *entry );
|
||||
|
||||
/**
|
||||
* \brief Free all entries in a mbedtls_asn1_named_data list
|
||||
* Head will be set to NULL
|
||||
* \brief Free all entries in a mbedtls_asn1_named_data list.
|
||||
*
|
||||
* \param head Pointer to the head of the list of named data entries to free
|
||||
* \param head Pointer to the head of the list of named data entries to free.
|
||||
* This function calls mbedtls_asn1_free_named_data() and
|
||||
* mbedtls_free() on each list element and
|
||||
* sets \c *head to \c NULL.
|
||||
*/
|
||||
void mbedtls_asn1_free_named_data_list( mbedtls_asn1_named_data **head );
|
||||
|
||||
|
64
Externals/mbedtls/include/mbedtls/asn1write.h
vendored
64
Externals/mbedtls/include/mbedtls/asn1write.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief ASN.1 buffer writing functionality
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,26 +18,25 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_ASN1_WRITE_H
|
||||
#define MBEDTLS_ASN1_WRITE_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "asn1.h"
|
||||
#include "mbedtls/asn1.h"
|
||||
|
||||
#define MBEDTLS_ASN1_CHK_ADD(g, f) \
|
||||
do { \
|
||||
if( ( ret = f ) < 0 ) \
|
||||
do \
|
||||
{ \
|
||||
if( ( ret = (f) ) < 0 ) \
|
||||
return( ret ); \
|
||||
else \
|
||||
g += ret; \
|
||||
(g) += ret; \
|
||||
} while( 0 )
|
||||
|
||||
#ifdef __cplusplus
|
||||
@ -99,6 +98,7 @@ int mbedtls_asn1_write_raw_buffer( unsigned char **p, unsigned char *start,
|
||||
* \param p The reference to the current position pointer.
|
||||
* \param start The start of the buffer, for bounds-checking.
|
||||
* \param X The MPI to write.
|
||||
* It must be non-negative.
|
||||
*
|
||||
* \return The number of bytes written to \p p on success.
|
||||
* \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure.
|
||||
@ -183,12 +183,28 @@ int mbedtls_asn1_write_bool( unsigned char **p, unsigned char *start,
|
||||
* \param p The reference to the current position pointer.
|
||||
* \param start The start of the buffer, for bounds-checking.
|
||||
* \param val The integer value to write.
|
||||
* It must be non-negative.
|
||||
*
|
||||
* \return The number of bytes written to \p p on success.
|
||||
* \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure.
|
||||
*/
|
||||
int mbedtls_asn1_write_int( unsigned char **p, unsigned char *start, int val );
|
||||
|
||||
/**
|
||||
* \brief Write an enum tag (#MBEDTLS_ASN1_ENUMERATED) and value
|
||||
* in ASN.1 format.
|
||||
*
|
||||
* \note This function works backwards in data buffer.
|
||||
*
|
||||
* \param p The reference to the current position pointer.
|
||||
* \param start The start of the buffer, for bounds-checking.
|
||||
* \param val The integer value to write.
|
||||
*
|
||||
* \return The number of bytes written to \p p on success.
|
||||
* \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure.
|
||||
*/
|
||||
int mbedtls_asn1_write_enum( unsigned char **p, unsigned char *start, int val );
|
||||
|
||||
/**
|
||||
* \brief Write a string in ASN.1 format using a specific
|
||||
* string encoding tag.
|
||||
@ -231,7 +247,7 @@ int mbedtls_asn1_write_printable_string( unsigned char **p,
|
||||
|
||||
/**
|
||||
* \brief Write a UTF8 string in ASN.1 format using the UTF8String
|
||||
* string encoding tag (#MBEDTLS_ASN1_PRINTABLE_STRING).
|
||||
* string encoding tag (#MBEDTLS_ASN1_UTF8_STRING).
|
||||
*
|
||||
* \note This function works backwards in data buffer.
|
||||
*
|
||||
@ -282,6 +298,28 @@ int mbedtls_asn1_write_ia5_string( unsigned char **p, unsigned char *start,
|
||||
int mbedtls_asn1_write_bitstring( unsigned char **p, unsigned char *start,
|
||||
const unsigned char *buf, size_t bits );
|
||||
|
||||
/**
|
||||
* \brief This function writes a named bitstring tag
|
||||
* (#MBEDTLS_ASN1_BIT_STRING) and value in ASN.1 format.
|
||||
*
|
||||
* As stated in RFC 5280 Appendix B, trailing zeroes are
|
||||
* omitted when encoding named bitstrings in DER.
|
||||
*
|
||||
* \note This function works backwards within the data buffer.
|
||||
*
|
||||
* \param p The reference to the current position pointer.
|
||||
* \param start The start of the buffer which is used for bounds-checking.
|
||||
* \param buf The bitstring to write.
|
||||
* \param bits The total number of bits in the bitstring.
|
||||
*
|
||||
* \return The number of bytes written to \p p on success.
|
||||
* \return A negative error code on failure.
|
||||
*/
|
||||
int mbedtls_asn1_write_named_bitstring( unsigned char **p,
|
||||
unsigned char *start,
|
||||
const unsigned char *buf,
|
||||
size_t bits );
|
||||
|
||||
/**
|
||||
* \brief Write an octet string tag (#MBEDTLS_ASN1_OCTET_STRING)
|
||||
* and value in ASN.1 format.
|
||||
@ -309,9 +347,13 @@ int mbedtls_asn1_write_octet_string( unsigned char **p, unsigned char *start,
|
||||
* through (will be updated in case of a new entry).
|
||||
* \param oid The OID to look for.
|
||||
* \param oid_len The size of the OID.
|
||||
* \param val The data to store (can be \c NULL if you want to fill
|
||||
* it by hand).
|
||||
* \param val The associated data to store. If this is \c NULL,
|
||||
* no data is copied to the new or existing buffer.
|
||||
* \param val_len The minimum length of the data buffer needed.
|
||||
* If this is 0, do not allocate a buffer for the associated
|
||||
* data.
|
||||
* If the OID was already present, enlarge, shrink or free
|
||||
* the existing buffer to fit \p val_len.
|
||||
*
|
||||
* \return A pointer to the new / existing entry on success.
|
||||
* \return \c NULL if if there was a memory allocation error.
|
||||
|
12
Externals/mbedtls/include/mbedtls/base64.h
vendored
12
Externals/mbedtls/include/mbedtls/base64.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief RFC 1521 base64 encoding/decoding
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,22 +18,22 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_BASE64_H
|
||||
#define MBEDTLS_BASE64_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#define MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL -0x002A /**< Output buffer too small. */
|
||||
#define MBEDTLS_ERR_BASE64_INVALID_CHARACTER -0x002C /**< Invalid character in input. */
|
||||
/** Output buffer too small. */
|
||||
#define MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL -0x002A
|
||||
/** Invalid character in input. */
|
||||
#define MBEDTLS_ERR_BASE64_INVALID_CHARACTER -0x002C
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
148
Externals/mbedtls/include/mbedtls/bignum.h
vendored
148
Externals/mbedtls/include/mbedtls/bignum.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Multi-precision integer library
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_BIGNUM_H
|
||||
#define MBEDTLS_BIGNUM_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -37,16 +35,29 @@
|
||||
#include <stdio.h>
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_ERR_MPI_FILE_IO_ERROR -0x0002 /**< An error occurred while reading from or writing to a file. */
|
||||
#define MBEDTLS_ERR_MPI_BAD_INPUT_DATA -0x0004 /**< Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_MPI_INVALID_CHARACTER -0x0006 /**< There is an invalid character in the digit string. */
|
||||
#define MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL -0x0008 /**< The buffer is too small to write to. */
|
||||
#define MBEDTLS_ERR_MPI_NEGATIVE_VALUE -0x000A /**< The input arguments are negative or result in illegal output. */
|
||||
#define MBEDTLS_ERR_MPI_DIVISION_BY_ZERO -0x000C /**< The input argument for division is zero, which is not allowed. */
|
||||
#define MBEDTLS_ERR_MPI_NOT_ACCEPTABLE -0x000E /**< The input arguments are not acceptable. */
|
||||
#define MBEDTLS_ERR_MPI_ALLOC_FAILED -0x0010 /**< Memory allocation failed. */
|
||||
/** An error occurred while reading from or writing to a file. */
|
||||
#define MBEDTLS_ERR_MPI_FILE_IO_ERROR -0x0002
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_MPI_BAD_INPUT_DATA -0x0004
|
||||
/** There is an invalid character in the digit string. */
|
||||
#define MBEDTLS_ERR_MPI_INVALID_CHARACTER -0x0006
|
||||
/** The buffer is too small to write to. */
|
||||
#define MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL -0x0008
|
||||
/** The input arguments are negative or result in illegal output. */
|
||||
#define MBEDTLS_ERR_MPI_NEGATIVE_VALUE -0x000A
|
||||
/** The input argument for division is zero, which is not allowed. */
|
||||
#define MBEDTLS_ERR_MPI_DIVISION_BY_ZERO -0x000C
|
||||
/** The input arguments are not acceptable. */
|
||||
#define MBEDTLS_ERR_MPI_NOT_ACCEPTABLE -0x000E
|
||||
/** Memory allocation failed. */
|
||||
#define MBEDTLS_ERR_MPI_ALLOC_FAILED -0x0010
|
||||
|
||||
#define MBEDTLS_MPI_CHK(f) do { if( ( ret = f ) != 0 ) goto cleanup; } while( 0 )
|
||||
#define MBEDTLS_MPI_CHK(f) \
|
||||
do \
|
||||
{ \
|
||||
if( ( ret = (f) ) != 0 ) \
|
||||
goto cleanup; \
|
||||
} while( 0 )
|
||||
|
||||
/*
|
||||
* Maximum size MPIs are allowed to grow to in number of limbs.
|
||||
@ -58,12 +69,12 @@
|
||||
* Maximum window size used for modular exponentiation. Default: 6
|
||||
* Minimum value: 1. Maximum value: 6.
|
||||
*
|
||||
* Result is an array of ( 2 << MBEDTLS_MPI_WINDOW_SIZE ) MPIs used
|
||||
* Result is an array of ( 2 ** MBEDTLS_MPI_WINDOW_SIZE ) MPIs used
|
||||
* for the sliding window calculation. (So 64 by default)
|
||||
*
|
||||
* Reduction in size, reduces speed.
|
||||
*/
|
||||
#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum windows size used. */
|
||||
#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum window size used. */
|
||||
#endif /* !MBEDTLS_MPI_WINDOW_SIZE */
|
||||
|
||||
#if !defined(MBEDTLS_MPI_MAX_SIZE)
|
||||
@ -124,7 +135,8 @@
|
||||
defined(__ppc64__) || defined(__powerpc64__) || \
|
||||
defined(__ia64__) || defined(__alpha__) || \
|
||||
( defined(__sparc__) && defined(__arch64__) ) || \
|
||||
defined(__s390x__) || defined(__mips64) )
|
||||
defined(__s390x__) || defined(__mips64) || \
|
||||
defined(__aarch64__) )
|
||||
#if !defined(MBEDTLS_HAVE_INT64)
|
||||
#define MBEDTLS_HAVE_INT64
|
||||
#endif /* MBEDTLS_HAVE_INT64 */
|
||||
@ -179,7 +191,7 @@ extern "C" {
|
||||
*/
|
||||
typedef struct mbedtls_mpi
|
||||
{
|
||||
int s; /*!< integer sign */
|
||||
int s; /*!< Sign: -1 if the mpi is negative, 1 otherwise */
|
||||
size_t n; /*!< total # of limbs */
|
||||
mbedtls_mpi_uint *p; /*!< pointer to limbs */
|
||||
}
|
||||
@ -490,8 +502,24 @@ int mbedtls_mpi_read_binary( mbedtls_mpi *X, const unsigned char *buf,
|
||||
size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief Export an MPI into unsigned big endian binary data
|
||||
* of fixed size.
|
||||
* \brief Import X from unsigned binary data, little endian
|
||||
*
|
||||
* \param X The destination MPI. This must point to an initialized MPI.
|
||||
* \param buf The input buffer. This must be a readable buffer of length
|
||||
* \p buflen Bytes.
|
||||
* \param buflen The length of the input buffer \p p in Bytes.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
|
||||
* \return Another negative error code on different kinds of failure.
|
||||
*/
|
||||
int mbedtls_mpi_read_binary_le( mbedtls_mpi *X,
|
||||
const unsigned char *buf, size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief Export X into unsigned binary data, big endian.
|
||||
* Always fills the whole buffer, which will start with zeros
|
||||
* if the number is smaller.
|
||||
*
|
||||
* \param X The source MPI. This must point to an initialized MPI.
|
||||
* \param buf The output buffer. This must be a writable buffer of length
|
||||
@ -506,6 +534,24 @@ int mbedtls_mpi_read_binary( mbedtls_mpi *X, const unsigned char *buf,
|
||||
int mbedtls_mpi_write_binary( const mbedtls_mpi *X, unsigned char *buf,
|
||||
size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief Export X into unsigned binary data, little endian.
|
||||
* Always fills the whole buffer, which will end with zeros
|
||||
* if the number is smaller.
|
||||
*
|
||||
* \param X The source MPI. This must point to an initialized MPI.
|
||||
* \param buf The output buffer. This must be a writable buffer of length
|
||||
* \p buflen Bytes.
|
||||
* \param buflen The size of the output buffer \p buf in Bytes.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't
|
||||
* large enough to hold the value of \p X.
|
||||
* \return Another negative error code on different kinds of failure.
|
||||
*/
|
||||
int mbedtls_mpi_write_binary_le( const mbedtls_mpi *X,
|
||||
unsigned char *buf, size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief Perform a left-shift on an MPI: X <<= count
|
||||
*
|
||||
@ -554,6 +600,24 @@ int mbedtls_mpi_cmp_abs( const mbedtls_mpi *X, const mbedtls_mpi *Y );
|
||||
*/
|
||||
int mbedtls_mpi_cmp_mpi( const mbedtls_mpi *X, const mbedtls_mpi *Y );
|
||||
|
||||
/**
|
||||
* \brief Check if an MPI is less than the other in constant time.
|
||||
*
|
||||
* \param X The left-hand MPI. This must point to an initialized MPI
|
||||
* with the same allocated length as Y.
|
||||
* \param Y The right-hand MPI. This must point to an initialized MPI
|
||||
* with the same allocated length as X.
|
||||
* \param ret The result of the comparison:
|
||||
* \c 1 if \p X is less than \p Y.
|
||||
* \c 0 if \p X is greater than or equal to \p Y.
|
||||
*
|
||||
* \return 0 on success.
|
||||
* \return MBEDTLS_ERR_MPI_BAD_INPUT_DATA if the allocated length of
|
||||
* the two input MPIs is not the same.
|
||||
*/
|
||||
int mbedtls_mpi_lt_mpi_ct( const mbedtls_mpi *X, const mbedtls_mpi *Y,
|
||||
unsigned *ret );
|
||||
|
||||
/**
|
||||
* \brief Compare an MPI with an integer.
|
||||
*
|
||||
@ -773,14 +837,14 @@ int mbedtls_mpi_mod_int( mbedtls_mpi_uint *r, const mbedtls_mpi *A,
|
||||
* \param E The exponent MPI. This must point to an initialized MPI.
|
||||
* \param N The base for the modular reduction. This must point to an
|
||||
* initialized MPI.
|
||||
* \param _RR A helper MPI depending solely on \p N which can be used to
|
||||
* \param prec_RR A helper MPI depending solely on \p N which can be used to
|
||||
* speed-up multiple modular exponentiations for the same value
|
||||
* of \p N. This may be \c NULL. If it is not \c NULL, it must
|
||||
* point to an initialized MPI. If it hasn't been used after
|
||||
* the call to mbedtls_mpi_init(), this function will compute
|
||||
* the helper value and store it in \p _RR for reuse on
|
||||
* the helper value and store it in \p prec_RR for reuse on
|
||||
* subsequent calls to this function. Otherwise, the function
|
||||
* will assume that \p _RR holds the helper value set by a
|
||||
* will assume that \p prec_RR holds the helper value set by a
|
||||
* previous call to mbedtls_mpi_exp_mod(), and reuse it.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
@ -792,7 +856,7 @@ int mbedtls_mpi_mod_int( mbedtls_mpi_uint *r, const mbedtls_mpi *A,
|
||||
*/
|
||||
int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A,
|
||||
const mbedtls_mpi *E, const mbedtls_mpi *N,
|
||||
mbedtls_mpi *_RR );
|
||||
mbedtls_mpi *prec_RR );
|
||||
|
||||
/**
|
||||
* \brief Fill an MPI with a number of random bytes.
|
||||
@ -815,6 +879,44 @@ int mbedtls_mpi_fill_random( mbedtls_mpi *X, size_t size,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng );
|
||||
|
||||
/** Generate a random number uniformly in a range.
|
||||
*
|
||||
* This function generates a random number between \p min inclusive and
|
||||
* \p N exclusive.
|
||||
*
|
||||
* The procedure complies with RFC 6979 §3.3 (deterministic ECDSA)
|
||||
* when the RNG is a suitably parametrized instance of HMAC_DRBG
|
||||
* and \p min is \c 1.
|
||||
*
|
||||
* \note There are `N - min` possible outputs. The lower bound
|
||||
* \p min can be reached, but the upper bound \p N cannot.
|
||||
*
|
||||
* \param X The destination MPI. This must point to an initialized MPI.
|
||||
* \param min The minimum value to return.
|
||||
* It must be nonnegative.
|
||||
* \param N The upper bound of the range, exclusive.
|
||||
* In other words, this is one plus the maximum value to return.
|
||||
* \p N must be strictly larger than \p min.
|
||||
* \param f_rng The RNG function to use. This must not be \c NULL.
|
||||
* \param p_rng The RNG parameter to be passed to \p f_rng.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
|
||||
* \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p min or \p N is invalid
|
||||
* or if they are incompatible.
|
||||
* \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if the implementation was
|
||||
* unable to find a suitable value within a limited number
|
||||
* of attempts. This has a negligible probability if \p N
|
||||
* is significantly larger than \p min, which is the case
|
||||
* for all usual cryptographic applications.
|
||||
* \return Another negative error code on failure.
|
||||
*/
|
||||
int mbedtls_mpi_random( mbedtls_mpi *X,
|
||||
mbedtls_mpi_sint min,
|
||||
const mbedtls_mpi *N,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng );
|
||||
|
||||
/**
|
||||
* \brief Compute the greatest common divisor: G = gcd(A, B)
|
||||
*
|
||||
|
17
Externals/mbedtls/include/mbedtls/blowfish.h
vendored
17
Externals/mbedtls/include/mbedtls/blowfish.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Blowfish block cipher
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_BLOWFISH_H
|
||||
#define MBEDTLS_BLOWFISH_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -33,7 +31,7 @@
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "platform_util.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#define MBEDTLS_BLOWFISH_ENCRYPT 1
|
||||
#define MBEDTLS_BLOWFISH_DECRYPT 0
|
||||
@ -45,13 +43,16 @@
|
||||
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#define MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( -0x0016 )
|
||||
#endif /* !MBEDTLS_DEPRECATED_REMOVED */
|
||||
#define MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA -0x0016 /**< Bad input data. */
|
||||
/** Bad input data. */
|
||||
#define MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA -0x0016
|
||||
|
||||
#define MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH -0x0018 /**< Invalid data input length. */
|
||||
/** Invalid data input length. */
|
||||
#define MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH -0x0018
|
||||
|
||||
/* MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED is deprecated and should not be used.
|
||||
*/
|
||||
#define MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED -0x0017 /**< Blowfish hardware accelerator failed. */
|
||||
/** Blowfish hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED -0x0017
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
81
Externals/mbedtls/include/mbedtls/bn_mul.h
vendored
81
Externals/mbedtls/include/mbedtls/bn_mul.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Multi-precision integer library
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,8 +18,6 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
/*
|
||||
* Multiply source vector [s] with b, add result
|
||||
@ -39,12 +37,52 @@
|
||||
#define MBEDTLS_BN_MUL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "bignum.h"
|
||||
#include "mbedtls/bignum.h"
|
||||
|
||||
|
||||
/*
|
||||
* Conversion macros for embedded constants:
|
||||
* build lists of mbedtls_mpi_uint's from lists of unsigned char's grouped by 8, 4 or 2
|
||||
*/
|
||||
#if defined(MBEDTLS_HAVE_INT32)
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ) \
|
||||
( (mbedtls_mpi_uint) (a) << 0 ) | \
|
||||
( (mbedtls_mpi_uint) (b) << 8 ) | \
|
||||
( (mbedtls_mpi_uint) (c) << 16 ) | \
|
||||
( (mbedtls_mpi_uint) (d) << 24 )
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_2( a, b ) \
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( a, b, 0, 0 )
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ), \
|
||||
MBEDTLS_BYTES_TO_T_UINT_4( e, f, g, h )
|
||||
|
||||
#else /* 64-bits */
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
|
||||
( (mbedtls_mpi_uint) (a) << 0 ) | \
|
||||
( (mbedtls_mpi_uint) (b) << 8 ) | \
|
||||
( (mbedtls_mpi_uint) (c) << 16 ) | \
|
||||
( (mbedtls_mpi_uint) (d) << 24 ) | \
|
||||
( (mbedtls_mpi_uint) (e) << 32 ) | \
|
||||
( (mbedtls_mpi_uint) (f) << 40 ) | \
|
||||
( (mbedtls_mpi_uint) (g) << 48 ) | \
|
||||
( (mbedtls_mpi_uint) (h) << 56 )
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ) \
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, 0, 0, 0, 0 )
|
||||
|
||||
#define MBEDTLS_BYTES_TO_T_UINT_2( a, b ) \
|
||||
MBEDTLS_BYTES_TO_T_UINT_8( a, b, 0, 0, 0, 0, 0, 0 )
|
||||
|
||||
#endif /* bits in mbedtls_mpi_uint */
|
||||
|
||||
#if defined(MBEDTLS_HAVE_ASM)
|
||||
|
||||
@ -191,13 +229,37 @@
|
||||
"addq $8, %%rdi\n"
|
||||
|
||||
#define MULADDC_STOP \
|
||||
: "+c" (c), "+D" (d), "+S" (s) \
|
||||
: "b" (b) \
|
||||
: "rax", "rdx", "r8" \
|
||||
: "+c" (c), "+D" (d), "+S" (s), "+m" (*(uint64_t (*)[16]) d) \
|
||||
: "b" (b), "m" (*(const uint64_t (*)[16]) s) \
|
||||
: "rax", "rdx", "r8" \
|
||||
);
|
||||
|
||||
#endif /* AMD64 */
|
||||
|
||||
#if defined(__aarch64__)
|
||||
|
||||
#define MULADDC_INIT \
|
||||
asm(
|
||||
|
||||
#define MULADDC_CORE \
|
||||
"ldr x4, [%2], #8 \n\t" \
|
||||
"ldr x5, [%1] \n\t" \
|
||||
"mul x6, x4, %4 \n\t" \
|
||||
"umulh x7, x4, %4 \n\t" \
|
||||
"adds x5, x5, x6 \n\t" \
|
||||
"adc x7, x7, xzr \n\t" \
|
||||
"adds x5, x5, %0 \n\t" \
|
||||
"adc %0, x7, xzr \n\t" \
|
||||
"str x5, [%1], #8 \n\t"
|
||||
|
||||
#define MULADDC_STOP \
|
||||
: "+r" (c), "+r" (d), "+r" (s), "+m" (*(uint64_t (*)[16]) d) \
|
||||
: "r" (b), "m" (*(const uint64_t (*)[16]) s) \
|
||||
: "x4", "x5", "x6", "x7", "cc" \
|
||||
);
|
||||
|
||||
#endif /* Aarch64 */
|
||||
|
||||
#if defined(__mc68020__) || defined(__mcpu32__)
|
||||
|
||||
#define MULADDC_INIT \
|
||||
@ -642,7 +704,8 @@
|
||||
"r6", "r7", "r8", "r9", "cc" \
|
||||
);
|
||||
|
||||
#elif defined (__ARM_FEATURE_DSP) && (__ARM_FEATURE_DSP == 1)
|
||||
#elif (__ARM_ARCH >= 6) && \
|
||||
defined (__ARM_FEATURE_DSP) && (__ARM_FEATURE_DSP == 1)
|
||||
|
||||
#define MULADDC_INIT \
|
||||
asm(
|
||||
|
17
Externals/mbedtls/include/mbedtls/camellia.h
vendored
17
Externals/mbedtls/include/mbedtls/camellia.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Camellia block cipher
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_CAMELLIA_H
|
||||
#define MBEDTLS_CAMELLIA_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -33,7 +31,7 @@
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "platform_util.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#define MBEDTLS_CAMELLIA_ENCRYPT 1
|
||||
#define MBEDTLS_CAMELLIA_DECRYPT 0
|
||||
@ -41,13 +39,16 @@
|
||||
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#define MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( -0x0024 )
|
||||
#endif /* !MBEDTLS_DEPRECATED_REMOVED */
|
||||
#define MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA -0x0024 /**< Bad input data. */
|
||||
/** Bad input data. */
|
||||
#define MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA -0x0024
|
||||
|
||||
#define MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH -0x0026 /**< Invalid data input length. */
|
||||
/** Invalid data input length. */
|
||||
#define MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH -0x0026
|
||||
|
||||
/* MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED is deprecated and should not be used.
|
||||
*/
|
||||
#define MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED -0x0027 /**< Camellia hardware accelerator failed. */
|
||||
/** Camellia hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED -0x0027
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
21
Externals/mbedtls/include/mbedtls/ccm.h
vendored
21
Externals/mbedtls/include/mbedtls/ccm.h
vendored
@ -28,7 +28,7 @@
|
||||
* consistent with RFC 3610.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -42,26 +42,27 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CCM_H
|
||||
#define MBEDTLS_CCM_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "cipher.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
|
||||
#define MBEDTLS_ERR_CCM_BAD_INPUT -0x000D /**< Bad input parameters to the function. */
|
||||
#define MBEDTLS_ERR_CCM_AUTH_FAILED -0x000F /**< Authenticated decryption failed. */
|
||||
/** Bad input parameters to the function. */
|
||||
#define MBEDTLS_ERR_CCM_BAD_INPUT -0x000D
|
||||
/** Authenticated decryption failed. */
|
||||
#define MBEDTLS_ERR_CCM_AUTH_FAILED -0x000F
|
||||
|
||||
/* MBEDTLS_ERR_CCM_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_CCM_HW_ACCEL_FAILED -0x0011 /**< CCM hardware accelerator failed. */
|
||||
/** CCM hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_CCM_HW_ACCEL_FAILED -0x0011
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -150,7 +151,7 @@ void mbedtls_ccm_free( mbedtls_ccm_context *ctx );
|
||||
* than zero, \p output must be a writable buffer of at least
|
||||
* that length.
|
||||
* \param tag The buffer holding the authentication field. This must be a
|
||||
* readable buffer of at least \p tag_len Bytes.
|
||||
* writable buffer of at least \p tag_len Bytes.
|
||||
* \param tag_len The length of the authentication field to generate in Bytes:
|
||||
* 4, 6, 8, 10, 12, 14 or 16.
|
||||
*
|
||||
@ -195,7 +196,7 @@ int mbedtls_ccm_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length,
|
||||
* than zero, \p output must be a writable buffer of at least
|
||||
* that length.
|
||||
* \param tag The buffer holding the authentication field. This must be a
|
||||
* readable buffer of at least \p tag_len Bytes.
|
||||
* writable buffer of at least \p tag_len Bytes.
|
||||
* \param tag_len The length of the authentication field to generate in Bytes:
|
||||
* 0, 4, 6, 8, 10, 12, 14 or 16.
|
||||
*
|
||||
|
246
Externals/mbedtls/include/mbedtls/certs.h
vendored
246
Externals/mbedtls/include/mbedtls/certs.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Sample certificates and DHM parameters for testing
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_CERTS_H
|
||||
#define MBEDTLS_CERTS_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -36,68 +34,214 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* List of all PEM-encoded CA certificates, terminated by NULL;
|
||||
* PEM encoded if MBEDTLS_PEM_PARSE_C is enabled, DER encoded
|
||||
* otherwise. */
|
||||
extern const char * mbedtls_test_cas[];
|
||||
extern const size_t mbedtls_test_cas_len[];
|
||||
|
||||
/* List of all DER-encoded CA certificates, terminated by NULL */
|
||||
extern const unsigned char * mbedtls_test_cas_der[];
|
||||
extern const size_t mbedtls_test_cas_der_len[];
|
||||
|
||||
#if defined(MBEDTLS_PEM_PARSE_C)
|
||||
/* Concatenation of all CA certificates in PEM format if available */
|
||||
extern const char mbedtls_test_cas_pem[];
|
||||
extern const size_t mbedtls_test_cas_pem_len;
|
||||
#endif
|
||||
|
||||
/* List of all CA certificates, terminated by NULL */
|
||||
extern const char * mbedtls_test_cas[];
|
||||
extern const size_t mbedtls_test_cas_len[];
|
||||
#endif /* MBEDTLS_PEM_PARSE_C */
|
||||
|
||||
/*
|
||||
* Convenience for users who just want a certificate:
|
||||
* RSA by default, or ECDSA if RSA is not available
|
||||
* CA test certificates
|
||||
*/
|
||||
extern const char * mbedtls_test_ca_crt;
|
||||
extern const size_t mbedtls_test_ca_crt_len;
|
||||
extern const char * mbedtls_test_ca_key;
|
||||
extern const size_t mbedtls_test_ca_key_len;
|
||||
extern const char * mbedtls_test_ca_pwd;
|
||||
extern const size_t mbedtls_test_ca_pwd_len;
|
||||
extern const char * mbedtls_test_srv_crt;
|
||||
extern const size_t mbedtls_test_srv_crt_len;
|
||||
extern const char * mbedtls_test_srv_key;
|
||||
extern const size_t mbedtls_test_srv_key_len;
|
||||
extern const char * mbedtls_test_cli_crt;
|
||||
extern const size_t mbedtls_test_cli_crt_len;
|
||||
extern const char * mbedtls_test_cli_key;
|
||||
extern const size_t mbedtls_test_cli_key_len;
|
||||
|
||||
#if defined(MBEDTLS_ECDSA_C)
|
||||
extern const char mbedtls_test_ca_crt_ec[];
|
||||
extern const char mbedtls_test_ca_crt_ec_pem[];
|
||||
extern const char mbedtls_test_ca_key_ec_pem[];
|
||||
extern const char mbedtls_test_ca_pwd_ec_pem[];
|
||||
extern const char mbedtls_test_ca_key_rsa_pem[];
|
||||
extern const char mbedtls_test_ca_pwd_rsa_pem[];
|
||||
extern const char mbedtls_test_ca_crt_rsa_sha1_pem[];
|
||||
extern const char mbedtls_test_ca_crt_rsa_sha256_pem[];
|
||||
|
||||
extern const unsigned char mbedtls_test_ca_crt_ec_der[];
|
||||
extern const unsigned char mbedtls_test_ca_key_ec_der[];
|
||||
extern const unsigned char mbedtls_test_ca_key_rsa_der[];
|
||||
extern const unsigned char mbedtls_test_ca_crt_rsa_sha1_der[];
|
||||
extern const unsigned char mbedtls_test_ca_crt_rsa_sha256_der[];
|
||||
|
||||
extern const size_t mbedtls_test_ca_crt_ec_pem_len;
|
||||
extern const size_t mbedtls_test_ca_key_ec_pem_len;
|
||||
extern const size_t mbedtls_test_ca_pwd_ec_pem_len;
|
||||
extern const size_t mbedtls_test_ca_key_rsa_pem_len;
|
||||
extern const size_t mbedtls_test_ca_pwd_rsa_pem_len;
|
||||
extern const size_t mbedtls_test_ca_crt_rsa_sha1_pem_len;
|
||||
extern const size_t mbedtls_test_ca_crt_rsa_sha256_pem_len;
|
||||
|
||||
extern const size_t mbedtls_test_ca_crt_ec_der_len;
|
||||
extern const size_t mbedtls_test_ca_key_ec_der_len;
|
||||
extern const size_t mbedtls_test_ca_pwd_ec_der_len;
|
||||
extern const size_t mbedtls_test_ca_key_rsa_der_len;
|
||||
extern const size_t mbedtls_test_ca_pwd_rsa_der_len;
|
||||
extern const size_t mbedtls_test_ca_crt_rsa_sha1_der_len;
|
||||
extern const size_t mbedtls_test_ca_crt_rsa_sha256_der_len;
|
||||
|
||||
/* Config-dependent dispatch between PEM and DER encoding
|
||||
* (PEM if enabled, otherwise DER) */
|
||||
|
||||
extern const char mbedtls_test_ca_crt_ec[];
|
||||
extern const char mbedtls_test_ca_key_ec[];
|
||||
extern const char mbedtls_test_ca_pwd_ec[];
|
||||
extern const char mbedtls_test_ca_key_rsa[];
|
||||
extern const char mbedtls_test_ca_pwd_rsa[];
|
||||
extern const char mbedtls_test_ca_crt_rsa_sha1[];
|
||||
extern const char mbedtls_test_ca_crt_rsa_sha256[];
|
||||
|
||||
extern const size_t mbedtls_test_ca_crt_ec_len;
|
||||
extern const char mbedtls_test_ca_key_ec[];
|
||||
extern const size_t mbedtls_test_ca_key_ec_len;
|
||||
extern const char mbedtls_test_ca_pwd_ec[];
|
||||
extern const size_t mbedtls_test_ca_pwd_ec_len;
|
||||
extern const char mbedtls_test_srv_crt_ec[];
|
||||
extern const size_t mbedtls_test_srv_crt_ec_len;
|
||||
extern const char mbedtls_test_srv_key_ec[];
|
||||
extern const size_t mbedtls_test_srv_key_ec_len;
|
||||
extern const char mbedtls_test_cli_crt_ec[];
|
||||
extern const size_t mbedtls_test_cli_crt_ec_len;
|
||||
extern const char mbedtls_test_cli_key_ec[];
|
||||
extern const size_t mbedtls_test_cli_key_ec_len;
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_RSA_C)
|
||||
extern const char mbedtls_test_ca_crt_rsa[];
|
||||
extern const size_t mbedtls_test_ca_crt_rsa_len;
|
||||
extern const char mbedtls_test_ca_key_rsa[];
|
||||
extern const size_t mbedtls_test_ca_key_rsa_len;
|
||||
extern const char mbedtls_test_ca_pwd_rsa[];
|
||||
extern const size_t mbedtls_test_ca_pwd_rsa_len;
|
||||
extern const char mbedtls_test_srv_crt_rsa[];
|
||||
extern const size_t mbedtls_test_srv_crt_rsa_len;
|
||||
extern const char mbedtls_test_srv_key_rsa[];
|
||||
extern const size_t mbedtls_test_ca_crt_rsa_sha1_len;
|
||||
extern const size_t mbedtls_test_ca_crt_rsa_sha256_len;
|
||||
|
||||
/* Config-dependent dispatch between SHA-1 and SHA-256
|
||||
* (SHA-256 if enabled, otherwise SHA-1) */
|
||||
|
||||
extern const char mbedtls_test_ca_crt_rsa[];
|
||||
extern const size_t mbedtls_test_ca_crt_rsa_len;
|
||||
|
||||
/* Config-dependent dispatch between EC and RSA
|
||||
* (RSA if enabled, otherwise EC) */
|
||||
|
||||
extern const char * mbedtls_test_ca_crt;
|
||||
extern const char * mbedtls_test_ca_key;
|
||||
extern const char * mbedtls_test_ca_pwd;
|
||||
extern const size_t mbedtls_test_ca_crt_len;
|
||||
extern const size_t mbedtls_test_ca_key_len;
|
||||
extern const size_t mbedtls_test_ca_pwd_len;
|
||||
|
||||
/*
|
||||
* Server test certificates
|
||||
*/
|
||||
|
||||
extern const char mbedtls_test_srv_crt_ec_pem[];
|
||||
extern const char mbedtls_test_srv_key_ec_pem[];
|
||||
extern const char mbedtls_test_srv_pwd_ec_pem[];
|
||||
extern const char mbedtls_test_srv_key_rsa_pem[];
|
||||
extern const char mbedtls_test_srv_pwd_rsa_pem[];
|
||||
extern const char mbedtls_test_srv_crt_rsa_sha1_pem[];
|
||||
extern const char mbedtls_test_srv_crt_rsa_sha256_pem[];
|
||||
|
||||
extern const unsigned char mbedtls_test_srv_crt_ec_der[];
|
||||
extern const unsigned char mbedtls_test_srv_key_ec_der[];
|
||||
extern const unsigned char mbedtls_test_srv_key_rsa_der[];
|
||||
extern const unsigned char mbedtls_test_srv_crt_rsa_sha1_der[];
|
||||
extern const unsigned char mbedtls_test_srv_crt_rsa_sha256_der[];
|
||||
|
||||
extern const size_t mbedtls_test_srv_crt_ec_pem_len;
|
||||
extern const size_t mbedtls_test_srv_key_ec_pem_len;
|
||||
extern const size_t mbedtls_test_srv_pwd_ec_pem_len;
|
||||
extern const size_t mbedtls_test_srv_key_rsa_pem_len;
|
||||
extern const size_t mbedtls_test_srv_pwd_rsa_pem_len;
|
||||
extern const size_t mbedtls_test_srv_crt_rsa_sha1_pem_len;
|
||||
extern const size_t mbedtls_test_srv_crt_rsa_sha256_pem_len;
|
||||
|
||||
extern const size_t mbedtls_test_srv_crt_ec_der_len;
|
||||
extern const size_t mbedtls_test_srv_key_ec_der_len;
|
||||
extern const size_t mbedtls_test_srv_pwd_ec_der_len;
|
||||
extern const size_t mbedtls_test_srv_key_rsa_der_len;
|
||||
extern const size_t mbedtls_test_srv_pwd_rsa_der_len;
|
||||
extern const size_t mbedtls_test_srv_crt_rsa_sha1_der_len;
|
||||
extern const size_t mbedtls_test_srv_crt_rsa_sha256_der_len;
|
||||
|
||||
/* Config-dependent dispatch between PEM and DER encoding
|
||||
* (PEM if enabled, otherwise DER) */
|
||||
|
||||
extern const char mbedtls_test_srv_crt_ec[];
|
||||
extern const char mbedtls_test_srv_key_ec[];
|
||||
extern const char mbedtls_test_srv_pwd_ec[];
|
||||
extern const char mbedtls_test_srv_key_rsa[];
|
||||
extern const char mbedtls_test_srv_pwd_rsa[];
|
||||
extern const char mbedtls_test_srv_crt_rsa_sha1[];
|
||||
extern const char mbedtls_test_srv_crt_rsa_sha256[];
|
||||
|
||||
extern const size_t mbedtls_test_srv_crt_ec_len;
|
||||
extern const size_t mbedtls_test_srv_key_ec_len;
|
||||
extern const size_t mbedtls_test_srv_pwd_ec_len;
|
||||
extern const size_t mbedtls_test_srv_key_rsa_len;
|
||||
extern const char mbedtls_test_cli_crt_rsa[];
|
||||
extern const size_t mbedtls_test_cli_crt_rsa_len;
|
||||
extern const char mbedtls_test_cli_key_rsa[];
|
||||
extern const size_t mbedtls_test_srv_pwd_rsa_len;
|
||||
extern const size_t mbedtls_test_srv_crt_rsa_sha1_len;
|
||||
extern const size_t mbedtls_test_srv_crt_rsa_sha256_len;
|
||||
|
||||
/* Config-dependent dispatch between SHA-1 and SHA-256
|
||||
* (SHA-256 if enabled, otherwise SHA-1) */
|
||||
|
||||
extern const char mbedtls_test_srv_crt_rsa[];
|
||||
extern const size_t mbedtls_test_srv_crt_rsa_len;
|
||||
|
||||
/* Config-dependent dispatch between EC and RSA
|
||||
* (RSA if enabled, otherwise EC) */
|
||||
|
||||
extern const char * mbedtls_test_srv_crt;
|
||||
extern const char * mbedtls_test_srv_key;
|
||||
extern const char * mbedtls_test_srv_pwd;
|
||||
extern const size_t mbedtls_test_srv_crt_len;
|
||||
extern const size_t mbedtls_test_srv_key_len;
|
||||
extern const size_t mbedtls_test_srv_pwd_len;
|
||||
|
||||
/*
|
||||
* Client test certificates
|
||||
*/
|
||||
|
||||
extern const char mbedtls_test_cli_crt_ec_pem[];
|
||||
extern const char mbedtls_test_cli_key_ec_pem[];
|
||||
extern const char mbedtls_test_cli_pwd_ec_pem[];
|
||||
extern const char mbedtls_test_cli_key_rsa_pem[];
|
||||
extern const char mbedtls_test_cli_pwd_rsa_pem[];
|
||||
extern const char mbedtls_test_cli_crt_rsa_pem[];
|
||||
|
||||
extern const unsigned char mbedtls_test_cli_crt_ec_der[];
|
||||
extern const unsigned char mbedtls_test_cli_key_ec_der[];
|
||||
extern const unsigned char mbedtls_test_cli_key_rsa_der[];
|
||||
extern const unsigned char mbedtls_test_cli_crt_rsa_der[];
|
||||
|
||||
extern const size_t mbedtls_test_cli_crt_ec_pem_len;
|
||||
extern const size_t mbedtls_test_cli_key_ec_pem_len;
|
||||
extern const size_t mbedtls_test_cli_pwd_ec_pem_len;
|
||||
extern const size_t mbedtls_test_cli_key_rsa_pem_len;
|
||||
extern const size_t mbedtls_test_cli_pwd_rsa_pem_len;
|
||||
extern const size_t mbedtls_test_cli_crt_rsa_pem_len;
|
||||
|
||||
extern const size_t mbedtls_test_cli_crt_ec_der_len;
|
||||
extern const size_t mbedtls_test_cli_key_ec_der_len;
|
||||
extern const size_t mbedtls_test_cli_key_rsa_der_len;
|
||||
extern const size_t mbedtls_test_cli_crt_rsa_der_len;
|
||||
|
||||
/* Config-dependent dispatch between PEM and DER encoding
|
||||
* (PEM if enabled, otherwise DER) */
|
||||
|
||||
extern const char mbedtls_test_cli_crt_ec[];
|
||||
extern const char mbedtls_test_cli_key_ec[];
|
||||
extern const char mbedtls_test_cli_pwd_ec[];
|
||||
extern const char mbedtls_test_cli_key_rsa[];
|
||||
extern const char mbedtls_test_cli_pwd_rsa[];
|
||||
extern const char mbedtls_test_cli_crt_rsa[];
|
||||
|
||||
extern const size_t mbedtls_test_cli_crt_ec_len;
|
||||
extern const size_t mbedtls_test_cli_key_ec_len;
|
||||
extern const size_t mbedtls_test_cli_pwd_ec_len;
|
||||
extern const size_t mbedtls_test_cli_key_rsa_len;
|
||||
#endif
|
||||
extern const size_t mbedtls_test_cli_pwd_rsa_len;
|
||||
extern const size_t mbedtls_test_cli_crt_rsa_len;
|
||||
|
||||
/* Config-dependent dispatch between EC and RSA
|
||||
* (RSA if enabled, otherwise EC) */
|
||||
|
||||
extern const char * mbedtls_test_cli_crt;
|
||||
extern const char * mbedtls_test_cli_key;
|
||||
extern const char * mbedtls_test_cli_pwd;
|
||||
extern const size_t mbedtls_test_cli_crt_len;
|
||||
extern const size_t mbedtls_test_cli_key_len;
|
||||
extern const size_t mbedtls_test_cli_pwd_len;
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
|
16
Externals/mbedtls/include/mbedtls/chacha20.h
vendored
16
Externals/mbedtls/include/mbedtls/chacha20.h
vendored
@ -12,7 +12,8 @@
|
||||
* \author Daniel King <damaki.gh@gmail.com>
|
||||
*/
|
||||
|
||||
/* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved.
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -26,15 +27,13 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CHACHA20_H
|
||||
#define MBEDTLS_CHACHA20_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -42,15 +41,18 @@
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
#define MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA -0x0051 /**< Invalid input parameter(s). */
|
||||
/** Invalid input parameter(s). */
|
||||
#define MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA -0x0051
|
||||
|
||||
/* MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE is deprecated and should not be
|
||||
* used. */
|
||||
#define MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE -0x0053 /**< Feature not available. For example, s part of the API is not implemented. */
|
||||
/** Feature not available. For example, s part of the API is not implemented. */
|
||||
#define MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE -0x0053
|
||||
|
||||
/* MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED is deprecated and should not be used.
|
||||
*/
|
||||
#define MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED -0x0055 /**< Chacha20 hardware accelerator failed. */
|
||||
/** Chacha20 hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED -0x0055
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
17
Externals/mbedtls/include/mbedtls/chachapoly.h
vendored
17
Externals/mbedtls/include/mbedtls/chachapoly.h
vendored
@ -12,7 +12,8 @@
|
||||
* \author Daniel King <damaki.gh@gmail.com>
|
||||
*/
|
||||
|
||||
/* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved.
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -26,24 +27,24 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CHACHAPOLY_H
|
||||
#define MBEDTLS_CHACHAPOLY_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
/* for shared error codes */
|
||||
#include "poly1305.h"
|
||||
#include "mbedtls/poly1305.h"
|
||||
|
||||
#define MBEDTLS_ERR_CHACHAPOLY_BAD_STATE -0x0054 /**< The requested operation is not permitted in the current state. */
|
||||
#define MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED -0x0056 /**< Authenticated decryption failed: data was not authentic. */
|
||||
/** The requested operation is not permitted in the current state. */
|
||||
#define MBEDTLS_ERR_CHACHAPOLY_BAD_STATE -0x0054
|
||||
/** Authenticated decryption failed: data was not authentic. */
|
||||
#define MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED -0x0056
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -58,7 +59,7 @@ mbedtls_chachapoly_mode_t;
|
||||
|
||||
#if !defined(MBEDTLS_CHACHAPOLY_ALT)
|
||||
|
||||
#include "chacha20.h"
|
||||
#include "mbedtls/chacha20.h"
|
||||
|
||||
typedef struct mbedtls_chachapoly_context
|
||||
{
|
||||
|
239
Externals/mbedtls/include/mbedtls/check_config.h
vendored
239
Externals/mbedtls/include/mbedtls/check_config.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Consistency checks for configuration options
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,8 +18,6 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
/*
|
||||
@ -45,16 +43,20 @@
|
||||
#endif
|
||||
|
||||
/* Fix the config here. Not convenient to put an #ifdef _WIN32 in config.h as
|
||||
* it would confuse config.pl. */
|
||||
* it would confuse config.py. */
|
||||
#if !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && \
|
||||
!defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO)
|
||||
#define MBEDTLS_PLATFORM_SNPRINTF_ALT
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) && \
|
||||
!defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO)
|
||||
#define MBEDTLS_PLATFORM_VSNPRINTF_ALT
|
||||
#endif
|
||||
#endif /* _WIN32 */
|
||||
|
||||
#if defined(TARGET_LIKE_MBED) && \
|
||||
( defined(MBEDTLS_NET_C) || defined(MBEDTLS_TIMING_C) )
|
||||
#error "The NET and TIMING modules are not available for mbed OS - please use the network and timing functions provided by mbed OS"
|
||||
#if defined(TARGET_LIKE_MBED) && defined(MBEDTLS_NET_C)
|
||||
#error "The NET module is not available for mbed OS - please use the network functions provided by Mbed OS"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_DEPRECATED_WARNING) && \
|
||||
@ -98,6 +100,17 @@
|
||||
|
||||
#if defined(MBEDTLS_ECDSA_C) && \
|
||||
( !defined(MBEDTLS_ECP_C) || \
|
||||
!( defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) ) || \
|
||||
!defined(MBEDTLS_ASN1_PARSE_C) || \
|
||||
!defined(MBEDTLS_ASN1_WRITE_C) )
|
||||
#error "MBEDTLS_ECDSA_C defined, but not all prerequisites"
|
||||
@ -109,21 +122,32 @@
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_RESTARTABLE) && \
|
||||
( defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) || \
|
||||
( defined(MBEDTLS_USE_PSA_CRYPTO) || \
|
||||
defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) || \
|
||||
defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) || \
|
||||
defined(MBEDTLS_ECDSA_SIGN_ALT) || \
|
||||
defined(MBEDTLS_ECDSA_VERIFY_ALT) || \
|
||||
defined(MBEDTLS_ECDSA_GENKEY_ALT) || \
|
||||
defined(MBEDTLS_ECP_INTERNAL_ALT) || \
|
||||
defined(MBEDTLS_ECP_ALT) )
|
||||
#error "MBEDTLS_ECP_RESTARTABLE defined, but it cannot coexist with an alternative ECP implementation"
|
||||
#error "MBEDTLS_ECP_RESTARTABLE defined, but it cannot coexist with an alternative or PSA-based ECP implementation"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_RESTARTABLE) && \
|
||||
! defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
|
||||
#error "MBEDTLS_ECP_RESTARTABLE defined, but not MBEDTLS_ECDH_LEGACY_CONTEXT"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) && \
|
||||
defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
|
||||
#error "MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED defined, but MBEDTLS_ECDH_LEGACY_CONTEXT not disabled"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECDSA_DETERMINISTIC) && !defined(MBEDTLS_HMAC_DRBG_C)
|
||||
#error "MBEDTLS_ECDSA_DETERMINISTIC defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_C) && ( !defined(MBEDTLS_BIGNUM_C) || ( \
|
||||
#if defined(MBEDTLS_ECP_C) && ( !defined(MBEDTLS_BIGNUM_C) || ( \
|
||||
!defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && \
|
||||
@ -134,10 +158,20 @@
|
||||
!defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) ) )
|
||||
!defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) ) )
|
||||
#error "MBEDTLS_ECP_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_C) && !( \
|
||||
defined(MBEDTLS_ECP_ALT) || \
|
||||
defined(MBEDTLS_CTR_DRBG_C) || \
|
||||
defined(MBEDTLS_HMAC_DRBG_C) || \
|
||||
defined(MBEDTLS_ECP_NO_INTERNAL_RNG))
|
||||
#error "MBEDTLS_ECP_C requires a DRBG module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)
|
||||
#error "MBEDTLS_PK_PARSE_C defined, but not all prerequesites"
|
||||
#endif
|
||||
@ -160,6 +194,16 @@
|
||||
#error "MBEDTLS_ENTROPY_FORCE_SHA256 defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(__has_feature)
|
||||
#if __has_feature(memory_sanitizer)
|
||||
#define MBEDTLS_HAS_MEMSAN
|
||||
#endif
|
||||
#endif
|
||||
#if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) && !defined(MBEDTLS_HAS_MEMSAN)
|
||||
#error "MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN requires building with MemorySanitizer"
|
||||
#endif
|
||||
#undef MBEDTLS_HAS_MEMSAN
|
||||
|
||||
#if defined(MBEDTLS_TEST_NULL_ENTROPY) && \
|
||||
( !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) )
|
||||
#error "MBEDTLS_TEST_NULL_ENTROPY defined, but not all prerequisites"
|
||||
@ -171,7 +215,7 @@
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_GCM_C) && ( \
|
||||
!defined(MBEDTLS_AES_C) && !defined(MBEDTLS_CAMELLIA_C) )
|
||||
!defined(MBEDTLS_AES_C) && !defined(MBEDTLS_CAMELLIA_C) && !defined(MBEDTLS_ARIA_C) )
|
||||
#error "MBEDTLS_GCM_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
@ -207,6 +251,10 @@
|
||||
#error "MBEDTLS_ECP_NORMALIZE_MXZ_ALT defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_NO_FALLBACK) && !defined(MBEDTLS_ECP_INTERNAL_ALT)
|
||||
#error "MBEDTLS_ECP_NO_FALLBACK defined, but no alternative implementation enabled"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_HAVEGE_C) && !defined(MBEDTLS_TIMING_C)
|
||||
#error "MBEDTLS_HAVEGE_C defined, but not all prerequisites"
|
||||
#endif
|
||||
@ -220,12 +268,14 @@
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) && \
|
||||
( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) )
|
||||
( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_ECDSA_C) || \
|
||||
!defined(MBEDTLS_X509_CRT_PARSE_C) )
|
||||
#error "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
|
||||
( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) )
|
||||
( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_RSA_C) || \
|
||||
!defined(MBEDTLS_X509_CRT_PARSE_C) )
|
||||
#error "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
@ -274,11 +324,27 @@
|
||||
#error "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) && \
|
||||
!defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) && \
|
||||
( !defined(MBEDTLS_SHA256_C) && \
|
||||
!defined(MBEDTLS_SHA512_C) && \
|
||||
!defined(MBEDTLS_SHA1_C) )
|
||||
#error "!MBEDTLS_SSL_KEEP_PEER_CERTIFICATE requires MBEDTLS_SHA512_C, MBEDTLS_SHA256_C or MBEDTLS_SHA1_C"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && \
|
||||
( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) )
|
||||
#error "MBEDTLS_MEMORY_BUFFER_ALLOC_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_MEMORY_BACKTRACE) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
|
||||
#error "MBEDTLS_MEMORY_BACKTRACE defined, but not all prerequesites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_MEMORY_DEBUG) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
|
||||
#error "MBEDTLS_MEMORY_DEBUG defined, but not all prerequesites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PADLOCK_C) && !defined(MBEDTLS_HAVE_ASM)
|
||||
#error "MBEDTLS_PADLOCK_C defined, but not all prerequisites"
|
||||
#endif
|
||||
@ -308,6 +374,14 @@
|
||||
#error "MBEDTLS_PKCS11_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PKCS11_C)
|
||||
#if defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#error "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#elif defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#warning "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#endif
|
||||
#endif /* MBEDTLS_PKCS11_C */
|
||||
|
||||
#if defined(MBEDTLS_PLATFORM_EXIT_ALT) && !defined(MBEDTLS_PLATFORM_C)
|
||||
#error "MBEDTLS_PLATFORM_EXIT_ALT defined, but not all prerequisites"
|
||||
#endif
|
||||
@ -435,10 +509,6 @@
|
||||
#error "MBEDTLS_PLATFORM_STD_CALLOC defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PLATFORM_STD_CALLOC) && !defined(MBEDTLS_PLATFORM_MEMORY)
|
||||
#error "MBEDTLS_PLATFORM_STD_CALLOC defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PLATFORM_STD_FREE) && !defined(MBEDTLS_PLATFORM_MEMORY)
|
||||
#error "MBEDTLS_PLATFORM_STD_FREE defined, but not all prerequisites"
|
||||
#endif
|
||||
@ -501,6 +571,54 @@
|
||||
#error "MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO and MBEDTLS_PLATFORM_STD_NV_SEED_WRITE cannot be defined simultaneously"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C) && \
|
||||
!( ( ( defined(MBEDTLS_CTR_DRBG_C) || defined(MBEDTLS_HMAC_DRBG_C) ) && \
|
||||
defined(MBEDTLS_ENTROPY_C) ) || \
|
||||
defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) )
|
||||
#error "MBEDTLS_PSA_CRYPTO_C defined, but not all prerequisites (missing RNG)"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SPM) && !defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
#error "MBEDTLS_PSA_CRYPTO_SPM defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C) && \
|
||||
! ( defined(MBEDTLS_PSA_CRYPTO_C) && \
|
||||
defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) )
|
||||
#error "MBEDTLS_PSA_CRYPTO_SE_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \
|
||||
! defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
#error "MBEDTLS_PSA_CRYPTO_STORAGE_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
|
||||
!( defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \
|
||||
defined(MBEDTLS_ENTROPY_NV_SEED) )
|
||||
#error "MBEDTLS_PSA_INJECT_ENTROPY defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
|
||||
!defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
|
||||
#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with actual entropy sources"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
|
||||
defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
|
||||
#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_ITS_FILE_C) && \
|
||||
!defined(MBEDTLS_FS_IO)
|
||||
#error "MBEDTLS_PSA_ITS_FILE_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) && \
|
||||
defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
#error "MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER defined, but it cannot coexist with MBEDTLS_USE_PSA_CRYPTO."
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_BIGNUM_C) || \
|
||||
!defined(MBEDTLS_OID_C) )
|
||||
#error "MBEDTLS_RSA_C defined, but not all prerequisites"
|
||||
@ -516,6 +634,10 @@
|
||||
#error "MBEDTLS_X509_RSASSA_PSS_SUPPORT defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SHA512_NO_SHA384) && !defined(MBEDTLS_SHA512_C)
|
||||
#error "MBEDTLS_SHA512_NO_SHA384 defined without MBEDTLS_SHA512_C"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3) && ( !defined(MBEDTLS_MD5_C) || \
|
||||
!defined(MBEDTLS_SHA1_C) )
|
||||
#error "MBEDTLS_SSL_PROTO_SSL3 defined, but not all prerequisites"
|
||||
@ -536,6 +658,28 @@
|
||||
#error "MBEDTLS_SSL_PROTO_TLS1_2 defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL) && ( !defined(MBEDTLS_HKDF_C) && \
|
||||
!defined(MBEDTLS_SHA256_C) && !defined(MBEDTLS_SHA512_C) )
|
||||
#error "MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if (defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)) && \
|
||||
!(defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) )
|
||||
#error "One or more versions of the TLS protocol are enabled " \
|
||||
"but no key exchange methods defined with MBEDTLS_KEY_EXCHANGE_xxxx"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_DTLS) && \
|
||||
!defined(MBEDTLS_SSL_PROTO_TLS1_1) && \
|
||||
!defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||
@ -591,6 +735,23 @@
|
||||
#error "MBEDTLS_SSL_DTLS_ANTI_REPLAY defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
|
||||
( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) )
|
||||
#error "MBEDTLS_SSL_DTLS_CONNECTION_ID defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
|
||||
defined(MBEDTLS_SSL_CID_IN_LEN_MAX) && \
|
||||
MBEDTLS_SSL_CID_IN_LEN_MAX > 255
|
||||
#error "MBEDTLS_SSL_CID_IN_LEN_MAX too large (max 255)"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
|
||||
defined(MBEDTLS_SSL_CID_OUT_LEN_MAX) && \
|
||||
MBEDTLS_SSL_CID_OUT_LEN_MAX > 255
|
||||
#error "MBEDTLS_SSL_CID_OUT_LEN_MAX too large (max 255)"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
|
||||
( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) )
|
||||
#error "MBEDTLS_SSL_DTLS_BADMAC_LIMIT defined, but not all prerequisites"
|
||||
@ -643,6 +804,10 @@
|
||||
#endif
|
||||
#undef MBEDTLS_THREADING_IMPL
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
#error "MBEDTLS_USE_PSA_CRYPTO defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_VERSION_FEATURES) && !defined(MBEDTLS_VERSION_C)
|
||||
#error "MBEDTLS_VERSION_FEATURES defined, but not all prerequisites"
|
||||
#endif
|
||||
@ -659,6 +824,10 @@
|
||||
#error "MBEDTLS_X509_CREATE_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CERTS_C) && !defined(MBEDTLS_X509_USE_C)
|
||||
#error "MBEDTLS_CERTS_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_X509_CRT_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) )
|
||||
#error "MBEDTLS_X509_CRT_PARSE_C defined, but not all prerequisites"
|
||||
#endif
|
||||
@ -688,10 +857,42 @@
|
||||
#error "MBEDTLS_HAVE_INT32/MBEDTLS_HAVE_INT64 and MBEDTLS_HAVE_ASM cannot be defined simultaneously"
|
||||
#endif /* (MBEDTLS_HAVE_INT32 || MBEDTLS_HAVE_INT64) && MBEDTLS_HAVE_ASM */
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
||||
#if defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#error "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#elif defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#warning "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#endif
|
||||
#endif /* MBEDTLS_SSL_PROTO_SSL3 */
|
||||
|
||||
#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
|
||||
#if defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#error "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#elif defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#warning "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#endif
|
||||
#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
|
||||
|
||||
#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
|
||||
#if defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#error "MBEDTLS_SSL_HW_RECORD_ACCEL is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#elif defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#warning "MBEDTLS_SSL_HW_RECORD_ACCEL is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#endif /* MBEDTLS_DEPRECATED_REMOVED */
|
||||
#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
|
||||
|
||||
#if defined(MBEDTLS_SSL_DTLS_SRTP) && ( !defined(MBEDTLS_SSL_PROTO_DTLS) )
|
||||
#error "MBEDTLS_SSL_DTLS_SRTP defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) && ( !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) )
|
||||
#error "MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Avoid warning from -pedantic. This is a convenient place for this
|
||||
* workaround since this is included by every single file before the
|
||||
* #if defined(MBEDTLS_xxx_C) that results in emtpy translation units.
|
||||
* #if defined(MBEDTLS_xxx_C) that results in empty translation units.
|
||||
*/
|
||||
typedef int mbedtls_iso_c_forbids_empty_translation_units;
|
||||
|
||||
|
368
Externals/mbedtls/include/mbedtls/cipher.h
vendored
368
Externals/mbedtls/include/mbedtls/cipher.h
vendored
@ -8,7 +8,7 @@
|
||||
* \author Adriaan de Jong <dejong@fox-it.com>
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -22,21 +22,19 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CIPHER_H
|
||||
#define MBEDTLS_CIPHER_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
#include "platform_util.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
#define MBEDTLS_CIPHER_MODE_AEAD
|
||||
@ -56,16 +54,24 @@
|
||||
#define inline __inline
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE -0x6080 /**< The selected feature is not available. */
|
||||
#define MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA -0x6100 /**< Bad input parameters. */
|
||||
#define MBEDTLS_ERR_CIPHER_ALLOC_FAILED -0x6180 /**< Failed to allocate memory. */
|
||||
#define MBEDTLS_ERR_CIPHER_INVALID_PADDING -0x6200 /**< Input data contains invalid padding and is rejected. */
|
||||
#define MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED -0x6280 /**< Decryption of block requires a full block. */
|
||||
#define MBEDTLS_ERR_CIPHER_AUTH_FAILED -0x6300 /**< Authentication failed (for AEAD modes). */
|
||||
#define MBEDTLS_ERR_CIPHER_INVALID_CONTEXT -0x6380 /**< The context is invalid. For example, because it was freed. */
|
||||
/** The selected feature is not available. */
|
||||
#define MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE -0x6080
|
||||
/** Bad input parameters. */
|
||||
#define MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA -0x6100
|
||||
/** Failed to allocate memory. */
|
||||
#define MBEDTLS_ERR_CIPHER_ALLOC_FAILED -0x6180
|
||||
/** Input data contains invalid padding and is rejected. */
|
||||
#define MBEDTLS_ERR_CIPHER_INVALID_PADDING -0x6200
|
||||
/** Decryption of block requires a full block. */
|
||||
#define MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED -0x6280
|
||||
/** Authentication failed (for AEAD modes). */
|
||||
#define MBEDTLS_ERR_CIPHER_AUTH_FAILED -0x6300
|
||||
/** The context is invalid. For example, because it was freed. */
|
||||
#define MBEDTLS_ERR_CIPHER_INVALID_CONTEXT -0x6380
|
||||
|
||||
/* MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED -0x6400 /**< Cipher hardware accelerator failed. */
|
||||
/** Cipher hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED -0x6400
|
||||
|
||||
#define MBEDTLS_CIPHER_VARIABLE_IV_LEN 0x01 /**< Cipher accepts IVs of variable length. */
|
||||
#define MBEDTLS_CIPHER_VARIABLE_KEY_LEN 0x02 /**< Cipher accepts keys of variable length. */
|
||||
@ -176,21 +182,29 @@ typedef enum {
|
||||
MBEDTLS_CIPHER_AES_256_XTS, /**< AES 256-bit cipher in XTS block mode. */
|
||||
MBEDTLS_CIPHER_CHACHA20, /**< ChaCha20 stream cipher. */
|
||||
MBEDTLS_CIPHER_CHACHA20_POLY1305, /**< ChaCha20-Poly1305 AEAD cipher. */
|
||||
MBEDTLS_CIPHER_AES_128_KW, /**< AES cipher with 128-bit NIST KW mode. */
|
||||
MBEDTLS_CIPHER_AES_192_KW, /**< AES cipher with 192-bit NIST KW mode. */
|
||||
MBEDTLS_CIPHER_AES_256_KW, /**< AES cipher with 256-bit NIST KW mode. */
|
||||
MBEDTLS_CIPHER_AES_128_KWP, /**< AES cipher with 128-bit NIST KWP mode. */
|
||||
MBEDTLS_CIPHER_AES_192_KWP, /**< AES cipher with 192-bit NIST KWP mode. */
|
||||
MBEDTLS_CIPHER_AES_256_KWP, /**< AES cipher with 256-bit NIST KWP mode. */
|
||||
} mbedtls_cipher_type_t;
|
||||
|
||||
/** Supported cipher modes. */
|
||||
typedef enum {
|
||||
MBEDTLS_MODE_NONE = 0, /**< None. */
|
||||
MBEDTLS_MODE_ECB, /**< The ECB cipher mode. */
|
||||
MBEDTLS_MODE_CBC, /**< The CBC cipher mode. */
|
||||
MBEDTLS_MODE_CFB, /**< The CFB cipher mode. */
|
||||
MBEDTLS_MODE_OFB, /**< The OFB cipher mode. */
|
||||
MBEDTLS_MODE_CTR, /**< The CTR cipher mode. */
|
||||
MBEDTLS_MODE_GCM, /**< The GCM cipher mode. */
|
||||
MBEDTLS_MODE_STREAM, /**< The stream cipher mode. */
|
||||
MBEDTLS_MODE_CCM, /**< The CCM cipher mode. */
|
||||
MBEDTLS_MODE_XTS, /**< The XTS cipher mode. */
|
||||
MBEDTLS_MODE_NONE = 0, /**< None. */
|
||||
MBEDTLS_MODE_ECB, /**< The ECB cipher mode. */
|
||||
MBEDTLS_MODE_CBC, /**< The CBC cipher mode. */
|
||||
MBEDTLS_MODE_CFB, /**< The CFB cipher mode. */
|
||||
MBEDTLS_MODE_OFB, /**< The OFB cipher mode. */
|
||||
MBEDTLS_MODE_CTR, /**< The CTR cipher mode. */
|
||||
MBEDTLS_MODE_GCM, /**< The GCM cipher mode. */
|
||||
MBEDTLS_MODE_STREAM, /**< The stream cipher mode. */
|
||||
MBEDTLS_MODE_CCM, /**< The CCM cipher mode. */
|
||||
MBEDTLS_MODE_XTS, /**< The XTS cipher mode. */
|
||||
MBEDTLS_MODE_CHACHAPOLY, /**< The ChaCha-Poly cipher mode. */
|
||||
MBEDTLS_MODE_KW, /**< The SP800-38F KW mode */
|
||||
MBEDTLS_MODE_KWP, /**< The SP800-38F KWP mode */
|
||||
} mbedtls_cipher_mode_t;
|
||||
|
||||
/** Supported cipher padding types. */
|
||||
@ -221,10 +235,30 @@ enum {
|
||||
};
|
||||
|
||||
/** Maximum length of any IV, in Bytes. */
|
||||
/* This should ideally be derived automatically from list of ciphers.
|
||||
* This should be kept in sync with MBEDTLS_SSL_MAX_IV_LENGTH defined
|
||||
* in ssl_internal.h. */
|
||||
#define MBEDTLS_MAX_IV_LENGTH 16
|
||||
|
||||
/** Maximum block size of any cipher, in Bytes. */
|
||||
/* This should ideally be derived automatically from list of ciphers.
|
||||
* This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined
|
||||
* in ssl_internal.h. */
|
||||
#define MBEDTLS_MAX_BLOCK_LENGTH 16
|
||||
|
||||
/** Maximum key length, in Bytes. */
|
||||
/* This should ideally be derived automatically from list of ciphers.
|
||||
* For now, only check whether XTS is enabled which uses 64 Byte keys,
|
||||
* and use 32 Bytes as an upper bound for the maximum key length otherwise.
|
||||
* This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined
|
||||
* in ssl_internal.h, which however deliberately ignores the case of XTS
|
||||
* since the latter isn't used in SSL/TLS. */
|
||||
#if defined(MBEDTLS_CIPHER_MODE_XTS)
|
||||
#define MBEDTLS_MAX_KEY_LENGTH 64
|
||||
#else
|
||||
#define MBEDTLS_MAX_KEY_LENGTH 32
|
||||
#endif /* MBEDTLS_CIPHER_MODE_XTS */
|
||||
|
||||
/**
|
||||
* Base cipher information (opaque struct).
|
||||
*/
|
||||
@ -322,14 +356,32 @@ typedef struct mbedtls_cipher_context_t
|
||||
/** CMAC-specific context. */
|
||||
mbedtls_cmac_context_t *cmac_ctx;
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
/** Indicates whether the cipher operations should be performed
|
||||
* by Mbed TLS' own crypto library or an external implementation
|
||||
* of the PSA Crypto API.
|
||||
* This is unset if the cipher context was established through
|
||||
* mbedtls_cipher_setup(), and set if it was established through
|
||||
* mbedtls_cipher_setup_psa().
|
||||
*/
|
||||
unsigned char psa_enabled;
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
} mbedtls_cipher_context_t;
|
||||
|
||||
/**
|
||||
* \brief This function retrieves the list of ciphers supported by the generic
|
||||
* cipher module.
|
||||
* \brief This function retrieves the list of ciphers supported
|
||||
* by the generic cipher module.
|
||||
*
|
||||
* \return A statically-allocated array of ciphers. The last entry
|
||||
* is zero.
|
||||
* For any cipher identifier in the returned list, you can
|
||||
* obtain the corresponding generic cipher information structure
|
||||
* via mbedtls_cipher_info_from_type(), which can then be used
|
||||
* to prepare a cipher context via mbedtls_cipher_setup().
|
||||
*
|
||||
*
|
||||
* \return A statically-allocated array of cipher identifiers
|
||||
* of type cipher_type_t. The last entry is zero.
|
||||
*/
|
||||
const int *mbedtls_cipher_list( void );
|
||||
|
||||
@ -396,9 +448,8 @@ void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx );
|
||||
|
||||
|
||||
/**
|
||||
* \brief This function initializes and fills the cipher-context
|
||||
* structure with the appropriate values. It also clears
|
||||
* the structure.
|
||||
* \brief This function initializes a cipher context for
|
||||
* use with the given cipher primitive.
|
||||
*
|
||||
* \param ctx The context to initialize. This must be initialized.
|
||||
* \param cipher_info The cipher to use.
|
||||
@ -416,6 +467,33 @@ void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx );
|
||||
int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx,
|
||||
const mbedtls_cipher_info_t *cipher_info );
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
/**
|
||||
* \brief This function initializes a cipher context for
|
||||
* PSA-based use with the given cipher primitive.
|
||||
*
|
||||
* \note See #MBEDTLS_USE_PSA_CRYPTO for information on PSA.
|
||||
*
|
||||
* \param ctx The context to initialize. May not be \c NULL.
|
||||
* \param cipher_info The cipher to use.
|
||||
* \param taglen For AEAD ciphers, the length in bytes of the
|
||||
* authentication tag to use. Subsequent uses of
|
||||
* mbedtls_cipher_auth_encrypt() or
|
||||
* mbedtls_cipher_auth_decrypt() must provide
|
||||
* the same tag length.
|
||||
* For non-AEAD ciphers, the value must be \c 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
|
||||
* parameter-verification failure.
|
||||
* \return #MBEDTLS_ERR_CIPHER_ALLOC_FAILED if allocation of the
|
||||
* cipher-specific context fails.
|
||||
*/
|
||||
int mbedtls_cipher_setup_psa( mbedtls_cipher_context_t *ctx,
|
||||
const mbedtls_cipher_info_t *cipher_info,
|
||||
size_t taglen );
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
/**
|
||||
* \brief This function returns the block size of the given cipher.
|
||||
*
|
||||
@ -638,7 +716,7 @@ int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx );
|
||||
* \param ctx The generic cipher context. This must be initialized.
|
||||
* \param ad The additional data to use. This must be a readable
|
||||
* buffer of at least \p ad_len Bytes.
|
||||
* \param ad_len the Length of \p ad Bytes.
|
||||
* \param ad_len The length of \p ad in Bytes.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return A specific error code on failure.
|
||||
@ -681,8 +759,10 @@ int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx,
|
||||
* unsupported mode for a cipher.
|
||||
* \return A cipher-specific error code on failure.
|
||||
*/
|
||||
int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *input,
|
||||
size_t ilen, unsigned char *output, size_t *olen );
|
||||
int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *input,
|
||||
size_t ilen, unsigned char *output,
|
||||
size_t *olen );
|
||||
|
||||
/**
|
||||
* \brief The generic cipher finalization function. If data still
|
||||
@ -785,30 +865,52 @@ int mbedtls_cipher_crypt( mbedtls_cipher_context_t *ctx,
|
||||
unsigned char *output, size_t *olen );
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_MODE_AEAD)
|
||||
#if ! defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#if defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#define MBEDTLS_DEPRECATED __attribute__((deprecated))
|
||||
#else
|
||||
#define MBEDTLS_DEPRECATED
|
||||
#endif /* MBEDTLS_DEPRECATED_WARNING */
|
||||
/**
|
||||
* \brief The generic autenticated encryption (AEAD) function.
|
||||
* \brief The generic authenticated encryption (AEAD) function.
|
||||
*
|
||||
* \deprecated Superseded by mbedtls_cipher_auth_encrypt_ext().
|
||||
*
|
||||
* \note This function only supports AEAD algorithms, not key
|
||||
* wrapping algorithms such as NIST_KW; for this, see
|
||||
* mbedtls_cipher_auth_encrypt_ext().
|
||||
*
|
||||
* \param ctx The generic cipher context. This must be initialized and
|
||||
* bound to a key.
|
||||
* \param iv The IV to use, or NONCE_COUNTER for CTR-mode ciphers.
|
||||
* This must be a readable buffer of at least \p iv_len
|
||||
* Bytes.
|
||||
* \param iv_len The IV length for ciphers with variable-size IV.
|
||||
* This parameter is discarded by ciphers with fixed-size IV.
|
||||
* bound to a key associated with an AEAD algorithm.
|
||||
* \param iv The nonce to use. This must be a readable buffer of
|
||||
* at least \p iv_len Bytes and must not be \c NULL.
|
||||
* \param iv_len The length of the nonce. This must satisfy the
|
||||
* constraints imposed by the AEAD cipher used.
|
||||
* \param ad The additional data to authenticate. This must be a
|
||||
* readable buffer of at least \p ad_len Bytes.
|
||||
* readable buffer of at least \p ad_len Bytes, and may
|
||||
* be \c NULL is \p ad_len is \c 0.
|
||||
* \param ad_len The length of \p ad.
|
||||
* \param input The buffer holding the input data. This must be a
|
||||
* readable buffer of at least \p ilen Bytes.
|
||||
* readable buffer of at least \p ilen Bytes, and may be
|
||||
* \c NULL if \p ilen is \c 0.
|
||||
* \param ilen The length of the input data.
|
||||
* \param output The buffer for the output data. This must be able to
|
||||
* hold at least \p ilen Bytes.
|
||||
* \param olen The length of the output data, to be updated with the
|
||||
* actual number of Bytes written. This must not be
|
||||
* \c NULL.
|
||||
* \param output The buffer for the output data. This must be a
|
||||
* writable buffer of at least \p ilen Bytes, and must
|
||||
* not be \c NULL.
|
||||
* \param olen This will be filled with the actual number of Bytes
|
||||
* written to the \p output buffer. This must point to a
|
||||
* writable object of type \c size_t.
|
||||
* \param tag The buffer for the authentication tag. This must be a
|
||||
* writable buffer of at least \p tag_len Bytes.
|
||||
* \param tag_len The desired length of the authentication tag.
|
||||
* writable buffer of at least \p tag_len Bytes. See note
|
||||
* below regarding restrictions with PSA-based contexts.
|
||||
* \param tag_len The desired length of the authentication tag. This
|
||||
* must match the constraints imposed by the AEAD cipher
|
||||
* used, and in particular must not be \c 0.
|
||||
*
|
||||
* \note If the context is based on PSA (that is, it was set up
|
||||
* with mbedtls_cipher_setup_psa()), then it is required
|
||||
* that \c tag == output + ilen. That is, the tag must be
|
||||
* appended to the ciphertext as recommended by RFC 5116.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
|
||||
@ -820,36 +922,53 @@ int mbedtls_cipher_auth_encrypt( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *ad, size_t ad_len,
|
||||
const unsigned char *input, size_t ilen,
|
||||
unsigned char *output, size_t *olen,
|
||||
unsigned char *tag, size_t tag_len );
|
||||
unsigned char *tag, size_t tag_len )
|
||||
MBEDTLS_DEPRECATED;
|
||||
|
||||
/**
|
||||
* \brief The generic autenticated decryption (AEAD) function.
|
||||
* \brief The generic authenticated decryption (AEAD) function.
|
||||
*
|
||||
* \deprecated Superseded by mbedtls_cipher_auth_decrypt_ext().
|
||||
*
|
||||
* \note This function only supports AEAD algorithms, not key
|
||||
* wrapping algorithms such as NIST_KW; for this, see
|
||||
* mbedtls_cipher_auth_decrypt_ext().
|
||||
*
|
||||
* \note If the data is not authentic, then the output buffer
|
||||
* is zeroed out to prevent the unauthentic plaintext being
|
||||
* used, making this interface safer.
|
||||
*
|
||||
* \param ctx The generic cipher context. This must be initialized and
|
||||
* and bound to a key.
|
||||
* \param iv The IV to use, or NONCE_COUNTER for CTR-mode ciphers.
|
||||
* This must be a readable buffer of at least \p iv_len
|
||||
* Bytes.
|
||||
* \param iv_len The IV length for ciphers with variable-size IV.
|
||||
* This parameter is discarded by ciphers with fixed-size IV.
|
||||
* \param ad The additional data to be authenticated. This must be a
|
||||
* readable buffer of at least \p ad_len Bytes.
|
||||
* bound to a key associated with an AEAD algorithm.
|
||||
* \param iv The nonce to use. This must be a readable buffer of
|
||||
* at least \p iv_len Bytes and must not be \c NULL.
|
||||
* \param iv_len The length of the nonce. This must satisfy the
|
||||
* constraints imposed by the AEAD cipher used.
|
||||
* \param ad The additional data to authenticate. This must be a
|
||||
* readable buffer of at least \p ad_len Bytes, and may
|
||||
* be \c NULL is \p ad_len is \c 0.
|
||||
* \param ad_len The length of \p ad.
|
||||
* \param input The buffer holding the input data. This must be a
|
||||
* readable buffer of at least \p ilen Bytes.
|
||||
* readable buffer of at least \p ilen Bytes, and may be
|
||||
* \c NULL if \p ilen is \c 0.
|
||||
* \param ilen The length of the input data.
|
||||
* \param output The buffer for the output data.
|
||||
* This must be able to hold at least \p ilen Bytes.
|
||||
* \param olen The length of the output data, to be updated with the
|
||||
* actual number of Bytes written. This must not be
|
||||
* \c NULL.
|
||||
* \param tag The buffer holding the authentication tag. This must be
|
||||
* a readable buffer of at least \p tag_len Bytes.
|
||||
* \param tag_len The length of the authentication tag.
|
||||
* \param output The buffer for the output data. This must be a
|
||||
* writable buffer of at least \p ilen Bytes, and must
|
||||
* not be \c NULL.
|
||||
* \param olen This will be filled with the actual number of Bytes
|
||||
* written to the \p output buffer. This must point to a
|
||||
* writable object of type \c size_t.
|
||||
* \param tag The buffer for the authentication tag. This must be a
|
||||
* readable buffer of at least \p tag_len Bytes. See note
|
||||
* below regarding restrictions with PSA-based contexts.
|
||||
* \param tag_len The length of the authentication tag. This must match
|
||||
* the constraints imposed by the AEAD cipher used, and in
|
||||
* particular must not be \c 0.
|
||||
*
|
||||
* \note If the context is based on PSA (that is, it was set up
|
||||
* with mbedtls_cipher_setup_psa()), then it is required
|
||||
* that \c tag == input + len. That is, the tag must be
|
||||
* appended to the ciphertext as recommended by RFC 5116.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
|
||||
@ -862,9 +981,120 @@ int mbedtls_cipher_auth_decrypt( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *ad, size_t ad_len,
|
||||
const unsigned char *input, size_t ilen,
|
||||
unsigned char *output, size_t *olen,
|
||||
const unsigned char *tag, size_t tag_len );
|
||||
const unsigned char *tag, size_t tag_len )
|
||||
MBEDTLS_DEPRECATED;
|
||||
#undef MBEDTLS_DEPRECATED
|
||||
#endif /* MBEDTLS_DEPRECATED_REMOVED */
|
||||
#endif /* MBEDTLS_CIPHER_MODE_AEAD */
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_MODE_AEAD) || defined(MBEDTLS_NIST_KW_C)
|
||||
/**
|
||||
* \brief The authenticated encryption (AEAD/NIST_KW) function.
|
||||
*
|
||||
* \note For AEAD modes, the tag will be appended to the
|
||||
* ciphertext, as recommended by RFC 5116.
|
||||
* (NIST_KW doesn't have a separate tag.)
|
||||
*
|
||||
* \param ctx The generic cipher context. This must be initialized and
|
||||
* bound to a key, with an AEAD algorithm or NIST_KW.
|
||||
* \param iv The nonce to use. This must be a readable buffer of
|
||||
* at least \p iv_len Bytes and may be \c NULL if \p
|
||||
* iv_len is \c 0.
|
||||
* \param iv_len The length of the nonce. For AEAD ciphers, this must
|
||||
* satisfy the constraints imposed by the cipher used.
|
||||
* For NIST_KW, this must be \c 0.
|
||||
* \param ad The additional data to authenticate. This must be a
|
||||
* readable buffer of at least \p ad_len Bytes, and may
|
||||
* be \c NULL is \p ad_len is \c 0.
|
||||
* \param ad_len The length of \p ad. For NIST_KW, this must be \c 0.
|
||||
* \param input The buffer holding the input data. This must be a
|
||||
* readable buffer of at least \p ilen Bytes, and may be
|
||||
* \c NULL if \p ilen is \c 0.
|
||||
* \param ilen The length of the input data.
|
||||
* \param output The buffer for the output data. This must be a
|
||||
* writable buffer of at least \p output_len Bytes, and
|
||||
* must not be \c NULL.
|
||||
* \param output_len The length of the \p output buffer in Bytes. For AEAD
|
||||
* ciphers, this must be at least \p ilen + \p tag_len.
|
||||
* For NIST_KW, this must be at least \p ilen + 8
|
||||
* (rounded up to a multiple of 8 if KWP is used);
|
||||
* \p ilen + 15 is always a safe value.
|
||||
* \param olen This will be filled with the actual number of Bytes
|
||||
* written to the \p output buffer. This must point to a
|
||||
* writable object of type \c size_t.
|
||||
* \param tag_len The desired length of the authentication tag. For AEAD
|
||||
* ciphers, this must match the constraints imposed by
|
||||
* the cipher used, and in particular must not be \c 0.
|
||||
* For NIST_KW, this must be \c 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
|
||||
* parameter-verification failure.
|
||||
* \return A cipher-specific error code on failure.
|
||||
*/
|
||||
int mbedtls_cipher_auth_encrypt_ext( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *iv, size_t iv_len,
|
||||
const unsigned char *ad, size_t ad_len,
|
||||
const unsigned char *input, size_t ilen,
|
||||
unsigned char *output, size_t output_len,
|
||||
size_t *olen, size_t tag_len );
|
||||
|
||||
/**
|
||||
* \brief The authenticated encryption (AEAD/NIST_KW) function.
|
||||
*
|
||||
* \note If the data is not authentic, then the output buffer
|
||||
* is zeroed out to prevent the unauthentic plaintext being
|
||||
* used, making this interface safer.
|
||||
*
|
||||
* \note For AEAD modes, the tag must be appended to the
|
||||
* ciphertext, as recommended by RFC 5116.
|
||||
* (NIST_KW doesn't have a separate tag.)
|
||||
*
|
||||
* \param ctx The generic cipher context. This must be initialized and
|
||||
* bound to a key, with an AEAD algorithm or NIST_KW.
|
||||
* \param iv The nonce to use. This must be a readable buffer of
|
||||
* at least \p iv_len Bytes and may be \c NULL if \p
|
||||
* iv_len is \c 0.
|
||||
* \param iv_len The length of the nonce. For AEAD ciphers, this must
|
||||
* satisfy the constraints imposed by the cipher used.
|
||||
* For NIST_KW, this must be \c 0.
|
||||
* \param ad The additional data to authenticate. This must be a
|
||||
* readable buffer of at least \p ad_len Bytes, and may
|
||||
* be \c NULL is \p ad_len is \c 0.
|
||||
* \param ad_len The length of \p ad. For NIST_KW, this must be \c 0.
|
||||
* \param input The buffer holding the input data. This must be a
|
||||
* readable buffer of at least \p ilen Bytes, and may be
|
||||
* \c NULL if \p ilen is \c 0.
|
||||
* \param ilen The length of the input data. For AEAD ciphers this
|
||||
* must be at least \p tag_len. For NIST_KW this must be
|
||||
* at least \c 8.
|
||||
* \param output The buffer for the output data. This must be a
|
||||
* writable buffer of at least \p output_len Bytes, and
|
||||
* may be \c NULL if \p output_len is \c 0.
|
||||
* \param output_len The length of the \p output buffer in Bytes. For AEAD
|
||||
* ciphers, this must be at least \p ilen - \p tag_len.
|
||||
* For NIST_KW, this must be at least \p ilen - 8.
|
||||
* \param olen This will be filled with the actual number of Bytes
|
||||
* written to the \p output buffer. This must point to a
|
||||
* writable object of type \c size_t.
|
||||
* \param tag_len The actual length of the authentication tag. For AEAD
|
||||
* ciphers, this must match the constraints imposed by
|
||||
* the cipher used, and in particular must not be \c 0.
|
||||
* For NIST_KW, this must be \c 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
|
||||
* parameter-verification failure.
|
||||
* \return #MBEDTLS_ERR_CIPHER_AUTH_FAILED if data is not authentic.
|
||||
* \return A cipher-specific error code on failure.
|
||||
*/
|
||||
int mbedtls_cipher_auth_decrypt_ext( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *iv, size_t iv_len,
|
||||
const unsigned char *ad, size_t ad_len,
|
||||
const unsigned char *input, size_t ilen,
|
||||
unsigned char *output, size_t output_len,
|
||||
size_t *olen, size_t tag_len );
|
||||
#endif /* MBEDTLS_CIPHER_MODE_AEAD || MBEDTLS_NIST_KW_C */
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
@ -6,7 +6,7 @@
|
||||
* \author Adriaan de Jong <dejong@fox-it.com>
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -20,19 +20,21 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_CIPHER_WRAP_H
|
||||
#define MBEDTLS_CIPHER_WRAP_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "cipher.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
#include "psa/crypto.h"
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -114,6 +116,29 @@ typedef struct
|
||||
const mbedtls_cipher_info_t *info;
|
||||
} mbedtls_cipher_definition_t;
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
typedef enum
|
||||
{
|
||||
MBEDTLS_CIPHER_PSA_KEY_UNSET = 0,
|
||||
MBEDTLS_CIPHER_PSA_KEY_OWNED, /* Used for PSA-based cipher contexts which */
|
||||
/* use raw key material internally imported */
|
||||
/* as a volatile key, and which hence need */
|
||||
/* to destroy that key when the context is */
|
||||
/* freed. */
|
||||
MBEDTLS_CIPHER_PSA_KEY_NOT_OWNED, /* Used for PSA-based cipher contexts */
|
||||
/* which use a key provided by the */
|
||||
/* user, and which hence will not be */
|
||||
/* destroyed when the context is freed. */
|
||||
} mbedtls_cipher_psa_key_ownership;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
psa_algorithm_t alg;
|
||||
psa_key_id_t slot;
|
||||
mbedtls_cipher_psa_key_ownership slot_state;
|
||||
} mbedtls_cipher_context_psa;
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
extern const mbedtls_cipher_definition_t mbedtls_cipher_definitions[];
|
||||
|
||||
extern int mbedtls_cipher_supported[];
|
||||
|
76
Externals/mbedtls/include/mbedtls/cmac.h
vendored
76
Externals/mbedtls/include/mbedtls/cmac.h
vendored
@ -7,7 +7,7 @@
|
||||
* Authentication is defined in <em>RFC-4493: The AES-CMAC Algorithm</em>.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2015-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -21,27 +21,26 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CMAC_H
|
||||
#define MBEDTLS_CMAC_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "cipher.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED -0x007A /**< CMAC hardware accelerator failed. */
|
||||
/** CMAC hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED -0x007A
|
||||
|
||||
#define MBEDTLS_AES_BLOCK_SIZE 16
|
||||
#define MBEDTLS_DES3_BLOCK_SIZE 8
|
||||
@ -75,9 +74,23 @@ struct mbedtls_cmac_context_t
|
||||
#endif /* !MBEDTLS_CMAC_ALT */
|
||||
|
||||
/**
|
||||
* \brief This function sets the CMAC key, and prepares to authenticate
|
||||
* \brief This function starts a new CMAC computation
|
||||
* by setting the CMAC key, and preparing to authenticate
|
||||
* the input data.
|
||||
* Must be called with an initialized cipher context.
|
||||
* It must be called with an initialized cipher context.
|
||||
*
|
||||
* Once this function has completed, data can be supplied
|
||||
* to the CMAC computation by calling
|
||||
* mbedtls_cipher_cmac_update().
|
||||
*
|
||||
* To start a CMAC computation using the same key as a previous
|
||||
* CMAC computation, use mbedtls_cipher_cmac_finish().
|
||||
*
|
||||
* \note When the CMAC implementation is supplied by an alternate
|
||||
* implementation (through #MBEDTLS_CMAC_ALT), some ciphers
|
||||
* may not be supported by that implementation, and thus
|
||||
* return an error. Alternate implementations must support
|
||||
* AES-128 and AES-256, and may support AES-192 and 3DES.
|
||||
*
|
||||
* \param ctx The cipher context used for the CMAC operation, initialized
|
||||
* as one of the following types: MBEDTLS_CIPHER_AES_128_ECB,
|
||||
@ -97,9 +110,15 @@ int mbedtls_cipher_cmac_starts( mbedtls_cipher_context_t *ctx,
|
||||
* \brief This function feeds an input buffer into an ongoing CMAC
|
||||
* computation.
|
||||
*
|
||||
* It is called between mbedtls_cipher_cmac_starts() or
|
||||
* mbedtls_cipher_cmac_reset(), and mbedtls_cipher_cmac_finish().
|
||||
* Can be called repeatedly.
|
||||
* The CMAC computation must have previously been started
|
||||
* by calling mbedtls_cipher_cmac_starts() or
|
||||
* mbedtls_cipher_cmac_reset().
|
||||
*
|
||||
* Call this function as many times as needed to input the
|
||||
* data to be authenticated.
|
||||
* Once all of the required data has been input,
|
||||
* call mbedtls_cipher_cmac_finish() to obtain the result
|
||||
* of the CMAC operation.
|
||||
*
|
||||
* \param ctx The cipher context used for the CMAC operation.
|
||||
* \param input The buffer holding the input data.
|
||||
@ -113,12 +132,13 @@ int mbedtls_cipher_cmac_update( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *input, size_t ilen );
|
||||
|
||||
/**
|
||||
* \brief This function finishes the CMAC operation, and writes
|
||||
* the result to the output buffer.
|
||||
* \brief This function finishes an ongoing CMAC operation, and
|
||||
* writes the result to the output buffer.
|
||||
*
|
||||
* It is called after mbedtls_cipher_cmac_update().
|
||||
* It can be followed by mbedtls_cipher_cmac_reset() and
|
||||
* mbedtls_cipher_cmac_update(), or mbedtls_cipher_free().
|
||||
* It should be followed either by
|
||||
* mbedtls_cipher_cmac_reset(), which starts another CMAC
|
||||
* operation with the same key, or mbedtls_cipher_free(),
|
||||
* which clears the cipher context.
|
||||
*
|
||||
* \param ctx The cipher context used for the CMAC operation.
|
||||
* \param output The output buffer for the CMAC checksum result.
|
||||
@ -131,12 +151,14 @@ int mbedtls_cipher_cmac_finish( mbedtls_cipher_context_t *ctx,
|
||||
unsigned char *output );
|
||||
|
||||
/**
|
||||
* \brief This function prepares the authentication of another
|
||||
* message with the same key as the previous CMAC
|
||||
* operation.
|
||||
* \brief This function starts a new CMAC operation with the same
|
||||
* key as the previous one.
|
||||
*
|
||||
* It is called after mbedtls_cipher_cmac_finish()
|
||||
* and before mbedtls_cipher_cmac_update().
|
||||
* It should be called after finishing the previous CMAC
|
||||
* operation with mbedtls_cipher_cmac_finish().
|
||||
* After calling this function,
|
||||
* call mbedtls_cipher_cmac_update() to supply the new
|
||||
* CMAC operation with data.
|
||||
*
|
||||
* \param ctx The cipher context used for the CMAC operation.
|
||||
*
|
||||
@ -156,6 +178,11 @@ int mbedtls_cipher_cmac_reset( mbedtls_cipher_context_t *ctx );
|
||||
* The CMAC result is calculated as
|
||||
* output = generic CMAC(cmac key, input buffer).
|
||||
*
|
||||
* \note When the CMAC implementation is supplied by an alternate
|
||||
* implementation (through #MBEDTLS_CMAC_ALT), some ciphers
|
||||
* may not be supported by that implementation, and thus
|
||||
* return an error. Alternate implementations must support
|
||||
* AES-128 and AES-256, and may support AES-192 and 3DES.
|
||||
*
|
||||
* \param cipher_info The cipher information.
|
||||
* \param key The CMAC key.
|
||||
@ -200,6 +227,13 @@ int mbedtls_aes_cmac_prf_128( const unsigned char *key, size_t key_len,
|
||||
/**
|
||||
* \brief The CMAC checkup routine.
|
||||
*
|
||||
* \note In case the CMAC routines are provided by an alternative
|
||||
* implementation (i.e. #MBEDTLS_CMAC_ALT is defined), the
|
||||
* checkup routine will succeed even if the implementation does
|
||||
* not support the less widely used AES-192 or 3DES primitives.
|
||||
* The self-test requires at least AES-128 and AES-256 to be
|
||||
* supported by the underlying implementation.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return \c 1 on failure.
|
||||
*/
|
||||
|
12
Externals/mbedtls/include/mbedtls/compat-1.3.h
vendored
12
Externals/mbedtls/include/mbedtls/compat-1.3.h
vendored
@ -7,7 +7,7 @@
|
||||
* \deprecated Use the new names directly instead
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -21,12 +21,10 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -1250,9 +1248,9 @@
|
||||
#define POLARSSL_KEY_EXCHANGE_PSK MBEDTLS_KEY_EXCHANGE_PSK
|
||||
#define POLARSSL_KEY_EXCHANGE_RSA MBEDTLS_KEY_EXCHANGE_RSA
|
||||
#define POLARSSL_KEY_EXCHANGE_RSA_PSK MBEDTLS_KEY_EXCHANGE_RSA_PSK
|
||||
#define POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED
|
||||
#define POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED
|
||||
#define POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED
|
||||
#define POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED
|
||||
#define POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED
|
||||
#define POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED
|
||||
#define POLARSSL_KEY_LENGTH_DES MBEDTLS_KEY_LENGTH_DES
|
||||
#define POLARSSL_KEY_LENGTH_DES_EDE MBEDTLS_KEY_LENGTH_DES_EDE
|
||||
#define POLARSSL_KEY_LENGTH_DES_EDE3 MBEDTLS_KEY_LENGTH_DES_EDE3
|
||||
|
896
Externals/mbedtls/include/mbedtls/config.h
vendored
896
Externals/mbedtls/include/mbedtls/config.h
vendored
File diff suppressed because it is too large
Load Diff
836
Externals/mbedtls/include/mbedtls/config_psa.h
vendored
Normal file
836
Externals/mbedtls/include/mbedtls/config_psa.h
vendored
Normal file
@ -0,0 +1,836 @@
|
||||
/**
|
||||
* \file mbedtls/config_psa.h
|
||||
* \brief PSA crypto configuration options (set of defines)
|
||||
*
|
||||
* This set of compile-time options takes settings defined in
|
||||
* include/mbedtls/config.h and include/psa/crypto_config.h and uses
|
||||
* those definitions to define symbols used in the library code.
|
||||
*
|
||||
* Users and integrators should not edit this file, please edit
|
||||
* include/mbedtls/config.h for MBETLS_XXX settings or
|
||||
* include/psa/crypto_config.h for PSA_WANT_XXX settings.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CONFIG_PSA_H
|
||||
#define MBEDTLS_CONFIG_PSA_H
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
|
||||
#include "psa/crypto_config.h"
|
||||
#endif /* defined(MBEDTLS_PSA_CRYPTO_CONFIG) */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* De facto synonyms */
|
||||
/****************************************************************/
|
||||
|
||||
#if defined(PSA_WANT_ALG_ECDSA_ANY) && !defined(PSA_WANT_ALG_ECDSA)
|
||||
#define PSA_WANT_ALG_ECDSA PSA_WANT_ALG_ECDSA_ANY
|
||||
#elif !defined(PSA_WANT_ALG_ECDSA_ANY) && defined(PSA_WANT_ALG_ECDSA)
|
||||
#define PSA_WANT_ALG_ECDSA_ANY PSA_WANT_ALG_ECDSA
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN)
|
||||
#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW
|
||||
#elif !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN)
|
||||
#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_RSA_PSS_ANY_SALT) && !defined(PSA_WANT_ALG_RSA_PSS)
|
||||
#define PSA_WANT_ALG_RSA_PSS PSA_WANT_ALG_RSA_PSS_ANY_SALT
|
||||
#elif !defined(PSA_WANT_ALG_RSA_PSS_ANY_SALT) && defined(PSA_WANT_ALG_RSA_PSS)
|
||||
#define PSA_WANT_ALG_RSA_PSS_ANY_SALT PSA_WANT_ALG_RSA_PSS
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* Require built-in implementations based on PSA requirements */
|
||||
/****************************************************************/
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
|
||||
|
||||
#if defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1
|
||||
#define MBEDTLS_ECDSA_DETERMINISTIC
|
||||
#define MBEDTLS_ECDSA_C
|
||||
#define MBEDTLS_HMAC_DRBG_C
|
||||
#define MBEDTLS_MD_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA */
|
||||
#endif /* PSA_WANT_ALG_DETERMINISTIC_ECDSA */
|
||||
|
||||
#if defined(PSA_WANT_ALG_ECDH)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDH)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1
|
||||
#define MBEDTLS_ECDH_C
|
||||
#define MBEDTLS_ECP_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_ECDH */
|
||||
#endif /* PSA_WANT_ALG_ECDH */
|
||||
|
||||
#if defined(PSA_WANT_ALG_ECDSA)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDSA)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1
|
||||
#define MBEDTLS_ECDSA_C
|
||||
#define MBEDTLS_ECP_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_ECDSA */
|
||||
#endif /* PSA_WANT_ALG_ECDSA */
|
||||
|
||||
#if defined(PSA_WANT_ALG_HKDF)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF */
|
||||
#endif /* PSA_WANT_ALG_HKDF */
|
||||
|
||||
#if defined(PSA_WANT_ALG_HMAC)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_HMAC)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_HMAC */
|
||||
#endif /* PSA_WANT_ALG_HMAC */
|
||||
|
||||
#if defined(PSA_WANT_ALG_MD2) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD2)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_MD2 1
|
||||
#define MBEDTLS_MD2_C
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_MD4) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD4)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_MD4 1
|
||||
#define MBEDTLS_MD4_C
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_MD5) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD5)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_MD5 1
|
||||
#define MBEDTLS_MD5_C
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_RIPEMD160) && !defined(MBEDTLS_PSA_ACCEL_ALG_RIPEMD160)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1
|
||||
#define MBEDTLS_RIPEMD160_C
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_RSA_OAEP)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1
|
||||
#define MBEDTLS_RSA_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PKCS1_V21
|
||||
#define MBEDTLS_MD_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP */
|
||||
#endif /* PSA_WANT_ALG_RSA_OAEP */
|
||||
|
||||
#if defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1
|
||||
#define MBEDTLS_RSA_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PKCS1_V15
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT */
|
||||
#endif /* PSA_WANT_ALG_RSA_PKCS1V15_CRYPT */
|
||||
|
||||
#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1
|
||||
#define MBEDTLS_RSA_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PKCS1_V15
|
||||
#define MBEDTLS_MD_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN */
|
||||
#endif /* PSA_WANT_ALG_RSA_PKCS1V15_SIGN */
|
||||
|
||||
#if defined(PSA_WANT_ALG_RSA_PSS)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PSS)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1
|
||||
#define MBEDTLS_RSA_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PKCS1_V21
|
||||
#define MBEDTLS_MD_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PSS */
|
||||
#endif /* PSA_WANT_ALG_RSA_PSS */
|
||||
|
||||
#if defined(PSA_WANT_ALG_SHA_1) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_1)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1
|
||||
#define MBEDTLS_SHA1_C
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_SHA_224) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_224)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1
|
||||
#define MBEDTLS_SHA256_C
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_SHA_256) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_256)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1
|
||||
#define MBEDTLS_SHA256_C
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_SHA_384) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_384)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1
|
||||
#define MBEDTLS_SHA512_C
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_SHA_512) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_512)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1
|
||||
#define MBEDTLS_SHA512_C
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_TLS12_PRF)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF */
|
||||
#endif /* PSA_WANT_ALG_TLS12_PRF */
|
||||
|
||||
#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS */
|
||||
#endif /* PSA_WANT_ALG_TLS12_PSK_TO_MS */
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR 1
|
||||
#define MBEDTLS_ECP_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR */
|
||||
#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR */
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1
|
||||
#define MBEDTLS_ECP_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY */
|
||||
#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR 1
|
||||
#define MBEDTLS_RSA_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_GENPRIME
|
||||
#define MBEDTLS_PK_PARSE_C
|
||||
#define MBEDTLS_PK_WRITE_C
|
||||
#define MBEDTLS_PK_C
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR */
|
||||
#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR */
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1
|
||||
#define MBEDTLS_RSA_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PK_PARSE_C
|
||||
#define MBEDTLS_PK_WRITE_C
|
||||
#define MBEDTLS_PK_C
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY */
|
||||
#endif /* PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY */
|
||||
|
||||
/* If any of the block modes are requested that don't have an
|
||||
* associated HW assist, define PSA_HAVE_SOFT_BLOCK_MODE for checking
|
||||
* in the block cipher key types. */
|
||||
#if (defined(PSA_WANT_ALG_CTR) && !defined(MBEDTLS_PSA_ACCEL_ALG_CTR)) || \
|
||||
(defined(PSA_WANT_ALG_CFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_CFB)) || \
|
||||
(defined(PSA_WANT_ALG_OFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_OFB)) || \
|
||||
(defined(PSA_WANT_ALG_XTS) && !defined(MBEDTLS_PSA_ACCEL_ALG_XTS)) || \
|
||||
defined(PSA_WANT_ALG_ECB_NO_PADDING) || \
|
||||
(defined(PSA_WANT_ALG_CBC_NO_PADDING) && \
|
||||
!defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING)) || \
|
||||
(defined(PSA_WANT_ALG_CBC_PKCS7) && \
|
||||
!defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7)) || \
|
||||
(defined(PSA_WANT_ALG_CMAC) && !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC))
|
||||
#define PSA_HAVE_SOFT_BLOCK_MODE 1
|
||||
#endif
|
||||
|
||||
#if (defined(PSA_WANT_ALG_GCM) && !defined(MBEDTLS_PSA_ACCEL_ALG_GCM)) || \
|
||||
(defined(PSA_WANT_ALG_CCM) && !defined(MBEDTLS_PSA_ACCEL_ALG_CCM))
|
||||
#define PSA_HAVE_SOFT_BLOCK_AEAD 1
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_AES)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_AES)
|
||||
#define PSA_HAVE_SOFT_KEY_TYPE_AES 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_AES */
|
||||
#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_MODE) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_AEAD)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1
|
||||
#define MBEDTLS_AES_C
|
||||
#endif /* PSA_HAVE_SOFT_KEY_TYPE_AES || PSA_HAVE_SOFT_BLOCK_MODE */
|
||||
#endif /* PSA_WANT_KEY_TYPE_AES */
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_ARC4)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARC4)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARC4 1
|
||||
#define MBEDTLS_ARC4_C
|
||||
#endif /*!MBEDTLS_PSA_ACCEL_KEY_TYPE_ARC4 */
|
||||
#endif /* PSA_WANT_KEY_TYPE_ARC4 */
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_ARIA)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA)
|
||||
#define PSA_HAVE_SOFT_KEY_TYPE_ARIA 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA */
|
||||
#if defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_MODE) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_AEAD)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1
|
||||
#define MBEDTLS_ARIA_C
|
||||
#endif /* PSA_HAVE_SOFT_KEY_TYPE_ARIA || PSA_HAVE_SOFT_BLOCK_MODE */
|
||||
#endif /* PSA_WANT_KEY_TYPE_ARIA */
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA)
|
||||
#define PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA */
|
||||
#if defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_MODE) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_AEAD)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1
|
||||
#define MBEDTLS_CAMELLIA_C
|
||||
#endif /* PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA || PSA_HAVE_SOFT_BLOCK_MODE */
|
||||
#endif /* PSA_WANT_KEY_TYPE_CAMELLIA */
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_DES)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DES)
|
||||
#define PSA_HAVE_SOFT_KEY_TYPE_DES 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DES */
|
||||
#if defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_MODE)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1
|
||||
#define MBEDTLS_DES_C
|
||||
#endif /*PSA_HAVE_SOFT_KEY_TYPE_DES || PSA_HAVE_SOFT_BLOCK_MODE */
|
||||
#endif /* PSA_WANT_KEY_TYPE_DES */
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1
|
||||
#define MBEDTLS_CHACHA20_C
|
||||
#endif /*!MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20 */
|
||||
#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */
|
||||
|
||||
/* If any of the software block ciphers are selected, define
|
||||
* PSA_HAVE_SOFT_BLOCK_CIPHER, which can be used in any of these
|
||||
* situations. */
|
||||
#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \
|
||||
defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \
|
||||
defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \
|
||||
defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA)
|
||||
#define PSA_HAVE_SOFT_BLOCK_CIPHER 1
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_STREAM_CIPHER)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1
|
||||
#endif /* PSA_WANT_ALG_STREAM_CIPHER */
|
||||
|
||||
#if defined(PSA_WANT_ALG_CBC_MAC)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_MAC)
|
||||
#error "CBC-MAC is not yet supported via the PSA API in Mbed TLS."
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CBC_MAC 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_CBC_MAC */
|
||||
#endif /* PSA_WANT_ALG_CBC_MAC */
|
||||
|
||||
#if defined(PSA_WANT_ALG_CMAC)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_CIPHER)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1
|
||||
#define MBEDTLS_CMAC_C
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_CMAC */
|
||||
#endif /* PSA_WANT_ALG_CMAC */
|
||||
|
||||
#if defined(PSA_WANT_ALG_CTR)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_CTR) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_CIPHER)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CTR 1
|
||||
#define MBEDTLS_CIPHER_MODE_CTR
|
||||
#endif
|
||||
#endif /* PSA_WANT_ALG_CTR */
|
||||
|
||||
#if defined(PSA_WANT_ALG_CFB)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_CFB) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_CIPHER)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CFB 1
|
||||
#define MBEDTLS_CIPHER_MODE_CFB
|
||||
#endif
|
||||
#endif /* PSA_WANT_ALG_CFB */
|
||||
|
||||
#if defined(PSA_WANT_ALG_OFB)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_OFB) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_CIPHER)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_OFB 1
|
||||
#define MBEDTLS_CIPHER_MODE_OFB
|
||||
#endif
|
||||
#endif /* PSA_WANT_ALG_OFB */
|
||||
|
||||
#if defined(PSA_WANT_ALG_XTS)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_XTS) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_CIPHER)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_XTS 1
|
||||
#define MBEDTLS_CIPHER_MODE_XTS
|
||||
#endif
|
||||
#endif /* PSA_WANT_ALG_XTS */
|
||||
|
||||
#if defined(PSA_WANT_ALG_ECB_NO_PADDING)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_ALG_CBC_NO_PADDING)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_CIPHER)
|
||||
#define MBEDTLS_CIPHER_MODE_CBC
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1
|
||||
#endif
|
||||
#endif /* PSA_WANT_ALG_CBC_NO_PADDING */
|
||||
|
||||
#if defined(PSA_WANT_ALG_CBC_PKCS7)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7) || \
|
||||
defined(PSA_HAVE_SOFT_BLOCK_CIPHER)
|
||||
#define MBEDTLS_CIPHER_MODE_CBC
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1
|
||||
#define MBEDTLS_CIPHER_PADDING_PKCS7
|
||||
#endif
|
||||
#endif /* PSA_WANT_ALG_CBC_PKCS7 */
|
||||
|
||||
#if defined(PSA_WANT_ALG_CCM)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_CCM) || \
|
||||
defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \
|
||||
defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \
|
||||
defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1
|
||||
#define MBEDTLS_CCM_C
|
||||
#endif
|
||||
#endif /* PSA_WANT_ALG_CCM */
|
||||
|
||||
#if defined(PSA_WANT_ALG_GCM)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_GCM) || \
|
||||
defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \
|
||||
defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \
|
||||
defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1
|
||||
#define MBEDTLS_GCM_C
|
||||
#endif
|
||||
#endif /* PSA_WANT_ALG_GCM */
|
||||
|
||||
#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305)
|
||||
#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
|
||||
#define MBEDTLS_CHACHAPOLY_C
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1
|
||||
#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 */
|
||||
#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256)
|
||||
#define MBEDTLS_ECP_DP_BP256R1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256 */
|
||||
#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_256 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384)
|
||||
#define MBEDTLS_ECP_DP_BP384R1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384 */
|
||||
#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_384 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512)
|
||||
#define MBEDTLS_ECP_DP_BP512R1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512 */
|
||||
#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_512 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_MONTGOMERY_255)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255)
|
||||
#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255 */
|
||||
#endif /* PSA_WANT_ECC_MONTGOMERY_255 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_MONTGOMERY_448)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448)
|
||||
/*
|
||||
* Curve448 is not yet supported via the PSA API in Mbed TLS
|
||||
* (https://github.com/ARMmbed/mbedtls/issues/4249).
|
||||
*/
|
||||
#error "Curve448 is not yet supported via the PSA API in Mbed TLS."
|
||||
#define MBEDTLS_ECP_DP_CURVE448_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448 */
|
||||
#endif /* PSA_WANT_ECC_MONTGOMERY_448 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_192)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192)
|
||||
#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192 */
|
||||
#endif /* PSA_WANT_ECC_SECP_R1_192 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_224)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224)
|
||||
#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224 */
|
||||
#endif /* PSA_WANT_ECC_SECP_R1_224 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_256)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256)
|
||||
#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256 */
|
||||
#endif /* PSA_WANT_ECC_SECP_R1_256 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_384)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384)
|
||||
#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384 */
|
||||
#endif /* PSA_WANT_ECC_SECP_R1_384 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_521)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521)
|
||||
#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521 */
|
||||
#endif /* PSA_WANT_ECC_SECP_R1_521 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_SECP_K1_192)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192)
|
||||
#define MBEDTLS_ECP_DP_SECP192K1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192 */
|
||||
#endif /* PSA_WANT_ECC_SECP_K1_192 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_SECP_K1_224)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224)
|
||||
/*
|
||||
* SECP224K1 is buggy via the PSA API in Mbed TLS
|
||||
* (https://github.com/ARMmbed/mbedtls/issues/3541).
|
||||
*/
|
||||
#error "SECP224K1 is buggy via the PSA API in Mbed TLS."
|
||||
#define MBEDTLS_ECP_DP_SECP224K1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224 */
|
||||
#endif /* PSA_WANT_ECC_SECP_K1_224 */
|
||||
|
||||
#if defined(PSA_WANT_ECC_SECP_K1_256)
|
||||
#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256)
|
||||
#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1
|
||||
#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256 */
|
||||
#endif /* PSA_WANT_ECC_SECP_K1_256 */
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* Infer PSA requirements from Mbed TLS capabilities */
|
||||
/****************************************************************/
|
||||
|
||||
#else /* MBEDTLS_PSA_CRYPTO_CONFIG */
|
||||
|
||||
/*
|
||||
* Ensure PSA_WANT_* defines are setup properly if MBEDTLS_PSA_CRYPTO_CONFIG
|
||||
* is not defined
|
||||
*/
|
||||
|
||||
#if defined(MBEDTLS_CCM_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1
|
||||
#define PSA_WANT_ALG_CCM 1
|
||||
#endif /* MBEDTLS_CCM_C */
|
||||
|
||||
#if defined(MBEDTLS_CMAC_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1
|
||||
#define PSA_WANT_ALG_CMAC 1
|
||||
#endif /* MBEDTLS_CMAC_C */
|
||||
|
||||
#if defined(MBEDTLS_ECDH_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1
|
||||
#define PSA_WANT_ALG_ECDH 1
|
||||
#endif /* MBEDTLS_ECDH_C */
|
||||
|
||||
#if defined(MBEDTLS_ECDSA_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1
|
||||
#define PSA_WANT_ALG_ECDSA 1
|
||||
#define PSA_WANT_ALG_ECDSA_ANY 1
|
||||
|
||||
// Only add in DETERMINISTIC support if ECDSA is also enabled
|
||||
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1
|
||||
#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1
|
||||
#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
|
||||
|
||||
#endif /* MBEDTLS_ECDSA_C */
|
||||
|
||||
#if defined(MBEDTLS_ECP_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 1
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1
|
||||
#endif /* MBEDTLS_ECP_C */
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1
|
||||
#define PSA_WANT_ALG_GCM 1
|
||||
#endif /* MBEDTLS_GCM_C */
|
||||
|
||||
#if defined(MBEDTLS_HKDF_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
|
||||
#define PSA_WANT_ALG_HMAC 1
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1
|
||||
#define PSA_WANT_ALG_HKDF 1
|
||||
#endif /* MBEDTLS_HKDF_C */
|
||||
|
||||
#if defined(MBEDTLS_MD_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
|
||||
#define PSA_WANT_ALG_HMAC 1
|
||||
#define PSA_WANT_KEY_TYPE_HMAC
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1
|
||||
#define PSA_WANT_ALG_TLS12_PRF 1
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1
|
||||
#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1
|
||||
#endif /* MBEDTLS_MD_C */
|
||||
|
||||
#if defined(MBEDTLS_MD2_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_MD2 1
|
||||
#define PSA_WANT_ALG_MD2 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_MD4_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_MD4 1
|
||||
#define PSA_WANT_ALG_MD4 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_MD5_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_MD5 1
|
||||
#define PSA_WANT_ALG_MD5 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_RIPEMD160_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1
|
||||
#define PSA_WANT_ALG_RIPEMD160 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_RSA_C)
|
||||
#if defined(MBEDTLS_PKCS1_V15)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1
|
||||
#define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1
|
||||
#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1
|
||||
#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW 1
|
||||
#endif /* MBEDTLS_PKCS1_V15 */
|
||||
#if defined(MBEDTLS_PKCS1_V21)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1
|
||||
#define PSA_WANT_ALG_RSA_OAEP 1
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1
|
||||
#define PSA_WANT_ALG_RSA_PSS 1
|
||||
#endif /* MBEDTLS_PKCS1_V21 */
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR 1
|
||||
#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1
|
||||
#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1
|
||||
#endif /* MBEDTLS_RSA_C */
|
||||
|
||||
#if defined(MBEDTLS_SHA1_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1
|
||||
#define PSA_WANT_ALG_SHA_1 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SHA256_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1
|
||||
#define PSA_WANT_ALG_SHA_224 1
|
||||
#define PSA_WANT_ALG_SHA_256 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SHA512_C)
|
||||
#if !defined(MBEDTLS_SHA512_NO_SHA384)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1
|
||||
#define PSA_WANT_ALG_SHA_384 1
|
||||
#endif
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1
|
||||
#define PSA_WANT_ALG_SHA_512 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_AES_C)
|
||||
#define PSA_WANT_KEY_TYPE_AES 1
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ARC4_C)
|
||||
#define PSA_WANT_KEY_TYPE_ARC4 1
|
||||
#define PSA_WANT_ALG_STREAM_CIPHER 1
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARC4 1
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ARIA_C)
|
||||
#define PSA_WANT_KEY_TYPE_ARIA 1
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CAMELLIA_C)
|
||||
#define PSA_WANT_KEY_TYPE_CAMELLIA 1
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_DES_C)
|
||||
#define PSA_WANT_KEY_TYPE_DES 1
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
#define PSA_WANT_KEY_TYPE_CHACHA20 1
|
||||
#define PSA_WANT_ALG_STREAM_CIPHER 1
|
||||
#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
#define PSA_WANT_ALG_CHACHA20_POLY1305 1
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_MODE_CBC)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1
|
||||
#define PSA_WANT_ALG_CBC_NO_PADDING 1
|
||||
#if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1
|
||||
#define PSA_WANT_ALG_CBC_PKCS7 1
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) || \
|
||||
defined(MBEDTLS_ARIA_C) || defined(MBEDTLS_CAMELLIA_C)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1
|
||||
#define PSA_WANT_ALG_ECB_NO_PADDING 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_MODE_CFB)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CFB 1
|
||||
#define PSA_WANT_ALG_CFB 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_MODE_CTR)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_CTR 1
|
||||
#define PSA_WANT_ALG_CTR 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_MODE_OFB)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_OFB 1
|
||||
#define PSA_WANT_ALG_OFB 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_MODE_XTS)
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_XTS 1
|
||||
#define PSA_WANT_ALG_XTS 1
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1
|
||||
#define PSA_WANT_ECC_BRAINPOOL_P_R1_256
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1
|
||||
#define PSA_WANT_ECC_BRAINPOOL_P_R1_384
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1
|
||||
#define PSA_WANT_ECC_BRAINPOOL_P_R1_512
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1
|
||||
#define PSA_WANT_ECC_MONTGOMERY_255
|
||||
#endif
|
||||
|
||||
/* Curve448 is not yet supported via the PSA API (https://github.com/ARMmbed/mbedtls/issues/4249) */
|
||||
#if 0 && defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1
|
||||
#define PSA_WANT_ECC_MONTGOMERY_448
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1
|
||||
#define PSA_WANT_ECC_SECP_R1_192
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1
|
||||
#define PSA_WANT_ECC_SECP_R1_224
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1
|
||||
#define PSA_WANT_ECC_SECP_R1_256
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1
|
||||
#define PSA_WANT_ECC_SECP_R1_384
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1
|
||||
#define PSA_WANT_ECC_SECP_R1_521
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1
|
||||
#define PSA_WANT_ECC_SECP_K1_192
|
||||
#endif
|
||||
|
||||
/* SECP224K1 is buggy via the PSA API (https://github.com/ARMmbed/mbedtls/issues/3541) */
|
||||
#if 0 && defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1
|
||||
#define PSA_WANT_ECC_SECP_K1_224
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
|
||||
#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1
|
||||
#define PSA_WANT_ECC_SECP_K1_256
|
||||
#endif
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_CONFIG */
|
||||
|
||||
/* These features are always enabled. */
|
||||
#define PSA_WANT_KEY_TYPE_DERIVE 1
|
||||
#define PSA_WANT_KEY_TYPE_RAW_DATA 1
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* MBEDTLS_CONFIG_PSA_H */
|
45
Externals/mbedtls/include/mbedtls/constant_time.h
vendored
Normal file
45
Externals/mbedtls/include/mbedtls/constant_time.h
vendored
Normal file
@ -0,0 +1,45 @@
|
||||
/**
|
||||
* Constant-time functions
|
||||
*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CONSTANT_TIME_H
|
||||
#define MBEDTLS_CONSTANT_TIME_H
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
|
||||
/** Constant-time buffer comparison without branches.
|
||||
*
|
||||
* This is equivalent to the standard memcmp function, but is likely to be
|
||||
* compiled to code using bitwise operation rather than a branch.
|
||||
*
|
||||
* This function can be used to write constant-time code by replacing branches
|
||||
* with bit operations using masks.
|
||||
*
|
||||
* \param a Pointer to the first buffer.
|
||||
* \param b Pointer to the second buffer.
|
||||
* \param n The number of bytes to compare in the buffer.
|
||||
*
|
||||
* \return Zero if the content of the two buffer is the same,
|
||||
* otherwise non-zero.
|
||||
*/
|
||||
int mbedtls_ct_memcmp( const void *a,
|
||||
const void *b,
|
||||
size_t n );
|
||||
|
||||
#endif /* MBEDTLS_CONSTANT_TIME_H */
|
351
Externals/mbedtls/include/mbedtls/ctr_drbg.h
vendored
351
Externals/mbedtls/include/mbedtls/ctr_drbg.h
vendored
@ -1,7 +1,8 @@
|
||||
/**
|
||||
* \file ctr_drbg.h
|
||||
*
|
||||
* \brief This file contains CTR_DRBG definitions and functions.
|
||||
* \brief This file contains definitions and functions for the
|
||||
* CTR_DRBG pseudorandom generator.
|
||||
*
|
||||
* CTR_DRBG is a standardized way of building a PRNG from a block-cipher
|
||||
* in counter mode operation, as defined in <em>NIST SP 800-90A:
|
||||
@ -9,13 +10,19 @@
|
||||
* Bit Generators</em>.
|
||||
*
|
||||
* The Mbed TLS implementation of CTR_DRBG uses AES-256 (default) or AES-128
|
||||
* as the underlying block cipher.
|
||||
* (if \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled at compile time)
|
||||
* as the underlying block cipher, with a derivation function.
|
||||
*
|
||||
* \warning Using 128-bit keys for CTR_DRBG limits the security of generated
|
||||
* keys and operations that use random values generated to 128-bit security.
|
||||
* The security strength as defined in NIST SP 800-90A is
|
||||
* 128 bits when AES-128 is used (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY enabled)
|
||||
* and 256 bits otherwise, provided that #MBEDTLS_CTR_DRBG_ENTROPY_LEN is
|
||||
* kept at its default value (and not overridden in config.h) and that the
|
||||
* DRBG instance is set up with default parameters.
|
||||
* See the documentation of mbedtls_ctr_drbg_seed() for more
|
||||
* information.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -29,36 +36,48 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CTR_DRBG_H
|
||||
#define MBEDTLS_CTR_DRBG_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "aes.h"
|
||||
#include "mbedtls/aes.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
#include "threading.h"
|
||||
#include "mbedtls/threading.h"
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED -0x0034 /**< The entropy source failed. */
|
||||
#define MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG -0x0036 /**< The requested random buffer length is too big. */
|
||||
#define MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG -0x0038 /**< The input (entropy + additional data) is too large. */
|
||||
#define MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR -0x003A /**< Read or write error in file. */
|
||||
/** The entropy source failed. */
|
||||
#define MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED -0x0034
|
||||
/** The requested random buffer length is too big. */
|
||||
#define MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG -0x0036
|
||||
/** The input (entropy + additional data) is too large. */
|
||||
#define MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG -0x0038
|
||||
/** Read or write error in file. */
|
||||
#define MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR -0x003A
|
||||
|
||||
#define MBEDTLS_CTR_DRBG_BLOCKSIZE 16 /**< The block size used by the cipher. */
|
||||
|
||||
#if defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY)
|
||||
#define MBEDTLS_CTR_DRBG_KEYSIZE 16 /**< The key size used by the cipher (compile-time choice: 128 bits). */
|
||||
#define MBEDTLS_CTR_DRBG_KEYSIZE 16
|
||||
/**< The key size in bytes used by the cipher.
|
||||
*
|
||||
* Compile-time choice: 16 bytes (128 bits)
|
||||
* because #MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled.
|
||||
*/
|
||||
#else
|
||||
#define MBEDTLS_CTR_DRBG_KEYSIZE 32 /**< The key size used by the cipher (compile-time choice: 256 bits). */
|
||||
#define MBEDTLS_CTR_DRBG_KEYSIZE 32
|
||||
/**< The key size in bytes used by the cipher.
|
||||
*
|
||||
* Compile-time choice: 32 bytes (256 bits)
|
||||
* because \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled.
|
||||
*/
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_CTR_DRBG_KEYBITS ( MBEDTLS_CTR_DRBG_KEYSIZE * 8 ) /**< The key size for the DRBG operation, in bits. */
|
||||
@ -73,21 +92,31 @@
|
||||
* \{
|
||||
*/
|
||||
|
||||
/** \def MBEDTLS_CTR_DRBG_ENTROPY_LEN
|
||||
*
|
||||
* \brief The amount of entropy used per seed by default, in bytes.
|
||||
*/
|
||||
#if !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN)
|
||||
#if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256)
|
||||
/** This is 48 bytes because the entropy module uses SHA-512
|
||||
* (\c MBEDTLS_ENTROPY_FORCE_SHA256 is disabled).
|
||||
*/
|
||||
#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48
|
||||
/**< The amount of entropy used per seed by default:
|
||||
* <ul><li>48 with SHA-512.</li>
|
||||
* <li>32 with SHA-256.</li></ul>
|
||||
|
||||
#else /* defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) */
|
||||
|
||||
/** This is 32 bytes because the entropy module uses SHA-256
|
||||
* (the SHA512 module is disabled or
|
||||
* \c MBEDTLS_ENTROPY_FORCE_SHA256 is enabled).
|
||||
*/
|
||||
#else
|
||||
#if !defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY)
|
||||
/** \warning To achieve a 256-bit security strength, you must pass a nonce
|
||||
* to mbedtls_ctr_drbg_seed().
|
||||
*/
|
||||
#endif /* !defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) */
|
||||
#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 32
|
||||
/**< Amount of entropy used per seed by default:
|
||||
* <ul><li>48 with SHA-512.</li>
|
||||
* <li>32 with SHA-256.</li></ul>
|
||||
*/
|
||||
#endif
|
||||
#endif
|
||||
#endif /* defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) */
|
||||
#endif /* !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) */
|
||||
|
||||
#if !defined(MBEDTLS_CTR_DRBG_RESEED_INTERVAL)
|
||||
#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000
|
||||
@ -106,7 +135,7 @@
|
||||
|
||||
#if !defined(MBEDTLS_CTR_DRBG_MAX_SEED_INPUT)
|
||||
#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384
|
||||
/**< The maximum size of seed or reseed buffer. */
|
||||
/**< The maximum size of seed or reseed buffer in bytes. */
|
||||
#endif
|
||||
|
||||
/* \} name SECTION: Module settings */
|
||||
@ -120,20 +149,49 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if MBEDTLS_CTR_DRBG_ENTROPY_LEN >= MBEDTLS_CTR_DRBG_KEYSIZE * 3 / 2
|
||||
/** The default length of the nonce read from the entropy source.
|
||||
*
|
||||
* This is \c 0 because a single read from the entropy source is sufficient
|
||||
* to include a nonce.
|
||||
* See the documentation of mbedtls_ctr_drbg_seed() for more information.
|
||||
*/
|
||||
#define MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN 0
|
||||
#else
|
||||
/** The default length of the nonce read from the entropy source.
|
||||
*
|
||||
* This is half of the default entropy length because a single read from
|
||||
* the entropy source does not provide enough material to form a nonce.
|
||||
* See the documentation of mbedtls_ctr_drbg_seed() for more information.
|
||||
*/
|
||||
#define MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN ( MBEDTLS_CTR_DRBG_ENTROPY_LEN + 1 ) / 2
|
||||
#endif
|
||||
|
||||
/**
|
||||
* \brief The CTR_DRBG context structure.
|
||||
*/
|
||||
typedef struct mbedtls_ctr_drbg_context
|
||||
{
|
||||
unsigned char counter[16]; /*!< The counter (V). */
|
||||
int reseed_counter; /*!< The reseed counter. */
|
||||
int reseed_counter; /*!< The reseed counter.
|
||||
* This is the number of requests that have
|
||||
* been made since the last (re)seeding,
|
||||
* minus one.
|
||||
* Before the initial seeding, this field
|
||||
* contains the amount of entropy in bytes
|
||||
* to use as a nonce for the initial seeding,
|
||||
* or -1 if no nonce length has been explicitly
|
||||
* set (see mbedtls_ctr_drbg_set_nonce_len()).
|
||||
*/
|
||||
int prediction_resistance; /*!< This determines whether prediction
|
||||
resistance is enabled, that is
|
||||
whether to systematically reseed before
|
||||
each random generation. */
|
||||
size_t entropy_len; /*!< The amount of entropy grabbed on each
|
||||
seed or reseed operation. */
|
||||
int reseed_interval; /*!< The reseed interval. */
|
||||
seed or reseed operation, in bytes. */
|
||||
int reseed_interval; /*!< The reseed interval.
|
||||
* This is the maximum number of requests
|
||||
* that can be made between reseedings. */
|
||||
|
||||
mbedtls_aes_context aes_ctx; /*!< The AES context. */
|
||||
|
||||
@ -146,6 +204,13 @@ typedef struct mbedtls_ctr_drbg_context
|
||||
void *p_entropy; /*!< The context for the entropy function. */
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
/* Invariant: the mutex is initialized if and only if f_entropy != NULL.
|
||||
* This means that the mutex is initialized during the initial seeding
|
||||
* in mbedtls_ctr_drbg_seed() and freed in mbedtls_ctr_drbg_free().
|
||||
*
|
||||
* Note that this invariant may change without notice. Do not rely on it
|
||||
* and do not access the mutex directly in application code.
|
||||
*/
|
||||
mbedtls_threading_mutex_t mutex;
|
||||
#endif
|
||||
}
|
||||
@ -156,6 +221,11 @@ mbedtls_ctr_drbg_context;
|
||||
* and prepares it for mbedtls_ctr_drbg_seed()
|
||||
* or mbedtls_ctr_drbg_free().
|
||||
*
|
||||
* \note The reseed interval is
|
||||
* #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default.
|
||||
* You can override it by calling
|
||||
* mbedtls_ctr_drbg_set_reseed_interval().
|
||||
*
|
||||
* \param ctx The CTR_DRBG context to initialize.
|
||||
*/
|
||||
void mbedtls_ctr_drbg_init( mbedtls_ctr_drbg_context *ctx );
|
||||
@ -164,17 +234,97 @@ void mbedtls_ctr_drbg_init( mbedtls_ctr_drbg_context *ctx );
|
||||
* \brief This function seeds and sets up the CTR_DRBG
|
||||
* entropy source for future reseeds.
|
||||
*
|
||||
* \note Personalization data can be provided in addition to the more generic
|
||||
* entropy source, to make this instantiation as unique as possible.
|
||||
* A typical choice for the \p f_entropy and \p p_entropy parameters is
|
||||
* to use the entropy module:
|
||||
* - \p f_entropy is mbedtls_entropy_func();
|
||||
* - \p p_entropy is an instance of ::mbedtls_entropy_context initialized
|
||||
* with mbedtls_entropy_init() (which registers the platform's default
|
||||
* entropy sources).
|
||||
*
|
||||
* The entropy length is #MBEDTLS_CTR_DRBG_ENTROPY_LEN by default.
|
||||
* You can override it by calling mbedtls_ctr_drbg_set_entropy_len().
|
||||
*
|
||||
* The entropy nonce length is:
|
||||
* - \c 0 if the entropy length is at least 3/2 times the entropy length,
|
||||
* which guarantees that the security strength is the maximum permitted
|
||||
* by the key size and entropy length according to NIST SP 800-90A §10.2.1;
|
||||
* - Half the entropy length otherwise.
|
||||
* You can override it by calling mbedtls_ctr_drbg_set_nonce_len().
|
||||
* With the default entropy length, the entropy nonce length is
|
||||
* #MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN.
|
||||
*
|
||||
* You can provide a nonce and personalization string in addition to the
|
||||
* entropy source, to make this instantiation as unique as possible.
|
||||
* See SP 800-90A §8.6.7 for more details about nonces.
|
||||
*
|
||||
* The _seed_material_ value passed to the derivation function in
|
||||
* the CTR_DRBG Instantiate Process described in NIST SP 800-90A §10.2.1.3.2
|
||||
* is the concatenation of the following strings:
|
||||
* - A string obtained by calling \p f_entropy function for the entropy
|
||||
* length.
|
||||
*/
|
||||
#if MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN == 0
|
||||
/**
|
||||
* - If mbedtls_ctr_drbg_set_nonce_len() has been called, a string
|
||||
* obtained by calling \p f_entropy function for the specified length.
|
||||
*/
|
||||
#else
|
||||
/**
|
||||
* - A string obtained by calling \p f_entropy function for the entropy nonce
|
||||
* length. If the entropy nonce length is \c 0, this function does not
|
||||
* make a second call to \p f_entropy.
|
||||
*/
|
||||
#endif
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
/**
|
||||
* \note When Mbed TLS is built with threading support,
|
||||
* after this function returns successfully,
|
||||
* it is safe to call mbedtls_ctr_drbg_random()
|
||||
* from multiple threads. Other operations, including
|
||||
* reseeding, are not thread-safe.
|
||||
*/
|
||||
#endif /* MBEDTLS_THREADING_C */
|
||||
/**
|
||||
* - The \p custom string.
|
||||
*
|
||||
* \note To achieve the nominal security strength permitted
|
||||
* by CTR_DRBG, the entropy length must be:
|
||||
* - at least 16 bytes for a 128-bit strength
|
||||
* (maximum achievable strength when using AES-128);
|
||||
* - at least 32 bytes for a 256-bit strength
|
||||
* (maximum achievable strength when using AES-256).
|
||||
*
|
||||
* In addition, if you do not pass a nonce in \p custom,
|
||||
* the sum of the entropy length
|
||||
* and the entropy nonce length must be:
|
||||
* - at least 24 bytes for a 128-bit strength
|
||||
* (maximum achievable strength when using AES-128);
|
||||
* - at least 48 bytes for a 256-bit strength
|
||||
* (maximum achievable strength when using AES-256).
|
||||
*
|
||||
* \param ctx The CTR_DRBG context to seed.
|
||||
* It must have been initialized with
|
||||
* mbedtls_ctr_drbg_init().
|
||||
* After a successful call to mbedtls_ctr_drbg_seed(),
|
||||
* you may not call mbedtls_ctr_drbg_seed() again on
|
||||
* the same context unless you call
|
||||
* mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init()
|
||||
* again first.
|
||||
* After a failed call to mbedtls_ctr_drbg_seed(),
|
||||
* you must call mbedtls_ctr_drbg_free().
|
||||
* \param f_entropy The entropy callback, taking as arguments the
|
||||
* \p p_entropy context, the buffer to fill, and the
|
||||
length of the buffer.
|
||||
* \param p_entropy The entropy context.
|
||||
* \param custom Personalization data, that is device-specific
|
||||
identifiers. Can be NULL.
|
||||
* \param len The length of the personalization data.
|
||||
* length of the buffer.
|
||||
* \p f_entropy is always called with a buffer size
|
||||
* less than or equal to the entropy length.
|
||||
* \param p_entropy The entropy context to pass to \p f_entropy.
|
||||
* \param custom The personalization string.
|
||||
* This can be \c NULL, in which case the personalization
|
||||
* string is empty regardless of the value of \p len.
|
||||
* \param len The length of the personalization string.
|
||||
* This must be at most
|
||||
* #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT
|
||||
* - #MBEDTLS_CTR_DRBG_ENTROPY_LEN.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure.
|
||||
@ -186,7 +336,8 @@ int mbedtls_ctr_drbg_seed( mbedtls_ctr_drbg_context *ctx,
|
||||
size_t len );
|
||||
|
||||
/**
|
||||
* \brief This function clears CTR_CRBG context data.
|
||||
* \brief This function resets CTR_DRBG context to the state immediately
|
||||
* after initial call of mbedtls_ctr_drbg_init().
|
||||
*
|
||||
* \param ctx The CTR_DRBG context to clear.
|
||||
*/
|
||||
@ -197,7 +348,8 @@ void mbedtls_ctr_drbg_free( mbedtls_ctr_drbg_context *ctx );
|
||||
* The default value is off.
|
||||
*
|
||||
* \note If enabled, entropy is gathered at the beginning of
|
||||
* every call to mbedtls_ctr_drbg_random_with_add().
|
||||
* every call to mbedtls_ctr_drbg_random_with_add()
|
||||
* or mbedtls_ctr_drbg_random().
|
||||
* Only use this if your entropy source has sufficient
|
||||
* throughput.
|
||||
*
|
||||
@ -209,18 +361,61 @@ void mbedtls_ctr_drbg_set_prediction_resistance( mbedtls_ctr_drbg_context *ctx,
|
||||
|
||||
/**
|
||||
* \brief This function sets the amount of entropy grabbed on each
|
||||
* seed or reseed. The default value is
|
||||
* #MBEDTLS_CTR_DRBG_ENTROPY_LEN.
|
||||
* seed or reseed.
|
||||
*
|
||||
* The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN.
|
||||
*
|
||||
* \note The security strength of CTR_DRBG is bounded by the
|
||||
* entropy length. Thus:
|
||||
* - When using AES-256
|
||||
* (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled,
|
||||
* which is the default),
|
||||
* \p len must be at least 32 (in bytes)
|
||||
* to achieve a 256-bit strength.
|
||||
* - When using AES-128
|
||||
* (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled)
|
||||
* \p len must be at least 16 (in bytes)
|
||||
* to achieve a 128-bit strength.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param len The amount of entropy to grab.
|
||||
* \param len The amount of entropy to grab, in bytes.
|
||||
* This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT
|
||||
* and at most the maximum length accepted by the
|
||||
* entropy function that is set in the context.
|
||||
*/
|
||||
void mbedtls_ctr_drbg_set_entropy_len( mbedtls_ctr_drbg_context *ctx,
|
||||
size_t len );
|
||||
|
||||
/**
|
||||
* \brief This function sets the amount of entropy grabbed
|
||||
* as a nonce for the initial seeding.
|
||||
*
|
||||
* Call this function before calling mbedtls_ctr_drbg_seed() to read
|
||||
* a nonce from the entropy source during the initial seeding.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param len The amount of entropy to grab for the nonce, in bytes.
|
||||
* This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT
|
||||
* and at most the maximum length accepted by the
|
||||
* entropy function that is set in the context.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is
|
||||
* more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* if the initial seeding has already taken place.
|
||||
*/
|
||||
int mbedtls_ctr_drbg_set_nonce_len( mbedtls_ctr_drbg_context *ctx,
|
||||
size_t len );
|
||||
|
||||
/**
|
||||
* \brief This function sets the reseed interval.
|
||||
* The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL.
|
||||
*
|
||||
* The reseed interval is the number of calls to mbedtls_ctr_drbg_random()
|
||||
* or mbedtls_ctr_drbg_random_with_add() after which the entropy function
|
||||
* is called again.
|
||||
*
|
||||
* The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param interval The reseed interval.
|
||||
@ -232,9 +427,18 @@ void mbedtls_ctr_drbg_set_reseed_interval( mbedtls_ctr_drbg_context *ctx,
|
||||
* \brief This function reseeds the CTR_DRBG context, that is
|
||||
* extracts data from the entropy source.
|
||||
*
|
||||
* \note This function is not thread-safe. It is not safe
|
||||
* to call this function if another thread might be
|
||||
* concurrently obtaining random numbers from the same
|
||||
* context or updating or reseeding the same context.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param additional Additional data to add to the state. Can be NULL.
|
||||
* \param additional Additional data to add to the state. Can be \c NULL.
|
||||
* \param len The length of the additional data.
|
||||
* This must be less than
|
||||
* #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len
|
||||
* where \c entropy_len is the entropy length
|
||||
* configured for the context.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure.
|
||||
@ -245,8 +449,14 @@ int mbedtls_ctr_drbg_reseed( mbedtls_ctr_drbg_context *ctx,
|
||||
/**
|
||||
* \brief This function updates the state of the CTR_DRBG context.
|
||||
*
|
||||
* \note This function is not thread-safe. It is not safe
|
||||
* to call this function if another thread might be
|
||||
* concurrently obtaining random numbers from the same
|
||||
* context or updating or reseeding the same context.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param additional The data to update the state with.
|
||||
* \param additional The data to update the state with. This must not be
|
||||
* \c NULL unless \p add_len is \c 0.
|
||||
* \param add_len Length of \p additional in bytes. This must be at
|
||||
* most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT.
|
||||
*
|
||||
@ -264,14 +474,28 @@ int mbedtls_ctr_drbg_update_ret( mbedtls_ctr_drbg_context *ctx,
|
||||
* \brief This function updates a CTR_DRBG instance with additional
|
||||
* data and uses it to generate random data.
|
||||
*
|
||||
* \note The function automatically reseeds if the reseed counter is exceeded.
|
||||
* This function automatically reseeds if the reseed counter is exceeded
|
||||
* or prediction resistance is enabled.
|
||||
*
|
||||
* \note This function is not thread-safe. It is not safe
|
||||
* to call this function if another thread might be
|
||||
* concurrently obtaining random numbers from the same
|
||||
* context or updating or reseeding the same context.
|
||||
*
|
||||
* \param p_rng The CTR_DRBG context. This must be a pointer to a
|
||||
* #mbedtls_ctr_drbg_context structure.
|
||||
* \param output The buffer to fill.
|
||||
* \param output_len The length of the buffer.
|
||||
* \param additional Additional data to update. Can be NULL.
|
||||
* \param add_len The length of the additional data.
|
||||
* \param output_len The length of the buffer in bytes.
|
||||
* \param additional Additional data to update. Can be \c NULL, in which
|
||||
* case the additional data is empty regardless of
|
||||
* the value of \p add_len.
|
||||
* \param add_len The length of the additional data
|
||||
* if \p additional is not \c NULL.
|
||||
* This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT
|
||||
* and less than
|
||||
* #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len
|
||||
* where \c entropy_len is the entropy length
|
||||
* configured for the context.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
@ -284,12 +508,22 @@ int mbedtls_ctr_drbg_random_with_add( void *p_rng,
|
||||
/**
|
||||
* \brief This function uses CTR_DRBG to generate random data.
|
||||
*
|
||||
* \note The function automatically reseeds if the reseed counter is exceeded.
|
||||
*
|
||||
* This function automatically reseeds if the reseed counter is exceeded
|
||||
* or prediction resistance is enabled.
|
||||
*/
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
/**
|
||||
* \note When Mbed TLS is built with threading support,
|
||||
* it is safe to call mbedtls_ctr_drbg_random()
|
||||
* from multiple threads. Other operations, including
|
||||
* reseeding, are not thread-safe.
|
||||
*/
|
||||
#endif /* MBEDTLS_THREADING_C */
|
||||
/**
|
||||
* \param p_rng The CTR_DRBG context. This must be a pointer to a
|
||||
* #mbedtls_ctr_drbg_context structure.
|
||||
* \param output The buffer to fill.
|
||||
* \param output_len The length of the buffer.
|
||||
* \param output_len The length of the buffer in bytes.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
@ -336,7 +570,7 @@ MBEDTLS_DEPRECATED void mbedtls_ctr_drbg_update(
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on reseed
|
||||
* failure.
|
||||
*/
|
||||
int mbedtls_ctr_drbg_write_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path );
|
||||
@ -350,8 +584,10 @@ int mbedtls_ctr_drbg_write_seed_file( mbedtls_ctr_drbg_context *ctx, const char
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
* #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG on failure.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on
|
||||
* reseed failure.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if the existing
|
||||
* seed file is too large.
|
||||
*/
|
||||
int mbedtls_ctr_drbg_update_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path );
|
||||
#endif /* MBEDTLS_FS_IO */
|
||||
@ -368,11 +604,6 @@ int mbedtls_ctr_drbg_self_test( int verbose );
|
||||
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
/* Internal functions (do not call directly) */
|
||||
int mbedtls_ctr_drbg_seed_entropy_len( mbedtls_ctr_drbg_context *,
|
||||
int (*)(void *, unsigned char *, size_t), void *,
|
||||
const unsigned char *, size_t, size_t );
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
62
Externals/mbedtls/include/mbedtls/debug.h
vendored
62
Externals/mbedtls/include/mbedtls/debug.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Functions for controlling and providing debug output from the library.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,22 +18,20 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_DEBUG_H
|
||||
#define MBEDTLS_DEBUG_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ssl.h"
|
||||
#include "mbedtls/ssl.h"
|
||||
|
||||
#if defined(MBEDTLS_ECP_C)
|
||||
#include "ecp.h"
|
||||
#include "mbedtls/ecp.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_DEBUG_C)
|
||||
@ -82,6 +80,55 @@
|
||||
|
||||
#endif /* MBEDTLS_DEBUG_C */
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PRINTF_ATTRIBUTE
|
||||
*
|
||||
* Mark a function as having printf attributes, and thus enable checking
|
||||
* via -wFormat and other flags. This does nothing on builds with compilers
|
||||
* that do not support the format attribute
|
||||
*
|
||||
* Module: library/debug.c
|
||||
* Caller:
|
||||
*
|
||||
* This module provides debugging functions.
|
||||
*/
|
||||
#if defined(__has_attribute)
|
||||
#if __has_attribute(format)
|
||||
#if defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 1
|
||||
#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) \
|
||||
__attribute__((__format__ (gnu_printf, string_index, first_to_check)))
|
||||
#else /* defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 1 */
|
||||
#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) \
|
||||
__attribute__((format(printf, string_index, first_to_check)))
|
||||
#endif
|
||||
#else /* __has_attribute(format) */
|
||||
#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check)
|
||||
#endif /* __has_attribute(format) */
|
||||
#else /* defined(__has_attribute) */
|
||||
#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check)
|
||||
#endif
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PRINTF_SIZET
|
||||
*
|
||||
* MBEDTLS_PRINTF_xxx: Due to issues with older window compilers
|
||||
* and MinGW we need to define the printf specifier for size_t
|
||||
* and long long per platform.
|
||||
*
|
||||
* Module: library/debug.c
|
||||
* Caller:
|
||||
*
|
||||
* This module provides debugging functions.
|
||||
*/
|
||||
#if (defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 0) || (defined(_MSC_VER) && _MSC_VER < 1800)
|
||||
#include <inttypes.h>
|
||||
#define MBEDTLS_PRINTF_SIZET PRIuPTR
|
||||
#define MBEDTLS_PRINTF_LONGLONG "I64d"
|
||||
#else /* (defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 0) || (defined(_MSC_VER) && _MSC_VER < 1800) */
|
||||
#define MBEDTLS_PRINTF_SIZET "zu"
|
||||
#define MBEDTLS_PRINTF_LONGLONG "lld"
|
||||
#endif /* (defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 0) || (defined(_MSC_VER) && _MSC_VER < 1800) */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
@ -120,7 +167,7 @@ void mbedtls_debug_set_threshold( int threshold );
|
||||
*/
|
||||
void mbedtls_debug_print_msg( const mbedtls_ssl_context *ssl, int level,
|
||||
const char *file, int line,
|
||||
const char *format, ... );
|
||||
const char *format, ... ) MBEDTLS_PRINTF_ATTRIBUTE(5, 6);
|
||||
|
||||
/**
|
||||
* \brief Print the return value of a function to the debug output. This
|
||||
@ -262,4 +309,3 @@ void mbedtls_debug_printf_ecdh( const mbedtls_ssl_context *ssl, int level,
|
||||
#endif
|
||||
|
||||
#endif /* debug.h */
|
||||
|
||||
|
26
Externals/mbedtls/include/mbedtls/des.h
vendored
26
Externals/mbedtls/include/mbedtls/des.h
vendored
@ -8,7 +8,7 @@
|
||||
* instead.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -23,17 +23,16 @@
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*
|
||||
*/
|
||||
#ifndef MBEDTLS_DES_H
|
||||
#define MBEDTLS_DES_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
@ -41,10 +40,12 @@
|
||||
#define MBEDTLS_DES_ENCRYPT 1
|
||||
#define MBEDTLS_DES_DECRYPT 0
|
||||
|
||||
#define MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH -0x0032 /**< The data input has an invalid length. */
|
||||
/** The data input has an invalid length. */
|
||||
#define MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH -0x0032
|
||||
|
||||
/* MBEDTLS_ERR_DES_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_DES_HW_ACCEL_FAILED -0x0033 /**< DES hardware accelerator failed. */
|
||||
/** DES hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_DES_HW_ACCEL_FAILED -0x0033
|
||||
|
||||
#define MBEDTLS_DES_KEY_SIZE 8
|
||||
|
||||
@ -146,6 +147,7 @@ void mbedtls_des_key_set_parity( unsigned char key[MBEDTLS_DES_KEY_SIZE] );
|
||||
* security risk. We recommend considering stronger ciphers
|
||||
* instead.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des_key_check_key_parity( const unsigned char key[MBEDTLS_DES_KEY_SIZE] );
|
||||
|
||||
/**
|
||||
@ -159,6 +161,7 @@ int mbedtls_des_key_check_key_parity( const unsigned char key[MBEDTLS_DES_KEY_SI
|
||||
* security risk. We recommend considering stronger ciphers
|
||||
* instead.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des_key_check_weak( const unsigned char key[MBEDTLS_DES_KEY_SIZE] );
|
||||
|
||||
/**
|
||||
@ -173,6 +176,7 @@ int mbedtls_des_key_check_weak( const unsigned char key[MBEDTLS_DES_KEY_SIZE] );
|
||||
* security risk. We recommend considering stronger ciphers
|
||||
* instead.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des_setkey_enc( mbedtls_des_context *ctx, const unsigned char key[MBEDTLS_DES_KEY_SIZE] );
|
||||
|
||||
/**
|
||||
@ -187,6 +191,7 @@ int mbedtls_des_setkey_enc( mbedtls_des_context *ctx, const unsigned char key[MB
|
||||
* security risk. We recommend considering stronger ciphers
|
||||
* instead.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des_setkey_dec( mbedtls_des_context *ctx, const unsigned char key[MBEDTLS_DES_KEY_SIZE] );
|
||||
|
||||
/**
|
||||
@ -197,6 +202,7 @@ int mbedtls_des_setkey_dec( mbedtls_des_context *ctx, const unsigned char key[MB
|
||||
*
|
||||
* \return 0
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des3_set2key_enc( mbedtls_des3_context *ctx,
|
||||
const unsigned char key[MBEDTLS_DES_KEY_SIZE * 2] );
|
||||
|
||||
@ -208,6 +214,7 @@ int mbedtls_des3_set2key_enc( mbedtls_des3_context *ctx,
|
||||
*
|
||||
* \return 0
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des3_set2key_dec( mbedtls_des3_context *ctx,
|
||||
const unsigned char key[MBEDTLS_DES_KEY_SIZE * 2] );
|
||||
|
||||
@ -219,6 +226,7 @@ int mbedtls_des3_set2key_dec( mbedtls_des3_context *ctx,
|
||||
*
|
||||
* \return 0
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des3_set3key_enc( mbedtls_des3_context *ctx,
|
||||
const unsigned char key[MBEDTLS_DES_KEY_SIZE * 3] );
|
||||
|
||||
@ -230,6 +238,7 @@ int mbedtls_des3_set3key_enc( mbedtls_des3_context *ctx,
|
||||
*
|
||||
* \return 0
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des3_set3key_dec( mbedtls_des3_context *ctx,
|
||||
const unsigned char key[MBEDTLS_DES_KEY_SIZE * 3] );
|
||||
|
||||
@ -246,6 +255,7 @@ int mbedtls_des3_set3key_dec( mbedtls_des3_context *ctx,
|
||||
* security risk. We recommend considering stronger ciphers
|
||||
* instead.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des_crypt_ecb( mbedtls_des_context *ctx,
|
||||
const unsigned char input[8],
|
||||
unsigned char output[8] );
|
||||
@ -273,6 +283,7 @@ int mbedtls_des_crypt_ecb( mbedtls_des_context *ctx,
|
||||
* security risk. We recommend considering stronger ciphers
|
||||
* instead.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des_crypt_cbc( mbedtls_des_context *ctx,
|
||||
int mode,
|
||||
size_t length,
|
||||
@ -290,6 +301,7 @@ int mbedtls_des_crypt_cbc( mbedtls_des_context *ctx,
|
||||
*
|
||||
* \return 0 if successful
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des3_crypt_ecb( mbedtls_des3_context *ctx,
|
||||
const unsigned char input[8],
|
||||
unsigned char output[8] );
|
||||
@ -315,6 +327,7 @@ int mbedtls_des3_crypt_ecb( mbedtls_des3_context *ctx,
|
||||
*
|
||||
* \return 0 if successful, or MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_des3_crypt_cbc( mbedtls_des3_context *ctx,
|
||||
int mode,
|
||||
size_t length,
|
||||
@ -345,6 +358,7 @@ void mbedtls_des_setkey( uint32_t SK[32],
|
||||
*
|
||||
* \return 0 if successful, or 1 if the test failed
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_CRITICAL
|
||||
int mbedtls_des_self_test( int verbose );
|
||||
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
43
Externals/mbedtls/include/mbedtls/dhm.h
vendored
43
Externals/mbedtls/include/mbedtls/dhm.h
vendored
@ -44,7 +44,7 @@
|
||||
*
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -58,37 +58,46 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_DHM_H
|
||||
#define MBEDTLS_DHM_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
#include "bignum.h"
|
||||
#include "mbedtls/bignum.h"
|
||||
|
||||
/*
|
||||
* DHM Error codes
|
||||
*/
|
||||
#define MBEDTLS_ERR_DHM_BAD_INPUT_DATA -0x3080 /**< Bad input parameters. */
|
||||
#define MBEDTLS_ERR_DHM_READ_PARAMS_FAILED -0x3100 /**< Reading of the DHM parameters failed. */
|
||||
#define MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED -0x3180 /**< Making of the DHM parameters failed. */
|
||||
#define MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED -0x3200 /**< Reading of the public values failed. */
|
||||
#define MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED -0x3280 /**< Making of the public value failed. */
|
||||
#define MBEDTLS_ERR_DHM_CALC_SECRET_FAILED -0x3300 /**< Calculation of the DHM secret failed. */
|
||||
#define MBEDTLS_ERR_DHM_INVALID_FORMAT -0x3380 /**< The ASN.1 data is not formatted correctly. */
|
||||
#define MBEDTLS_ERR_DHM_ALLOC_FAILED -0x3400 /**< Allocation of memory failed. */
|
||||
#define MBEDTLS_ERR_DHM_FILE_IO_ERROR -0x3480 /**< Read or write of file failed. */
|
||||
/** Bad input parameters. */
|
||||
#define MBEDTLS_ERR_DHM_BAD_INPUT_DATA -0x3080
|
||||
/** Reading of the DHM parameters failed. */
|
||||
#define MBEDTLS_ERR_DHM_READ_PARAMS_FAILED -0x3100
|
||||
/** Making of the DHM parameters failed. */
|
||||
#define MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED -0x3180
|
||||
/** Reading of the public values failed. */
|
||||
#define MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED -0x3200
|
||||
/** Making of the public value failed. */
|
||||
#define MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED -0x3280
|
||||
/** Calculation of the DHM secret failed. */
|
||||
#define MBEDTLS_ERR_DHM_CALC_SECRET_FAILED -0x3300
|
||||
/** The ASN.1 data is not formatted correctly. */
|
||||
#define MBEDTLS_ERR_DHM_INVALID_FORMAT -0x3380
|
||||
/** Allocation of memory failed. */
|
||||
#define MBEDTLS_ERR_DHM_ALLOC_FAILED -0x3400
|
||||
/** Read or write of file failed. */
|
||||
#define MBEDTLS_ERR_DHM_FILE_IO_ERROR -0x3480
|
||||
|
||||
/* MBEDTLS_ERR_DHM_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_DHM_HW_ACCEL_FAILED -0x3500 /**< DHM hardware accelerator failed. */
|
||||
/** DHM hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_DHM_HW_ACCEL_FAILED -0x3500
|
||||
|
||||
#define MBEDTLS_ERR_DHM_SET_GROUP_FAILED -0x3580 /**< Setting the modulus and generator failed. */
|
||||
/** Setting the modulus and generator failed. */
|
||||
#define MBEDTLS_ERR_DHM_SET_GROUP_FAILED -0x3580
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -298,7 +307,6 @@ int mbedtls_dhm_calc_secret( mbedtls_dhm_context *ctx,
|
||||
void mbedtls_dhm_free( mbedtls_dhm_context *ctx );
|
||||
|
||||
#if defined(MBEDTLS_ASN1_PARSE_C)
|
||||
/** \ingroup x509_module */
|
||||
/**
|
||||
* \brief This function parses DHM parameters in PEM or DER format.
|
||||
*
|
||||
@ -317,7 +325,6 @@ int mbedtls_dhm_parse_dhm( mbedtls_dhm_context *dhm, const unsigned char *dhmin,
|
||||
size_t dhminlen );
|
||||
|
||||
#if defined(MBEDTLS_FS_IO)
|
||||
/** \ingroup x509_module */
|
||||
/**
|
||||
* \brief This function loads and parses DHM parameters from a file.
|
||||
*
|
||||
|
38
Externals/mbedtls/include/mbedtls/ecdh.h
vendored
38
Externals/mbedtls/include/mbedtls/ecdh.h
vendored
@ -13,7 +13,7 @@
|
||||
* Cryptography</em>.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -27,32 +27,23 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_ECDH_H
|
||||
#define MBEDTLS_ECDH_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ecp.h"
|
||||
#include "mbedtls/ecp.h"
|
||||
|
||||
/*
|
||||
* Use a backward compatible ECDH context.
|
||||
*
|
||||
* This flag is always enabled for now and future versions might add a
|
||||
* configuration option that conditionally undefines this flag.
|
||||
* The configuration option in question may have a different name.
|
||||
*
|
||||
* Features undefining this flag, must have a warning in their description in
|
||||
* config.h stating that the feature breaks backward compatibility.
|
||||
*/
|
||||
#define MBEDTLS_ECDH_LEGACY_CONTEXT
|
||||
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
|
||||
#undef MBEDTLS_ECDH_LEGACY_CONTEXT
|
||||
#include "everest/everest.h"
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -78,6 +69,9 @@ typedef enum
|
||||
{
|
||||
MBEDTLS_ECDH_VARIANT_NONE = 0, /*!< Implementation not defined. */
|
||||
MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0,/*!< The default Mbed TLS implementation */
|
||||
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
|
||||
MBEDTLS_ECDH_VARIANT_EVEREST /*!< Everest implementation */
|
||||
#endif
|
||||
} mbedtls_ecdh_variant;
|
||||
|
||||
/**
|
||||
@ -131,6 +125,9 @@ typedef struct mbedtls_ecdh_context
|
||||
union
|
||||
{
|
||||
mbedtls_ecdh_context_mbed mbed_ecdh;
|
||||
#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
|
||||
mbedtls_ecdh_context_everest everest_ecdh;
|
||||
#endif
|
||||
} ctx; /*!< Implementation-specific context. The
|
||||
context in use is specified by the \c var
|
||||
field. */
|
||||
@ -145,6 +142,15 @@ typedef struct mbedtls_ecdh_context
|
||||
}
|
||||
mbedtls_ecdh_context;
|
||||
|
||||
/**
|
||||
* \brief Check whether a given group can be used for ECDH.
|
||||
*
|
||||
* \param gid The ECP group ID to check.
|
||||
*
|
||||
* \return \c 1 if the group can be used, \c 0 otherwise
|
||||
*/
|
||||
int mbedtls_ecdh_can_do( mbedtls_ecp_group_id gid );
|
||||
|
||||
/**
|
||||
* \brief This function generates an ECDH keypair on an elliptic
|
||||
* curve.
|
||||
|
119
Externals/mbedtls/include/mbedtls/ecdsa.h
vendored
119
Externals/mbedtls/include/mbedtls/ecdsa.h
vendored
@ -11,7 +11,7 @@
|
||||
*
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -25,41 +25,44 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_ECDSA_H
|
||||
#define MBEDTLS_ECDSA_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ecp.h"
|
||||
#include "md.h"
|
||||
#include "mbedtls/ecp.h"
|
||||
#include "mbedtls/md.h"
|
||||
|
||||
/*
|
||||
* RFC-4492 page 20:
|
||||
/**
|
||||
* \brief Maximum ECDSA signature size for a given curve bit size
|
||||
*
|
||||
* \param bits Curve size in bits
|
||||
* \return Maximum signature size in bytes
|
||||
*
|
||||
* \note This macro returns a compile-time constant if its argument
|
||||
* is one. It may evaluate its argument multiple times.
|
||||
*/
|
||||
/*
|
||||
* Ecdsa-Sig-Value ::= SEQUENCE {
|
||||
* r INTEGER,
|
||||
* s INTEGER
|
||||
* }
|
||||
*
|
||||
* Size is at most
|
||||
* 1 (tag) + 1 (len) + 1 (initial 0) + ECP_MAX_BYTES for each of r and s,
|
||||
* twice that + 1 (tag) + 2 (len) for the sequence
|
||||
* (assuming ECP_MAX_BYTES is less than 126 for r and s,
|
||||
* and less than 124 (total len <= 255) for the sequence)
|
||||
* For each of r and s, the value (V) may include an extra initial "0" bit.
|
||||
*/
|
||||
#if MBEDTLS_ECP_MAX_BYTES > 124
|
||||
#error "MBEDTLS_ECP_MAX_BYTES bigger than expected, please fix MBEDTLS_ECDSA_MAX_LEN"
|
||||
#endif
|
||||
#define MBEDTLS_ECDSA_MAX_SIG_LEN( bits ) \
|
||||
( /*T,L of SEQUENCE*/ ( ( bits ) >= 61 * 8 ? 3 : 2 ) + \
|
||||
/*T,L of r,s*/ 2 * ( ( ( bits ) >= 127 * 8 ? 3 : 2 ) + \
|
||||
/*V of r,s*/ ( ( bits ) + 8 ) / 8 ) )
|
||||
|
||||
/** The maximal size of an ECDSA signature in Bytes. */
|
||||
#define MBEDTLS_ECDSA_MAX_LEN ( 3 + 2 * ( 3 + MBEDTLS_ECP_MAX_BYTES ) )
|
||||
#define MBEDTLS_ECDSA_MAX_LEN MBEDTLS_ECDSA_MAX_SIG_LEN( MBEDTLS_ECP_MAX_BITS )
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -120,6 +123,16 @@ typedef void mbedtls_ecdsa_restart_ctx;
|
||||
|
||||
#endif /* MBEDTLS_ECP_RESTARTABLE */
|
||||
|
||||
/**
|
||||
* \brief This function checks whether a given group can be used
|
||||
* for ECDSA.
|
||||
*
|
||||
* \param gid The ECP group ID to check.
|
||||
*
|
||||
* \return \c 1 if the group can be used, \c 0 otherwise
|
||||
*/
|
||||
int mbedtls_ecdsa_can_do( mbedtls_ecp_group_id gid );
|
||||
|
||||
/**
|
||||
* \brief This function computes the ECDSA signature of a
|
||||
* previously-hashed message.
|
||||
@ -161,6 +174,12 @@ int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
|
||||
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng );
|
||||
|
||||
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
|
||||
#if ! defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#if defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#define MBEDTLS_DEPRECATED __attribute__((deprecated))
|
||||
#else
|
||||
#define MBEDTLS_DEPRECATED
|
||||
#endif
|
||||
/**
|
||||
* \brief This function computes the ECDSA signature of a
|
||||
* previously-hashed message, deterministic version.
|
||||
@ -175,6 +194,19 @@ int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
|
||||
* (SECG): SEC1 Elliptic Curve Cryptography</em>, section
|
||||
* 4.1.3, step 5.
|
||||
*
|
||||
* \warning Since the output of the internal RNG is always the same for
|
||||
* the same key and message, this limits the efficiency of
|
||||
* blinding and leaks information through side channels. For
|
||||
* secure behavior use mbedtls_ecdsa_sign_det_ext() instead.
|
||||
*
|
||||
* (Optimally the blinding is a random value that is different
|
||||
* on every execution. In this case the blinding is still
|
||||
* random from the attackers perspective, but is the same on
|
||||
* each execution. This means that this blinding does not
|
||||
* prevent attackers from recovering secrets by combining
|
||||
* several measurement traces, but may prevent some attacks
|
||||
* that exploit relationships between secret data.)
|
||||
*
|
||||
* \see ecp.h
|
||||
*
|
||||
* \param grp The context for the elliptic curve to use.
|
||||
@ -199,7 +231,55 @@ int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
|
||||
int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r,
|
||||
mbedtls_mpi *s, const mbedtls_mpi *d,
|
||||
const unsigned char *buf, size_t blen,
|
||||
mbedtls_md_type_t md_alg );
|
||||
mbedtls_md_type_t md_alg ) MBEDTLS_DEPRECATED;
|
||||
#undef MBEDTLS_DEPRECATED
|
||||
#endif /* MBEDTLS_DEPRECATED_REMOVED */
|
||||
|
||||
/**
|
||||
* \brief This function computes the ECDSA signature of a
|
||||
* previously-hashed message, deterministic version.
|
||||
*
|
||||
* For more information, see <em>RFC-6979: Deterministic
|
||||
* Usage of the Digital Signature Algorithm (DSA) and Elliptic
|
||||
* Curve Digital Signature Algorithm (ECDSA)</em>.
|
||||
*
|
||||
* \note If the bitlength of the message hash is larger than the
|
||||
* bitlength of the group order, then the hash is truncated as
|
||||
* defined in <em>Standards for Efficient Cryptography Group
|
||||
* (SECG): SEC1 Elliptic Curve Cryptography</em>, section
|
||||
* 4.1.3, step 5.
|
||||
*
|
||||
* \see ecp.h
|
||||
*
|
||||
* \param grp The context for the elliptic curve to use.
|
||||
* This must be initialized and have group parameters
|
||||
* set, for example through mbedtls_ecp_group_load().
|
||||
* \param r The MPI context in which to store the first part
|
||||
* the signature. This must be initialized.
|
||||
* \param s The MPI context in which to store the second part
|
||||
* the signature. This must be initialized.
|
||||
* \param d The private signing key. This must be initialized
|
||||
* and setup, for example through mbedtls_ecp_gen_privkey().
|
||||
* \param buf The hashed content to be signed. This must be a readable
|
||||
* buffer of length \p blen Bytes. It may be \c NULL if
|
||||
* \p blen is zero.
|
||||
* \param blen The length of \p buf in Bytes.
|
||||
* \param md_alg The hash algorithm used to hash the original data.
|
||||
* \param f_rng_blind The RNG function used for blinding. This must not be
|
||||
* \c NULL.
|
||||
* \param p_rng_blind The RNG context to be passed to \p f_rng. This may be
|
||||
* \c NULL if \p f_rng doesn't need a context parameter.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX
|
||||
* error code on failure.
|
||||
*/
|
||||
int mbedtls_ecdsa_sign_det_ext( mbedtls_ecp_group *grp, mbedtls_mpi *r,
|
||||
mbedtls_mpi *s, const mbedtls_mpi *d,
|
||||
const unsigned char *buf, size_t blen,
|
||||
mbedtls_md_type_t md_alg,
|
||||
int (*f_rng_blind)(void *, unsigned char *, size_t),
|
||||
void *p_rng_blind );
|
||||
#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
|
||||
|
||||
/**
|
||||
@ -278,7 +358,8 @@ int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp,
|
||||
* the signature written. Must not be \c NULL.
|
||||
* \param f_rng The RNG function. This must not be \c NULL if
|
||||
* #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise,
|
||||
* it is unused and may be set to \c NULL.
|
||||
* it is used only for blinding and may be set to \c NULL, but
|
||||
* doing so is DEPRECATED.
|
||||
* \param p_rng The RNG context to be passed to \p f_rng. This may be
|
||||
* \c NULL if \p f_rng is \c NULL or doesn't use a context.
|
||||
*
|
||||
|
10
Externals/mbedtls/include/mbedtls/ecjpake.h
vendored
10
Externals/mbedtls/include/mbedtls/ecjpake.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Elliptic curve J-PAKE
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,8 +18,6 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_ECJPAKE_H
|
||||
#define MBEDTLS_ECJPAKE_H
|
||||
@ -41,13 +39,13 @@
|
||||
* also be use outside TLS.
|
||||
*/
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ecp.h"
|
||||
#include "md.h"
|
||||
#include "mbedtls/ecp.h"
|
||||
#include "mbedtls/md.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
233
Externals/mbedtls/include/mbedtls/ecp.h
vendored
233
Externals/mbedtls/include/mbedtls/ecp.h
vendored
@ -15,7 +15,7 @@
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -29,37 +29,65 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_ECP_H
|
||||
#define MBEDTLS_ECP_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "bignum.h"
|
||||
#include "mbedtls/bignum.h"
|
||||
|
||||
/*
|
||||
* ECP error codes
|
||||
*/
|
||||
#define MBEDTLS_ERR_ECP_BAD_INPUT_DATA -0x4F80 /**< Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL -0x4F00 /**< The buffer is too small to write to. */
|
||||
#define MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE -0x4E80 /**< The requested feature is not available, for example, the requested curve is not supported. */
|
||||
#define MBEDTLS_ERR_ECP_VERIFY_FAILED -0x4E00 /**< The signature is not valid. */
|
||||
#define MBEDTLS_ERR_ECP_ALLOC_FAILED -0x4D80 /**< Memory allocation failed. */
|
||||
#define MBEDTLS_ERR_ECP_RANDOM_FAILED -0x4D00 /**< Generation of random value, such as ephemeral key, failed. */
|
||||
#define MBEDTLS_ERR_ECP_INVALID_KEY -0x4C80 /**< Invalid private or public key. */
|
||||
#define MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH -0x4C00 /**< The buffer contains a valid signature followed by more data. */
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_ECP_BAD_INPUT_DATA -0x4F80
|
||||
/** The buffer is too small to write to. */
|
||||
#define MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL -0x4F00
|
||||
/** The requested feature is not available, for example, the requested curve is not supported. */
|
||||
#define MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE -0x4E80
|
||||
/** The signature is not valid. */
|
||||
#define MBEDTLS_ERR_ECP_VERIFY_FAILED -0x4E00
|
||||
/** Memory allocation failed. */
|
||||
#define MBEDTLS_ERR_ECP_ALLOC_FAILED -0x4D80
|
||||
/** Generation of random value, such as ephemeral key, failed. */
|
||||
#define MBEDTLS_ERR_ECP_RANDOM_FAILED -0x4D00
|
||||
/** Invalid private or public key. */
|
||||
#define MBEDTLS_ERR_ECP_INVALID_KEY -0x4C80
|
||||
/** The buffer contains a valid signature followed by more data. */
|
||||
#define MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH -0x4C00
|
||||
|
||||
/* MBEDTLS_ERR_ECP_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_ECP_HW_ACCEL_FAILED -0x4B80 /**< The ECP hardware accelerator failed. */
|
||||
/** The ECP hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_ECP_HW_ACCEL_FAILED -0x4B80
|
||||
|
||||
#define MBEDTLS_ERR_ECP_IN_PROGRESS -0x4B00 /**< Operation in progress, call again with the same parameters to continue. */
|
||||
/** Operation in progress, call again with the same parameters to continue. */
|
||||
#define MBEDTLS_ERR_ECP_IN_PROGRESS -0x4B00
|
||||
|
||||
/* Flags indicating whether to include code that is specific to certain
|
||||
* types of curves. These flags are for internal library use only. */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
|
||||
#define MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
|
||||
#define MBEDTLS_ECP_MONTGOMERY_ENABLED
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -74,6 +102,21 @@ extern "C" {
|
||||
* parameters. Therefore, only standardized domain parameters from trusted
|
||||
* sources should be used. See mbedtls_ecp_group_load().
|
||||
*/
|
||||
/* Note: when adding a new curve:
|
||||
* - Add it at the end of this enum, otherwise you'll break the ABI by
|
||||
* changing the numerical value for existing curves.
|
||||
* - Increment MBEDTLS_ECP_DP_MAX below if needed.
|
||||
* - Update the calculation of MBEDTLS_ECP_MAX_BITS_MIN below.
|
||||
* - Add the corresponding MBEDTLS_ECP_DP_xxx_ENABLED macro definition to
|
||||
* config.h.
|
||||
* - List the curve as a dependency of MBEDTLS_ECP_C and
|
||||
* MBEDTLS_ECDSA_C if supported in check_config.h.
|
||||
* - Add the curve to the appropriate curve type macro
|
||||
* MBEDTLS_ECP_yyy_ENABLED above.
|
||||
* - Add the necessary definitions to ecp_curves.c.
|
||||
* - Add the curve to the ecp_supported_curves array in ecp.c.
|
||||
* - Add the curve to applicable profiles in x509_crt.c if applicable.
|
||||
*/
|
||||
typedef enum
|
||||
{
|
||||
MBEDTLS_ECP_DP_NONE = 0, /*!< Curve not defined. */
|
||||
@ -99,6 +142,16 @@ typedef enum
|
||||
*/
|
||||
#define MBEDTLS_ECP_DP_MAX 12
|
||||
|
||||
/*
|
||||
* Curve types
|
||||
*/
|
||||
typedef enum
|
||||
{
|
||||
MBEDTLS_ECP_TYPE_NONE = 0,
|
||||
MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS, /* y^2 = x^3 + a x + b */
|
||||
MBEDTLS_ECP_TYPE_MONTGOMERY, /* y^2 = x^3 + a x^2 + x */
|
||||
} mbedtls_ecp_curve_type;
|
||||
|
||||
/**
|
||||
* Curve information, for use by other modules.
|
||||
*/
|
||||
@ -129,6 +182,40 @@ typedef struct mbedtls_ecp_point
|
||||
}
|
||||
mbedtls_ecp_point;
|
||||
|
||||
/* Determine the minimum safe value of MBEDTLS_ECP_MAX_BITS. */
|
||||
#if !defined(MBEDTLS_ECP_C)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 0
|
||||
/* Note: the curves must be listed in DECREASING size! */
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 521
|
||||
#elif defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 512
|
||||
#elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 448
|
||||
#elif defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 384
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 384
|
||||
#elif defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 256
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 256
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 256
|
||||
#elif defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 255
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 225 // n is slightly above 2^224
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 224
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 192
|
||||
#elif defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
#define MBEDTLS_ECP_MAX_BITS_MIN 192
|
||||
#else
|
||||
#error "MBEDTLS_ECP_C enabled, but no curve?"
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_ECP_ALT)
|
||||
/*
|
||||
* default mbed TLS elliptic curve arithmetic implementation
|
||||
@ -203,11 +290,23 @@ mbedtls_ecp_group;
|
||||
* \{
|
||||
*/
|
||||
|
||||
#if !defined(MBEDTLS_ECP_MAX_BITS)
|
||||
#if defined(MBEDTLS_ECP_MAX_BITS)
|
||||
|
||||
#if MBEDTLS_ECP_MAX_BITS < MBEDTLS_ECP_MAX_BITS_MIN
|
||||
#error "MBEDTLS_ECP_MAX_BITS is smaller than the largest supported curve"
|
||||
#endif
|
||||
|
||||
#elif defined(MBEDTLS_ECP_C)
|
||||
/**
|
||||
* The maximum size of the groups, that is, of \c N and \c P.
|
||||
*/
|
||||
#define MBEDTLS_ECP_MAX_BITS 521 /**< The maximum size of groups, in bits. */
|
||||
#define MBEDTLS_ECP_MAX_BITS MBEDTLS_ECP_MAX_BITS_MIN
|
||||
|
||||
#else
|
||||
/* MBEDTLS_ECP_MAX_BITS is not relevant without MBEDTLS_ECP_C, but set it
|
||||
* to a nonzero value so that code that unconditionally allocates an array
|
||||
* of a size based on it keeps working if built without ECC support. */
|
||||
#define MBEDTLS_ECP_MAX_BITS 1
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_ECP_MAX_BYTES ( ( MBEDTLS_ECP_MAX_BITS + 7 ) / 8 )
|
||||
@ -216,7 +315,8 @@ mbedtls_ecp_group;
|
||||
#if !defined(MBEDTLS_ECP_WINDOW_SIZE)
|
||||
/*
|
||||
* Maximum "window" size used for point multiplication.
|
||||
* Default: 6.
|
||||
* Default: a point where higher memory usage yields disminishing performance
|
||||
* returns.
|
||||
* Minimum value: 2. Maximum value: 7.
|
||||
*
|
||||
* Result is an array of at most ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) )
|
||||
@ -233,7 +333,7 @@ mbedtls_ecp_group;
|
||||
* 224 475 475 453 398 342
|
||||
* 192 640 640 633 587 476
|
||||
*/
|
||||
#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< The maximum window size used. */
|
||||
#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< The maximum window size used. */
|
||||
#endif /* MBEDTLS_ECP_WINDOW_SIZE */
|
||||
|
||||
#if !defined(MBEDTLS_ECP_FIXED_POINT_OPTIM)
|
||||
@ -417,10 +517,20 @@ void mbedtls_ecp_set_max_ops( unsigned max_ops );
|
||||
int mbedtls_ecp_restart_is_enabled( void );
|
||||
#endif /* MBEDTLS_ECP_RESTARTABLE */
|
||||
|
||||
/*
|
||||
* Get the type of a curve
|
||||
*/
|
||||
mbedtls_ecp_curve_type mbedtls_ecp_get_type( const mbedtls_ecp_group *grp );
|
||||
|
||||
/**
|
||||
* \brief This function retrieves the information defined in
|
||||
* mbedtls_ecp_curve_info() for all supported curves in order
|
||||
* of preference.
|
||||
* mbedtls_ecp_curve_info() for all supported curves.
|
||||
*
|
||||
* \note This function returns information about all curves
|
||||
* supported by the library. Some curves may not be
|
||||
* supported for all algorithms. Call mbedtls_ecdh_can_do()
|
||||
* or mbedtls_ecdsa_can_do() to check if a curve is
|
||||
* supported for ECDH or ECDSA.
|
||||
*
|
||||
* \return A statically allocated array. The last entry is 0.
|
||||
*/
|
||||
@ -431,6 +541,12 @@ const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list( void );
|
||||
* identifiers of all supported curves in the order of
|
||||
* preference.
|
||||
*
|
||||
* \note This function returns information about all curves
|
||||
* supported by the library. Some curves may not be
|
||||
* supported for all algorithms. Call mbedtls_ecdh_can_do()
|
||||
* or mbedtls_ecdsa_can_do() to check if a curve is
|
||||
* supported for ECDH or ECDSA.
|
||||
*
|
||||
* \return A statically allocated array,
|
||||
* terminated with MBEDTLS_ECP_DP_NONE.
|
||||
*/
|
||||
@ -482,7 +598,7 @@ void mbedtls_ecp_point_init( mbedtls_ecp_point *pt );
|
||||
*
|
||||
* \note After this function is called, domain parameters
|
||||
* for various ECP groups can be loaded through the
|
||||
* mbedtls_ecp_load() or mbedtls_ecp_tls_read_group()
|
||||
* mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group()
|
||||
* functions.
|
||||
*/
|
||||
void mbedtls_ecp_group_init( mbedtls_ecp_group *grp );
|
||||
@ -626,6 +742,9 @@ int mbedtls_ecp_point_read_string( mbedtls_ecp_point *P, int radix,
|
||||
* \param P The point to export. This must be initialized.
|
||||
* \param format The point format. This must be either
|
||||
* #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED.
|
||||
* (For groups without these formats, this parameter is
|
||||
* ignored. But it still has to be either of the above
|
||||
* values.)
|
||||
* \param olen The address at which to store the length of
|
||||
* the output in Bytes. This must not be \c NULL.
|
||||
* \param buf The output buffer. This must be a writable buffer
|
||||
@ -635,11 +754,14 @@ int mbedtls_ecp_point_read_string( mbedtls_ecp_point *P, int radix,
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer
|
||||
* is too small to hold the point.
|
||||
* \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format
|
||||
* or the export for the given group is not implemented.
|
||||
* \return Another negative error code on other kinds of failure.
|
||||
*/
|
||||
int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp, const mbedtls_ecp_point *P,
|
||||
int format, size_t *olen,
|
||||
unsigned char *buf, size_t buflen );
|
||||
int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp,
|
||||
const mbedtls_ecp_point *P,
|
||||
int format, size_t *olen,
|
||||
unsigned char *buf, size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief This function imports a point from unsigned binary data.
|
||||
@ -660,8 +782,8 @@ int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp, const mbedtls_
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid.
|
||||
* \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure.
|
||||
* \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format
|
||||
* is not implemented.
|
||||
* \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the
|
||||
* given group is not implemented.
|
||||
*/
|
||||
int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group *grp,
|
||||
mbedtls_ecp_point *P,
|
||||
@ -813,6 +935,9 @@ int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group *grp,
|
||||
* intermediate results to prevent potential timing attacks
|
||||
* targeting these results. We recommend always providing
|
||||
* a non-NULL \p f_rng. The overhead is negligible.
|
||||
* Note: unless #MBEDTLS_ECP_NO_INTERNAL_RNG is defined, when
|
||||
* \p f_rng is NULL, an internal RNG (seeded from the value
|
||||
* of \p m) will be used instead.
|
||||
*
|
||||
* \param grp The ECP group to use.
|
||||
* This must be initialized and have group parameters
|
||||
@ -870,6 +995,7 @@ int mbedtls_ecp_mul_restartable( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
|
||||
mbedtls_ecp_restart_ctx *rs_ctx );
|
||||
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
/**
|
||||
* \brief This function performs multiplication and addition of two
|
||||
* points by integers: \p R = \p m * \p P + \p n * \p Q
|
||||
@ -879,6 +1005,10 @@ int mbedtls_ecp_mul_restartable( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
* \note In contrast to mbedtls_ecp_mul(), this function does not
|
||||
* guarantee a constant execution flow and timing.
|
||||
*
|
||||
* \note This function is only defined for short Weierstrass curves.
|
||||
* It may not be included in builds without any short
|
||||
* Weierstrass curve.
|
||||
*
|
||||
* \param grp The ECP group to use.
|
||||
* This must be initialized and have group parameters
|
||||
* set, for example through mbedtls_ecp_group_load().
|
||||
@ -897,6 +1027,8 @@ int mbedtls_ecp_mul_restartable( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
* valid private keys, or \p P or \p Q are not valid public
|
||||
* keys.
|
||||
* \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure.
|
||||
* \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not
|
||||
* designate a short Weierstrass curve.
|
||||
* \return Another negative error code on other kinds of failure.
|
||||
*/
|
||||
int mbedtls_ecp_muladd( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
@ -914,6 +1046,10 @@ int mbedtls_ecp_muladd( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
* but it can return early and restart according to the limit
|
||||
* set with \c mbedtls_ecp_set_max_ops() to reduce blocking.
|
||||
*
|
||||
* \note This function is only defined for short Weierstrass curves.
|
||||
* It may not be included in builds without any short
|
||||
* Weierstrass curve.
|
||||
*
|
||||
* \param grp The ECP group to use.
|
||||
* This must be initialized and have group parameters
|
||||
* set, for example through mbedtls_ecp_group_load().
|
||||
@ -933,6 +1069,8 @@ int mbedtls_ecp_muladd( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
|
||||
* valid private keys, or \p P or \p Q are not valid public
|
||||
* keys.
|
||||
* \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure.
|
||||
* \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not
|
||||
* designate a short Weierstrass curve.
|
||||
* \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of
|
||||
* operations was reached: see \c mbedtls_ecp_set_max_ops().
|
||||
* \return Another negative error code on other kinds of failure.
|
||||
@ -942,6 +1080,7 @@ int mbedtls_ecp_muladd_restartable(
|
||||
const mbedtls_mpi *m, const mbedtls_ecp_point *P,
|
||||
const mbedtls_mpi *n, const mbedtls_ecp_point *Q,
|
||||
mbedtls_ecp_restart_ctx *rs_ctx );
|
||||
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
||||
|
||||
/**
|
||||
* \brief This function checks that a point is a valid public key
|
||||
@ -1093,6 +1232,46 @@ int mbedtls_ecp_gen_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng );
|
||||
|
||||
/**
|
||||
* \brief This function reads an elliptic curve private key.
|
||||
*
|
||||
* \param grp_id The ECP group identifier.
|
||||
* \param key The destination key.
|
||||
* \param buf The buffer containing the binary representation of the
|
||||
* key. (Big endian integer for Weierstrass curves, byte
|
||||
* string for Montgomery curves.)
|
||||
* \param buflen The length of the buffer in bytes.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is
|
||||
* invalid.
|
||||
* \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
|
||||
* \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for
|
||||
* the group is not implemented.
|
||||
* \return Another negative error code on different kinds of failure.
|
||||
*/
|
||||
int mbedtls_ecp_read_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
|
||||
const unsigned char *buf, size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief This function exports an elliptic curve private key.
|
||||
*
|
||||
* \param key The private key.
|
||||
* \param buf The output buffer for containing the binary representation
|
||||
* of the key. (Big endian integer for Weierstrass curves, byte
|
||||
* string for Montgomery curves.)
|
||||
* \param buflen The total length of the buffer in bytes.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key
|
||||
representation is larger than the available space in \p buf.
|
||||
* \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for
|
||||
* the group is not implemented.
|
||||
* \return Another negative error code on different kinds of failure.
|
||||
*/
|
||||
int mbedtls_ecp_write_key( mbedtls_ecp_keypair *key,
|
||||
unsigned char *buf, size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief This function checks that the keypair objects
|
||||
* \p pub and \p prv have the same group and the
|
||||
|
14
Externals/mbedtls/include/mbedtls/ecp_internal.h
vendored
14
Externals/mbedtls/include/mbedtls/ecp_internal.h
vendored
@ -5,7 +5,7 @@
|
||||
* point arithmetic.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2016, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -19,8 +19,6 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
/*
|
||||
@ -62,7 +60,7 @@
|
||||
#define MBEDTLS_ECP_INTERNAL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -105,7 +103,7 @@ int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp );
|
||||
*/
|
||||
void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp );
|
||||
|
||||
#if defined(ECP_SHORTWEIERSTRASS)
|
||||
#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
||||
|
||||
#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
|
||||
/**
|
||||
@ -245,9 +243,9 @@ int mbedtls_internal_ecp_normalize_jac( const mbedtls_ecp_group *grp,
|
||||
mbedtls_ecp_point *pt );
|
||||
#endif
|
||||
|
||||
#endif /* ECP_SHORTWEIERSTRASS */
|
||||
#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
||||
|
||||
#if defined(ECP_MONTGOMERY)
|
||||
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
||||
|
||||
#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
|
||||
int mbedtls_internal_ecp_double_add_mxz( const mbedtls_ecp_group *grp,
|
||||
@ -291,7 +289,7 @@ int mbedtls_internal_ecp_normalize_mxz( const mbedtls_ecp_group *grp,
|
||||
mbedtls_ecp_point *P );
|
||||
#endif
|
||||
|
||||
#endif /* ECP_MONTGOMERY */
|
||||
#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
|
||||
|
||||
#endif /* MBEDTLS_ECP_INTERNAL_ALT */
|
||||
|
||||
|
37
Externals/mbedtls/include/mbedtls/entropy.h
vendored
37
Externals/mbedtls/include/mbedtls/entropy.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Entropy accumulator implementation
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_ENTROPY_H
|
||||
#define MBEDTLS_ENTROPY_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -33,28 +31,33 @@
|
||||
#include <stddef.h>
|
||||
|
||||
#if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256)
|
||||
#include "sha512.h"
|
||||
#include "mbedtls/sha512.h"
|
||||
#define MBEDTLS_ENTROPY_SHA512_ACCUMULATOR
|
||||
#else
|
||||
#if defined(MBEDTLS_SHA256_C)
|
||||
#define MBEDTLS_ENTROPY_SHA256_ACCUMULATOR
|
||||
#include "sha256.h"
|
||||
#include "mbedtls/sha256.h"
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
#include "threading.h"
|
||||
#include "mbedtls/threading.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_HAVEGE_C)
|
||||
#include "havege.h"
|
||||
#include "mbedtls/havege.h"
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_ERR_ENTROPY_SOURCE_FAILED -0x003C /**< Critical entropy source failure. */
|
||||
#define MBEDTLS_ERR_ENTROPY_MAX_SOURCES -0x003E /**< No more sources can be added. */
|
||||
#define MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED -0x0040 /**< No sources have been added to poll. */
|
||||
#define MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE -0x003D /**< No strong sources have been added to poll. */
|
||||
#define MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR -0x003F /**< Read/write error in file. */
|
||||
/** Critical entropy source failure. */
|
||||
#define MBEDTLS_ERR_ENTROPY_SOURCE_FAILED -0x003C
|
||||
/** No more sources can be added. */
|
||||
#define MBEDTLS_ERR_ENTROPY_MAX_SOURCES -0x003E
|
||||
/** No sources have been added to poll. */
|
||||
#define MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED -0x0040
|
||||
/** No strong sources have been added to poll. */
|
||||
#define MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE -0x003D
|
||||
/** Read/write error in file. */
|
||||
#define MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR -0x003F
|
||||
|
||||
/**
|
||||
* \name SECTION: Module settings
|
||||
@ -122,13 +125,15 @@ mbedtls_entropy_source_state;
|
||||
*/
|
||||
typedef struct mbedtls_entropy_context
|
||||
{
|
||||
int accumulator_started;
|
||||
int accumulator_started; /* 0 after init.
|
||||
* 1 after the first update.
|
||||
* -1 after free. */
|
||||
#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
|
||||
mbedtls_sha512_context accumulator;
|
||||
#else
|
||||
#elif defined(MBEDTLS_ENTROPY_SHA256_ACCUMULATOR)
|
||||
mbedtls_sha256_context accumulator;
|
||||
#endif
|
||||
int source_count;
|
||||
int source_count; /* Number of entries used in source. */
|
||||
mbedtls_entropy_source_state source[MBEDTLS_ENTROPY_MAX_SOURCES];
|
||||
#if defined(MBEDTLS_HAVEGE_C)
|
||||
mbedtls_havege_state havege_data;
|
||||
|
@ -4,7 +4,7 @@
|
||||
* \brief Platform-specific and custom entropy polling functions
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_ENTROPY_POLL_H
|
||||
#define MBEDTLS_ENTROPY_POLL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
104
Externals/mbedtls/include/mbedtls/error.h
vendored
104
Externals/mbedtls/include/mbedtls/error.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Error to string translation
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,20 +18,23 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_ERROR_H
|
||||
#define MBEDTLS_ERROR_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
||||
!defined(inline) && !defined(__cplusplus)
|
||||
#define inline __inline
|
||||
#endif
|
||||
|
||||
/**
|
||||
* Error code layout.
|
||||
*
|
||||
@ -52,9 +55,10 @@
|
||||
* For historical reasons, low-level error codes are divided in even and odd,
|
||||
* even codes were assigned first, and -1 is reserved for other errors.
|
||||
*
|
||||
* Low-level module errors (0x0002-0x007E, 0x0003-0x007F)
|
||||
* Low-level module errors (0x0002-0x007E, 0x0001-0x007F)
|
||||
*
|
||||
* Module Nr Codes assigned
|
||||
* ERROR 2 0x006E 0x0001
|
||||
* MPI 7 0x0002-0x0010
|
||||
* GCM 3 0x0012-0x0014 0x0013-0x0013
|
||||
* BLOWFISH 3 0x0016-0x0018 0x0017-0x0017
|
||||
@ -86,7 +90,7 @@
|
||||
* CHACHA20 3 0x0051-0x0055
|
||||
* POLY1305 3 0x0057-0x005B
|
||||
* CHACHAPOLY 2 0x0054-0x0056
|
||||
* PLATFORM 1 0x0070-0x0072
|
||||
* PLATFORM 2 0x0070-0x0072
|
||||
*
|
||||
* High-level module nr (3 bits - 0x0...-0x7...)
|
||||
* Name ID Nr of Errors
|
||||
@ -100,8 +104,9 @@
|
||||
* ECP 4 10 (Started from top)
|
||||
* MD 5 5
|
||||
* HKDF 5 1 (Started from top)
|
||||
* CIPHER 6 8
|
||||
* SSL 6 23 (Started from top)
|
||||
* SSL 5 2 (Started from 0x5F00)
|
||||
* CIPHER 6 8 (Started from 0x6080)
|
||||
* SSL 6 24 (Started from top, plus 0x6000)
|
||||
* SSL 7 32
|
||||
*
|
||||
* Module dependent error code (5 bits 0x.00.-0x.F8.)
|
||||
@ -111,6 +116,59 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/** Generic error */
|
||||
#define MBEDTLS_ERR_ERROR_GENERIC_ERROR -0x0001
|
||||
/** This is a bug in the library */
|
||||
#define MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED -0x006E
|
||||
|
||||
/**
|
||||
* \brief Combines a high-level and low-level error code together.
|
||||
*
|
||||
* Wrapper macro for mbedtls_error_add(). See that function for
|
||||
* more details.
|
||||
*/
|
||||
#define MBEDTLS_ERROR_ADD( high, low ) \
|
||||
mbedtls_error_add( high, low, __FILE__, __LINE__ )
|
||||
|
||||
#if defined(MBEDTLS_TEST_HOOKS)
|
||||
/**
|
||||
* \brief Testing hook called before adding/combining two error codes together.
|
||||
* Only used when invasive testing is enabled via MBEDTLS_TEST_HOOKS.
|
||||
*/
|
||||
extern void (*mbedtls_test_hook_error_add)( int, int, const char *, int );
|
||||
#endif
|
||||
|
||||
/**
|
||||
* \brief Combines a high-level and low-level error code together.
|
||||
*
|
||||
* This function can be called directly however it is usually
|
||||
* called via the #MBEDTLS_ERROR_ADD macro.
|
||||
*
|
||||
* While a value of zero is not a negative error code, it is still an
|
||||
* error code (that denotes success) and can be combined with both a
|
||||
* negative error code or another value of zero.
|
||||
*
|
||||
* \note When invasive testing is enabled via #MBEDTLS_TEST_HOOKS, also try to
|
||||
* call \link mbedtls_test_hook_error_add \endlink.
|
||||
*
|
||||
* \param high high-level error code. See error.h for more details.
|
||||
* \param low low-level error code. See error.h for more details.
|
||||
* \param file file where this error code addition occurred.
|
||||
* \param line line where this error code addition occurred.
|
||||
*/
|
||||
static inline int mbedtls_error_add( int high, int low,
|
||||
const char *file, int line )
|
||||
{
|
||||
#if defined(MBEDTLS_TEST_HOOKS)
|
||||
if( *mbedtls_test_hook_error_add != NULL )
|
||||
( *mbedtls_test_hook_error_add )( high, low, file, line );
|
||||
#endif
|
||||
(void)file;
|
||||
(void)line;
|
||||
|
||||
return( high + low );
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Translate a mbed TLS error code into a string representation,
|
||||
* Result is truncated if necessary and always includes a terminating
|
||||
@ -122,6 +180,36 @@ extern "C" {
|
||||
*/
|
||||
void mbedtls_strerror( int errnum, char *buffer, size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief Translate the high-level part of an Mbed TLS error code into a string
|
||||
* representation.
|
||||
*
|
||||
* This function returns a const pointer to an un-modifiable string. The caller
|
||||
* must not try to modify the string. It is intended to be used mostly for
|
||||
* logging purposes.
|
||||
*
|
||||
* \param error_code error code
|
||||
*
|
||||
* \return The string representation of the error code, or \c NULL if the error
|
||||
* code is unknown.
|
||||
*/
|
||||
const char * mbedtls_high_level_strerr( int error_code );
|
||||
|
||||
/**
|
||||
* \brief Translate the low-level part of an Mbed TLS error code into a string
|
||||
* representation.
|
||||
*
|
||||
* This function returns a const pointer to an un-modifiable string. The caller
|
||||
* must not try to modify the string. It is intended to be used mostly for
|
||||
* logging purposes.
|
||||
*
|
||||
* \param error_code error code
|
||||
*
|
||||
* \return The string representation of the error code, or \c NULL if the error
|
||||
* code is unknown.
|
||||
*/
|
||||
const char * mbedtls_low_level_strerr( int error_code );
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
21
Externals/mbedtls/include/mbedtls/gcm.h
vendored
21
Externals/mbedtls/include/mbedtls/gcm.h
vendored
@ -12,7 +12,7 @@
|
||||
*
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -26,32 +26,33 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_GCM_H
|
||||
#define MBEDTLS_GCM_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "cipher.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
#define MBEDTLS_GCM_ENCRYPT 1
|
||||
#define MBEDTLS_GCM_DECRYPT 0
|
||||
|
||||
#define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012 /**< Authenticated decryption failed. */
|
||||
/** Authenticated decryption failed. */
|
||||
#define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012
|
||||
|
||||
/* MBEDTLS_ERR_GCM_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_GCM_HW_ACCEL_FAILED -0x0013 /**< GCM hardware accelerator failed. */
|
||||
/** GCM hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_GCM_HW_ACCEL_FAILED -0x0013
|
||||
|
||||
#define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014 /**< Bad input parameters to function. */
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -157,7 +158,7 @@ int mbedtls_gcm_setkey( mbedtls_gcm_context *ctx,
|
||||
* than zero, this must be a writable buffer of at least that
|
||||
* size in Bytes.
|
||||
* \param tag_len The length of the tag to generate.
|
||||
* \param tag The buffer for holding the tag. This must be a readable
|
||||
* \param tag The buffer for holding the tag. This must be a writable
|
||||
* buffer of at least \p tag_len Bytes.
|
||||
*
|
||||
* \return \c 0 if the encryption or decryption was performed
|
||||
@ -285,7 +286,7 @@ int mbedtls_gcm_update( mbedtls_gcm_context *ctx,
|
||||
* tag. The tag can have a maximum length of 16 Bytes.
|
||||
*
|
||||
* \param ctx The GCM context. This must be initialized.
|
||||
* \param tag The buffer for holding the tag. This must be a readable
|
||||
* \param tag The buffer for holding the tag. This must be a writable
|
||||
* buffer of at least \p tag_len Bytes.
|
||||
* \param tag_len The length of the tag to generate. This must be at least
|
||||
* four.
|
||||
|
13
Externals/mbedtls/include/mbedtls/havege.h
vendored
13
Externals/mbedtls/include/mbedtls/havege.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief HAVEGE: HArdware Volatile Entropy Gathering and Expansion
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,19 +18,18 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_HAVEGE_H
|
||||
#define MBEDTLS_HAVEGE_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#define MBEDTLS_HAVEGE_COLLECT_SIZE 1024
|
||||
|
||||
@ -43,9 +42,9 @@ extern "C" {
|
||||
*/
|
||||
typedef struct mbedtls_havege_state
|
||||
{
|
||||
int PT1, PT2, offset[2];
|
||||
int pool[MBEDTLS_HAVEGE_COLLECT_SIZE];
|
||||
int WALK[8192];
|
||||
uint32_t PT1, PT2, offset[2];
|
||||
uint32_t pool[MBEDTLS_HAVEGE_COLLECT_SIZE];
|
||||
uint32_t WALK[8192];
|
||||
}
|
||||
mbedtls_havege_state;
|
||||
|
||||
|
31
Externals/mbedtls/include/mbedtls/hkdf.h
vendored
31
Externals/mbedtls/include/mbedtls/hkdf.h
vendored
@ -7,39 +7,38 @@
|
||||
* specified by RFC 5869.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2016-2018, ARM Limited, All Rights Reserved
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
#ifndef MBEDTLS_HKDF_H
|
||||
#define MBEDTLS_HKDF_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "md.h"
|
||||
#include "mbedtls/md.h"
|
||||
|
||||
/**
|
||||
* \name HKDF Error codes
|
||||
* \{
|
||||
*/
|
||||
#define MBEDTLS_ERR_HKDF_BAD_INPUT_DATA -0x5F80 /**< Bad input parameters to function. */
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_HKDF_BAD_INPUT_DATA -0x5F80
|
||||
/* \} name */
|
||||
|
||||
#ifdef __cplusplus
|
||||
|
366
Externals/mbedtls/include/mbedtls/hmac_drbg.h
vendored
366
Externals/mbedtls/include/mbedtls/hmac_drbg.h
vendored
@ -1,10 +1,14 @@
|
||||
/**
|
||||
* \file hmac_drbg.h
|
||||
*
|
||||
* \brief HMAC_DRBG (NIST SP 800-90A)
|
||||
* \brief The HMAC_DRBG pseudorandom generator.
|
||||
*
|
||||
* This module implements the HMAC_DRBG pseudorandom generator described
|
||||
* in <em>NIST SP 800-90A: Recommendation for Random Number Generation Using
|
||||
* Deterministic Random Bit Generators</em>.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,31 +22,33 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_HMAC_DRBG_H
|
||||
#define MBEDTLS_HMAC_DRBG_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "md.h"
|
||||
#include "mbedtls/md.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
#include "threading.h"
|
||||
#include "mbedtls/threading.h"
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Error codes
|
||||
*/
|
||||
#define MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG -0x0003 /**< Too many random requested in single call. */
|
||||
#define MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG -0x0005 /**< Input too large (Entropy + additional). */
|
||||
#define MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR -0x0007 /**< Read/write error in file. */
|
||||
#define MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED -0x0009 /**< The entropy source failed. */
|
||||
/** Too many random requested in single call. */
|
||||
#define MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG -0x0003
|
||||
/** Input too large (Entropy + additional). */
|
||||
#define MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG -0x0005
|
||||
/** Read/write error in file. */
|
||||
#define MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR -0x0007
|
||||
/** The entropy source failed. */
|
||||
#define MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED -0x0009
|
||||
|
||||
/**
|
||||
* \name SECTION: Module settings
|
||||
@ -82,7 +88,7 @@ extern "C" {
|
||||
*/
|
||||
typedef struct mbedtls_hmac_drbg_context
|
||||
{
|
||||
/* Working state: the key K is not stored explicitely,
|
||||
/* Working state: the key K is not stored explicitly,
|
||||
* but is implied by the HMAC context */
|
||||
mbedtls_md_context_t md_ctx; /*!< HMAC context (inc. K) */
|
||||
unsigned char V[MBEDTLS_MD_MAX_SIZE]; /*!< V in the spec */
|
||||
@ -99,43 +105,99 @@ typedef struct mbedtls_hmac_drbg_context
|
||||
void *p_entropy; /*!< context for the entropy function */
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
/* Invariant: the mutex is initialized if and only if
|
||||
* md_ctx->md_info != NULL. This means that the mutex is initialized
|
||||
* during the initial seeding in mbedtls_hmac_drbg_seed() or
|
||||
* mbedtls_hmac_drbg_seed_buf() and freed in mbedtls_ctr_drbg_free().
|
||||
*
|
||||
* Note that this invariant may change without notice. Do not rely on it
|
||||
* and do not access the mutex directly in application code.
|
||||
*/
|
||||
mbedtls_threading_mutex_t mutex;
|
||||
#endif
|
||||
} mbedtls_hmac_drbg_context;
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG context initialization
|
||||
* Makes the context ready for mbedtls_hmac_drbg_seed(),
|
||||
* mbedtls_hmac_drbg_seed_buf() or
|
||||
* mbedtls_hmac_drbg_free().
|
||||
* \brief HMAC_DRBG context initialization.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to be initialized
|
||||
* This function makes the context ready for mbedtls_hmac_drbg_seed(),
|
||||
* mbedtls_hmac_drbg_seed_buf() or mbedtls_hmac_drbg_free().
|
||||
*
|
||||
* \note The reseed interval is #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL
|
||||
* by default. Override this value by calling
|
||||
* mbedtls_hmac_drbg_set_reseed_interval().
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to be initialized.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_init( mbedtls_hmac_drbg_context *ctx );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG initial seeding
|
||||
* Seed and setup entropy source for future reseeds.
|
||||
* \brief HMAC_DRBG initial seeding.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to be seeded
|
||||
* \param md_info MD algorithm to use for HMAC_DRBG
|
||||
* \param f_entropy Entropy callback (p_entropy, buffer to fill, buffer
|
||||
* length)
|
||||
* \param p_entropy Entropy context
|
||||
* \param custom Personalization data (Device specific identifiers)
|
||||
* (Can be NULL)
|
||||
* \param len Length of personalization data
|
||||
* Set the initial seed and set up the entropy source for future reseeds.
|
||||
*
|
||||
* \note The "security strength" as defined by NIST is set to:
|
||||
* 128 bits if md_alg is SHA-1,
|
||||
* 192 bits if md_alg is SHA-224,
|
||||
* 256 bits if md_alg is SHA-256 or higher.
|
||||
* A typical choice for the \p f_entropy and \p p_entropy parameters is
|
||||
* to use the entropy module:
|
||||
* - \p f_entropy is mbedtls_entropy_func();
|
||||
* - \p p_entropy is an instance of ::mbedtls_entropy_context initialized
|
||||
* with mbedtls_entropy_init() (which registers the platform's default
|
||||
* entropy sources).
|
||||
*
|
||||
* You can provide a personalization string in addition to the
|
||||
* entropy source, to make this instantiation as unique as possible.
|
||||
*
|
||||
* \note By default, the security strength as defined by NIST is:
|
||||
* - 128 bits if \p md_info is SHA-1;
|
||||
* - 192 bits if \p md_info is SHA-224;
|
||||
* - 256 bits if \p md_info is SHA-256, SHA-384 or SHA-512.
|
||||
* Note that SHA-256 is just as efficient as SHA-224.
|
||||
* The security strength can be reduced if a smaller
|
||||
* entropy length is set with
|
||||
* mbedtls_hmac_drbg_set_entropy_len().
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_MD_BAD_INPUT_DATA, or
|
||||
* MBEDTLS_ERR_MD_ALLOC_FAILED, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED.
|
||||
* \note The default entropy length is the security strength
|
||||
* (converted from bits to bytes). You can override
|
||||
* it by calling mbedtls_hmac_drbg_set_entropy_len().
|
||||
*
|
||||
* \note During the initial seeding, this function calls
|
||||
* the entropy source to obtain a nonce
|
||||
* whose length is half the entropy length.
|
||||
*/
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
/**
|
||||
* \note When Mbed TLS is built with threading support,
|
||||
* after this function returns successfully,
|
||||
* it is safe to call mbedtls_hmac_drbg_random()
|
||||
* from multiple threads. Other operations, including
|
||||
* reseeding, are not thread-safe.
|
||||
*/
|
||||
#endif /* MBEDTLS_THREADING_C */
|
||||
/**
|
||||
* \param ctx HMAC_DRBG context to be seeded.
|
||||
* \param md_info MD algorithm to use for HMAC_DRBG.
|
||||
* \param f_entropy The entropy callback, taking as arguments the
|
||||
* \p p_entropy context, the buffer to fill, and the
|
||||
* length of the buffer.
|
||||
* \p f_entropy is always called with a length that is
|
||||
* less than or equal to the entropy length.
|
||||
* \param p_entropy The entropy context to pass to \p f_entropy.
|
||||
* \param custom The personalization string.
|
||||
* This can be \c NULL, in which case the personalization
|
||||
* string is empty regardless of the value of \p len.
|
||||
* \param len The length of the personalization string.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT
|
||||
* and also at most
|
||||
* #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2
|
||||
* where \p entropy_len is the entropy length
|
||||
* described above.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is
|
||||
* invalid.
|
||||
* \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough
|
||||
* memory to allocate context data.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* if the call to \p f_entropy failed.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_seed( mbedtls_hmac_drbg_context *ctx,
|
||||
const mbedtls_md_info_t * md_info,
|
||||
@ -146,98 +208,156 @@ int mbedtls_hmac_drbg_seed( mbedtls_hmac_drbg_context *ctx,
|
||||
|
||||
/**
|
||||
* \brief Initilisation of simpified HMAC_DRBG (never reseeds).
|
||||
* (For use with deterministic ECDSA.)
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to be initialised
|
||||
* \param md_info MD algorithm to use for HMAC_DRBG
|
||||
* \param data Concatenation of entropy string and additional data
|
||||
* \param data_len Length of data in bytes
|
||||
* This function is meant for use in algorithms that need a pseudorandom
|
||||
* input such as deterministic ECDSA.
|
||||
*/
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
/**
|
||||
* \note When Mbed TLS is built with threading support,
|
||||
* after this function returns successfully,
|
||||
* it is safe to call mbedtls_hmac_drbg_random()
|
||||
* from multiple threads. Other operations, including
|
||||
* reseeding, are not thread-safe.
|
||||
*/
|
||||
#endif /* MBEDTLS_THREADING_C */
|
||||
/**
|
||||
* \param ctx HMAC_DRBG context to be initialised.
|
||||
* \param md_info MD algorithm to use for HMAC_DRBG.
|
||||
* \param data Concatenation of the initial entropy string and
|
||||
* the additional data.
|
||||
* \param data_len Length of \p data in bytes.
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_MD_BAD_INPUT_DATA, or
|
||||
* MBEDTLS_ERR_MD_ALLOC_FAILED.
|
||||
* \return \c 0 if successful. or
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is
|
||||
* invalid.
|
||||
* \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough
|
||||
* memory to allocate context data.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_seed_buf( mbedtls_hmac_drbg_context *ctx,
|
||||
const mbedtls_md_info_t * md_info,
|
||||
const unsigned char *data, size_t data_len );
|
||||
|
||||
/**
|
||||
* \brief Enable / disable prediction resistance (Default: Off)
|
||||
* \brief This function turns prediction resistance on or off.
|
||||
* The default value is off.
|
||||
*
|
||||
* Note: If enabled, entropy is used for ctx->entropy_len before each call!
|
||||
* Only use this if you have ample supply of good entropy!
|
||||
* \note If enabled, entropy is gathered at the beginning of
|
||||
* every call to mbedtls_hmac_drbg_random_with_add()
|
||||
* or mbedtls_hmac_drbg_random().
|
||||
* Only use this if your entropy source has sufficient
|
||||
* throughput.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param resistance MBEDTLS_HMAC_DRBG_PR_ON or MBEDTLS_HMAC_DRBG_PR_OFF
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param resistance #MBEDTLS_HMAC_DRBG_PR_ON or #MBEDTLS_HMAC_DRBG_PR_OFF.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_set_prediction_resistance( mbedtls_hmac_drbg_context *ctx,
|
||||
int resistance );
|
||||
|
||||
/**
|
||||
* \brief Set the amount of entropy grabbed on each reseed
|
||||
* (Default: given by the security strength, which
|
||||
* depends on the hash used, see \c mbedtls_hmac_drbg_init() )
|
||||
* \brief This function sets the amount of entropy grabbed on each
|
||||
* seed or reseed.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param len Amount of entropy to grab, in bytes
|
||||
* See the documentation of mbedtls_hmac_drbg_seed() for the default value.
|
||||
*
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param len The amount of entropy to grab, in bytes.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_set_entropy_len( mbedtls_hmac_drbg_context *ctx,
|
||||
size_t len );
|
||||
|
||||
/**
|
||||
* \brief Set the reseed interval
|
||||
* (Default: MBEDTLS_HMAC_DRBG_RESEED_INTERVAL)
|
||||
* \brief Set the reseed interval.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param interval Reseed interval
|
||||
* The reseed interval is the number of calls to mbedtls_hmac_drbg_random()
|
||||
* or mbedtls_hmac_drbg_random_with_add() after which the entropy function
|
||||
* is called again.
|
||||
*
|
||||
* The default value is #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL.
|
||||
*
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param interval The reseed interval.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_set_reseed_interval( mbedtls_hmac_drbg_context *ctx,
|
||||
int interval );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG update state
|
||||
* \brief This function updates the state of the HMAC_DRBG context.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param additional Additional data to update state with, or NULL
|
||||
* \param add_len Length of additional data, or 0
|
||||
* \note This function is not thread-safe. It is not safe
|
||||
* to call this function if another thread might be
|
||||
* concurrently obtaining random numbers from the same
|
||||
* context or updating or reseeding the same context.
|
||||
*
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param additional The data to update the state with.
|
||||
* If this is \c NULL, there is no additional data.
|
||||
* \param add_len Length of \p additional in bytes.
|
||||
* Unused if \p additional is \c NULL.
|
||||
*
|
||||
* \return \c 0 on success, or an error from the underlying
|
||||
* hash calculation.
|
||||
*
|
||||
* \note Additional data is optional, pass NULL and 0 as second
|
||||
* third argument if no additional data is being used.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_update_ret( mbedtls_hmac_drbg_context *ctx,
|
||||
const unsigned char *additional, size_t add_len );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG reseeding (extracts data from entropy source)
|
||||
* \brief This function reseeds the HMAC_DRBG context, that is
|
||||
* extracts data from the entropy source.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param additional Additional data to add to state (Can be NULL)
|
||||
* \param len Length of additional data
|
||||
* \note This function is not thread-safe. It is not safe
|
||||
* to call this function if another thread might be
|
||||
* concurrently obtaining random numbers from the same
|
||||
* context or updating or reseeding the same context.
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param additional Additional data to add to the state.
|
||||
* If this is \c NULL, there is no additional data
|
||||
* and \p len should be \c 0.
|
||||
* \param len The length of the additional data.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT
|
||||
* and also at most
|
||||
* #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len
|
||||
* where \p entropy_len is the entropy length
|
||||
* (see mbedtls_hmac_drbg_set_entropy_len()).
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* if a call to the entropy function failed.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_reseed( mbedtls_hmac_drbg_context *ctx,
|
||||
const unsigned char *additional, size_t len );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG generate random with additional update input
|
||||
* \brief This function updates an HMAC_DRBG instance with additional
|
||||
* data and uses it to generate random data.
|
||||
*
|
||||
* Note: Automatically reseeds if reseed_counter is reached or PR is enabled.
|
||||
* This function automatically reseeds if the reseed counter is exceeded
|
||||
* or prediction resistance is enabled.
|
||||
*
|
||||
* \param p_rng HMAC_DRBG context
|
||||
* \param output Buffer to fill
|
||||
* \param output_len Length of the buffer
|
||||
* \param additional Additional data to update with (can be NULL)
|
||||
* \param add_len Length of additional data (can be 0)
|
||||
* \note This function is not thread-safe. It is not safe
|
||||
* to call this function if another thread might be
|
||||
* concurrently obtaining random numbers from the same
|
||||
* context or updating or reseeding the same context.
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG.
|
||||
* \param p_rng The HMAC_DRBG context. This must be a pointer to a
|
||||
* #mbedtls_hmac_drbg_context structure.
|
||||
* \param output The buffer to fill.
|
||||
* \param output_len The length of the buffer in bytes.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST.
|
||||
* \param additional Additional data to update with.
|
||||
* If this is \c NULL, there is no additional data
|
||||
* and \p add_len should be \c 0.
|
||||
* \param add_len The length of the additional data.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* if a call to the entropy source failed.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if
|
||||
* \p output_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if
|
||||
* \p add_len > #MBEDTLS_HMAC_DRBG_MAX_INPUT.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_random_with_add( void *p_rng,
|
||||
unsigned char *output, size_t output_len,
|
||||
@ -245,24 +365,39 @@ int mbedtls_hmac_drbg_random_with_add( void *p_rng,
|
||||
size_t add_len );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG generate random
|
||||
* \brief This function uses HMAC_DRBG to generate random data.
|
||||
*
|
||||
* Note: Automatically reseeds if reseed_counter is reached or PR is enabled.
|
||||
* This function automatically reseeds if the reseed counter is exceeded
|
||||
* or prediction resistance is enabled.
|
||||
*/
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
/**
|
||||
* \note When Mbed TLS is built with threading support,
|
||||
* it is safe to call mbedtls_ctr_drbg_random()
|
||||
* from multiple threads. Other operations, including
|
||||
* reseeding, are not thread-safe.
|
||||
*/
|
||||
#endif /* MBEDTLS_THREADING_C */
|
||||
/**
|
||||
* \param p_rng The HMAC_DRBG context. This must be a pointer to a
|
||||
* #mbedtls_hmac_drbg_context structure.
|
||||
* \param output The buffer to fill.
|
||||
* \param out_len The length of the buffer in bytes.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST.
|
||||
*
|
||||
* \param p_rng HMAC_DRBG context
|
||||
* \param output Buffer to fill
|
||||
* \param out_len Length of the buffer
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* if a call to the entropy source failed.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if
|
||||
* \p out_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_random( void *p_rng, unsigned char *output, size_t out_len );
|
||||
|
||||
/**
|
||||
* \brief Free an HMAC_DRBG context
|
||||
* \brief This function resets HMAC_DRBG context to the state immediately
|
||||
* after initial call of mbedtls_hmac_drbg_init().
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to free.
|
||||
* \param ctx The HMAC_DRBG context to free.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_free( mbedtls_hmac_drbg_context *ctx );
|
||||
|
||||
@ -273,17 +408,16 @@ void mbedtls_hmac_drbg_free( mbedtls_hmac_drbg_context *ctx );
|
||||
#define MBEDTLS_DEPRECATED
|
||||
#endif
|
||||
/**
|
||||
* \brief HMAC_DRBG update state
|
||||
* \brief This function updates the state of the HMAC_DRBG context.
|
||||
*
|
||||
* \deprecated Superseded by mbedtls_hmac_drbg_update_ret()
|
||||
* in 2.16.0.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param additional Additional data to update state with, or NULL
|
||||
* \param add_len Length of additional data, or 0
|
||||
*
|
||||
* \note Additional data is optional, pass NULL and 0 as second
|
||||
* third argument if no additional data is being used.
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param additional The data to update the state with.
|
||||
* If this is \c NULL, there is no additional data.
|
||||
* \param add_len Length of \p additional in bytes.
|
||||
* Unused if \p additional is \c NULL.
|
||||
*/
|
||||
MBEDTLS_DEPRECATED void mbedtls_hmac_drbg_update(
|
||||
mbedtls_hmac_drbg_context *ctx,
|
||||
@ -293,26 +427,31 @@ MBEDTLS_DEPRECATED void mbedtls_hmac_drbg_update(
|
||||
|
||||
#if defined(MBEDTLS_FS_IO)
|
||||
/**
|
||||
* \brief Write a seed file
|
||||
* \brief This function writes a seed file.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param path Name of the file
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param path The name of the file.
|
||||
*
|
||||
* \return 0 if successful, 1 on file error, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on reseed
|
||||
* failure.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_write_seed_file( mbedtls_hmac_drbg_context *ctx, const char *path );
|
||||
|
||||
/**
|
||||
* \brief Read and update a seed file. Seed is added to this
|
||||
* instance
|
||||
* \brief This function reads and updates a seed file. The seed
|
||||
* is added to this instance.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param path Name of the file
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param path The name of the file.
|
||||
*
|
||||
* \return 0 if successful, 1 on file error,
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on
|
||||
* reseed failure.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if the existing
|
||||
* seed file is too large.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_update_seed_file( mbedtls_hmac_drbg_context *ctx, const char *path );
|
||||
#endif /* MBEDTLS_FS_IO */
|
||||
@ -320,9 +459,10 @@ int mbedtls_hmac_drbg_update_seed_file( mbedtls_hmac_drbg_context *ctx, const ch
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
/**
|
||||
* \brief Checkup routine
|
||||
* \brief The HMAC_DRBG Checkup routine.
|
||||
*
|
||||
* \return 0 if successful, or 1 if the test failed
|
||||
* \return \c 0 if successful.
|
||||
* \return \c 1 if the test failed.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_self_test( int verbose );
|
||||
#endif
|
||||
|
43
Externals/mbedtls/include/mbedtls/md.h
vendored
43
Externals/mbedtls/include/mbedtls/md.h
vendored
@ -6,7 +6,7 @@
|
||||
* \author Adriaan de Jong <dejong@fox-it.com>
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -20,8 +20,6 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_MD_H
|
||||
@ -30,18 +28,24 @@
|
||||
#include <stddef.h>
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#define MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE -0x5080 /**< The selected feature is not available. */
|
||||
#define MBEDTLS_ERR_MD_BAD_INPUT_DATA -0x5100 /**< Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_MD_ALLOC_FAILED -0x5180 /**< Failed to allocate memory. */
|
||||
#define MBEDTLS_ERR_MD_FILE_IO_ERROR -0x5200 /**< Opening or reading of file failed. */
|
||||
/** The selected feature is not available. */
|
||||
#define MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE -0x5080
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_MD_BAD_INPUT_DATA -0x5100
|
||||
/** Failed to allocate memory. */
|
||||
#define MBEDTLS_ERR_MD_ALLOC_FAILED -0x5180
|
||||
/** Opening or reading of file failed. */
|
||||
#define MBEDTLS_ERR_MD_FILE_IO_ERROR -0x5200
|
||||
|
||||
/* MBEDTLS_ERR_MD_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_MD_HW_ACCEL_FAILED -0x5280 /**< MD hardware accelerator failed. */
|
||||
/** MD hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_MD_HW_ACCEL_FAILED -0x5280
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -74,6 +78,12 @@ typedef enum {
|
||||
#define MBEDTLS_MD_MAX_SIZE 32 /* longest known is SHA256 or less */
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SHA512_C)
|
||||
#define MBEDTLS_MD_MAX_BLOCK_SIZE 128
|
||||
#else
|
||||
#define MBEDTLS_MD_MAX_BLOCK_SIZE 64
|
||||
#endif
|
||||
|
||||
/**
|
||||
* Opaque struct defined in md_internal.h.
|
||||
*/
|
||||
@ -98,6 +108,8 @@ typedef struct mbedtls_md_context_t
|
||||
* \brief This function returns the list of digests supported by the
|
||||
* generic digest module.
|
||||
*
|
||||
* \note The list starts with the strongest available hashes.
|
||||
*
|
||||
* \return A statically allocated array of digests. Each element
|
||||
* in the returned list is an integer belonging to the
|
||||
* message-digest enumeration #mbedtls_md_type_t.
|
||||
@ -199,6 +211,7 @@ int mbedtls_md_init_ctx( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_
|
||||
* failure.
|
||||
* \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_setup( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_info, int hmac );
|
||||
|
||||
/**
|
||||
@ -220,6 +233,7 @@ int mbedtls_md_setup( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_inf
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_clone( mbedtls_md_context_t *dst,
|
||||
const mbedtls_md_context_t *src );
|
||||
|
||||
@ -269,6 +283,7 @@ const char *mbedtls_md_get_name( const mbedtls_md_info_t *md_info );
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification
|
||||
* failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_starts( mbedtls_md_context_t *ctx );
|
||||
|
||||
/**
|
||||
@ -287,6 +302,7 @@ int mbedtls_md_starts( mbedtls_md_context_t *ctx );
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification
|
||||
* failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_update( mbedtls_md_context_t *ctx, const unsigned char *input, size_t ilen );
|
||||
|
||||
/**
|
||||
@ -307,6 +323,7 @@ int mbedtls_md_update( mbedtls_md_context_t *ctx, const unsigned char *input, si
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification
|
||||
* failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_finish( mbedtls_md_context_t *ctx, unsigned char *output );
|
||||
|
||||
/**
|
||||
@ -327,6 +344,7 @@ int mbedtls_md_finish( mbedtls_md_context_t *ctx, unsigned char *output );
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification
|
||||
* failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md( const mbedtls_md_info_t *md_info, const unsigned char *input, size_t ilen,
|
||||
unsigned char *output );
|
||||
|
||||
@ -348,6 +366,7 @@ int mbedtls_md( const mbedtls_md_info_t *md_info, const unsigned char *input, si
|
||||
* the file pointed by \p path.
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info was NULL.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_file( const mbedtls_md_info_t *md_info, const char *path,
|
||||
unsigned char *output );
|
||||
#endif /* MBEDTLS_FS_IO */
|
||||
@ -370,6 +389,7 @@ int mbedtls_md_file( const mbedtls_md_info_t *md_info, const char *path,
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification
|
||||
* failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_hmac_starts( mbedtls_md_context_t *ctx, const unsigned char *key,
|
||||
size_t keylen );
|
||||
|
||||
@ -392,6 +412,7 @@ int mbedtls_md_hmac_starts( mbedtls_md_context_t *ctx, const unsigned char *key,
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification
|
||||
* failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_hmac_update( mbedtls_md_context_t *ctx, const unsigned char *input,
|
||||
size_t ilen );
|
||||
|
||||
@ -413,6 +434,7 @@ int mbedtls_md_hmac_update( mbedtls_md_context_t *ctx, const unsigned char *inpu
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification
|
||||
* failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_hmac_finish( mbedtls_md_context_t *ctx, unsigned char *output);
|
||||
|
||||
/**
|
||||
@ -430,6 +452,7 @@ int mbedtls_md_hmac_finish( mbedtls_md_context_t *ctx, unsigned char *output);
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification
|
||||
* failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_hmac_reset( mbedtls_md_context_t *ctx );
|
||||
|
||||
/**
|
||||
@ -454,11 +477,13 @@ int mbedtls_md_hmac_reset( mbedtls_md_context_t *ctx );
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification
|
||||
* failure.
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_hmac( const mbedtls_md_info_t *md_info, const unsigned char *key, size_t keylen,
|
||||
const unsigned char *input, size_t ilen,
|
||||
unsigned char *output );
|
||||
|
||||
/* Internal use */
|
||||
MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
int mbedtls_md_process( mbedtls_md_context_t *ctx, const unsigned char *data );
|
||||
|
||||
#ifdef __cplusplus
|
||||
|
9
Externals/mbedtls/include/mbedtls/md2.h
vendored
9
Externals/mbedtls/include/mbedtls/md2.h
vendored
@ -8,7 +8,7 @@
|
||||
* instead.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -23,14 +23,12 @@
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*
|
||||
*/
|
||||
#ifndef MBEDTLS_MD2_H
|
||||
#define MBEDTLS_MD2_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -38,7 +36,8 @@
|
||||
#include <stddef.h>
|
||||
|
||||
/* MBEDTLS_ERR_MD2_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_MD2_HW_ACCEL_FAILED -0x002B /**< MD2 hardware accelerator failed */
|
||||
/** MD2 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_MD2_HW_ACCEL_FAILED -0x002B
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
9
Externals/mbedtls/include/mbedtls/md4.h
vendored
9
Externals/mbedtls/include/mbedtls/md4.h
vendored
@ -8,7 +8,7 @@
|
||||
* instead.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -23,14 +23,12 @@
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*
|
||||
*/
|
||||
#ifndef MBEDTLS_MD4_H
|
||||
#define MBEDTLS_MD4_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -39,7 +37,8 @@
|
||||
#include <stdint.h>
|
||||
|
||||
/* MBEDTLS_ERR_MD4_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_MD4_HW_ACCEL_FAILED -0x002D /**< MD4 hardware accelerator failed */
|
||||
/** MD4 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_MD4_HW_ACCEL_FAILED -0x002D
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
9
Externals/mbedtls/include/mbedtls/md5.h
vendored
9
Externals/mbedtls/include/mbedtls/md5.h
vendored
@ -8,7 +8,7 @@
|
||||
* digests instead.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -22,14 +22,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_MD5_H
|
||||
#define MBEDTLS_MD5_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -38,7 +36,8 @@
|
||||
#include <stdint.h>
|
||||
|
||||
/* MBEDTLS_ERR_MD5_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_MD5_HW_ACCEL_FAILED -0x002F /**< MD5 hardware accelerator failed */
|
||||
/** MD5 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_MD5_HW_ACCEL_FAILED -0x002F
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
45
Externals/mbedtls/include/mbedtls/md_internal.h
vendored
45
Externals/mbedtls/include/mbedtls/md_internal.h
vendored
@ -8,7 +8,7 @@
|
||||
* \author Adriaan de Jong <dejong@fox-it.com>
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -22,19 +22,17 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_MD_WRAP_H
|
||||
#define MBEDTLS_MD_WRAP_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "md.h"
|
||||
#include "mbedtls/md.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -46,42 +44,17 @@ extern "C" {
|
||||
*/
|
||||
struct mbedtls_md_info_t
|
||||
{
|
||||
/** Digest identifier */
|
||||
mbedtls_md_type_t type;
|
||||
|
||||
/** Name of the message digest */
|
||||
const char * name;
|
||||
|
||||
/** Digest identifier */
|
||||
mbedtls_md_type_t type;
|
||||
|
||||
/** Output length of the digest function in bytes */
|
||||
int size;
|
||||
unsigned char size;
|
||||
|
||||
/** Block length of the digest function in bytes */
|
||||
int block_size;
|
||||
|
||||
/** Digest initialisation function */
|
||||
int (*starts_func)( void *ctx );
|
||||
|
||||
/** Digest update function */
|
||||
int (*update_func)( void *ctx, const unsigned char *input, size_t ilen );
|
||||
|
||||
/** Digest finalisation function */
|
||||
int (*finish_func)( void *ctx, unsigned char *output );
|
||||
|
||||
/** Generic digest function */
|
||||
int (*digest_func)( const unsigned char *input, size_t ilen,
|
||||
unsigned char *output );
|
||||
|
||||
/** Allocate a new context */
|
||||
void * (*ctx_alloc_func)( void );
|
||||
|
||||
/** Free the given context */
|
||||
void (*ctx_free_func)( void *ctx );
|
||||
|
||||
/** Clone state from a context */
|
||||
void (*clone_func)( void *dst, const void *src );
|
||||
|
||||
/** Internal use only */
|
||||
int (*process_func)( void *ctx, const unsigned char *input );
|
||||
unsigned char block_size;
|
||||
};
|
||||
|
||||
#if defined(MBEDTLS_MD2_C)
|
||||
@ -104,7 +77,9 @@ extern const mbedtls_md_info_t mbedtls_sha224_info;
|
||||
extern const mbedtls_md_info_t mbedtls_sha256_info;
|
||||
#endif
|
||||
#if defined(MBEDTLS_SHA512_C)
|
||||
#if !defined(MBEDTLS_SHA512_NO_SHA384)
|
||||
extern const mbedtls_md_info_t mbedtls_sha384_info;
|
||||
#endif
|
||||
extern const mbedtls_md_info_t mbedtls_sha512_info;
|
||||
#endif
|
||||
|
||||
|
@ -4,7 +4,7 @@
|
||||
* \brief Buffer-based memory allocator
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_MEMORY_BUFFER_ALLOC_H
|
||||
#define MBEDTLS_MEMORY_BUFFER_ALLOC_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
8
Externals/mbedtls/include/mbedtls/net.h
vendored
8
Externals/mbedtls/include/mbedtls/net.h
vendored
@ -6,7 +6,7 @@
|
||||
* \deprecated Superseded by mbedtls/net_sockets.h
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -20,17 +20,15 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#include "net_sockets.h"
|
||||
#include "mbedtls/net_sockets.h"
|
||||
#if defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#warning "Deprecated header file: Superseded by mbedtls/net_sockets.h"
|
||||
#endif /* MBEDTLS_DEPRECATED_WARNING */
|
||||
|
72
Externals/mbedtls/include/mbedtls/net_sockets.h
vendored
72
Externals/mbedtls/include/mbedtls/net_sockets.h
vendored
@ -20,7 +20,7 @@
|
||||
*
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -34,36 +34,47 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_NET_SOCKETS_H
|
||||
#define MBEDTLS_NET_SOCKETS_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ssl.h"
|
||||
#include "mbedtls/ssl.h"
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#define MBEDTLS_ERR_NET_SOCKET_FAILED -0x0042 /**< Failed to open a socket. */
|
||||
#define MBEDTLS_ERR_NET_CONNECT_FAILED -0x0044 /**< The connection to the given server / port failed. */
|
||||
#define MBEDTLS_ERR_NET_BIND_FAILED -0x0046 /**< Binding of the socket failed. */
|
||||
#define MBEDTLS_ERR_NET_LISTEN_FAILED -0x0048 /**< Could not listen on the socket. */
|
||||
#define MBEDTLS_ERR_NET_ACCEPT_FAILED -0x004A /**< Could not accept the incoming connection. */
|
||||
#define MBEDTLS_ERR_NET_RECV_FAILED -0x004C /**< Reading information from the socket failed. */
|
||||
#define MBEDTLS_ERR_NET_SEND_FAILED -0x004E /**< Sending information through the socket failed. */
|
||||
#define MBEDTLS_ERR_NET_CONN_RESET -0x0050 /**< Connection was reset by peer. */
|
||||
#define MBEDTLS_ERR_NET_UNKNOWN_HOST -0x0052 /**< Failed to get an IP address for the given hostname. */
|
||||
#define MBEDTLS_ERR_NET_BUFFER_TOO_SMALL -0x0043 /**< Buffer is too small to hold the data. */
|
||||
#define MBEDTLS_ERR_NET_INVALID_CONTEXT -0x0045 /**< The context is invalid, eg because it was free()ed. */
|
||||
#define MBEDTLS_ERR_NET_POLL_FAILED -0x0047 /**< Polling the net context failed. */
|
||||
#define MBEDTLS_ERR_NET_BAD_INPUT_DATA -0x0049 /**< Input invalid. */
|
||||
/** Failed to open a socket. */
|
||||
#define MBEDTLS_ERR_NET_SOCKET_FAILED -0x0042
|
||||
/** The connection to the given server / port failed. */
|
||||
#define MBEDTLS_ERR_NET_CONNECT_FAILED -0x0044
|
||||
/** Binding of the socket failed. */
|
||||
#define MBEDTLS_ERR_NET_BIND_FAILED -0x0046
|
||||
/** Could not listen on the socket. */
|
||||
#define MBEDTLS_ERR_NET_LISTEN_FAILED -0x0048
|
||||
/** Could not accept the incoming connection. */
|
||||
#define MBEDTLS_ERR_NET_ACCEPT_FAILED -0x004A
|
||||
/** Reading information from the socket failed. */
|
||||
#define MBEDTLS_ERR_NET_RECV_FAILED -0x004C
|
||||
/** Sending information through the socket failed. */
|
||||
#define MBEDTLS_ERR_NET_SEND_FAILED -0x004E
|
||||
/** Connection was reset by peer. */
|
||||
#define MBEDTLS_ERR_NET_CONN_RESET -0x0050
|
||||
/** Failed to get an IP address for the given hostname. */
|
||||
#define MBEDTLS_ERR_NET_UNKNOWN_HOST -0x0052
|
||||
/** Buffer is too small to hold the data. */
|
||||
#define MBEDTLS_ERR_NET_BUFFER_TOO_SMALL -0x0043
|
||||
/** The context is invalid, eg because it was free()ed. */
|
||||
#define MBEDTLS_ERR_NET_INVALID_CONTEXT -0x0045
|
||||
/** Polling the net context failed. */
|
||||
#define MBEDTLS_ERR_NET_POLL_FAILED -0x0047
|
||||
/** Input invalid. */
|
||||
#define MBEDTLS_ERR_NET_BAD_INPUT_DATA -0x0049
|
||||
|
||||
#define MBEDTLS_NET_LISTEN_BACKLOG 10 /**< The backlog that listen() should use. */
|
||||
|
||||
@ -126,6 +137,7 @@ int mbedtls_net_connect( mbedtls_net_context *ctx, const char *host, const char
|
||||
*
|
||||
* \return 0 if successful, or one of:
|
||||
* MBEDTLS_ERR_NET_SOCKET_FAILED,
|
||||
* MBEDTLS_ERR_NET_UNKNOWN_HOST,
|
||||
* MBEDTLS_ERR_NET_BIND_FAILED,
|
||||
* MBEDTLS_ERR_NET_LISTEN_FAILED
|
||||
*
|
||||
@ -145,6 +157,8 @@ int mbedtls_net_bind( mbedtls_net_context *ctx, const char *bind_ip, const char
|
||||
* can be NULL if client_ip is null
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_NET_SOCKET_FAILED,
|
||||
* MBEDTLS_ERR_NET_BIND_FAILED,
|
||||
* MBEDTLS_ERR_NET_ACCEPT_FAILED, or
|
||||
* MBEDTLS_ERR_NET_BUFFER_TOO_SMALL if buf_size is too small,
|
||||
* MBEDTLS_ERR_SSL_WANT_READ if bind_fd was set to
|
||||
@ -157,6 +171,10 @@ int mbedtls_net_accept( mbedtls_net_context *bind_ctx,
|
||||
/**
|
||||
* \brief Check and wait for the context to be ready for read/write
|
||||
*
|
||||
* \note The current implementation of this function uses
|
||||
* select() and returns an error if the file descriptor
|
||||
* is \c FD_SETSIZE or greater.
|
||||
*
|
||||
* \param ctx Socket to check
|
||||
* \param rw Bitflag composed of MBEDTLS_NET_POLL_READ and
|
||||
* MBEDTLS_NET_POLL_WRITE specifying the events
|
||||
@ -238,16 +256,21 @@ int mbedtls_net_send( void *ctx, const unsigned char *buf, size_t len );
|
||||
* 'timeout' seconds. If no error occurs, the actual amount
|
||||
* read is returned.
|
||||
*
|
||||
* \note The current implementation of this function uses
|
||||
* select() and returns an error if the file descriptor
|
||||
* is \c FD_SETSIZE or greater.
|
||||
*
|
||||
* \param ctx Socket
|
||||
* \param buf The buffer to write to
|
||||
* \param len Maximum length of the buffer
|
||||
* \param timeout Maximum number of milliseconds to wait for data
|
||||
* 0 means no timeout (wait forever)
|
||||
*
|
||||
* \return the number of bytes received,
|
||||
* or a non-zero error code:
|
||||
* MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out,
|
||||
* \return The number of bytes received if successful.
|
||||
* MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out.
|
||||
* MBEDTLS_ERR_SSL_WANT_READ if interrupted by a signal.
|
||||
* Another negative error code (MBEDTLS_ERR_NET_xxx)
|
||||
* for other failures.
|
||||
*
|
||||
* \note This function will block (until data becomes available or
|
||||
* timeout is reached) even if the socket is set to
|
||||
@ -257,6 +280,13 @@ int mbedtls_net_send( void *ctx, const unsigned char *buf, size_t len );
|
||||
int mbedtls_net_recv_timeout( void *ctx, unsigned char *buf, size_t len,
|
||||
uint32_t timeout );
|
||||
|
||||
/**
|
||||
* \brief Closes down the connection and free associated data
|
||||
*
|
||||
* \param ctx The context to close
|
||||
*/
|
||||
void mbedtls_net_close( mbedtls_net_context *ctx );
|
||||
|
||||
/**
|
||||
* \brief Gracefully shutdown the connection and free associated data
|
||||
*
|
||||
|
8
Externals/mbedtls/include/mbedtls/nist_kw.h
vendored
8
Externals/mbedtls/include/mbedtls/nist_kw.h
vendored
@ -16,7 +16,7 @@
|
||||
*
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -30,20 +30,18 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_NIST_KW_H
|
||||
#define MBEDTLS_NIST_KW_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "cipher.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
76
Externals/mbedtls/include/mbedtls/oid.h
vendored
76
Externals/mbedtls/include/mbedtls/oid.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Object Identifier (OID) database
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,37 +18,55 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_OID_H
|
||||
#define MBEDTLS_OID_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "asn1.h"
|
||||
#include "pk.h"
|
||||
#include "mbedtls/asn1.h"
|
||||
#include "mbedtls/pk.h"
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_C)
|
||||
#include "cipher.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_MD_C)
|
||||
#include "md.h"
|
||||
#include "mbedtls/md.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)
|
||||
#include "x509.h"
|
||||
#endif
|
||||
/** OID is not found. */
|
||||
#define MBEDTLS_ERR_OID_NOT_FOUND -0x002E
|
||||
/** output buffer is too small */
|
||||
#define MBEDTLS_ERR_OID_BUF_TOO_SMALL -0x000B
|
||||
|
||||
#define MBEDTLS_ERR_OID_NOT_FOUND -0x002E /**< OID is not found. */
|
||||
#define MBEDTLS_ERR_OID_BUF_TOO_SMALL -0x000B /**< output buffer is too small */
|
||||
/* This is for the benefit of X.509, but defined here in order to avoid
|
||||
* having a "backwards" include of x.509.h here */
|
||||
/*
|
||||
* X.509 extension types (internal, arbitrary values for bitsets)
|
||||
*/
|
||||
#define MBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER (1 << 0)
|
||||
#define MBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER (1 << 1)
|
||||
#define MBEDTLS_OID_X509_EXT_KEY_USAGE (1 << 2)
|
||||
#define MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES (1 << 3)
|
||||
#define MBEDTLS_OID_X509_EXT_POLICY_MAPPINGS (1 << 4)
|
||||
#define MBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME (1 << 5)
|
||||
#define MBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME (1 << 6)
|
||||
#define MBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS (1 << 7)
|
||||
#define MBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS (1 << 8)
|
||||
#define MBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS (1 << 9)
|
||||
#define MBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS (1 << 10)
|
||||
#define MBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE (1 << 11)
|
||||
#define MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS (1 << 12)
|
||||
#define MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY (1 << 13)
|
||||
#define MBEDTLS_OID_X509_EXT_FRESHEST_CRL (1 << 14)
|
||||
#define MBEDTLS_OID_X509_EXT_NS_CERT_TYPE (1 << 16)
|
||||
|
||||
/*
|
||||
* Top level OID tuples
|
||||
@ -104,7 +122,8 @@
|
||||
* { iso(1) identified-organization(3) dod(6) internet(1)
|
||||
* security(5) mechanisms(5) pkix(7) }
|
||||
*/
|
||||
#define MBEDTLS_OID_PKIX MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ORG_DOD "\x01\x05\x05\x07"
|
||||
#define MBEDTLS_OID_INTERNET MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ORG_DOD "\x01"
|
||||
#define MBEDTLS_OID_PKIX MBEDTLS_OID_INTERNET "\x05\x05\x07"
|
||||
|
||||
/*
|
||||
* Arc for standard naming attributes
|
||||
@ -149,6 +168,11 @@
|
||||
#define MBEDTLS_OID_INIHIBIT_ANYPOLICY MBEDTLS_OID_ID_CE "\x36" /**< id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::= { id-ce 54 } */
|
||||
#define MBEDTLS_OID_FRESHEST_CRL MBEDTLS_OID_ID_CE "\x2E" /**< id-ce-freshestCRL OBJECT IDENTIFIER ::= { id-ce 46 } */
|
||||
|
||||
/*
|
||||
* Certificate policies
|
||||
*/
|
||||
#define MBEDTLS_OID_ANY_POLICY MBEDTLS_OID_CERTIFICATE_POLICIES "\x00" /**< anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificatePolicies 0 } */
|
||||
|
||||
/*
|
||||
* Netscape certificate extensions
|
||||
*/
|
||||
@ -183,6 +207,16 @@
|
||||
#define MBEDTLS_OID_TIME_STAMPING MBEDTLS_OID_KP "\x08" /**< id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 } */
|
||||
#define MBEDTLS_OID_OCSP_SIGNING MBEDTLS_OID_KP "\x09" /**< id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 } */
|
||||
|
||||
/**
|
||||
* Wi-SUN Alliance Field Area Network
|
||||
* { iso(1) identified-organization(3) dod(6) internet(1)
|
||||
* private(4) enterprise(1) WiSUN(45605) FieldAreaNetwork(1) }
|
||||
*/
|
||||
#define MBEDTLS_OID_WISUN_FAN MBEDTLS_OID_INTERNET "\x04\x01\x82\xe4\x25\x01"
|
||||
|
||||
#define MBEDTLS_OID_ON MBEDTLS_OID_PKIX "\x08" /**< id-on OBJECT IDENTIFIER ::= { id-pkix 8 } */
|
||||
#define MBEDTLS_OID_ON_HW_MODULE_NAME MBEDTLS_OID_ON "\x04" /**< id-on-hardwareModuleName OBJECT IDENTIFIER ::= { id-on 4 } */
|
||||
|
||||
/*
|
||||
* PKCS definition OIDs
|
||||
*/
|
||||
@ -228,6 +262,8 @@
|
||||
|
||||
#define MBEDTLS_OID_DIGEST_ALG_SHA512 MBEDTLS_OID_NIST_ALG "\x02\x03" /**< id-mbedtls_sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3 } */
|
||||
|
||||
#define MBEDTLS_OID_DIGEST_ALG_RIPEMD160 MBEDTLS_OID_TELETRUST "\x03\x02\x01" /**< id-ripemd160 OBJECT IDENTIFIER :: { iso(1) identified-organization(3) teletrust(36) algorithm(3) hashAlgorithm(2) ripemd160(1) } */
|
||||
|
||||
#define MBEDTLS_OID_HMAC_SHA1 MBEDTLS_OID_RSA_COMPANY "\x02\x07" /**< id-hmacWithSHA1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 7 } */
|
||||
|
||||
#define MBEDTLS_OID_HMAC_SHA224 MBEDTLS_OID_RSA_COMPANY "\x02\x08" /**< id-hmacWithSHA224 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 8 } */
|
||||
@ -424,7 +460,6 @@ typedef struct mbedtls_oid_descriptor_t
|
||||
*/
|
||||
int mbedtls_oid_get_numeric_string( char *buf, size_t size, const mbedtls_asn1_buf *oid );
|
||||
|
||||
#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)
|
||||
/**
|
||||
* \brief Translate an X.509 extension OID into local values
|
||||
*
|
||||
@ -434,7 +469,6 @@ int mbedtls_oid_get_numeric_string( char *buf, size_t size, const mbedtls_asn1_b
|
||||
* \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND
|
||||
*/
|
||||
int mbedtls_oid_get_x509_ext_type( const mbedtls_asn1_buf *oid, int *ext_type );
|
||||
#endif
|
||||
|
||||
/**
|
||||
* \brief Translate an X.509 attribute type OID into the short name
|
||||
@ -560,6 +594,16 @@ int mbedtls_oid_get_md_hmac( const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_
|
||||
*/
|
||||
int mbedtls_oid_get_extended_key_usage( const mbedtls_asn1_buf *oid, const char **desc );
|
||||
|
||||
/**
|
||||
* \brief Translate certificate policies OID into description
|
||||
*
|
||||
* \param oid OID to use
|
||||
* \param desc place to store string pointer
|
||||
*
|
||||
* \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND
|
||||
*/
|
||||
int mbedtls_oid_get_certificate_policies( const mbedtls_asn1_buf *oid, const char **desc );
|
||||
|
||||
/**
|
||||
* \brief Translate md_type into hash algorithm OID
|
||||
*
|
||||
|
15
Externals/mbedtls/include/mbedtls/padlock.h
vendored
15
Externals/mbedtls/include/mbedtls/padlock.h
vendored
@ -8,7 +8,7 @@
|
||||
* functions; you must not call them directly.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -22,21 +22,20 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_PADLOCK_H
|
||||
#define MBEDTLS_PADLOCK_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "aes.h"
|
||||
#include "mbedtls/aes.h"
|
||||
|
||||
#define MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED -0x0030 /**< Input data should be aligned. */
|
||||
/** Input data should be aligned. */
|
||||
#define MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED -0x0030
|
||||
|
||||
#if defined(__has_feature)
|
||||
#if __has_feature(address_sanitizer)
|
||||
@ -59,7 +58,7 @@
|
||||
#define MBEDTLS_PADLOCK_PHE 0x0C00
|
||||
#define MBEDTLS_PADLOCK_PMM 0x3000
|
||||
|
||||
#define MBEDTLS_PADLOCK_ALIGN16(x) (uint32_t *) (16 + ((int32_t) x & ~15))
|
||||
#define MBEDTLS_PADLOCK_ALIGN16(x) (uint32_t *) (16 + ((int32_t) (x) & ~15))
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -73,7 +72,7 @@ extern "C" {
|
||||
*
|
||||
* \param feature The feature to detect
|
||||
*
|
||||
* \return 1 if CPU has support for the feature, 0 otherwise
|
||||
* \return non-zero if CPU has support for the feature, 0 otherwise
|
||||
*/
|
||||
int mbedtls_padlock_has_support( int feature );
|
||||
|
||||
|
63
Externals/mbedtls/include/mbedtls/pem.h
vendored
63
Externals/mbedtls/include/mbedtls/pem.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Privacy Enhanced Mail (PEM) decoding
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_PEM_H
|
||||
#define MBEDTLS_PEM_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -38,15 +36,24 @@
|
||||
* PEM data.
|
||||
* \{
|
||||
*/
|
||||
#define MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT -0x1080 /**< No PEM header or footer found. */
|
||||
#define MBEDTLS_ERR_PEM_INVALID_DATA -0x1100 /**< PEM string is not as expected. */
|
||||
#define MBEDTLS_ERR_PEM_ALLOC_FAILED -0x1180 /**< Failed to allocate memory. */
|
||||
#define MBEDTLS_ERR_PEM_INVALID_ENC_IV -0x1200 /**< RSA IV is not in hex-format. */
|
||||
#define MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG -0x1280 /**< Unsupported key encryption algorithm. */
|
||||
#define MBEDTLS_ERR_PEM_PASSWORD_REQUIRED -0x1300 /**< Private key password can't be empty. */
|
||||
#define MBEDTLS_ERR_PEM_PASSWORD_MISMATCH -0x1380 /**< Given private key password does not allow for correct decryption. */
|
||||
#define MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE -0x1400 /**< Unavailable feature, e.g. hashing/encryption combination. */
|
||||
#define MBEDTLS_ERR_PEM_BAD_INPUT_DATA -0x1480 /**< Bad input parameters to function. */
|
||||
/** No PEM header or footer found. */
|
||||
#define MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT -0x1080
|
||||
/** PEM string is not as expected. */
|
||||
#define MBEDTLS_ERR_PEM_INVALID_DATA -0x1100
|
||||
/** Failed to allocate memory. */
|
||||
#define MBEDTLS_ERR_PEM_ALLOC_FAILED -0x1180
|
||||
/** RSA IV is not in hex-format. */
|
||||
#define MBEDTLS_ERR_PEM_INVALID_ENC_IV -0x1200
|
||||
/** Unsupported key encryption algorithm. */
|
||||
#define MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG -0x1280
|
||||
/** Private key password can't be empty. */
|
||||
#define MBEDTLS_ERR_PEM_PASSWORD_REQUIRED -0x1300
|
||||
/** Given private key password does not allow for correct decryption. */
|
||||
#define MBEDTLS_ERR_PEM_PASSWORD_MISMATCH -0x1380
|
||||
/** Unavailable feature, e.g. hashing/encryption combination. */
|
||||
#define MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE -0x1400
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_PEM_BAD_INPUT_DATA -0x1480
|
||||
/* \} name */
|
||||
|
||||
#ifdef __cplusplus
|
||||
@ -112,17 +119,27 @@ void mbedtls_pem_free( mbedtls_pem_context *ctx );
|
||||
* \brief Write a buffer of PEM information from a DER encoded
|
||||
* buffer.
|
||||
*
|
||||
* \param header header string to write
|
||||
* \param footer footer string to write
|
||||
* \param der_data DER data to write
|
||||
* \param der_len length of the DER data
|
||||
* \param buf buffer to write to
|
||||
* \param buf_len length of output buffer
|
||||
* \param olen total length written / required (if buf_len is not enough)
|
||||
* \param header The header string to write.
|
||||
* \param footer The footer string to write.
|
||||
* \param der_data The DER data to encode.
|
||||
* \param der_len The length of the DER data \p der_data in Bytes.
|
||||
* \param buf The buffer to write to.
|
||||
* \param buf_len The length of the output buffer \p buf in Bytes.
|
||||
* \param olen The address at which to store the total length written
|
||||
* or required (if \p buf_len is not enough).
|
||||
*
|
||||
* \return 0 on success, or a specific PEM or BASE64 error code. On
|
||||
* MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL olen is the required
|
||||
* size.
|
||||
* \note You may pass \c NULL for \p buf and \c 0 for \p buf_len
|
||||
* to request the length of the resulting PEM buffer in
|
||||
* `*olen`.
|
||||
*
|
||||
* \note This function may be called with overlapping \p der_data
|
||||
* and \p buf buffers.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL if \p buf isn't large
|
||||
* enough to hold the PEM buffer. In this case, `*olen` holds
|
||||
* the required minimum size of \p buf.
|
||||
* \return Another PEM or BASE64 error code on other kinds of failure.
|
||||
*/
|
||||
int mbedtls_pem_write_buffer( const char *header, const char *footer,
|
||||
const unsigned char *der_data, size_t der_len,
|
||||
|
210
Externals/mbedtls/include/mbedtls/pk.h
vendored
210
Externals/mbedtls/include/mbedtls/pk.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Public Key abstraction layer
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,31 +18,33 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_PK_H
|
||||
#define MBEDTLS_PK_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "md.h"
|
||||
#include "mbedtls/md.h"
|
||||
|
||||
#if defined(MBEDTLS_RSA_C)
|
||||
#include "rsa.h"
|
||||
#include "mbedtls/rsa.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_C)
|
||||
#include "ecp.h"
|
||||
#include "mbedtls/ecp.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECDSA_C)
|
||||
#include "ecdsa.h"
|
||||
#include "mbedtls/ecdsa.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
#include "psa/crypto.h"
|
||||
#endif
|
||||
|
||||
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
||||
@ -50,23 +52,38 @@
|
||||
#define inline __inline
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_ERR_PK_ALLOC_FAILED -0x3F80 /**< Memory allocation failed. */
|
||||
#define MBEDTLS_ERR_PK_TYPE_MISMATCH -0x3F00 /**< Type mismatch, eg attempt to encrypt with an ECDSA key */
|
||||
#define MBEDTLS_ERR_PK_BAD_INPUT_DATA -0x3E80 /**< Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_PK_FILE_IO_ERROR -0x3E00 /**< Read/write of file failed. */
|
||||
#define MBEDTLS_ERR_PK_KEY_INVALID_VERSION -0x3D80 /**< Unsupported key version */
|
||||
#define MBEDTLS_ERR_PK_KEY_INVALID_FORMAT -0x3D00 /**< Invalid key tag or value. */
|
||||
#define MBEDTLS_ERR_PK_UNKNOWN_PK_ALG -0x3C80 /**< Key algorithm is unsupported (only RSA and EC are supported). */
|
||||
#define MBEDTLS_ERR_PK_PASSWORD_REQUIRED -0x3C00 /**< Private key password can't be empty. */
|
||||
#define MBEDTLS_ERR_PK_PASSWORD_MISMATCH -0x3B80 /**< Given private key password does not allow for correct decryption. */
|
||||
#define MBEDTLS_ERR_PK_INVALID_PUBKEY -0x3B00 /**< The pubkey tag or value is invalid (only RSA and EC are supported). */
|
||||
#define MBEDTLS_ERR_PK_INVALID_ALG -0x3A80 /**< The algorithm tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE -0x3A00 /**< Elliptic curve is unsupported (only NIST curves are supported). */
|
||||
#define MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE -0x3980 /**< Unavailable feature, e.g. RSA disabled for RSA key. */
|
||||
#define MBEDTLS_ERR_PK_SIG_LEN_MISMATCH -0x3900 /**< The buffer contains a valid signature followed by more data. */
|
||||
/** Memory allocation failed. */
|
||||
#define MBEDTLS_ERR_PK_ALLOC_FAILED -0x3F80
|
||||
/** Type mismatch, eg attempt to encrypt with an ECDSA key */
|
||||
#define MBEDTLS_ERR_PK_TYPE_MISMATCH -0x3F00
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_PK_BAD_INPUT_DATA -0x3E80
|
||||
/** Read/write of file failed. */
|
||||
#define MBEDTLS_ERR_PK_FILE_IO_ERROR -0x3E00
|
||||
/** Unsupported key version */
|
||||
#define MBEDTLS_ERR_PK_KEY_INVALID_VERSION -0x3D80
|
||||
/** Invalid key tag or value. */
|
||||
#define MBEDTLS_ERR_PK_KEY_INVALID_FORMAT -0x3D00
|
||||
/** Key algorithm is unsupported (only RSA and EC are supported). */
|
||||
#define MBEDTLS_ERR_PK_UNKNOWN_PK_ALG -0x3C80
|
||||
/** Private key password can't be empty. */
|
||||
#define MBEDTLS_ERR_PK_PASSWORD_REQUIRED -0x3C00
|
||||
/** Given private key password does not allow for correct decryption. */
|
||||
#define MBEDTLS_ERR_PK_PASSWORD_MISMATCH -0x3B80
|
||||
/** The pubkey tag or value is invalid (only RSA and EC are supported). */
|
||||
#define MBEDTLS_ERR_PK_INVALID_PUBKEY -0x3B00
|
||||
/** The algorithm tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_PK_INVALID_ALG -0x3A80
|
||||
/** Elliptic curve is unsupported (only NIST curves are supported). */
|
||||
#define MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE -0x3A00
|
||||
/** Unavailable feature, e.g. RSA disabled for RSA key. */
|
||||
#define MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE -0x3980
|
||||
/** The buffer contains a valid signature followed by more data. */
|
||||
#define MBEDTLS_ERR_PK_SIG_LEN_MISMATCH -0x3900
|
||||
|
||||
/* MBEDTLS_ERR_PK_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_PK_HW_ACCEL_FAILED -0x3880 /**< PK hardware accelerator failed. */
|
||||
/** PK hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_PK_HW_ACCEL_FAILED -0x3880
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -83,6 +100,7 @@ typedef enum {
|
||||
MBEDTLS_PK_ECDSA,
|
||||
MBEDTLS_PK_RSA_ALT,
|
||||
MBEDTLS_PK_RSASSA_PSS,
|
||||
MBEDTLS_PK_OPAQUE,
|
||||
} mbedtls_pk_type_t;
|
||||
|
||||
/**
|
||||
@ -96,6 +114,58 @@ typedef struct mbedtls_pk_rsassa_pss_options
|
||||
|
||||
} mbedtls_pk_rsassa_pss_options;
|
||||
|
||||
/**
|
||||
* \brief Maximum size of a signature made by mbedtls_pk_sign().
|
||||
*/
|
||||
/* We need to set MBEDTLS_PK_SIGNATURE_MAX_SIZE to the maximum signature
|
||||
* size among the supported signature types. Do it by starting at 0,
|
||||
* then incrementally increasing to be large enough for each supported
|
||||
* signature mechanism.
|
||||
*
|
||||
* The resulting value can be 0, for example if MBEDTLS_ECDH_C is enabled
|
||||
* (which allows the pk module to be included) but neither MBEDTLS_ECDSA_C
|
||||
* nor MBEDTLS_RSA_C nor any opaque signature mechanism (PSA or RSA_ALT).
|
||||
*/
|
||||
#define MBEDTLS_PK_SIGNATURE_MAX_SIZE 0
|
||||
|
||||
#if ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_PK_RSA_ALT_SUPPORT) ) && \
|
||||
MBEDTLS_MPI_MAX_SIZE > MBEDTLS_PK_SIGNATURE_MAX_SIZE
|
||||
/* For RSA, the signature can be as large as the bignum module allows.
|
||||
* For RSA_ALT, the signature size is not necessarily tied to what the
|
||||
* bignum module can do, but in the absence of any specific setting,
|
||||
* we use that (rsa_alt_sign_wrap in pk_wrap will check). */
|
||||
#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE
|
||||
#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_MPI_MAX_SIZE
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECDSA_C) && \
|
||||
MBEDTLS_ECDSA_MAX_LEN > MBEDTLS_PK_SIGNATURE_MAX_SIZE
|
||||
/* For ECDSA, the ecdsa module exports a constant for the maximum
|
||||
* signature size. */
|
||||
#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE
|
||||
#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_ECDSA_MAX_LEN
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
#if PSA_SIGNATURE_MAX_SIZE > MBEDTLS_PK_SIGNATURE_MAX_SIZE
|
||||
/* PSA_SIGNATURE_MAX_SIZE is the maximum size of a signature made
|
||||
* through the PSA API in the PSA representation. */
|
||||
#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE
|
||||
#define MBEDTLS_PK_SIGNATURE_MAX_SIZE PSA_SIGNATURE_MAX_SIZE
|
||||
#endif
|
||||
|
||||
#if PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE + 11 > MBEDTLS_PK_SIGNATURE_MAX_SIZE
|
||||
/* The Mbed TLS representation is different for ECDSA signatures:
|
||||
* PSA uses the raw concatenation of r and s,
|
||||
* whereas Mbed TLS uses the ASN.1 representation (SEQUENCE of two INTEGERs).
|
||||
* Add the overhead of ASN.1: up to (1+2) + 2 * (1+2+1) for the
|
||||
* types, lengths (represented by up to 2 bytes), and potential leading
|
||||
* zeros of the INTEGERs and the SEQUENCE. */
|
||||
#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE
|
||||
#define MBEDTLS_PK_SIGNATURE_MAX_SIZE ( PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE + 11 )
|
||||
#endif
|
||||
#endif /* defined(MBEDTLS_USE_PSA_CRYPTO) */
|
||||
|
||||
/**
|
||||
* \brief Types for interfacing with the debug module
|
||||
*/
|
||||
@ -209,6 +279,11 @@ void mbedtls_pk_init( mbedtls_pk_context *ctx );
|
||||
*
|
||||
* \param ctx The context to clear. It must have been initialized.
|
||||
* If this is \c NULL, this function does nothing.
|
||||
*
|
||||
* \note For contexts that have been set up with
|
||||
* mbedtls_pk_setup_opaque(), this does not free the underlying
|
||||
* PSA key and you still need to call psa_destroy_key()
|
||||
* independently if you want to destroy that key.
|
||||
*/
|
||||
void mbedtls_pk_free( mbedtls_pk_context *ctx );
|
||||
|
||||
@ -247,6 +322,39 @@ void mbedtls_pk_restart_free( mbedtls_pk_restart_ctx *ctx );
|
||||
*/
|
||||
int mbedtls_pk_setup( mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info );
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
/**
|
||||
* \brief Initialize a PK context to wrap a PSA key.
|
||||
*
|
||||
* \note This function replaces mbedtls_pk_setup() for contexts
|
||||
* that wrap a (possibly opaque) PSA key instead of
|
||||
* storing and manipulating the key material directly.
|
||||
*
|
||||
* \param ctx The context to initialize. It must be empty (type NONE).
|
||||
* \param key The PSA key to wrap, which must hold an ECC key pair
|
||||
* (see notes below).
|
||||
*
|
||||
* \note The wrapped key must remain valid as long as the
|
||||
* wrapping PK context is in use, that is at least between
|
||||
* the point this function is called and the point
|
||||
* mbedtls_pk_free() is called on this context. The wrapped
|
||||
* key might then be independently used or destroyed.
|
||||
*
|
||||
* \note This function is currently only available for ECC key
|
||||
* pairs (that is, ECC keys containing private key material).
|
||||
* Support for other key types may be added later.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input
|
||||
* (context already used, invalid key identifier).
|
||||
* \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the key is not an
|
||||
* ECC key pair.
|
||||
* \return #MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure.
|
||||
*/
|
||||
int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx,
|
||||
const psa_key_id_t key );
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
|
||||
/**
|
||||
* \brief Initialize an RSA-alt context
|
||||
@ -400,8 +508,13 @@ int mbedtls_pk_verify_ext( mbedtls_pk_type_t type, const void *options,
|
||||
* \param md_alg Hash algorithm used (see notes)
|
||||
* \param hash Hash of the message to sign
|
||||
* \param hash_len Hash length or 0 (see notes)
|
||||
* \param sig Place to write the signature
|
||||
* \param sig_len Number of bytes written
|
||||
* \param sig Place to write the signature.
|
||||
* It must have enough room for the signature.
|
||||
* #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough.
|
||||
* You may use a smaller buffer if it is large enough
|
||||
* given the key type.
|
||||
* \param sig_len On successful return,
|
||||
* the number of bytes written to \p sig.
|
||||
* \param f_rng RNG function
|
||||
* \param p_rng RNG parameter
|
||||
*
|
||||
@ -432,16 +545,21 @@ int mbedtls_pk_sign( mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg,
|
||||
*
|
||||
* \param ctx The PK context to use. It must have been set up
|
||||
* with a private key.
|
||||
* \param md_alg Hash algorithm used (see notes)
|
||||
* \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign())
|
||||
* \param hash Hash of the message to sign
|
||||
* \param hash_len Hash length or 0 (see notes)
|
||||
* \param sig Place to write the signature
|
||||
* \param sig_len Number of bytes written
|
||||
* \param hash_len Hash length or 0 (see notes for mbedtls_pk_sign())
|
||||
* \param sig Place to write the signature.
|
||||
* It must have enough room for the signature.
|
||||
* #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough.
|
||||
* You may use a smaller buffer if it is large enough
|
||||
* given the key type.
|
||||
* \param sig_len On successful return,
|
||||
* the number of bytes written to \p sig.
|
||||
* \param f_rng RNG function
|
||||
* \param p_rng RNG parameter
|
||||
* \param rs_ctx Restart context (NULL to disable restart)
|
||||
*
|
||||
* \return See \c mbedtls_pk_sign(), or
|
||||
* \return See \c mbedtls_pk_sign().
|
||||
* \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of
|
||||
* operations was reached: see \c mbedtls_ecp_set_max_ops().
|
||||
*/
|
||||
@ -501,7 +619,11 @@ int mbedtls_pk_encrypt( mbedtls_pk_context *ctx,
|
||||
* \param pub Context holding a public key.
|
||||
* \param prv Context holding a private (and public) key.
|
||||
*
|
||||
* \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA
|
||||
* \return \c 0 on success (keys were checked and match each other).
|
||||
* \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not
|
||||
* be checked - in that case they may or may not match.
|
||||
* \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid.
|
||||
* \return Another non-zero value if the keys do not match.
|
||||
*/
|
||||
int mbedtls_pk_check_pair( const mbedtls_pk_context *pub, const mbedtls_pk_context *prv );
|
||||
|
||||
@ -740,6 +862,32 @@ int mbedtls_pk_write_pubkey( unsigned char **p, unsigned char *start,
|
||||
int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n );
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
/**
|
||||
* \brief Turn an EC key into an opaque one.
|
||||
*
|
||||
* \warning This is a temporary utility function for tests. It might
|
||||
* change or be removed at any time without notice.
|
||||
*
|
||||
* \note Only ECDSA keys are supported so far. Signing with the
|
||||
* specified hash is the only allowed use of that key.
|
||||
*
|
||||
* \param pk Input: the EC key to import to a PSA key.
|
||||
* Output: a PK context wrapping that PSA key.
|
||||
* \param key Output: a PSA key identifier.
|
||||
* It's the caller's responsibility to call
|
||||
* psa_destroy_key() on that key identifier after calling
|
||||
* mbedtls_pk_free() on the PK context.
|
||||
* \param hash_alg The hash algorithm to allow for use with that key.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return An Mbed TLS error code otherwise.
|
||||
*/
|
||||
int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk,
|
||||
psa_key_id_t *key,
|
||||
psa_algorithm_t hash_alg );
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
12
Externals/mbedtls/include/mbedtls/pk_internal.h
vendored
12
Externals/mbedtls/include/mbedtls/pk_internal.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Public Key abstraction layer: wrapper functions
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,20 +18,18 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_PK_WRAP_H
|
||||
#define MBEDTLS_PK_WRAP_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "pk.h"
|
||||
#include "mbedtls/pk.h"
|
||||
|
||||
struct mbedtls_pk_info_t
|
||||
{
|
||||
@ -135,4 +133,8 @@ extern const mbedtls_pk_info_t mbedtls_ecdsa_info;
|
||||
extern const mbedtls_pk_info_t mbedtls_rsa_alt_info;
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
extern const mbedtls_pk_info_t mbedtls_pk_opaque_info;
|
||||
#endif
|
||||
|
||||
#endif /* MBEDTLS_PK_WRAP_H */
|
||||
|
129
Externals/mbedtls/include/mbedtls/pkcs11.h
vendored
129
Externals/mbedtls/include/mbedtls/pkcs11.h
vendored
@ -6,7 +6,7 @@
|
||||
* \author Adriaan de Jong <dejong@fox-it.com>
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -20,21 +20,19 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_PKCS11_H
|
||||
#define MBEDTLS_PKCS11_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PKCS11_C)
|
||||
|
||||
#include "x509_crt.h"
|
||||
#include "mbedtls/x509_crt.h"
|
||||
|
||||
#include <pkcs11-helper-1.0/pkcs11h-certificate.h>
|
||||
|
||||
@ -47,6 +45,8 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
|
||||
/**
|
||||
* Context for PKCS #11 private keys.
|
||||
*/
|
||||
@ -56,47 +56,71 @@ typedef struct mbedtls_pkcs11_context
|
||||
int len;
|
||||
} mbedtls_pkcs11_context;
|
||||
|
||||
#if defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#define MBEDTLS_DEPRECATED __attribute__((deprecated))
|
||||
#else
|
||||
#define MBEDTLS_DEPRECATED
|
||||
#endif
|
||||
|
||||
/**
|
||||
* Initialize a mbedtls_pkcs11_context.
|
||||
* (Just making memory references valid.)
|
||||
*
|
||||
* \deprecated This function is deprecated and will be removed in a
|
||||
* future version of the library.
|
||||
*/
|
||||
void mbedtls_pkcs11_init( mbedtls_pkcs11_context *ctx );
|
||||
MBEDTLS_DEPRECATED void mbedtls_pkcs11_init( mbedtls_pkcs11_context *ctx );
|
||||
|
||||
/**
|
||||
* Fill in a mbed TLS certificate, based on the given PKCS11 helper certificate.
|
||||
*
|
||||
* \deprecated This function is deprecated and will be removed in a
|
||||
* future version of the library.
|
||||
*
|
||||
* \param cert X.509 certificate to fill
|
||||
* \param pkcs11h_cert PKCS #11 helper certificate
|
||||
*
|
||||
* \return 0 on success.
|
||||
*/
|
||||
int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert, pkcs11h_certificate_t pkcs11h_cert );
|
||||
MBEDTLS_DEPRECATED int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert,
|
||||
pkcs11h_certificate_t pkcs11h_cert );
|
||||
|
||||
/**
|
||||
* Set up a mbedtls_pkcs11_context storing the given certificate. Note that the
|
||||
* mbedtls_pkcs11_context will take over control of the certificate, freeing it when
|
||||
* done.
|
||||
*
|
||||
* \deprecated This function is deprecated and will be removed in a
|
||||
* future version of the library.
|
||||
*
|
||||
* \param priv_key Private key structure to fill.
|
||||
* \param pkcs11_cert PKCS #11 helper certificate
|
||||
*
|
||||
* \return 0 on success
|
||||
*/
|
||||
int mbedtls_pkcs11_priv_key_bind( mbedtls_pkcs11_context *priv_key,
|
||||
pkcs11h_certificate_t pkcs11_cert );
|
||||
MBEDTLS_DEPRECATED int mbedtls_pkcs11_priv_key_bind(
|
||||
mbedtls_pkcs11_context *priv_key,
|
||||
pkcs11h_certificate_t pkcs11_cert );
|
||||
|
||||
/**
|
||||
* Free the contents of the given private key context. Note that the structure
|
||||
* itself is not freed.
|
||||
*
|
||||
* \deprecated This function is deprecated and will be removed in a
|
||||
* future version of the library.
|
||||
*
|
||||
* \param priv_key Private key structure to cleanup
|
||||
*/
|
||||
void mbedtls_pkcs11_priv_key_free( mbedtls_pkcs11_context *priv_key );
|
||||
MBEDTLS_DEPRECATED void mbedtls_pkcs11_priv_key_free(
|
||||
mbedtls_pkcs11_context *priv_key );
|
||||
|
||||
/**
|
||||
* \brief Do an RSA private key decrypt, then remove the message
|
||||
* padding
|
||||
*
|
||||
* \deprecated This function is deprecated and will be removed in a future
|
||||
* version of the library.
|
||||
*
|
||||
* \param ctx PKCS #11 context
|
||||
* \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
|
||||
* \param input buffer holding the encrypted data
|
||||
@ -110,15 +134,18 @@ void mbedtls_pkcs11_priv_key_free( mbedtls_pkcs11_context *priv_key );
|
||||
* of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
|
||||
* an error is thrown.
|
||||
*/
|
||||
int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx,
|
||||
int mode, size_t *olen,
|
||||
const unsigned char *input,
|
||||
unsigned char *output,
|
||||
size_t output_max_len );
|
||||
MBEDTLS_DEPRECATED int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx,
|
||||
int mode, size_t *olen,
|
||||
const unsigned char *input,
|
||||
unsigned char *output,
|
||||
size_t output_max_len );
|
||||
|
||||
/**
|
||||
* \brief Do a private RSA to sign a message digest
|
||||
*
|
||||
* \deprecated This function is deprecated and will be removed in a future
|
||||
* version of the library.
|
||||
*
|
||||
* \param ctx PKCS #11 context
|
||||
* \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
|
||||
* \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
|
||||
@ -132,28 +159,58 @@ int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx,
|
||||
* \note The "sig" buffer must be as large as the size
|
||||
* of ctx->N (eg. 128 bytes if RSA-1024 is used).
|
||||
*/
|
||||
int mbedtls_pkcs11_sign( mbedtls_pkcs11_context *ctx,
|
||||
int mode,
|
||||
mbedtls_md_type_t md_alg,
|
||||
unsigned int hashlen,
|
||||
const unsigned char *hash,
|
||||
unsigned char *sig );
|
||||
MBEDTLS_DEPRECATED int mbedtls_pkcs11_sign( mbedtls_pkcs11_context *ctx,
|
||||
int mode,
|
||||
mbedtls_md_type_t md_alg,
|
||||
unsigned int hashlen,
|
||||
const unsigned char *hash,
|
||||
unsigned char *sig );
|
||||
|
||||
/**
|
||||
* SSL/TLS wrappers for PKCS#11 functions
|
||||
*
|
||||
* \deprecated This function is deprecated and will be removed in a future
|
||||
* version of the library.
|
||||
*/
|
||||
static inline int mbedtls_ssl_pkcs11_decrypt( void *ctx, int mode, size_t *olen,
|
||||
const unsigned char *input, unsigned char *output,
|
||||
size_t output_max_len )
|
||||
MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_decrypt( void *ctx,
|
||||
int mode, size_t *olen,
|
||||
const unsigned char *input, unsigned char *output,
|
||||
size_t output_max_len )
|
||||
{
|
||||
return mbedtls_pkcs11_decrypt( (mbedtls_pkcs11_context *) ctx, mode, olen, input, output,
|
||||
output_max_len );
|
||||
}
|
||||
|
||||
static inline int mbedtls_ssl_pkcs11_sign( void *ctx,
|
||||
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
|
||||
int mode, mbedtls_md_type_t md_alg, unsigned int hashlen,
|
||||
const unsigned char *hash, unsigned char *sig )
|
||||
/**
|
||||
* \brief This function signs a message digest using RSA.
|
||||
*
|
||||
* \deprecated This function is deprecated and will be removed in a future
|
||||
* version of the library.
|
||||
*
|
||||
* \param ctx The PKCS #11 context.
|
||||
* \param f_rng The RNG function. This parameter is unused.
|
||||
* \param p_rng The RNG context. This parameter is unused.
|
||||
* \param mode The operation to run. This must be set to
|
||||
* MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's
|
||||
* signature.
|
||||
* \param md_alg The message digest algorithm. One of the MBEDTLS_MD_XXX
|
||||
* must be passed to this function and MBEDTLS_MD_NONE can be
|
||||
* used for signing raw data.
|
||||
* \param hashlen The message digest length (for MBEDTLS_MD_NONE only).
|
||||
* \param hash The buffer holding the message digest.
|
||||
* \param sig The buffer that will hold the ciphertext.
|
||||
*
|
||||
* \return \c 0 if the signing operation was successful.
|
||||
* \return A non-zero error code on failure.
|
||||
*
|
||||
* \note The \p sig buffer must be as large as the size of
|
||||
* <code>ctx->N</code>. For example, 128 bytes if RSA-1024 is
|
||||
* used.
|
||||
*/
|
||||
MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_sign( void *ctx,
|
||||
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
|
||||
int mode, mbedtls_md_type_t md_alg, unsigned int hashlen,
|
||||
const unsigned char *hash, unsigned char *sig )
|
||||
{
|
||||
((void) f_rng);
|
||||
((void) p_rng);
|
||||
@ -161,11 +218,25 @@ static inline int mbedtls_ssl_pkcs11_sign( void *ctx,
|
||||
hashlen, hash, sig );
|
||||
}
|
||||
|
||||
static inline size_t mbedtls_ssl_pkcs11_key_len( void *ctx )
|
||||
/**
|
||||
* This function gets the length of the private key.
|
||||
*
|
||||
* \deprecated This function is deprecated and will be removed in a future
|
||||
* version of the library.
|
||||
*
|
||||
* \param ctx The PKCS #11 context.
|
||||
*
|
||||
* \return The length of the private key.
|
||||
*/
|
||||
MBEDTLS_DEPRECATED static inline size_t mbedtls_ssl_pkcs11_key_len( void *ctx )
|
||||
{
|
||||
return ( (mbedtls_pkcs11_context *) ctx )->len;
|
||||
}
|
||||
|
||||
#undef MBEDTLS_DEPRECATED
|
||||
|
||||
#endif /* MBEDTLS_DEPRECATED_REMOVED */
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
58
Externals/mbedtls/include/mbedtls/pkcs12.h
vendored
58
Externals/mbedtls/include/mbedtls/pkcs12.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief PKCS#12 Personal Information Exchange Syntax
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,28 +18,30 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_PKCS12_H
|
||||
#define MBEDTLS_PKCS12_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "md.h"
|
||||
#include "cipher.h"
|
||||
#include "asn1.h"
|
||||
#include "mbedtls/md.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
#include "mbedtls/asn1.h"
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#define MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA -0x1F80 /**< Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE -0x1F00 /**< Feature not available, e.g. unsupported encryption scheme. */
|
||||
#define MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT -0x1E80 /**< PBE ASN.1 data not as expected. */
|
||||
#define MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH -0x1E00 /**< Given private key password does not allow for correct decryption. */
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA -0x1F80
|
||||
/** Feature not available, e.g. unsupported encryption scheme. */
|
||||
#define MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE -0x1F00
|
||||
/** PBE ASN.1 data not as expected. */
|
||||
#define MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT -0x1E80
|
||||
/** Given private key password does not allow for correct decryption. */
|
||||
#define MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH -0x1E00
|
||||
|
||||
#define MBEDTLS_PKCS12_DERIVE_KEY 1 /**< encryption/decryption key */
|
||||
#define MBEDTLS_PKCS12_DERIVE_IV 2 /**< initialization vector */
|
||||
@ -77,11 +79,13 @@ int mbedtls_pkcs12_pbe_sha1_rc4_128( mbedtls_asn1_buf *pbe_params, int mode,
|
||||
* \brief PKCS12 Password Based function (encryption / decryption)
|
||||
* for cipher-based and mbedtls_md-based PBE's
|
||||
*
|
||||
* \param pbe_params an ASN1 buffer containing the pkcs-12PbeParams structure
|
||||
* \param mode either MBEDTLS_PKCS12_PBE_ENCRYPT or MBEDTLS_PKCS12_PBE_DECRYPT
|
||||
* \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure
|
||||
* \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or
|
||||
* #MBEDTLS_PKCS12_PBE_DECRYPT
|
||||
* \param cipher_type the cipher used
|
||||
* \param md_type the mbedtls_md used
|
||||
* \param pwd the password used (may be NULL if no password is used)
|
||||
* \param md_type the mbedtls_md used
|
||||
* \param pwd Latin1-encoded password used. This may only be \c NULL when
|
||||
* \p pwdlen is 0. No null terminator should be used.
|
||||
* \param pwdlen length of the password (may be 0)
|
||||
* \param input the input data
|
||||
* \param len data length
|
||||
@ -102,18 +106,24 @@ int mbedtls_pkcs12_pbe( mbedtls_asn1_buf *pbe_params, int mode,
|
||||
* to produce pseudo-random bits for a particular "purpose".
|
||||
*
|
||||
* Depending on the given id, this function can produce an
|
||||
* encryption/decryption key, an nitialization vector or an
|
||||
* encryption/decryption key, an initialization vector or an
|
||||
* integrity key.
|
||||
*
|
||||
* \param data buffer to store the derived data in
|
||||
* \param datalen length to fill
|
||||
* \param pwd password to use (may be NULL if no password is used)
|
||||
* \param pwdlen length of the password (may be 0)
|
||||
* \param salt salt buffer to use
|
||||
* \param saltlen length of the salt
|
||||
* \param mbedtls_md mbedtls_md type to use during the derivation
|
||||
* \param id id that describes the purpose (can be MBEDTLS_PKCS12_DERIVE_KEY,
|
||||
* MBEDTLS_PKCS12_DERIVE_IV or MBEDTLS_PKCS12_DERIVE_MAC_KEY)
|
||||
* \param datalen length of buffer to fill
|
||||
* \param pwd The password to use. For compliance with PKCS#12 §B.1, this
|
||||
* should be a BMPString, i.e. a Unicode string where each
|
||||
* character is encoded as 2 bytes in big-endian order, with
|
||||
* no byte order mark and with a null terminator (i.e. the
|
||||
* last two bytes should be 0x00 0x00).
|
||||
* \param pwdlen length of the password (may be 0).
|
||||
* \param salt Salt buffer to use This may only be \c NULL when
|
||||
* \p saltlen is 0.
|
||||
* \param saltlen length of the salt (may be zero)
|
||||
* \param mbedtls_md mbedtls_md type to use during the derivation
|
||||
* \param id id that describes the purpose (can be
|
||||
* #MBEDTLS_PKCS12_DERIVE_KEY, #MBEDTLS_PKCS12_DERIVE_IV or
|
||||
* #MBEDTLS_PKCS12_DERIVE_MAC_KEY)
|
||||
* \param iterations number of iterations
|
||||
*
|
||||
* \return 0 if successful, or a MD, BIGNUM type error.
|
||||
|
22
Externals/mbedtls/include/mbedtls/pkcs5.h
vendored
22
Externals/mbedtls/include/mbedtls/pkcs5.h
vendored
@ -6,7 +6,7 @@
|
||||
* \author Mathias Olsson <mathias@kompetensum.com>
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -20,28 +20,30 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_PKCS5_H
|
||||
#define MBEDTLS_PKCS5_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "asn1.h"
|
||||
#include "md.h"
|
||||
#include "mbedtls/asn1.h"
|
||||
#include "mbedtls/md.h"
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#define MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA -0x2f80 /**< Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_PKCS5_INVALID_FORMAT -0x2f00 /**< Unexpected ASN.1 data. */
|
||||
#define MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE -0x2e80 /**< Requested encryption or digest alg not available. */
|
||||
#define MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH -0x2e00 /**< Given private key password does not allow for correct decryption. */
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA -0x2f80
|
||||
/** Unexpected ASN.1 data. */
|
||||
#define MBEDTLS_ERR_PKCS5_INVALID_FORMAT -0x2f00
|
||||
/** Requested encryption or digest alg not available. */
|
||||
#define MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE -0x2e80
|
||||
/** Given private key password does not allow for correct decryption. */
|
||||
#define MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH -0x2e00
|
||||
|
||||
#define MBEDTLS_PKCS5_DECRYPT 0
|
||||
#define MBEDTLS_PKCS5_ENCRYPT 1
|
||||
|
70
Externals/mbedtls/include/mbedtls/platform.h
vendored
70
Externals/mbedtls/include/mbedtls/platform.h
vendored
@ -13,7 +13,7 @@
|
||||
* dynamically configured at runtime.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -27,24 +27,24 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_PLATFORM_H
|
||||
#define MBEDTLS_PLATFORM_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_HAVE_TIME)
|
||||
#include "platform_time.h"
|
||||
#include "mbedtls/platform_time.h"
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED -0x0070 /**< Hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED -0x0072 /**< The requested feature is not supported by the platform */
|
||||
/** Hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED -0x0070
|
||||
/** The requested feature is not supported by the platform */
|
||||
#define MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED -0x0072
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -58,17 +58,33 @@ extern "C" {
|
||||
* \{
|
||||
*/
|
||||
|
||||
/* The older Microsoft Windows common runtime provides non-conforming
|
||||
* implementations of some standard library functions, including snprintf
|
||||
* and vsnprintf. This affects MSVC and MinGW builds.
|
||||
*/
|
||||
#if defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER <= 1900)
|
||||
#define MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF
|
||||
#define MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS)
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <time.h>
|
||||
#if !defined(MBEDTLS_PLATFORM_STD_SNPRINTF)
|
||||
#if defined(_WIN32)
|
||||
#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF)
|
||||
#define MBEDTLS_PLATFORM_STD_SNPRINTF mbedtls_platform_win32_snprintf /**< The default \c snprintf function to use. */
|
||||
#else
|
||||
#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< The default \c snprintf function to use. */
|
||||
#endif
|
||||
#endif
|
||||
#if !defined(MBEDTLS_PLATFORM_STD_VSNPRINTF)
|
||||
#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF)
|
||||
#define MBEDTLS_PLATFORM_STD_VSNPRINTF mbedtls_platform_win32_vsnprintf /**< The default \c vsnprintf function to use. */
|
||||
#else
|
||||
#define MBEDTLS_PLATFORM_STD_VSNPRINTF vsnprintf /**< The default \c vsnprintf function to use. */
|
||||
#endif
|
||||
#endif
|
||||
#if !defined(MBEDTLS_PLATFORM_STD_PRINTF)
|
||||
#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< The default \c printf function to use. */
|
||||
#endif
|
||||
@ -204,7 +220,7 @@ int mbedtls_platform_set_printf( int (*printf_func)( const char *, ... ) );
|
||||
* - however it is acceptable to return -1 instead of the required length when
|
||||
* the destination buffer is too short.
|
||||
*/
|
||||
#if defined(_WIN32)
|
||||
#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF)
|
||||
/* For Windows (inc. MSYS2), we provide our own fixed implementation */
|
||||
int mbedtls_platform_win32_snprintf( char *s, size_t n, const char *fmt, ... );
|
||||
#endif
|
||||
@ -230,6 +246,42 @@ int mbedtls_platform_set_snprintf( int (*snprintf_func)( char * s, size_t n,
|
||||
#endif /* MBEDTLS_PLATFORM_SNPRINTF_MACRO */
|
||||
#endif /* MBEDTLS_PLATFORM_SNPRINTF_ALT */
|
||||
|
||||
/*
|
||||
* The function pointers for vsnprintf
|
||||
*
|
||||
* The vsnprintf implementation should conform to C99:
|
||||
* - it *must* always correctly zero-terminate the buffer
|
||||
* (except when n == 0, then it must leave the buffer untouched)
|
||||
* - however it is acceptable to return -1 instead of the required length when
|
||||
* the destination buffer is too short.
|
||||
*/
|
||||
#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF)
|
||||
#include <stdarg.h>
|
||||
/* For Older Windows (inc. MSYS2), we provide our own fixed implementation */
|
||||
int mbedtls_platform_win32_vsnprintf( char *s, size_t n, const char *fmt, va_list arg );
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT)
|
||||
#include <stdarg.h>
|
||||
extern int (*mbedtls_vsnprintf)( char * s, size_t n, const char * format, va_list arg );
|
||||
|
||||
/**
|
||||
* \brief Set your own snprintf function pointer
|
||||
*
|
||||
* \param vsnprintf_func The \c vsnprintf function implementation
|
||||
*
|
||||
* \return \c 0
|
||||
*/
|
||||
int mbedtls_platform_set_vsnprintf( int (*vsnprintf_func)( char * s, size_t n,
|
||||
const char * format, va_list arg ) );
|
||||
#else /* MBEDTLS_PLATFORM_VSNPRINTF_ALT */
|
||||
#if defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO)
|
||||
#define mbedtls_vsnprintf MBEDTLS_PLATFORM_VSNPRINTF_MACRO
|
||||
#else
|
||||
#define mbedtls_vsnprintf vsnprintf
|
||||
#endif /* MBEDTLS_PLATFORM_VSNPRINTF_MACRO */
|
||||
#endif /* MBEDTLS_PLATFORM_VSNPRINTF_ALT */
|
||||
|
||||
/*
|
||||
* The function pointers for exit
|
||||
*/
|
||||
|
@ -4,7 +4,7 @@
|
||||
* \brief mbed TLS Platform time abstraction
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_PLATFORM_TIME_H
|
||||
#define MBEDTLS_PLATFORM_TIME_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
108
Externals/mbedtls/include/mbedtls/platform_util.h
vendored
108
Externals/mbedtls/include/mbedtls/platform_util.h
vendored
@ -5,7 +5,7 @@
|
||||
* library.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2018, Arm Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -19,21 +19,19 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_PLATFORM_UTIL_H
|
||||
#define MBEDTLS_PLATFORM_UTIL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
#if defined(MBEDTLS_HAVE_TIME_DATE)
|
||||
#include "platform_time.h"
|
||||
#include "mbedtls/platform_time.h"
|
||||
#include <time.h>
|
||||
#endif /* MBEDTLS_HAVE_TIME_DATE */
|
||||
|
||||
@ -43,6 +41,12 @@ extern "C" {
|
||||
|
||||
#if defined(MBEDTLS_CHECK_PARAMS)
|
||||
|
||||
#if defined(MBEDTLS_CHECK_PARAMS_ASSERT)
|
||||
/* Allow the user to define MBEDTLS_PARAM_FAILED to something like assert
|
||||
* (which is what our config.h suggests). */
|
||||
#include <assert.h>
|
||||
#endif /* MBEDTLS_CHECK_PARAMS_ASSERT */
|
||||
|
||||
#if defined(MBEDTLS_PARAM_FAILED)
|
||||
/** An alternative definition of MBEDTLS_PARAM_FAILED has been set in config.h.
|
||||
*
|
||||
@ -50,6 +54,11 @@ extern "C" {
|
||||
* MBEDTLS_PARAM_FAILED() will expand to a call to mbedtls_param_failed().
|
||||
*/
|
||||
#define MBEDTLS_PARAM_FAILED_ALT
|
||||
|
||||
#elif defined(MBEDTLS_CHECK_PARAMS_ASSERT)
|
||||
#define MBEDTLS_PARAM_FAILED( cond ) assert( cond )
|
||||
#define MBEDTLS_PARAM_FAILED_ALT
|
||||
|
||||
#else /* MBEDTLS_PARAM_FAILED */
|
||||
#define MBEDTLS_PARAM_FAILED( cond ) \
|
||||
mbedtls_param_failed( #cond, __FILE__, __LINE__ )
|
||||
@ -123,6 +132,95 @@ MBEDTLS_DEPRECATED typedef int mbedtls_deprecated_numeric_constant_t;
|
||||
#endif /* MBEDTLS_DEPRECATED_WARNING */
|
||||
#endif /* MBEDTLS_DEPRECATED_REMOVED */
|
||||
|
||||
/* Implementation of the check-return facility.
|
||||
* See the user documentation in config.h.
|
||||
*
|
||||
* Do not use this macro directly to annotate function: instead,
|
||||
* use one of MBEDTLS_CHECK_RETURN_CRITICAL or MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
* depending on how important it is to check the return value.
|
||||
*/
|
||||
#if !defined(MBEDTLS_CHECK_RETURN)
|
||||
#if defined(__GNUC__)
|
||||
#define MBEDTLS_CHECK_RETURN __attribute__((__warn_unused_result__))
|
||||
#elif defined(_MSC_VER) && _MSC_VER >= 1700
|
||||
#include <sal.h>
|
||||
#define MBEDTLS_CHECK_RETURN _Check_return_
|
||||
#else
|
||||
#define MBEDTLS_CHECK_RETURN
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/** Critical-failure function
|
||||
*
|
||||
* This macro appearing at the beginning of the declaration of a function
|
||||
* indicates that its return value should be checked in all applications.
|
||||
* Omitting the check is very likely to indicate a bug in the application
|
||||
* and will result in a compile-time warning if #MBEDTLS_CHECK_RETURN
|
||||
* is implemented for the compiler in use.
|
||||
*
|
||||
* \note The use of this macro is a work in progress.
|
||||
* This macro may be added to more functions in the future.
|
||||
* Such an extension is not considered an API break, provided that
|
||||
* there are near-unavoidable circumstances under which the function
|
||||
* can fail. For example, signature/MAC/AEAD verification functions,
|
||||
* and functions that require a random generator, are considered
|
||||
* return-check-critical.
|
||||
*/
|
||||
#define MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN
|
||||
|
||||
/** Ordinary-failure function
|
||||
*
|
||||
* This macro appearing at the beginning of the declaration of a function
|
||||
* indicates that its return value should be generally be checked in portable
|
||||
* applications. Omitting the check will result in a compile-time warning if
|
||||
* #MBEDTLS_CHECK_RETURN is implemented for the compiler in use and
|
||||
* #MBEDTLS_CHECK_RETURN_WARNING is enabled in the compile-time configuration.
|
||||
*
|
||||
* You can use #MBEDTLS_IGNORE_RETURN to explicitly ignore the return value
|
||||
* of a function that is annotated with #MBEDTLS_CHECK_RETURN.
|
||||
*
|
||||
* \note The use of this macro is a work in progress.
|
||||
* This macro will be added to more functions in the future.
|
||||
* Eventually this should appear before most functions returning
|
||||
* an error code (as \c int in the \c mbedtls_xxx API or
|
||||
* as ::psa_status_t in the \c psa_xxx API).
|
||||
*/
|
||||
#if defined(MBEDTLS_CHECK_RETURN_WARNING)
|
||||
#define MBEDTLS_CHECK_RETURN_TYPICAL MBEDTLS_CHECK_RETURN
|
||||
#else
|
||||
#define MBEDTLS_CHECK_RETURN_TYPICAL
|
||||
#endif
|
||||
|
||||
/** Benign-failure function
|
||||
*
|
||||
* This macro appearing at the beginning of the declaration of a function
|
||||
* indicates that it is rarely useful to check its return value.
|
||||
*
|
||||
* This macro has an empty expansion. It exists for documentation purposes:
|
||||
* a #MBEDTLS_CHECK_RETURN_OPTIONAL annotation indicates that the function
|
||||
* has been analyzed for return-check usefuless, whereas the lack of
|
||||
* an annotation indicates that the function has not been analyzed and its
|
||||
* return-check usefulness is unknown.
|
||||
*/
|
||||
#define MBEDTLS_CHECK_RETURN_OPTIONAL
|
||||
|
||||
/** \def MBEDTLS_IGNORE_RETURN
|
||||
*
|
||||
* Call this macro with one argument, a function call, to suppress a warning
|
||||
* from #MBEDTLS_CHECK_RETURN due to that function call.
|
||||
*/
|
||||
#if !defined(MBEDTLS_IGNORE_RETURN)
|
||||
/* GCC doesn't silence the warning with just (void)(result).
|
||||
* (void)!(result) is known to work up at least up to GCC 10, as well
|
||||
* as with Clang and MSVC.
|
||||
*
|
||||
* https://gcc.gnu.org/onlinedocs/gcc-3.4.6/gcc/Non_002dbugs.html
|
||||
* https://stackoverflow.com/questions/40576003/ignoring-warning-wunused-result
|
||||
* https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425#c34
|
||||
*/
|
||||
#define MBEDTLS_IGNORE_RETURN(result) ( (void) !( result ) )
|
||||
#endif
|
||||
|
||||
/**
|
||||
* \brief Securely zeroize a buffer
|
||||
*
|
||||
|
16
Externals/mbedtls/include/mbedtls/poly1305.h
vendored
16
Externals/mbedtls/include/mbedtls/poly1305.h
vendored
@ -12,7 +12,8 @@
|
||||
* \author Daniel King <damaki.gh@gmail.com>
|
||||
*/
|
||||
|
||||
/* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved.
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -26,15 +27,13 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_POLY1305_H
|
||||
#define MBEDTLS_POLY1305_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -42,15 +41,18 @@
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
#define MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA -0x0057 /**< Invalid input parameter(s). */
|
||||
/** Invalid input parameter(s). */
|
||||
#define MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA -0x0057
|
||||
|
||||
/* MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE is deprecated and should not be
|
||||
* used. */
|
||||
#define MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE -0x0059 /**< Feature not available. For example, s part of the API is not implemented. */
|
||||
/** Feature not available. For example, s part of the API is not implemented. */
|
||||
#define MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE -0x0059
|
||||
|
||||
/* MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED is deprecated and should not be used.
|
||||
*/
|
||||
#define MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED -0x005B /**< Poly1305 hardware accelerator failed. */
|
||||
/** Poly1305 hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED -0x005B
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
512
Externals/mbedtls/include/mbedtls/psa_util.h
vendored
Normal file
512
Externals/mbedtls/include/mbedtls/psa_util.h
vendored
Normal file
@ -0,0 +1,512 @@
|
||||
/**
|
||||
* \file psa_util.h
|
||||
*
|
||||
* \brief Utility functions for the use of the PSA Crypto library.
|
||||
*
|
||||
* \warning This function is not part of the public API and may
|
||||
* change at any time.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_PSA_UTIL_H
|
||||
#define MBEDTLS_PSA_UTIL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
|
||||
#include "psa/crypto.h"
|
||||
|
||||
#include "mbedtls/ecp.h"
|
||||
#include "mbedtls/md.h"
|
||||
#include "mbedtls/pk.h"
|
||||
#include "mbedtls/oid.h"
|
||||
|
||||
#include <string.h>
|
||||
|
||||
/* Translations for symmetric crypto. */
|
||||
|
||||
static inline psa_key_type_t mbedtls_psa_translate_cipher_type(
|
||||
mbedtls_cipher_type_t cipher )
|
||||
{
|
||||
switch( cipher )
|
||||
{
|
||||
case MBEDTLS_CIPHER_AES_128_CCM:
|
||||
case MBEDTLS_CIPHER_AES_192_CCM:
|
||||
case MBEDTLS_CIPHER_AES_256_CCM:
|
||||
case MBEDTLS_CIPHER_AES_128_GCM:
|
||||
case MBEDTLS_CIPHER_AES_192_GCM:
|
||||
case MBEDTLS_CIPHER_AES_256_GCM:
|
||||
case MBEDTLS_CIPHER_AES_128_CBC:
|
||||
case MBEDTLS_CIPHER_AES_192_CBC:
|
||||
case MBEDTLS_CIPHER_AES_256_CBC:
|
||||
case MBEDTLS_CIPHER_AES_128_ECB:
|
||||
case MBEDTLS_CIPHER_AES_192_ECB:
|
||||
case MBEDTLS_CIPHER_AES_256_ECB:
|
||||
return( PSA_KEY_TYPE_AES );
|
||||
|
||||
/* ARIA not yet supported in PSA. */
|
||||
/* case MBEDTLS_CIPHER_ARIA_128_CCM:
|
||||
case MBEDTLS_CIPHER_ARIA_192_CCM:
|
||||
case MBEDTLS_CIPHER_ARIA_256_CCM:
|
||||
case MBEDTLS_CIPHER_ARIA_128_GCM:
|
||||
case MBEDTLS_CIPHER_ARIA_192_GCM:
|
||||
case MBEDTLS_CIPHER_ARIA_256_GCM:
|
||||
case MBEDTLS_CIPHER_ARIA_128_CBC:
|
||||
case MBEDTLS_CIPHER_ARIA_192_CBC:
|
||||
case MBEDTLS_CIPHER_ARIA_256_CBC:
|
||||
return( PSA_KEY_TYPE_ARIA ); */
|
||||
|
||||
default:
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
|
||||
static inline psa_algorithm_t mbedtls_psa_translate_cipher_mode(
|
||||
mbedtls_cipher_mode_t mode, size_t taglen )
|
||||
{
|
||||
switch( mode )
|
||||
{
|
||||
case MBEDTLS_MODE_ECB:
|
||||
return( PSA_ALG_ECB_NO_PADDING );
|
||||
case MBEDTLS_MODE_GCM:
|
||||
return( PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, taglen ) );
|
||||
case MBEDTLS_MODE_CCM:
|
||||
return( PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) );
|
||||
case MBEDTLS_MODE_CBC:
|
||||
if( taglen == 0 )
|
||||
return( PSA_ALG_CBC_NO_PADDING );
|
||||
else
|
||||
return( 0 );
|
||||
default:
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
|
||||
static inline psa_key_usage_t mbedtls_psa_translate_cipher_operation(
|
||||
mbedtls_operation_t op )
|
||||
{
|
||||
switch( op )
|
||||
{
|
||||
case MBEDTLS_ENCRYPT:
|
||||
return( PSA_KEY_USAGE_ENCRYPT );
|
||||
case MBEDTLS_DECRYPT:
|
||||
return( PSA_KEY_USAGE_DECRYPT );
|
||||
default:
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
|
||||
/* Translations for hashing. */
|
||||
|
||||
static inline psa_algorithm_t mbedtls_psa_translate_md( mbedtls_md_type_t md_alg )
|
||||
{
|
||||
switch( md_alg )
|
||||
{
|
||||
#if defined(MBEDTLS_MD2_C)
|
||||
case MBEDTLS_MD_MD2:
|
||||
return( PSA_ALG_MD2 );
|
||||
#endif
|
||||
#if defined(MBEDTLS_MD4_C)
|
||||
case MBEDTLS_MD_MD4:
|
||||
return( PSA_ALG_MD4 );
|
||||
#endif
|
||||
#if defined(MBEDTLS_MD5_C)
|
||||
case MBEDTLS_MD_MD5:
|
||||
return( PSA_ALG_MD5 );
|
||||
#endif
|
||||
#if defined(MBEDTLS_SHA1_C)
|
||||
case MBEDTLS_MD_SHA1:
|
||||
return( PSA_ALG_SHA_1 );
|
||||
#endif
|
||||
#if defined(MBEDTLS_SHA256_C)
|
||||
case MBEDTLS_MD_SHA224:
|
||||
return( PSA_ALG_SHA_224 );
|
||||
case MBEDTLS_MD_SHA256:
|
||||
return( PSA_ALG_SHA_256 );
|
||||
#endif
|
||||
#if defined(MBEDTLS_SHA512_C)
|
||||
case MBEDTLS_MD_SHA384:
|
||||
return( PSA_ALG_SHA_384 );
|
||||
case MBEDTLS_MD_SHA512:
|
||||
return( PSA_ALG_SHA_512 );
|
||||
#endif
|
||||
#if defined(MBEDTLS_RIPEMD160_C)
|
||||
case MBEDTLS_MD_RIPEMD160:
|
||||
return( PSA_ALG_RIPEMD160 );
|
||||
#endif
|
||||
case MBEDTLS_MD_NONE:
|
||||
return( 0 );
|
||||
default:
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
|
||||
/* Translations for ECC. */
|
||||
|
||||
static inline int mbedtls_psa_get_ecc_oid_from_id(
|
||||
psa_ecc_family_t curve, size_t bits,
|
||||
char const **oid, size_t *oid_len )
|
||||
{
|
||||
switch( curve )
|
||||
{
|
||||
case PSA_ECC_FAMILY_SECP_R1:
|
||||
switch( bits )
|
||||
{
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
case 192:
|
||||
*oid = MBEDTLS_OID_EC_GRP_SECP192R1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP192R1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
|
||||
case 224:
|
||||
*oid = MBEDTLS_OID_EC_GRP_SECP224R1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP224R1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
|
||||
case 256:
|
||||
*oid = MBEDTLS_OID_EC_GRP_SECP256R1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP256R1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
|
||||
case 384:
|
||||
*oid = MBEDTLS_OID_EC_GRP_SECP384R1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP384R1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
|
||||
case 521:
|
||||
*oid = MBEDTLS_OID_EC_GRP_SECP521R1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP521R1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
|
||||
}
|
||||
break;
|
||||
case PSA_ECC_FAMILY_SECP_K1:
|
||||
switch( bits )
|
||||
{
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
|
||||
case 192:
|
||||
*oid = MBEDTLS_OID_EC_GRP_SECP192K1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP192K1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
|
||||
case 224:
|
||||
*oid = MBEDTLS_OID_EC_GRP_SECP224K1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP224K1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
|
||||
case 256:
|
||||
*oid = MBEDTLS_OID_EC_GRP_SECP256K1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP256K1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
|
||||
}
|
||||
break;
|
||||
case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
|
||||
switch( bits )
|
||||
{
|
||||
#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
|
||||
case 256:
|
||||
*oid = MBEDTLS_OID_EC_GRP_BP256R1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_BP256R1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
|
||||
case 384:
|
||||
*oid = MBEDTLS_OID_EC_GRP_BP384R1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_BP384R1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
|
||||
#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
|
||||
case 512:
|
||||
*oid = MBEDTLS_OID_EC_GRP_BP512R1;
|
||||
*oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_BP512R1 );
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
|
||||
}
|
||||
break;
|
||||
}
|
||||
(void) oid;
|
||||
(void) oid_len;
|
||||
return( -1 );
|
||||
}
|
||||
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH 1
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 192 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 192 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 224 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 224 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 384 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 384 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 521 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 521 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 192 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 192 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 224 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 224 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 384 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 384 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
|
||||
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 512 + 7 ) / 8 ) + 1 )
|
||||
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
|
||||
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 512 + 7 ) / 8 ) + 1 )
|
||||
#endif
|
||||
#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
|
||||
|
||||
|
||||
/* Translations for PK layer */
|
||||
|
||||
static inline int mbedtls_psa_err_translate_pk( psa_status_t status )
|
||||
{
|
||||
switch( status )
|
||||
{
|
||||
case PSA_SUCCESS:
|
||||
return( 0 );
|
||||
case PSA_ERROR_NOT_SUPPORTED:
|
||||
return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
|
||||
case PSA_ERROR_INSUFFICIENT_MEMORY:
|
||||
return( MBEDTLS_ERR_PK_ALLOC_FAILED );
|
||||
case PSA_ERROR_INSUFFICIENT_ENTROPY:
|
||||
return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
|
||||
case PSA_ERROR_BAD_STATE:
|
||||
return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
|
||||
/* All other failures */
|
||||
case PSA_ERROR_COMMUNICATION_FAILURE:
|
||||
case PSA_ERROR_HARDWARE_FAILURE:
|
||||
case PSA_ERROR_CORRUPTION_DETECTED:
|
||||
return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
|
||||
default: /* We return the same as for the 'other failures',
|
||||
* but list them separately nonetheless to indicate
|
||||
* which failure conditions we have considered. */
|
||||
return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
|
||||
}
|
||||
}
|
||||
|
||||
/* Translations for ECC */
|
||||
|
||||
/* This function transforms an ECC group identifier from
|
||||
* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
|
||||
* into a PSA ECC group identifier. */
|
||||
#if defined(MBEDTLS_ECP_C)
|
||||
static inline psa_key_type_t mbedtls_psa_parse_tls_ecc_group(
|
||||
uint16_t tls_ecc_grp_reg_id, size_t *bits )
|
||||
{
|
||||
const mbedtls_ecp_curve_info *curve_info =
|
||||
mbedtls_ecp_curve_info_from_tls_id( tls_ecc_grp_reg_id );
|
||||
if( curve_info == NULL )
|
||||
return( 0 );
|
||||
return( PSA_KEY_TYPE_ECC_KEY_PAIR(
|
||||
mbedtls_ecc_group_to_psa( curve_info->grp_id, bits ) ) );
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_C */
|
||||
|
||||
/* This function takes a buffer holding an EC public key
|
||||
* exported through psa_export_public_key(), and converts
|
||||
* it into an ECPoint structure to be put into a ClientKeyExchange
|
||||
* message in an ECDHE exchange.
|
||||
*
|
||||
* Both the present and the foreseeable future format of EC public keys
|
||||
* used by PSA have the ECPoint structure contained in the exported key
|
||||
* as a subbuffer, and the function merely selects this subbuffer instead
|
||||
* of making a copy.
|
||||
*/
|
||||
static inline int mbedtls_psa_tls_psa_ec_to_ecpoint( unsigned char *src,
|
||||
size_t srclen,
|
||||
unsigned char **dst,
|
||||
size_t *dstlen )
|
||||
{
|
||||
*dst = src;
|
||||
*dstlen = srclen;
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
/* This function takes a buffer holding an ECPoint structure
|
||||
* (as contained in a TLS ServerKeyExchange message for ECDHE
|
||||
* exchanges) and converts it into a format that the PSA key
|
||||
* agreement API understands.
|
||||
*/
|
||||
static inline int mbedtls_psa_tls_ecpoint_to_psa_ec( unsigned char const *src,
|
||||
size_t srclen,
|
||||
unsigned char *dst,
|
||||
size_t dstlen,
|
||||
size_t *olen )
|
||||
{
|
||||
if( srclen > dstlen )
|
||||
return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
|
||||
|
||||
memcpy( dst, src, srclen );
|
||||
*olen = srclen;
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
/* Expose whatever RNG the PSA subsystem uses to applications using the
|
||||
* mbedtls_xxx API. The declarations and definitions here need to be
|
||||
* consistent with the implementation in library/psa_crypto_random_impl.h.
|
||||
* See that file for implementation documentation. */
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
/* The type of a `f_rng` random generator function that many library functions
|
||||
* take.
|
||||
*
|
||||
* This type name is not part of the Mbed TLS stable API. It may be renamed
|
||||
* or moved without warning.
|
||||
*/
|
||||
typedef int mbedtls_f_rng_t( void *p_rng, unsigned char *output, size_t output_size );
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
|
||||
|
||||
/** The random generator function for the PSA subsystem.
|
||||
*
|
||||
* This function is suitable as the `f_rng` random generator function
|
||||
* parameter of many `mbedtls_xxx` functions. Use #MBEDTLS_PSA_RANDOM_STATE
|
||||
* to obtain the \p p_rng parameter.
|
||||
*
|
||||
* The implementation of this function depends on the configuration of the
|
||||
* library.
|
||||
*
|
||||
* \note Depending on the configuration, this may be a function or
|
||||
* a pointer to a function.
|
||||
*
|
||||
* \note This function may only be used if the PSA crypto subsystem is active.
|
||||
* This means that you must call psa_crypto_init() before any call to
|
||||
* this function, and you must not call this function after calling
|
||||
* mbedtls_psa_crypto_free().
|
||||
*
|
||||
* \param p_rng The random generator context. This must be
|
||||
* #MBEDTLS_PSA_RANDOM_STATE. No other state is
|
||||
* supported.
|
||||
* \param output The buffer to fill. It must have room for
|
||||
* \c output_size bytes.
|
||||
* \param output_size The number of bytes to write to \p output.
|
||||
* This function may fail if \p output_size is too
|
||||
* large. It is guaranteed to accept any output size
|
||||
* requested by Mbed TLS library functions. The
|
||||
* maximum request size depends on the library
|
||||
* configuration.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return An `MBEDTLS_ERR_ENTROPY_xxx`,
|
||||
* `MBEDTLS_ERR_PLATFORM_xxx,
|
||||
* `MBEDTLS_ERR_CTR_DRBG_xxx` or
|
||||
* `MBEDTLS_ERR_HMAC_DRBG_xxx` on error.
|
||||
*/
|
||||
int mbedtls_psa_get_random( void *p_rng,
|
||||
unsigned char *output,
|
||||
size_t output_size );
|
||||
|
||||
/** The random generator state for the PSA subsystem.
|
||||
*
|
||||
* This macro expands to an expression which is suitable as the `p_rng`
|
||||
* random generator state parameter of many `mbedtls_xxx` functions.
|
||||
* It must be used in combination with the random generator function
|
||||
* mbedtls_psa_get_random().
|
||||
*
|
||||
* The implementation of this macro depends on the configuration of the
|
||||
* library. Do not make any assumption on its nature.
|
||||
*/
|
||||
#define MBEDTLS_PSA_RANDOM_STATE NULL
|
||||
|
||||
#else /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
|
||||
|
||||
#if defined(MBEDTLS_CTR_DRBG_C)
|
||||
#include "mbedtls/ctr_drbg.h"
|
||||
typedef mbedtls_ctr_drbg_context mbedtls_psa_drbg_context_t;
|
||||
static mbedtls_f_rng_t *const mbedtls_psa_get_random = mbedtls_ctr_drbg_random;
|
||||
#elif defined(MBEDTLS_HMAC_DRBG_C)
|
||||
#include "mbedtls/hmac_drbg.h"
|
||||
typedef mbedtls_hmac_drbg_context mbedtls_psa_drbg_context_t;
|
||||
static mbedtls_f_rng_t *const mbedtls_psa_get_random = mbedtls_hmac_drbg_random;
|
||||
#endif
|
||||
extern mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state;
|
||||
|
||||
#define MBEDTLS_PSA_RANDOM_STATE mbedtls_psa_random_state
|
||||
|
||||
#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
|
||||
#endif /* MBEDTLS_PSA_UTIL_H */
|
11
Externals/mbedtls/include/mbedtls/ripemd160.h
vendored
11
Externals/mbedtls/include/mbedtls/ripemd160.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief RIPE MD-160 message digest
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_RIPEMD160_H
|
||||
#define MBEDTLS_RIPEMD160_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -35,7 +33,8 @@
|
||||
|
||||
/* MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED is deprecated and should not be used.
|
||||
*/
|
||||
#define MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED -0x0031 /**< RIPEMD160 hardware accelerator failed */
|
||||
/** RIPEMD160 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED -0x0031
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -57,7 +56,7 @@ typedef struct mbedtls_ripemd160_context
|
||||
mbedtls_ripemd160_context;
|
||||
|
||||
#else /* MBEDTLS_RIPEMD160_ALT */
|
||||
#include "ripemd160.h"
|
||||
#include "ripemd160_alt.h"
|
||||
#endif /* MBEDTLS_RIPEMD160_ALT */
|
||||
|
||||
/**
|
||||
|
176
Externals/mbedtls/include/mbedtls/rsa.h
vendored
176
Externals/mbedtls/include/mbedtls/rsa.h
vendored
@ -10,7 +10,7 @@
|
||||
*
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -24,44 +24,53 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_RSA_H
|
||||
#define MBEDTLS_RSA_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "bignum.h"
|
||||
#include "md.h"
|
||||
#include "mbedtls/bignum.h"
|
||||
#include "mbedtls/md.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
#include "threading.h"
|
||||
#include "mbedtls/threading.h"
|
||||
#endif
|
||||
|
||||
/*
|
||||
* RSA Error codes
|
||||
*/
|
||||
#define MBEDTLS_ERR_RSA_BAD_INPUT_DATA -0x4080 /**< Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_RSA_INVALID_PADDING -0x4100 /**< Input data contains invalid padding and is rejected. */
|
||||
#define MBEDTLS_ERR_RSA_KEY_GEN_FAILED -0x4180 /**< Something failed during generation of a key. */
|
||||
#define MBEDTLS_ERR_RSA_KEY_CHECK_FAILED -0x4200 /**< Key failed to pass the validity check of the library. */
|
||||
#define MBEDTLS_ERR_RSA_PUBLIC_FAILED -0x4280 /**< The public key operation failed. */
|
||||
#define MBEDTLS_ERR_RSA_PRIVATE_FAILED -0x4300 /**< The private key operation failed. */
|
||||
#define MBEDTLS_ERR_RSA_VERIFY_FAILED -0x4380 /**< The PKCS#1 verification failed. */
|
||||
#define MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE -0x4400 /**< The output buffer for decryption is not large enough. */
|
||||
#define MBEDTLS_ERR_RSA_RNG_FAILED -0x4480 /**< The random generator failed to generate non-zeros. */
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_RSA_BAD_INPUT_DATA -0x4080
|
||||
/** Input data contains invalid padding and is rejected. */
|
||||
#define MBEDTLS_ERR_RSA_INVALID_PADDING -0x4100
|
||||
/** Something failed during generation of a key. */
|
||||
#define MBEDTLS_ERR_RSA_KEY_GEN_FAILED -0x4180
|
||||
/** Key failed to pass the validity check of the library. */
|
||||
#define MBEDTLS_ERR_RSA_KEY_CHECK_FAILED -0x4200
|
||||
/** The public key operation failed. */
|
||||
#define MBEDTLS_ERR_RSA_PUBLIC_FAILED -0x4280
|
||||
/** The private key operation failed. */
|
||||
#define MBEDTLS_ERR_RSA_PRIVATE_FAILED -0x4300
|
||||
/** The PKCS#1 verification failed. */
|
||||
#define MBEDTLS_ERR_RSA_VERIFY_FAILED -0x4380
|
||||
/** The output buffer for decryption is not large enough. */
|
||||
#define MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE -0x4400
|
||||
/** The random generator failed to generate non-zeros. */
|
||||
#define MBEDTLS_ERR_RSA_RNG_FAILED -0x4480
|
||||
|
||||
/* MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION is deprecated and should not be used.
|
||||
*/
|
||||
#define MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION -0x4500 /**< The implementation does not offer the requested operation, for example, because of security violations or lack of functionality. */
|
||||
/** The implementation does not offer the requested operation, for example, because of security violations or lack of functionality. */
|
||||
#define MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION -0x4500
|
||||
|
||||
/* MBEDTLS_ERR_RSA_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_RSA_HW_ACCEL_FAILED -0x4580 /**< RSA hardware accelerator failed. */
|
||||
/** RSA hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_RSA_HW_ACCEL_FAILED -0x4580
|
||||
|
||||
/*
|
||||
* RSA constants
|
||||
@ -99,7 +108,10 @@ extern "C" {
|
||||
*/
|
||||
typedef struct mbedtls_rsa_context
|
||||
{
|
||||
int ver; /*!< Always 0.*/
|
||||
int ver; /*!< Reserved for internal purposes.
|
||||
* Do not set this field in application
|
||||
* code. Its meaning might change without
|
||||
* notice. */
|
||||
size_t len; /*!< The size of \p N in Bytes. */
|
||||
|
||||
mbedtls_mpi N; /*!< The public modulus. */
|
||||
@ -129,6 +141,7 @@ typedef struct mbedtls_rsa_context
|
||||
mask generating function used in the
|
||||
EME-OAEP and EMSA-PSS encodings. */
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
/* Invariant: the mutex is initialized iff ver != 0. */
|
||||
mbedtls_threading_mutex_t mutex; /*!< Thread-safety mutex. */
|
||||
#endif
|
||||
}
|
||||
@ -150,13 +163,13 @@ mbedtls_rsa_context;
|
||||
* \note The choice of padding mode is strictly enforced for private key
|
||||
* operations, since there might be security concerns in
|
||||
* mixing padding modes. For public key operations it is
|
||||
* a default value, which can be overriden by calling specific
|
||||
* a default value, which can be overridden by calling specific
|
||||
* \c rsa_rsaes_xxx or \c rsa_rsassa_xxx functions.
|
||||
*
|
||||
* \note The hash selected in \p hash_id is always used for OEAP
|
||||
* encryption. For PSS signatures, it is always used for
|
||||
* making signatures, but can be overriden for verifying them.
|
||||
* If set to #MBEDTLS_MD_NONE, it is always overriden.
|
||||
* making signatures, but can be overridden for verifying them.
|
||||
* If set to #MBEDTLS_MD_NONE, it is always overridden.
|
||||
*
|
||||
* \param ctx The RSA context to initialize. This must not be \c NULL.
|
||||
* \param padding The padding mode to use. This must be either
|
||||
@ -601,7 +614,8 @@ int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
|
||||
* #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated).
|
||||
* \param ilen The length of the plaintext in Bytes.
|
||||
* \param input The input data to encrypt. This must be a readable
|
||||
* buffer of size \p ilen Bytes. This must not be \c NULL.
|
||||
* buffer of size \p ilen Bytes. It may be \c NULL if
|
||||
* `ilen == 0`.
|
||||
* \param output The output buffer. This must be a writable buffer
|
||||
* of length \c ctx->len Bytes. For example, \c 256 Bytes
|
||||
* for an 2048-bit RSA modulus.
|
||||
@ -641,7 +655,8 @@ int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx,
|
||||
* #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated).
|
||||
* \param ilen The length of the plaintext in Bytes.
|
||||
* \param input The input data to encrypt. This must be a readable
|
||||
* buffer of size \p ilen Bytes. This must not be \c NULL.
|
||||
* buffer of size \p ilen Bytes. It may be \c NULL if
|
||||
* `ilen == 0`.
|
||||
* \param output The output buffer. This must be a writable buffer
|
||||
* of length \c ctx->len Bytes. For example, \c 256 Bytes
|
||||
* for an 2048-bit RSA modulus.
|
||||
@ -685,7 +700,8 @@ int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx,
|
||||
* \param label_len The length of the label in Bytes.
|
||||
* \param ilen The length of the plaintext buffer \p input in Bytes.
|
||||
* \param input The input data to encrypt. This must be a readable
|
||||
* buffer of size \p ilen Bytes. This must not be \c NULL.
|
||||
* buffer of size \p ilen Bytes. It may be \c NULL if
|
||||
* `ilen == 0`.
|
||||
* \param output The output buffer. This must be a writable buffer
|
||||
* of length \c ctx->len Bytes. For example, \c 256 Bytes
|
||||
* for an 2048-bit RSA modulus.
|
||||
@ -904,7 +920,8 @@ int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
|
||||
* the size of the hash corresponding to \p md_alg.
|
||||
* \param sig The buffer to hold the signature. This must be a writable
|
||||
* buffer of length \c ctx->len Bytes. For example, \c 256 Bytes
|
||||
* for an 2048-bit RSA modulus.
|
||||
* for an 2048-bit RSA modulus. A buffer length of
|
||||
* #MBEDTLS_MPI_MAX_SIZE is always safe.
|
||||
*
|
||||
* \return \c 0 if the signing operation was successful.
|
||||
* \return An \c MBEDTLS_ERR_RSA_XXX error code on failure.
|
||||
@ -951,7 +968,8 @@ int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
|
||||
* the size of the hash corresponding to \p md_alg.
|
||||
* \param sig The buffer to hold the signature. This must be a writable
|
||||
* buffer of length \c ctx->len Bytes. For example, \c 256 Bytes
|
||||
* for an 2048-bit RSA modulus.
|
||||
* for an 2048-bit RSA modulus. A buffer length of
|
||||
* #MBEDTLS_MPI_MAX_SIZE is always safe.
|
||||
*
|
||||
* \return \c 0 if the signing operation was successful.
|
||||
* \return An \c MBEDTLS_ERR_RSA_XXX error code on failure.
|
||||
@ -969,12 +987,69 @@ int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
|
||||
* \brief This function performs a PKCS#1 v2.1 PSS signature
|
||||
* operation (RSASSA-PSS-SIGN).
|
||||
*
|
||||
* \note The \p hash_id in the RSA context is the one used for the
|
||||
* encoding. \p md_alg in the function call is the type of hash
|
||||
* that is encoded. According to <em>RFC-3447: Public-Key
|
||||
* \note The \c hash_id set in \p ctx (when calling
|
||||
* mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding()
|
||||
* afterwards) selects the hash used for the
|
||||
* encoding operation and for the mask generation function
|
||||
* (MGF1). For more details on the encoding operation and the
|
||||
* mask generation function, consult <em>RFC-3447: Public-Key
|
||||
* Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography
|
||||
* Specifications</em> it is advised to keep both hashes the
|
||||
* same.
|
||||
* Specifications</em>.
|
||||
*
|
||||
* \note This function enforces that the provided salt length complies
|
||||
* with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1
|
||||
* step 3. The constraint is that the hash length plus the salt
|
||||
* length plus 2 bytes must be at most the key length. If this
|
||||
* constraint is not met, this function returns
|
||||
* #MBEDTLS_ERR_RSA_BAD_INPUT_DATA.
|
||||
*
|
||||
* \param ctx The initialized RSA context to use.
|
||||
* \param f_rng The RNG function. It must not be \c NULL.
|
||||
* \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL
|
||||
* if \p f_rng doesn't need a context argument.
|
||||
* \param md_alg The message-digest algorithm used to hash the original data.
|
||||
* Use #MBEDTLS_MD_NONE for signing raw data.
|
||||
* \param hashlen The length of the message digest.
|
||||
* Ths is only used if \p md_alg is #MBEDTLS_MD_NONE.
|
||||
* \param hash The buffer holding the message digest or raw data.
|
||||
* If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable
|
||||
* buffer of length \p hashlen Bytes. If \p md_alg is not
|
||||
* #MBEDTLS_MD_NONE, it must be a readable buffer of length
|
||||
* the size of the hash corresponding to \p md_alg.
|
||||
* \param saltlen The length of the salt that should be used.
|
||||
* If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use
|
||||
* the largest possible salt length up to the hash length,
|
||||
* which is the largest permitted by some standards including
|
||||
* FIPS 186-4 §5.5.
|
||||
* \param sig The buffer to hold the signature. This must be a writable
|
||||
* buffer of length \c ctx->len Bytes. For example, \c 256 Bytes
|
||||
* for an 2048-bit RSA modulus. A buffer length of
|
||||
* #MBEDTLS_MPI_MAX_SIZE is always safe.
|
||||
*
|
||||
* \return \c 0 if the signing operation was successful.
|
||||
* \return An \c MBEDTLS_ERR_RSA_XXX error code on failure.
|
||||
*/
|
||||
int mbedtls_rsa_rsassa_pss_sign_ext( mbedtls_rsa_context *ctx,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng,
|
||||
mbedtls_md_type_t md_alg,
|
||||
unsigned int hashlen,
|
||||
const unsigned char *hash,
|
||||
int saltlen,
|
||||
unsigned char *sig );
|
||||
|
||||
/**
|
||||
* \brief This function performs a PKCS#1 v2.1 PSS signature
|
||||
* operation (RSASSA-PSS-SIGN).
|
||||
*
|
||||
* \note The \c hash_id set in \p ctx (when calling
|
||||
* mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding()
|
||||
* afterwards) selects the hash used for the
|
||||
* encoding operation and for the mask generation function
|
||||
* (MGF1). For more details on the encoding operation and the
|
||||
* mask generation function, consult <em>RFC-3447: Public-Key
|
||||
* Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography
|
||||
* Specifications</em>.
|
||||
*
|
||||
* \note This function always uses the maximum possible salt size,
|
||||
* up to the length of the payload hash. This choice of salt
|
||||
@ -1004,7 +1079,7 @@ int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
|
||||
* \param md_alg The message-digest algorithm used to hash the original data.
|
||||
* Use #MBEDTLS_MD_NONE for signing raw data.
|
||||
* \param hashlen The length of the message digest.
|
||||
* Ths is only used if \p md_alg is #MBEDTLS_MD_NONE.
|
||||
* This is only used if \p md_alg is #MBEDTLS_MD_NONE.
|
||||
* \param hash The buffer holding the message digest or raw data.
|
||||
* If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable
|
||||
* buffer of length \p hashlen Bytes. If \p md_alg is not
|
||||
@ -1012,7 +1087,8 @@ int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
|
||||
* the size of the hash corresponding to \p md_alg.
|
||||
* \param sig The buffer to hold the signature. This must be a writable
|
||||
* buffer of length \c ctx->len Bytes. For example, \c 256 Bytes
|
||||
* for an 2048-bit RSA modulus.
|
||||
* for an 2048-bit RSA modulus. A buffer length of
|
||||
* #MBEDTLS_MPI_MAX_SIZE is always safe.
|
||||
*
|
||||
* \return \c 0 if the signing operation was successful.
|
||||
* \return An \c MBEDTLS_ERR_RSA_XXX error code on failure.
|
||||
@ -1129,16 +1205,15 @@ int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx,
|
||||
* \brief This function performs a PKCS#1 v2.1 PSS verification
|
||||
* operation (RSASSA-PSS-VERIFY).
|
||||
*
|
||||
* The hash function for the MGF mask generating function
|
||||
* is that specified in the RSA context.
|
||||
*
|
||||
* \note The \p hash_id in the RSA context is the one used for the
|
||||
* verification. \p md_alg in the function call is the type of
|
||||
* hash that is verified. According to <em>RFC-3447: Public-Key
|
||||
* \note The \c hash_id set in \p ctx (when calling
|
||||
* mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding()
|
||||
* afterwards) selects the hash used for the
|
||||
* encoding operation and for the mask generation function
|
||||
* (MGF1). For more details on the encoding operation and the
|
||||
* mask generation function, consult <em>RFC-3447: Public-Key
|
||||
* Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography
|
||||
* Specifications</em> it is advised to keep both hashes the
|
||||
* same. If \p hash_id in the RSA context is unset,
|
||||
* the \p md_alg from the function call is used.
|
||||
* Specifications</em>. If the \c hash_id set in \p ctx is
|
||||
* #MBEDTLS_MD_NONE, the \p md_alg parameter is used.
|
||||
*
|
||||
* \deprecated It is deprecated and discouraged to call this function
|
||||
* in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library
|
||||
@ -1186,13 +1261,12 @@ int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
|
||||
* \brief This function performs a PKCS#1 v2.1 PSS verification
|
||||
* operation (RSASSA-PSS-VERIFY).
|
||||
*
|
||||
* The hash function for the MGF mask generating function
|
||||
* is that specified in \p mgf1_hash_id.
|
||||
*
|
||||
* \note The \p sig buffer must be as large as the size
|
||||
* of \p ctx->N. For example, 128 Bytes if RSA-1024 is used.
|
||||
*
|
||||
* \note The \p hash_id in the RSA context is ignored.
|
||||
* \note The \c hash_id set in \p ctx (when calling
|
||||
* mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding()
|
||||
* afterwards) is ignored.
|
||||
*
|
||||
* \param ctx The initialized RSA public key context to use.
|
||||
* \param f_rng The RNG function to use. If \p mode is #MBEDTLS_RSA_PRIVATE,
|
||||
@ -1211,7 +1285,13 @@ int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
|
||||
* buffer of length \p hashlen Bytes. If \p md_alg is not
|
||||
* #MBEDTLS_MD_NONE, it must be a readable buffer of length
|
||||
* the size of the hash corresponding to \p md_alg.
|
||||
* \param mgf1_hash_id The message digest used for mask generation.
|
||||
* \param mgf1_hash_id The message digest algorithm used for the
|
||||
* verification operation and the mask generation
|
||||
* function (MGF1). For more details on the encoding
|
||||
* operation and the mask generation function, consult
|
||||
* <em>RFC-3447: Public-Key Cryptography Standards
|
||||
* (PKCS) #1 v2.1: RSA Cryptography
|
||||
* Specifications</em>.
|
||||
* \param expected_salt_len The length of the salt used in padding. Use
|
||||
* #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length.
|
||||
* \param sig The buffer holding the signature. This must be a readable
|
||||
|
@ -35,7 +35,7 @@
|
||||
*
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2017, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -50,20 +50,18 @@
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_RSA_INTERNAL_H
|
||||
#define MBEDTLS_RSA_INTERNAL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "bignum.h"
|
||||
#include "mbedtls/bignum.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
12
Externals/mbedtls/include/mbedtls/sha1.h
vendored
12
Externals/mbedtls/include/mbedtls/sha1.h
vendored
@ -11,7 +11,7 @@
|
||||
* digests instead.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -25,14 +25,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_SHA1_H
|
||||
#define MBEDTLS_SHA1_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -41,8 +39,10 @@
|
||||
#include <stdint.h>
|
||||
|
||||
/* MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED -0x0035 /**< SHA-1 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_SHA1_BAD_INPUT_DATA -0x0073 /**< SHA-1 input data was malformed. */
|
||||
/** SHA-1 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED -0x0035
|
||||
/** SHA-1 input data was malformed. */
|
||||
#define MBEDTLS_ERR_SHA1_BAD_INPUT_DATA -0x0073
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
15
Externals/mbedtls/include/mbedtls/sha256.h
vendored
15
Externals/mbedtls/include/mbedtls/sha256.h
vendored
@ -7,7 +7,7 @@
|
||||
* hash functions are defined in <em>FIPS 180-4: Secure Hash Standard (SHS)</em>.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -21,14 +21,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_SHA256_H
|
||||
#define MBEDTLS_SHA256_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -37,8 +35,10 @@
|
||||
#include <stdint.h>
|
||||
|
||||
/* MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED -0x0037 /**< SHA-256 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_SHA256_BAD_INPUT_DATA -0x0074 /**< SHA-256 input data was malformed. */
|
||||
/** SHA-256 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED -0x0037
|
||||
/** SHA-256 input data was malformed. */
|
||||
#define MBEDTLS_ERR_SHA256_BAD_INPUT_DATA -0x0074
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -237,6 +237,9 @@ MBEDTLS_DEPRECATED void mbedtls_sha256_process( mbedtls_sha256_context *ctx,
|
||||
* be a writable buffer of length \c 32 Bytes.
|
||||
* \param is224 Determines which function to use. This must be
|
||||
* either \c 0 for SHA-256, or \c 1 for SHA-224.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return A negative error code on failure.
|
||||
*/
|
||||
int mbedtls_sha256_ret( const unsigned char *input,
|
||||
size_t ilen,
|
||||
|
34
Externals/mbedtls/include/mbedtls/sha512.h
vendored
34
Externals/mbedtls/include/mbedtls/sha512.h
vendored
@ -6,7 +6,7 @@
|
||||
* hash functions are defined in <em>FIPS 180-4: Secure Hash Standard (SHS)</em>.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -20,14 +20,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_SHA512_H
|
||||
#define MBEDTLS_SHA512_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -36,8 +34,10 @@
|
||||
#include <stdint.h>
|
||||
|
||||
/* MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED -0x0039 /**< SHA-512 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_SHA512_BAD_INPUT_DATA -0x0075 /**< SHA-512 input data was malformed. */
|
||||
/** SHA-512 hardware accelerator failed */
|
||||
#define MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED -0x0039
|
||||
/** SHA-512 input data was malformed. */
|
||||
#define MBEDTLS_ERR_SHA512_BAD_INPUT_DATA -0x0075
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -59,8 +59,10 @@ typedef struct mbedtls_sha512_context
|
||||
uint64_t total[2]; /*!< The number of Bytes processed. */
|
||||
uint64_t state[8]; /*!< The intermediate digest state. */
|
||||
unsigned char buffer[128]; /*!< The data block being processed. */
|
||||
#if !defined(MBEDTLS_SHA512_NO_SHA384)
|
||||
int is384; /*!< Determines which function to use:
|
||||
0: Use SHA-512, or 1: Use SHA-384. */
|
||||
#endif
|
||||
}
|
||||
mbedtls_sha512_context;
|
||||
|
||||
@ -101,7 +103,11 @@ void mbedtls_sha512_clone( mbedtls_sha512_context *dst,
|
||||
*
|
||||
* \param ctx The SHA-512 context to use. This must be initialized.
|
||||
* \param is384 Determines which function to use. This must be
|
||||
* either \c for SHA-512, or \c 1 for SHA-384.
|
||||
* either \c 0 for SHA-512, or \c 1 for SHA-384.
|
||||
*
|
||||
* \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must
|
||||
* be \c 0, or the function will return
|
||||
* #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return A negative error code on failure.
|
||||
@ -127,8 +133,7 @@ int mbedtls_sha512_update_ret( mbedtls_sha512_context *ctx,
|
||||
|
||||
/**
|
||||
* \brief This function finishes the SHA-512 operation, and writes
|
||||
* the result to the output buffer. This function is for
|
||||
* internal use only.
|
||||
* the result to the output buffer.
|
||||
*
|
||||
* \param ctx The SHA-512 context. This must be initialized
|
||||
* and have a hash operation started.
|
||||
@ -144,6 +149,7 @@ int mbedtls_sha512_finish_ret( mbedtls_sha512_context *ctx,
|
||||
/**
|
||||
* \brief This function processes a single data block within
|
||||
* the ongoing SHA-512 computation.
|
||||
* This function is for internal use only.
|
||||
*
|
||||
* \param ctx The SHA-512 context. This must be initialized.
|
||||
* \param data The buffer holding one block of data. This
|
||||
@ -169,6 +175,9 @@ int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx,
|
||||
* \param ctx The SHA-512 context to use. This must be initialized.
|
||||
* \param is384 Determines which function to use. This must be either
|
||||
* \c 0 for SHA-512 or \c 1 for SHA-384.
|
||||
*
|
||||
* \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must
|
||||
* be \c 0, or the function will fail to work.
|
||||
*/
|
||||
MBEDTLS_DEPRECATED void mbedtls_sha512_starts( mbedtls_sha512_context *ctx,
|
||||
int is384 );
|
||||
@ -239,6 +248,10 @@ MBEDTLS_DEPRECATED void mbedtls_sha512_process(
|
||||
* \param is384 Determines which function to use. This must be either
|
||||
* \c 0 for SHA-512, or \c 1 for SHA-384.
|
||||
*
|
||||
* \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must
|
||||
* be \c 0, or the function will return
|
||||
* #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return A negative error code on failure.
|
||||
*/
|
||||
@ -273,6 +286,9 @@ int mbedtls_sha512_ret( const unsigned char *input,
|
||||
* be a writable buffer of length \c 64 Bytes.
|
||||
* \param is384 Determines which function to use. This must be either
|
||||
* \c 0 for SHA-512, or \c 1 for SHA-384.
|
||||
*
|
||||
* \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must
|
||||
* be \c 0, or the function will fail to work.
|
||||
*/
|
||||
MBEDTLS_DEPRECATED void mbedtls_sha512( const unsigned char *input,
|
||||
size_t ilen,
|
||||
|
1673
Externals/mbedtls/include/mbedtls/ssl.h
vendored
1673
Externals/mbedtls/include/mbedtls/ssl.h
vendored
File diff suppressed because it is too large
Load Diff
13
Externals/mbedtls/include/mbedtls/ssl_cache.h
vendored
13
Externals/mbedtls/include/mbedtls/ssl_cache.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief SSL session cache implementation
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,22 +18,20 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_SSL_CACHE_H
|
||||
#define MBEDTLS_SSL_CACHE_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ssl.h"
|
||||
#include "mbedtls/ssl.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
#include "threading.h"
|
||||
#include "mbedtls/threading.h"
|
||||
#endif
|
||||
|
||||
/**
|
||||
@ -70,7 +68,8 @@ struct mbedtls_ssl_cache_entry
|
||||
mbedtls_time_t timestamp; /*!< entry timestamp */
|
||||
#endif
|
||||
mbedtls_ssl_session session; /*!< entry session */
|
||||
#if defined(MBEDTLS_X509_CRT_PARSE_C)
|
||||
#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
|
||||
defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
|
||||
mbedtls_x509_buf peer_cert; /*!< entry peer_cert */
|
||||
#endif
|
||||
mbedtls_ssl_cache_entry *next; /*!< chain pointer */
|
||||
|
@ -4,7 +4,7 @@
|
||||
* \brief SSL Ciphersuites for mbed TLS
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,21 +18,19 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_SSL_CIPHERSUITES_H
|
||||
#define MBEDTLS_SSL_CIPHERSUITES_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "pk.h"
|
||||
#include "cipher.h"
|
||||
#include "md.h"
|
||||
#include "mbedtls/pk.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
#include "mbedtls/md.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -312,7 +310,7 @@ typedef enum {
|
||||
defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED
|
||||
#endif
|
||||
|
||||
/* Key exchanges allowing client certificate requests */
|
||||
@ -322,28 +320,28 @@ typedef enum {
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED
|
||||
#endif
|
||||
|
||||
/* Key exchanges involving server signature in ServerKeyExchange */
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED
|
||||
#endif
|
||||
|
||||
/* Key exchanges using ECDH */
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED
|
||||
#endif
|
||||
|
||||
/* Key exchanges that don't involve ephemeral keys */
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED
|
||||
defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED
|
||||
#endif
|
||||
|
||||
/* Key exchanges that involve ephemeral keys */
|
||||
@ -353,7 +351,7 @@ typedef enum {
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED
|
||||
#endif
|
||||
|
||||
/* Key exchanges using a PSK */
|
||||
@ -361,20 +359,20 @@ typedef enum {
|
||||
defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED
|
||||
#endif
|
||||
|
||||
/* Key exchanges using DHE */
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED
|
||||
#endif
|
||||
|
||||
/* Key exchanges using ECDHE */
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
|
||||
#define MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED
|
||||
#endif
|
||||
|
||||
typedef struct mbedtls_ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t;
|
||||
@ -417,7 +415,7 @@ mbedtls_pk_type_t mbedtls_ssl_get_ciphersuite_sig_alg( const mbedtls_ssl_ciphers
|
||||
int mbedtls_ssl_ciphersuite_uses_ec( const mbedtls_ssl_ciphersuite_t *info );
|
||||
int mbedtls_ssl_ciphersuite_uses_psk( const mbedtls_ssl_ciphersuite_t *info );
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED)
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED)
|
||||
static inline int mbedtls_ssl_ciphersuite_has_pfs( const mbedtls_ssl_ciphersuite_t *info )
|
||||
{
|
||||
switch( info->key_exchange )
|
||||
@ -434,9 +432,9 @@ static inline int mbedtls_ssl_ciphersuite_has_pfs( const mbedtls_ssl_ciphersuite
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED */
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED)
|
||||
static inline int mbedtls_ssl_ciphersuite_no_pfs( const mbedtls_ssl_ciphersuite_t *info )
|
||||
{
|
||||
switch( info->key_exchange )
|
||||
@ -452,9 +450,9 @@ static inline int mbedtls_ssl_ciphersuite_no_pfs( const mbedtls_ssl_ciphersuite_
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED */
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED)
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED)
|
||||
static inline int mbedtls_ssl_ciphersuite_uses_ecdh( const mbedtls_ssl_ciphersuite_t *info )
|
||||
{
|
||||
switch( info->key_exchange )
|
||||
@ -467,7 +465,7 @@ static inline int mbedtls_ssl_ciphersuite_uses_ecdh( const mbedtls_ssl_ciphersui
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED */
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */
|
||||
|
||||
static inline int mbedtls_ssl_ciphersuite_cert_req_allowed( const mbedtls_ssl_ciphersuite_t *info )
|
||||
{
|
||||
@ -486,7 +484,25 @@ static inline int mbedtls_ssl_ciphersuite_cert_req_allowed( const mbedtls_ssl_ci
|
||||
}
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED)
|
||||
static inline int mbedtls_ssl_ciphersuite_uses_srv_cert( const mbedtls_ssl_ciphersuite_t *info )
|
||||
{
|
||||
switch( info->key_exchange )
|
||||
{
|
||||
case MBEDTLS_KEY_EXCHANGE_RSA:
|
||||
case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
|
||||
case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
|
||||
case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
|
||||
case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
|
||||
case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
|
||||
case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
|
||||
return( 1 );
|
||||
|
||||
default:
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED)
|
||||
static inline int mbedtls_ssl_ciphersuite_uses_dhe( const mbedtls_ssl_ciphersuite_t *info )
|
||||
{
|
||||
switch( info->key_exchange )
|
||||
@ -499,9 +515,9 @@ static inline int mbedtls_ssl_ciphersuite_uses_dhe( const mbedtls_ssl_ciphersuit
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED) */
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) */
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
|
||||
static inline int mbedtls_ssl_ciphersuite_uses_ecdhe( const mbedtls_ssl_ciphersuite_t *info )
|
||||
{
|
||||
switch( info->key_exchange )
|
||||
@ -515,9 +531,9 @@ static inline int mbedtls_ssl_ciphersuite_uses_ecdhe( const mbedtls_ssl_ciphersu
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED) */
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) */
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
|
||||
static inline int mbedtls_ssl_ciphersuite_uses_server_signature( const mbedtls_ssl_ciphersuite_t *info )
|
||||
{
|
||||
switch( info->key_exchange )
|
||||
@ -531,7 +547,7 @@ static inline int mbedtls_ssl_ciphersuite_uses_server_signature( const mbedtls_s
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
|
10
Externals/mbedtls/include/mbedtls/ssl_cookie.h
vendored
10
Externals/mbedtls/include/mbedtls/ssl_cookie.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief DTLS cookie callbacks implementation
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,22 +18,20 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_SSL_COOKIE_H
|
||||
#define MBEDTLS_SSL_COOKIE_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ssl.h"
|
||||
#include "mbedtls/ssl.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
#include "threading.h"
|
||||
#include "mbedtls/threading.h"
|
||||
#endif
|
||||
|
||||
/**
|
||||
|
796
Externals/mbedtls/include/mbedtls/ssl_internal.h
vendored
796
Externals/mbedtls/include/mbedtls/ssl_internal.h
vendored
File diff suppressed because it is too large
Load Diff
18
Externals/mbedtls/include/mbedtls/ssl_ticket.h
vendored
18
Externals/mbedtls/include/mbedtls/ssl_ticket.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief TLS server ticket callbacks implementation
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_SSL_TICKET_H
|
||||
#define MBEDTLS_SSL_TICKET_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -36,11 +34,11 @@
|
||||
* secrecy, when MBEDTLS_HAVE_TIME is defined.
|
||||
*/
|
||||
|
||||
#include "ssl.h"
|
||||
#include "cipher.h"
|
||||
#include "mbedtls/ssl.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
#include "threading.h"
|
||||
#include "mbedtls/threading.h"
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
@ -99,7 +97,7 @@ void mbedtls_ssl_ticket_init( mbedtls_ssl_ticket_context *ctx );
|
||||
* Recommended value: 86400 (one day).
|
||||
*
|
||||
* \note It is highly recommended to select a cipher that is at
|
||||
* least as strong as the the strongest ciphersuite
|
||||
* least as strong as the strongest ciphersuite
|
||||
* supported. Usually that means a 256-bit key.
|
||||
*
|
||||
* \note The lifetime of the keys is twice the lifetime of tickets.
|
||||
@ -117,14 +115,14 @@ int mbedtls_ssl_ticket_setup( mbedtls_ssl_ticket_context *ctx,
|
||||
/**
|
||||
* \brief Implementation of the ticket write callback
|
||||
*
|
||||
* \note See \c mbedlts_ssl_ticket_write_t for description
|
||||
* \note See \c mbedtls_ssl_ticket_write_t for description
|
||||
*/
|
||||
mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write;
|
||||
|
||||
/**
|
||||
* \brief Implementation of the ticket parse callback
|
||||
*
|
||||
* \note See \c mbedlts_ssl_ticket_parse_t for description
|
||||
* \note See \c mbedtls_ssl_ticket_parse_t for description
|
||||
*/
|
||||
mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse;
|
||||
|
||||
|
18
Externals/mbedtls/include/mbedtls/threading.h
vendored
18
Externals/mbedtls/include/mbedtls/threading.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Threading abstraction layer
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_THREADING_H
|
||||
#define MBEDTLS_THREADING_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -38,16 +36,22 @@ extern "C" {
|
||||
|
||||
/* MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE is deprecated and should not be
|
||||
* used. */
|
||||
#define MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE -0x001A /**< The selected feature is not available. */
|
||||
/** The selected feature is not available. */
|
||||
#define MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE -0x001A
|
||||
|
||||
#define MBEDTLS_ERR_THREADING_BAD_INPUT_DATA -0x001C /**< Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_THREADING_MUTEX_ERROR -0x001E /**< Locking / unlocking / free failed with error code. */
|
||||
/** Bad input parameters to function. */
|
||||
#define MBEDTLS_ERR_THREADING_BAD_INPUT_DATA -0x001C
|
||||
/** Locking / unlocking / free failed with error code. */
|
||||
#define MBEDTLS_ERR_THREADING_MUTEX_ERROR -0x001E
|
||||
|
||||
#if defined(MBEDTLS_THREADING_PTHREAD)
|
||||
#include <pthread.h>
|
||||
typedef struct mbedtls_threading_mutex_t
|
||||
{
|
||||
pthread_mutex_t mutex;
|
||||
/* is_valid is 0 after a failed init or a free, and nonzero after a
|
||||
* successful init. This field is not considered part of the public
|
||||
* API of Mbed TLS and may change without notice. */
|
||||
char is_valid;
|
||||
} mbedtls_threading_mutex_t;
|
||||
#endif
|
||||
|
6
Externals/mbedtls/include/mbedtls/timing.h
vendored
6
Externals/mbedtls/include/mbedtls/timing.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Portable interface to timeouts and to the CPU cycle counter
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_TIMING_H
|
||||
#define MBEDTLS_TIMING_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
16
Externals/mbedtls/include/mbedtls/version.h
vendored
16
Externals/mbedtls/include/mbedtls/version.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief Run-time version information
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,8 +18,6 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
/*
|
||||
* This set of compile-time defines and run-time variables can be used to
|
||||
@ -29,7 +27,7 @@
|
||||
#define MBEDTLS_VERSION_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -39,17 +37,17 @@
|
||||
* Major, Minor, Patchlevel
|
||||
*/
|
||||
#define MBEDTLS_VERSION_MAJOR 2
|
||||
#define MBEDTLS_VERSION_MINOR 16
|
||||
#define MBEDTLS_VERSION_PATCH 1
|
||||
#define MBEDTLS_VERSION_MINOR 28
|
||||
#define MBEDTLS_VERSION_PATCH 0
|
||||
|
||||
/**
|
||||
* The single version number has the following structure:
|
||||
* MMNNPP00
|
||||
* Major version | Minor version | Patch version
|
||||
*/
|
||||
#define MBEDTLS_VERSION_NUMBER 0x02100100
|
||||
#define MBEDTLS_VERSION_STRING "2.16.1"
|
||||
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.16.1"
|
||||
#define MBEDTLS_VERSION_NUMBER 0x021C0000
|
||||
#define MBEDTLS_VERSION_STRING "2.28.0"
|
||||
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.28.0"
|
||||
|
||||
#if defined(MBEDTLS_VERSION_C)
|
||||
|
||||
|
134
Externals/mbedtls/include/mbedtls/x509.h
vendored
134
Externals/mbedtls/include/mbedtls/x509.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief X.509 generic defines and structures
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,23 +18,21 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_X509_H
|
||||
#define MBEDTLS_X509_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "asn1.h"
|
||||
#include "pk.h"
|
||||
#include "mbedtls/asn1.h"
|
||||
#include "mbedtls/pk.h"
|
||||
|
||||
#if defined(MBEDTLS_RSA_C)
|
||||
#include "rsa.h"
|
||||
#include "mbedtls/rsa.h"
|
||||
#endif
|
||||
|
||||
/**
|
||||
@ -58,26 +56,46 @@
|
||||
* \name X509 Error codes
|
||||
* \{
|
||||
*/
|
||||
#define MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE -0x2080 /**< Unavailable feature, e.g. RSA hashing/encryption combination. */
|
||||
#define MBEDTLS_ERR_X509_UNKNOWN_OID -0x2100 /**< Requested OID is unknown. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_FORMAT -0x2180 /**< The CRT/CRL/CSR format is invalid, e.g. different type expected. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_VERSION -0x2200 /**< The CRT/CRL/CSR version element is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_SERIAL -0x2280 /**< The serial tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_ALG -0x2300 /**< The algorithm tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_NAME -0x2380 /**< The name tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_DATE -0x2400 /**< The date tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_SIGNATURE -0x2480 /**< The signature tag or value invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_EXTENSIONS -0x2500 /**< The extension tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_UNKNOWN_VERSION -0x2580 /**< CRT/CRL/CSR has an unsupported version number. */
|
||||
#define MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG -0x2600 /**< Signature algorithm (oid) is unsupported. */
|
||||
#define MBEDTLS_ERR_X509_SIG_MISMATCH -0x2680 /**< Signature algorithms do not match. (see \c ::mbedtls_x509_crt sig_oid) */
|
||||
#define MBEDTLS_ERR_X509_CERT_VERIFY_FAILED -0x2700 /**< Certificate verification failed, e.g. CRL, CA or signature check failed. */
|
||||
#define MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT -0x2780 /**< Format not recognized as DER or PEM. */
|
||||
#define MBEDTLS_ERR_X509_BAD_INPUT_DATA -0x2800 /**< Input invalid. */
|
||||
#define MBEDTLS_ERR_X509_ALLOC_FAILED -0x2880 /**< Allocation of memory failed. */
|
||||
#define MBEDTLS_ERR_X509_FILE_IO_ERROR -0x2900 /**< Read/write of file failed. */
|
||||
#define MBEDTLS_ERR_X509_BUFFER_TOO_SMALL -0x2980 /**< Destination buffer is too small. */
|
||||
#define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000 /**< A fatal error occured, eg the chain is too long or the vrfy callback failed. */
|
||||
/** Unavailable feature, e.g. RSA hashing/encryption combination. */
|
||||
#define MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE -0x2080
|
||||
/** Requested OID is unknown. */
|
||||
#define MBEDTLS_ERR_X509_UNKNOWN_OID -0x2100
|
||||
/** The CRT/CRL/CSR format is invalid, e.g. different type expected. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_FORMAT -0x2180
|
||||
/** The CRT/CRL/CSR version element is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_VERSION -0x2200
|
||||
/** The serial tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_SERIAL -0x2280
|
||||
/** The algorithm tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_ALG -0x2300
|
||||
/** The name tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_NAME -0x2380
|
||||
/** The date tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_DATE -0x2400
|
||||
/** The signature tag or value invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_SIGNATURE -0x2480
|
||||
/** The extension tag or value is invalid. */
|
||||
#define MBEDTLS_ERR_X509_INVALID_EXTENSIONS -0x2500
|
||||
/** CRT/CRL/CSR has an unsupported version number. */
|
||||
#define MBEDTLS_ERR_X509_UNKNOWN_VERSION -0x2580
|
||||
/** Signature algorithm (oid) is unsupported. */
|
||||
#define MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG -0x2600
|
||||
/** Signature algorithms do not match. (see \c ::mbedtls_x509_crt sig_oid) */
|
||||
#define MBEDTLS_ERR_X509_SIG_MISMATCH -0x2680
|
||||
/** Certificate verification failed, e.g. CRL, CA or signature check failed. */
|
||||
#define MBEDTLS_ERR_X509_CERT_VERIFY_FAILED -0x2700
|
||||
/** Format not recognized as DER or PEM. */
|
||||
#define MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT -0x2780
|
||||
/** Input invalid. */
|
||||
#define MBEDTLS_ERR_X509_BAD_INPUT_DATA -0x2800
|
||||
/** Allocation of memory failed. */
|
||||
#define MBEDTLS_ERR_X509_ALLOC_FAILED -0x2880
|
||||
/** Read/write of file failed. */
|
||||
#define MBEDTLS_ERR_X509_FILE_IO_ERROR -0x2900
|
||||
/** Destination buffer is too small. */
|
||||
#define MBEDTLS_ERR_X509_BUFFER_TOO_SMALL -0x2980
|
||||
/** A fatal error occurred, eg the chain is too long or the vrfy callback failed. */
|
||||
#define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000
|
||||
/* \} name */
|
||||
|
||||
/**
|
||||
@ -109,6 +127,28 @@
|
||||
/* \} name */
|
||||
/* \} addtogroup x509_module */
|
||||
|
||||
/*
|
||||
* X.509 v3 Subject Alternative Name types.
|
||||
* otherName [0] OtherName,
|
||||
* rfc822Name [1] IA5String,
|
||||
* dNSName [2] IA5String,
|
||||
* x400Address [3] ORAddress,
|
||||
* directoryName [4] Name,
|
||||
* ediPartyName [5] EDIPartyName,
|
||||
* uniformResourceIdentifier [6] IA5String,
|
||||
* iPAddress [7] OCTET STRING,
|
||||
* registeredID [8] OBJECT IDENTIFIER
|
||||
*/
|
||||
#define MBEDTLS_X509_SAN_OTHER_NAME 0
|
||||
#define MBEDTLS_X509_SAN_RFC822_NAME 1
|
||||
#define MBEDTLS_X509_SAN_DNS_NAME 2
|
||||
#define MBEDTLS_X509_SAN_X400_ADDRESS_NAME 3
|
||||
#define MBEDTLS_X509_SAN_DIRECTORY_NAME 4
|
||||
#define MBEDTLS_X509_SAN_EDI_PARTY_NAME 5
|
||||
#define MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER 6
|
||||
#define MBEDTLS_X509_SAN_IP_ADDRESS 7
|
||||
#define MBEDTLS_X509_SAN_REGISTERED_ID 8
|
||||
|
||||
/*
|
||||
* X.509 v3 Key Usage Extension flags
|
||||
* Reminder: update x509_info_key_usage() when adding new flags.
|
||||
@ -142,24 +182,26 @@
|
||||
*
|
||||
* Comments refer to the status for using certificates. Status can be
|
||||
* different for writing certificates or reading CRLs or CSRs.
|
||||
*
|
||||
* Those are defined in oid.h as oid.c needs them in a data structure. Since
|
||||
* these were previously defined here, let's have aliases for compatibility.
|
||||
*/
|
||||
#define MBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIER (1 << 0)
|
||||
#define MBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIER (1 << 1)
|
||||
#define MBEDTLS_X509_EXT_KEY_USAGE (1 << 2)
|
||||
#define MBEDTLS_X509_EXT_CERTIFICATE_POLICIES (1 << 3)
|
||||
#define MBEDTLS_X509_EXT_POLICY_MAPPINGS (1 << 4)
|
||||
#define MBEDTLS_X509_EXT_SUBJECT_ALT_NAME (1 << 5) /* Supported (DNS) */
|
||||
#define MBEDTLS_X509_EXT_ISSUER_ALT_NAME (1 << 6)
|
||||
#define MBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRS (1 << 7)
|
||||
#define MBEDTLS_X509_EXT_BASIC_CONSTRAINTS (1 << 8) /* Supported */
|
||||
#define MBEDTLS_X509_EXT_NAME_CONSTRAINTS (1 << 9)
|
||||
#define MBEDTLS_X509_EXT_POLICY_CONSTRAINTS (1 << 10)
|
||||
#define MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE (1 << 11)
|
||||
#define MBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTS (1 << 12)
|
||||
#define MBEDTLS_X509_EXT_INIHIBIT_ANYPOLICY (1 << 13)
|
||||
#define MBEDTLS_X509_EXT_FRESHEST_CRL (1 << 14)
|
||||
|
||||
#define MBEDTLS_X509_EXT_NS_CERT_TYPE (1 << 16)
|
||||
#define MBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIER MBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER
|
||||
#define MBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIER MBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER
|
||||
#define MBEDTLS_X509_EXT_KEY_USAGE MBEDTLS_OID_X509_EXT_KEY_USAGE
|
||||
#define MBEDTLS_X509_EXT_CERTIFICATE_POLICIES MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES
|
||||
#define MBEDTLS_X509_EXT_POLICY_MAPPINGS MBEDTLS_OID_X509_EXT_POLICY_MAPPINGS
|
||||
#define MBEDTLS_X509_EXT_SUBJECT_ALT_NAME MBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME /* Supported (DNS) */
|
||||
#define MBEDTLS_X509_EXT_ISSUER_ALT_NAME MBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME
|
||||
#define MBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRS MBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS
|
||||
#define MBEDTLS_X509_EXT_BASIC_CONSTRAINTS MBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS /* Supported */
|
||||
#define MBEDTLS_X509_EXT_NAME_CONSTRAINTS MBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS
|
||||
#define MBEDTLS_X509_EXT_POLICY_CONSTRAINTS MBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS
|
||||
#define MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE MBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE
|
||||
#define MBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTS MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS
|
||||
#define MBEDTLS_X509_EXT_INIHIBIT_ANYPOLICY MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY
|
||||
#define MBEDTLS_X509_EXT_FRESHEST_CRL MBEDTLS_OID_X509_EXT_FRESHEST_CRL
|
||||
#define MBEDTLS_X509_EXT_NS_CERT_TYPE MBEDTLS_OID_X509_EXT_NS_CERT_TYPE
|
||||
|
||||
/*
|
||||
* Storage format identifiers
|
||||
@ -250,7 +292,7 @@ int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *se
|
||||
*
|
||||
* \param to mbedtls_x509_time to check
|
||||
*
|
||||
* \return 1 if the given time is in the past or an error occured,
|
||||
* \return 1 if the given time is in the past or an error occurred,
|
||||
* 0 otherwise.
|
||||
*/
|
||||
int mbedtls_x509_time_is_past( const mbedtls_x509_time *to );
|
||||
@ -264,7 +306,7 @@ int mbedtls_x509_time_is_past( const mbedtls_x509_time *to );
|
||||
*
|
||||
* \param from mbedtls_x509_time to check
|
||||
*
|
||||
* \return 1 if the given time is in the future or an error occured,
|
||||
* \return 1 if the given time is in the future or an error occurred,
|
||||
* 0 otherwise.
|
||||
*/
|
||||
int mbedtls_x509_time_is_future( const mbedtls_x509_time *from );
|
||||
|
12
Externals/mbedtls/include/mbedtls/x509_crl.h
vendored
12
Externals/mbedtls/include/mbedtls/x509_crl.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief X.509 certificate revocation list parsing
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,19 +18,17 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_X509_CRL_H
|
||||
#define MBEDTLS_X509_CRL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "x509.h"
|
||||
#include "mbedtls/x509.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@ -111,7 +109,7 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
|
||||
/**
|
||||
* \brief Parse one or more CRLs and append them to the chained list
|
||||
*
|
||||
* \note Mutliple CRLs are accepted only if using PEM format
|
||||
* \note Multiple CRLs are accepted only if using PEM format
|
||||
*
|
||||
* \param chain points to the start of the chain
|
||||
* \param buf buffer holding the CRL data in PEM or DER format
|
||||
@ -126,7 +124,7 @@ int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, s
|
||||
/**
|
||||
* \brief Load one or more CRLs and append them to the chained list
|
||||
*
|
||||
* \note Mutliple CRLs are accepted only if using PEM format
|
||||
* \note Multiple CRLs are accepted only if using PEM format
|
||||
*
|
||||
* \param chain points to the start of the chain
|
||||
* \param path filename to read the CRLs from (in PEM or DER encoding)
|
||||
|
427
Externals/mbedtls/include/mbedtls/x509_crt.h
vendored
427
Externals/mbedtls/include/mbedtls/x509_crt.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief X.509 certificate parsing and writing
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,20 +18,19 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_X509_CRT_H
|
||||
#define MBEDTLS_X509_CRT_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "x509.h"
|
||||
#include "x509_crl.h"
|
||||
#include "mbedtls/x509.h"
|
||||
#include "mbedtls/x509_crl.h"
|
||||
#include "mbedtls/bignum.h"
|
||||
|
||||
/**
|
||||
* \addtogroup x509_module
|
||||
@ -52,6 +51,8 @@ extern "C" {
|
||||
*/
|
||||
typedef struct mbedtls_x509_crt
|
||||
{
|
||||
int own_buffer; /**< Indicates if \c raw is owned
|
||||
* by the structure or not. */
|
||||
mbedtls_x509_buf raw; /**< The raw certificate data (DER). */
|
||||
mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */
|
||||
|
||||
@ -68,12 +69,15 @@ typedef struct mbedtls_x509_crt
|
||||
mbedtls_x509_time valid_from; /**< Start time of certificate validity. */
|
||||
mbedtls_x509_time valid_to; /**< End time of certificate validity. */
|
||||
|
||||
mbedtls_x509_buf pk_raw;
|
||||
mbedtls_pk_context pk; /**< Container for the public key context. */
|
||||
|
||||
mbedtls_x509_buf issuer_id; /**< Optional X.509 v2/v3 issuer unique identifier. */
|
||||
mbedtls_x509_buf subject_id; /**< Optional X.509 v2/v3 subject unique identifier. */
|
||||
mbedtls_x509_buf v3_ext; /**< Optional X.509 v3 extensions. */
|
||||
mbedtls_x509_sequence subject_alt_names; /**< Optional list of Subject Alternative Names (Only dNSName supported). */
|
||||
mbedtls_x509_sequence subject_alt_names; /**< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). */
|
||||
|
||||
mbedtls_x509_sequence certificate_policies; /**< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). */
|
||||
|
||||
int ext_types; /**< Bit string containing detected and parsed extensions */
|
||||
int ca_istrue; /**< Optional Basic Constraint extension value: 1 if this certificate belongs to a CA, 0 otherwise. */
|
||||
@ -94,11 +98,58 @@ typedef struct mbedtls_x509_crt
|
||||
}
|
||||
mbedtls_x509_crt;
|
||||
|
||||
/**
|
||||
* From RFC 5280 section 4.2.1.6:
|
||||
* OtherName ::= SEQUENCE {
|
||||
* type-id OBJECT IDENTIFIER,
|
||||
* value [0] EXPLICIT ANY DEFINED BY type-id }
|
||||
*/
|
||||
typedef struct mbedtls_x509_san_other_name
|
||||
{
|
||||
/**
|
||||
* The type_id is an OID as deifned in RFC 5280.
|
||||
* To check the value of the type id, you should use
|
||||
* \p MBEDTLS_OID_CMP with a known OID mbedtls_x509_buf.
|
||||
*/
|
||||
mbedtls_x509_buf type_id; /**< The type id. */
|
||||
union
|
||||
{
|
||||
/**
|
||||
* From RFC 4108 section 5:
|
||||
* HardwareModuleName ::= SEQUENCE {
|
||||
* hwType OBJECT IDENTIFIER,
|
||||
* hwSerialNum OCTET STRING }
|
||||
*/
|
||||
struct
|
||||
{
|
||||
mbedtls_x509_buf oid; /**< The object identifier. */
|
||||
mbedtls_x509_buf val; /**< The named value. */
|
||||
}
|
||||
hardware_module_name;
|
||||
}
|
||||
value;
|
||||
}
|
||||
mbedtls_x509_san_other_name;
|
||||
|
||||
/**
|
||||
* A structure for holding the parsed Subject Alternative Name, according to type
|
||||
*/
|
||||
typedef struct mbedtls_x509_subject_alternative_name
|
||||
{
|
||||
int type; /**< The SAN type, value of MBEDTLS_X509_SAN_XXX. */
|
||||
union {
|
||||
mbedtls_x509_san_other_name other_name; /**< The otherName supported type. */
|
||||
mbedtls_x509_buf unstructured_name; /**< The buffer for the un constructed types. Only dnsName currently supported */
|
||||
}
|
||||
san; /**< A union of the supported SAN types */
|
||||
}
|
||||
mbedtls_x509_subject_alternative_name;
|
||||
|
||||
/**
|
||||
* Build flag from an algorithm/curve identifier (pk, md, ecp)
|
||||
* Since 0 is always XXX_NONE, ignore it.
|
||||
*/
|
||||
#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( id - 1 ) )
|
||||
#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( (id) - 1 ) )
|
||||
|
||||
/**
|
||||
* Security profile for certificate verification.
|
||||
@ -163,6 +214,14 @@ typedef struct
|
||||
{
|
||||
mbedtls_x509_crt_verify_chain_item items[MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE];
|
||||
unsigned len;
|
||||
|
||||
#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
|
||||
/* This stores the list of potential trusted signers obtained from
|
||||
* the CA callback used for the CRT verification, if configured.
|
||||
* We must track it somewhere because the callback passes its
|
||||
* ownership to the caller. */
|
||||
mbedtls_x509_crt *trust_ca_cb_result;
|
||||
#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
|
||||
} mbedtls_x509_crt_verify_chain;
|
||||
|
||||
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
|
||||
@ -204,12 +263,21 @@ typedef void mbedtls_x509_crt_restart_ctx;
|
||||
/**
|
||||
* Default security profile. Should provide a good balance between security
|
||||
* and compatibility with current deployments.
|
||||
*
|
||||
* This profile permits:
|
||||
* - SHA2 hashes.
|
||||
* - All supported elliptic curves.
|
||||
* - RSA with 2048 bits and above.
|
||||
*
|
||||
* New minor versions of Mbed TLS may extend this profile, for example if
|
||||
* new curves are added to the library. New minor versions of Mbed TLS will
|
||||
* not reduce this profile unless serious security concerns require it.
|
||||
*/
|
||||
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default;
|
||||
|
||||
/**
|
||||
* Expected next default profile. Recommended for new deployments.
|
||||
* Currently targets a 128-bit security level, except for RSA-2048.
|
||||
* Currently targets a 128-bit security level, except for allowing RSA-2048.
|
||||
*/
|
||||
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next;
|
||||
|
||||
@ -220,16 +288,142 @@ extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb;
|
||||
|
||||
/**
|
||||
* \brief Parse a single DER formatted certificate and add it
|
||||
* to the chained list.
|
||||
* to the end of the provided chained list.
|
||||
*
|
||||
* \param chain points to the start of the chain
|
||||
* \param buf buffer holding the certificate DER data
|
||||
* \param buflen size of the buffer
|
||||
* \param chain The pointer to the start of the CRT chain to attach to.
|
||||
* When parsing the first CRT in a chain, this should point
|
||||
* to an instance of ::mbedtls_x509_crt initialized through
|
||||
* mbedtls_x509_crt_init().
|
||||
* \param buf The buffer holding the DER encoded certificate.
|
||||
* \param buflen The size in Bytes of \p buf.
|
||||
*
|
||||
* \return 0 if successful, or a specific X509 or PEM error code
|
||||
* \note This function makes an internal copy of the CRT buffer
|
||||
* \p buf. In particular, \p buf may be destroyed or reused
|
||||
* after this call returns. To avoid duplicating the CRT
|
||||
* buffer (at the cost of stricter lifetime constraints),
|
||||
* use mbedtls_x509_crt_parse_der_nocopy() instead.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return A negative error code on failure.
|
||||
*/
|
||||
int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, const unsigned char *buf,
|
||||
size_t buflen );
|
||||
int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain,
|
||||
const unsigned char *buf,
|
||||
size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief The type of certificate extension callbacks.
|
||||
*
|
||||
* Callbacks of this type are passed to and used by the
|
||||
* mbedtls_x509_crt_parse_der_with_ext_cb() routine when
|
||||
* it encounters either an unsupported extension or a
|
||||
* "certificate policies" extension containing any
|
||||
* unsupported certificate policies.
|
||||
* Future versions of the library may invoke the callback
|
||||
* in other cases, if and when the need arises.
|
||||
*
|
||||
* \param p_ctx An opaque context passed to the callback.
|
||||
* \param crt The certificate being parsed.
|
||||
* \param oid The OID of the extension.
|
||||
* \param critical Whether the extension is critical.
|
||||
* \param p Pointer to the start of the extension value
|
||||
* (the content of the OCTET STRING).
|
||||
* \param end End of extension value.
|
||||
*
|
||||
* \note The callback must fail and return a negative error code
|
||||
* if it can not parse or does not support the extension.
|
||||
* When the callback fails to parse a critical extension
|
||||
* mbedtls_x509_crt_parse_der_with_ext_cb() also fails.
|
||||
* When the callback fails to parse a non critical extension
|
||||
* mbedtls_x509_crt_parse_der_with_ext_cb() simply skips
|
||||
* the extension and continues parsing.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return A negative error code on failure.
|
||||
*/
|
||||
typedef int (*mbedtls_x509_crt_ext_cb_t)( void *p_ctx,
|
||||
mbedtls_x509_crt const *crt,
|
||||
mbedtls_x509_buf const *oid,
|
||||
int critical,
|
||||
const unsigned char *p,
|
||||
const unsigned char *end );
|
||||
|
||||
/**
|
||||
* \brief Parse a single DER formatted certificate and add it
|
||||
* to the end of the provided chained list.
|
||||
*
|
||||
* \param chain The pointer to the start of the CRT chain to attach to.
|
||||
* When parsing the first CRT in a chain, this should point
|
||||
* to an instance of ::mbedtls_x509_crt initialized through
|
||||
* mbedtls_x509_crt_init().
|
||||
* \param buf The buffer holding the DER encoded certificate.
|
||||
* \param buflen The size in Bytes of \p buf.
|
||||
* \param make_copy When not zero this function makes an internal copy of the
|
||||
* CRT buffer \p buf. In particular, \p buf may be destroyed
|
||||
* or reused after this call returns.
|
||||
* When zero this function avoids duplicating the CRT buffer
|
||||
* by taking temporary ownership thereof until the CRT
|
||||
* is destroyed (like mbedtls_x509_crt_parse_der_nocopy())
|
||||
* \param cb A callback invoked for every unsupported certificate
|
||||
* extension.
|
||||
* \param p_ctx An opaque context passed to the callback.
|
||||
*
|
||||
* \note This call is functionally equivalent to
|
||||
* mbedtls_x509_crt_parse_der(), and/or
|
||||
* mbedtls_x509_crt_parse_der_nocopy()
|
||||
* but it calls the callback with every unsupported
|
||||
* certificate extension and additionally the
|
||||
* "certificate policies" extension if it contains any
|
||||
* unsupported certificate policies.
|
||||
* The callback must return a negative error code if it
|
||||
* does not know how to handle such an extension.
|
||||
* When the callback fails to parse a critical extension
|
||||
* mbedtls_x509_crt_parse_der_with_ext_cb() also fails.
|
||||
* When the callback fails to parse a non critical extension
|
||||
* mbedtls_x509_crt_parse_der_with_ext_cb() simply skips
|
||||
* the extension and continues parsing.
|
||||
* Future versions of the library may invoke the callback
|
||||
* in other cases, if and when the need arises.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return A negative error code on failure.
|
||||
*/
|
||||
int mbedtls_x509_crt_parse_der_with_ext_cb( mbedtls_x509_crt *chain,
|
||||
const unsigned char *buf,
|
||||
size_t buflen,
|
||||
int make_copy,
|
||||
mbedtls_x509_crt_ext_cb_t cb,
|
||||
void *p_ctx );
|
||||
|
||||
/**
|
||||
* \brief Parse a single DER formatted certificate and add it
|
||||
* to the end of the provided chained list. This is a
|
||||
* variant of mbedtls_x509_crt_parse_der() which takes
|
||||
* temporary ownership of the CRT buffer until the CRT
|
||||
* is destroyed.
|
||||
*
|
||||
* \param chain The pointer to the start of the CRT chain to attach to.
|
||||
* When parsing the first CRT in a chain, this should point
|
||||
* to an instance of ::mbedtls_x509_crt initialized through
|
||||
* mbedtls_x509_crt_init().
|
||||
* \param buf The address of the readable buffer holding the DER encoded
|
||||
* certificate to use. On success, this buffer must be
|
||||
* retained and not be changed for the liftetime of the
|
||||
* CRT chain \p chain, that is, until \p chain is destroyed
|
||||
* through a call to mbedtls_x509_crt_free().
|
||||
* \param buflen The size in Bytes of \p buf.
|
||||
*
|
||||
* \note This call is functionally equivalent to
|
||||
* mbedtls_x509_crt_parse_der(), but it avoids creating a
|
||||
* copy of the input buffer at the cost of stronger lifetime
|
||||
* constraints. This is useful in constrained environments
|
||||
* where duplication of the CRT cannot be tolerated.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return A negative error code on failure.
|
||||
*/
|
||||
int mbedtls_x509_crt_parse_der_nocopy( mbedtls_x509_crt *chain,
|
||||
const unsigned char *buf,
|
||||
size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief Parse one DER-encoded or one or more concatenated PEM-encoded
|
||||
@ -293,8 +487,37 @@ int mbedtls_x509_crt_parse_file( mbedtls_x509_crt *chain, const char *path );
|
||||
* if partly successful or a specific X509 or PEM error code
|
||||
*/
|
||||
int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path );
|
||||
#endif /* MBEDTLS_FS_IO */
|
||||
|
||||
#endif /* MBEDTLS_FS_IO */
|
||||
/**
|
||||
* \brief This function parses an item in the SubjectAlternativeNames
|
||||
* extension.
|
||||
*
|
||||
* \param san_buf The buffer holding the raw data item of the subject
|
||||
* alternative name.
|
||||
* \param san The target structure to populate with the parsed presentation
|
||||
* of the subject alternative name encoded in \p san_raw.
|
||||
*
|
||||
* \note Only "dnsName" and "otherName" of type hardware_module_name
|
||||
* as defined in RFC 4180 is supported.
|
||||
*
|
||||
* \note This function should be called on a single raw data of
|
||||
* subject alternative name. For example, after successful
|
||||
* certificate parsing, one must iterate on every item in the
|
||||
* \p crt->subject_alt_names sequence, and pass it to
|
||||
* this function.
|
||||
*
|
||||
* \warning The target structure contains pointers to the raw data of the
|
||||
* parsed certificate, and its lifetime is restricted by the
|
||||
* lifetime of the certificate.
|
||||
*
|
||||
* \return \c 0 on success
|
||||
* \return #MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE for an unsupported
|
||||
* SAN type.
|
||||
* \return Another negative value for any other failure.
|
||||
*/
|
||||
int mbedtls_x509_parse_subject_alt_name( const mbedtls_x509_buf *san_buf,
|
||||
mbedtls_x509_subject_alternative_name *san );
|
||||
/**
|
||||
* \brief Returns an informational string about the
|
||||
* certificate.
|
||||
@ -326,7 +549,7 @@ int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix,
|
||||
uint32_t flags );
|
||||
|
||||
/**
|
||||
* \brief Verify the certificate signature
|
||||
* \brief Verify a chain of certificates.
|
||||
*
|
||||
* The verify callback is a user-supplied callback that
|
||||
* can clear / modify / add flags for a certificate. If set,
|
||||
@ -366,22 +589,30 @@ int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix,
|
||||
* specific peers you know) - in that case, the self-signed
|
||||
* certificate doesn't need to have the CA bit set.
|
||||
*
|
||||
* \param crt a certificate (chain) to be verified
|
||||
* \param trust_ca the list of trusted CAs (see note above)
|
||||
* \param ca_crl the list of CRLs for trusted CAs (see note above)
|
||||
* \param cn expected Common Name (can be set to
|
||||
* NULL if the CN must not be verified)
|
||||
* \param flags result of the verification
|
||||
* \param f_vrfy verification function
|
||||
* \param p_vrfy verification parameter
|
||||
* \param crt The certificate chain to be verified.
|
||||
* \param trust_ca The list of trusted CAs.
|
||||
* \param ca_crl The list of CRLs for trusted CAs.
|
||||
* \param cn The expected Common Name. This will be checked to be
|
||||
* present in the certificate's subjectAltNames extension or,
|
||||
* if this extension is absent, as a CN component in its
|
||||
* Subject name. Currently only DNS names are supported. This
|
||||
* may be \c NULL if the CN need not be verified.
|
||||
* \param flags The address at which to store the result of the verification.
|
||||
* If the verification couldn't be completed, the flag value is
|
||||
* set to (uint32_t) -1.
|
||||
* \param f_vrfy The verification callback to use. See the documentation
|
||||
* of mbedtls_x509_crt_verify() for more information.
|
||||
* \param p_vrfy The context to be passed to \p f_vrfy.
|
||||
*
|
||||
* \return 0 (and flags set to 0) if the chain was verified and valid,
|
||||
* MBEDTLS_ERR_X509_CERT_VERIFY_FAILED if the chain was verified
|
||||
* but found to be invalid, in which case *flags will have one
|
||||
* or more MBEDTLS_X509_BADCERT_XXX or MBEDTLS_X509_BADCRL_XXX
|
||||
* flags set, or another error (and flags set to 0xffffffff)
|
||||
* in case of a fatal error encountered during the
|
||||
* verification process.
|
||||
* \return \c 0 if the chain is valid with respect to the
|
||||
* passed CN, CAs, CRLs and security profile.
|
||||
* \return #MBEDTLS_ERR_X509_CERT_VERIFY_FAILED in case the
|
||||
* certificate chain verification failed. In this case,
|
||||
* \c *flags will have one or more
|
||||
* \c MBEDTLS_X509_BADCERT_XXX or \c MBEDTLS_X509_BADCRL_XXX
|
||||
* flags set.
|
||||
* \return Another negative error code in case of a fatal error
|
||||
* encountered during the verification process.
|
||||
*/
|
||||
int mbedtls_x509_crt_verify( mbedtls_x509_crt *crt,
|
||||
mbedtls_x509_crt *trust_ca,
|
||||
@ -391,7 +622,8 @@ int mbedtls_x509_crt_verify( mbedtls_x509_crt *crt,
|
||||
void *p_vrfy );
|
||||
|
||||
/**
|
||||
* \brief Verify the certificate signature according to profile
|
||||
* \brief Verify a chain of certificates with respect to
|
||||
* a configurable security profile.
|
||||
*
|
||||
* \note Same as \c mbedtls_x509_crt_verify(), but with explicit
|
||||
* security profile.
|
||||
@ -400,22 +632,28 @@ int mbedtls_x509_crt_verify( mbedtls_x509_crt *crt,
|
||||
* for ECDSA) apply to all certificates: trusted root,
|
||||
* intermediate CAs if any, and end entity certificate.
|
||||
*
|
||||
* \param crt a certificate (chain) to be verified
|
||||
* \param trust_ca the list of trusted CAs
|
||||
* \param ca_crl the list of CRLs for trusted CAs
|
||||
* \param profile security profile for verification
|
||||
* \param cn expected Common Name (can be set to
|
||||
* NULL if the CN must not be verified)
|
||||
* \param flags result of the verification
|
||||
* \param f_vrfy verification function
|
||||
* \param p_vrfy verification parameter
|
||||
* \param crt The certificate chain to be verified.
|
||||
* \param trust_ca The list of trusted CAs.
|
||||
* \param ca_crl The list of CRLs for trusted CAs.
|
||||
* \param profile The security profile to use for the verification.
|
||||
* \param cn The expected Common Name. This may be \c NULL if the
|
||||
* CN need not be verified.
|
||||
* \param flags The address at which to store the result of the verification.
|
||||
* If the verification couldn't be completed, the flag value is
|
||||
* set to (uint32_t) -1.
|
||||
* \param f_vrfy The verification callback to use. See the documentation
|
||||
* of mbedtls_x509_crt_verify() for more information.
|
||||
* \param p_vrfy The context to be passed to \p f_vrfy.
|
||||
*
|
||||
* \return 0 if successful or MBEDTLS_ERR_X509_CERT_VERIFY_FAILED
|
||||
* in which case *flags will have one or more
|
||||
* MBEDTLS_X509_BADCERT_XXX or MBEDTLS_X509_BADCRL_XXX flags
|
||||
* set,
|
||||
* or another error in case of a fatal error encountered
|
||||
* during the verification process.
|
||||
* \return \c 0 if the chain is valid with respect to the
|
||||
* passed CN, CAs, CRLs and security profile.
|
||||
* \return #MBEDTLS_ERR_X509_CERT_VERIFY_FAILED in case the
|
||||
* certificate chain verification failed. In this case,
|
||||
* \c *flags will have one or more
|
||||
* \c MBEDTLS_X509_BADCERT_XXX or \c MBEDTLS_X509_BADCRL_XXX
|
||||
* flags set.
|
||||
* \return Another negative error code in case of a fatal error
|
||||
* encountered during the verification process.
|
||||
*/
|
||||
int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt,
|
||||
mbedtls_x509_crt *trust_ca,
|
||||
@ -432,16 +670,20 @@ int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt,
|
||||
* but can return early and restart according to the limit
|
||||
* set with \c mbedtls_ecp_set_max_ops() to reduce blocking.
|
||||
*
|
||||
* \param crt a certificate (chain) to be verified
|
||||
* \param trust_ca the list of trusted CAs
|
||||
* \param ca_crl the list of CRLs for trusted CAs
|
||||
* \param profile security profile for verification
|
||||
* \param cn expected Common Name (can be set to
|
||||
* NULL if the CN must not be verified)
|
||||
* \param flags result of the verification
|
||||
* \param f_vrfy verification function
|
||||
* \param p_vrfy verification parameter
|
||||
* \param rs_ctx restart context (NULL to disable restart)
|
||||
* \param crt The certificate chain to be verified.
|
||||
* \param trust_ca The list of trusted CAs.
|
||||
* \param ca_crl The list of CRLs for trusted CAs.
|
||||
* \param profile The security profile to use for the verification.
|
||||
* \param cn The expected Common Name. This may be \c NULL if the
|
||||
* CN need not be verified.
|
||||
* \param flags The address at which to store the result of the verification.
|
||||
* If the verification couldn't be completed, the flag value is
|
||||
* set to (uint32_t) -1.
|
||||
* \param f_vrfy The verification callback to use. See the documentation
|
||||
* of mbedtls_x509_crt_verify() for more information.
|
||||
* \param p_vrfy The context to be passed to \p f_vrfy.
|
||||
* \param rs_ctx The restart context to use. This may be set to \c NULL
|
||||
* to disable restartable ECC.
|
||||
*
|
||||
* \return See \c mbedtls_crt_verify_with_profile(), or
|
||||
* \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of
|
||||
@ -456,6 +698,73 @@ int mbedtls_x509_crt_verify_restartable( mbedtls_x509_crt *crt,
|
||||
void *p_vrfy,
|
||||
mbedtls_x509_crt_restart_ctx *rs_ctx );
|
||||
|
||||
/**
|
||||
* \brief The type of trusted certificate callbacks.
|
||||
*
|
||||
* Callbacks of this type are passed to and used by the CRT
|
||||
* verification routine mbedtls_x509_crt_verify_with_ca_cb()
|
||||
* when looking for trusted signers of a given certificate.
|
||||
*
|
||||
* On success, the callback returns a list of trusted
|
||||
* certificates to be considered as potential signers
|
||||
* for the input certificate.
|
||||
*
|
||||
* \param p_ctx An opaque context passed to the callback.
|
||||
* \param child The certificate for which to search a potential signer.
|
||||
* This will point to a readable certificate.
|
||||
* \param candidate_cas The address at which to store the address of the first
|
||||
* entry in the generated linked list of candidate signers.
|
||||
* This will not be \c NULL.
|
||||
*
|
||||
* \note The callback must only return a non-zero value on a
|
||||
* fatal error. If, in contrast, the search for a potential
|
||||
* signer completes without a single candidate, the
|
||||
* callback must return \c 0 and set \c *candidate_cas
|
||||
* to \c NULL.
|
||||
*
|
||||
* \return \c 0 on success. In this case, \c *candidate_cas points
|
||||
* to a heap-allocated linked list of instances of
|
||||
* ::mbedtls_x509_crt, and ownership of this list is passed
|
||||
* to the caller.
|
||||
* \return A negative error code on failure.
|
||||
*/
|
||||
typedef int (*mbedtls_x509_crt_ca_cb_t)( void *p_ctx,
|
||||
mbedtls_x509_crt const *child,
|
||||
mbedtls_x509_crt **candidate_cas );
|
||||
|
||||
#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
|
||||
/**
|
||||
* \brief Version of \c mbedtls_x509_crt_verify_with_profile() which
|
||||
* uses a callback to acquire the list of trusted CA
|
||||
* certificates.
|
||||
*
|
||||
* \param crt The certificate chain to be verified.
|
||||
* \param f_ca_cb The callback to be used to query for potential signers
|
||||
* of a given child certificate. See the documentation of
|
||||
* ::mbedtls_x509_crt_ca_cb_t for more information.
|
||||
* \param p_ca_cb The opaque context to be passed to \p f_ca_cb.
|
||||
* \param profile The security profile for the verification.
|
||||
* \param cn The expected Common Name. This may be \c NULL if the
|
||||
* CN need not be verified.
|
||||
* \param flags The address at which to store the result of the verification.
|
||||
* If the verification couldn't be completed, the flag value is
|
||||
* set to (uint32_t) -1.
|
||||
* \param f_vrfy The verification callback to use. See the documentation
|
||||
* of mbedtls_x509_crt_verify() for more information.
|
||||
* \param p_vrfy The context to be passed to \p f_vrfy.
|
||||
*
|
||||
* \return See \c mbedtls_crt_verify_with_profile().
|
||||
*/
|
||||
int mbedtls_x509_crt_verify_with_ca_cb( mbedtls_x509_crt *crt,
|
||||
mbedtls_x509_crt_ca_cb_t f_ca_cb,
|
||||
void *p_ca_cb,
|
||||
const mbedtls_x509_crt_profile *profile,
|
||||
const char *cn, uint32_t *flags,
|
||||
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
|
||||
void *p_vrfy );
|
||||
|
||||
#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
|
||||
|
||||
#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
|
||||
/**
|
||||
* \brief Check usage of certificate against keyUsage extension.
|
||||
|
8
Externals/mbedtls/include/mbedtls/x509_csr.h
vendored
8
Externals/mbedtls/include/mbedtls/x509_csr.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief X.509 certificate signing request parsing and writing
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,19 +18,17 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_X509_CSR_H
|
||||
#define MBEDTLS_X509_CSR_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "x509.h"
|
||||
#include "mbedtls/x509.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
12
Externals/mbedtls/include/mbedtls/xtea.h
vendored
12
Externals/mbedtls/include/mbedtls/xtea.h
vendored
@ -4,7 +4,7 @@
|
||||
* \brief XTEA block cipher (32-bit)
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
@ -18,14 +18,12 @@
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#ifndef MBEDTLS_XTEA_H
|
||||
#define MBEDTLS_XTEA_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
@ -36,10 +34,12 @@
|
||||
#define MBEDTLS_XTEA_ENCRYPT 1
|
||||
#define MBEDTLS_XTEA_DECRYPT 0
|
||||
|
||||
#define MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH -0x0028 /**< The data input has an invalid length. */
|
||||
/** The data input has an invalid length. */
|
||||
#define MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH -0x0028
|
||||
|
||||
/* MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED is deprecated and should not be used. */
|
||||
#define MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED -0x0029 /**< XTEA hardware accelerator failed. */
|
||||
/** XTEA hardware accelerator failed. */
|
||||
#define MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED -0x0029
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
3956
Externals/mbedtls/include/psa/crypto.h
vendored
Normal file
3956
Externals/mbedtls/include/psa/crypto.h
vendored
Normal file
File diff suppressed because it is too large
Load Diff
79
Externals/mbedtls/include/psa/crypto_builtin_composites.h
vendored
Normal file
79
Externals/mbedtls/include/psa/crypto_builtin_composites.h
vendored
Normal file
@ -0,0 +1,79 @@
|
||||
/*
|
||||
* Context structure declaration of the Mbed TLS software-based PSA drivers
|
||||
* called through the PSA Crypto driver dispatch layer.
|
||||
* This file contains the context structures of those algorithms which need to
|
||||
* rely on other algorithms, i.e. are 'composite' algorithms.
|
||||
*
|
||||
* \note This file may not be included directly. Applications must
|
||||
* include psa/crypto.h.
|
||||
*
|
||||
* \note This header and its content is not part of the Mbed TLS API and
|
||||
* applications must not depend on it. Its main purpose is to define the
|
||||
* multi-part state objects of the Mbed TLS software-based PSA drivers. The
|
||||
* definition of these objects are then used by crypto_struct.h to define the
|
||||
* implementation-defined types of PSA multi-part state objects.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_BUILTIN_COMPOSITES_H
|
||||
#define PSA_CRYPTO_BUILTIN_COMPOSITES_H
|
||||
|
||||
#include <psa/crypto_driver_common.h>
|
||||
|
||||
/*
|
||||
* MAC multi-part operation definitions.
|
||||
*/
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
|
||||
#define MBEDTLS_PSA_BUILTIN_MAC
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) || defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
typedef struct
|
||||
{
|
||||
/** The HMAC algorithm in use */
|
||||
psa_algorithm_t alg;
|
||||
/** The hash context. */
|
||||
struct psa_hash_operation_s hash_ctx;
|
||||
/** The HMAC part of the context. */
|
||||
uint8_t opad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
|
||||
} mbedtls_psa_hmac_operation_t;
|
||||
|
||||
#define MBEDTLS_PSA_HMAC_OPERATION_INIT {0, PSA_HASH_OPERATION_INIT, {0}}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
|
||||
|
||||
#include "mbedtls/cmac.h"
|
||||
|
||||
typedef struct
|
||||
{
|
||||
psa_algorithm_t alg;
|
||||
union
|
||||
{
|
||||
unsigned dummy; /* Make the union non-empty even with no supported algorithms. */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) || defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
mbedtls_psa_hmac_operation_t hmac;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) || defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
mbedtls_cipher_context_t cmac;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
|
||||
} ctx;
|
||||
} mbedtls_psa_mac_operation_t;
|
||||
|
||||
#define MBEDTLS_PSA_MAC_OPERATION_INIT {0, {0}}
|
||||
|
||||
#endif /* PSA_CRYPTO_BUILTIN_COMPOSITES_H */
|
126
Externals/mbedtls/include/psa/crypto_builtin_primitives.h
vendored
Normal file
126
Externals/mbedtls/include/psa/crypto_builtin_primitives.h
vendored
Normal file
@ -0,0 +1,126 @@
|
||||
/*
|
||||
* Context structure declaration of the Mbed TLS software-based PSA drivers
|
||||
* called through the PSA Crypto driver dispatch layer.
|
||||
* This file contains the context structures of those algorithms which do not
|
||||
* rely on other algorithms, i.e. are 'primitive' algorithms.
|
||||
*
|
||||
* \note This file may not be included directly. Applications must
|
||||
* include psa/crypto.h.
|
||||
*
|
||||
* \note This header and its content is not part of the Mbed TLS API and
|
||||
* applications must not depend on it. Its main purpose is to define the
|
||||
* multi-part state objects of the Mbed TLS software-based PSA drivers. The
|
||||
* definition of these objects are then used by crypto_struct.h to define the
|
||||
* implementation-defined types of PSA multi-part state objects.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_BUILTIN_PRIMITIVES_H
|
||||
#define PSA_CRYPTO_BUILTIN_PRIMITIVES_H
|
||||
|
||||
#include <psa/crypto_driver_common.h>
|
||||
|
||||
/*
|
||||
* Hash multi-part operation definitions.
|
||||
*/
|
||||
|
||||
#include "mbedtls/md2.h"
|
||||
#include "mbedtls/md4.h"
|
||||
#include "mbedtls/md5.h"
|
||||
#include "mbedtls/ripemd160.h"
|
||||
#include "mbedtls/sha1.h"
|
||||
#include "mbedtls/sha256.h"
|
||||
#include "mbedtls/sha512.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_MD4) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_MD5) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
|
||||
#define MBEDTLS_PSA_BUILTIN_HASH
|
||||
#endif
|
||||
|
||||
typedef struct
|
||||
{
|
||||
psa_algorithm_t alg;
|
||||
union
|
||||
{
|
||||
unsigned dummy; /* Make the union non-empty even with no supported algorithms. */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
|
||||
mbedtls_md2_context md2;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
|
||||
mbedtls_md4_context md4;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
|
||||
mbedtls_md5_context md5;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
|
||||
mbedtls_ripemd160_context ripemd160;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
|
||||
mbedtls_sha1_context sha1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
|
||||
mbedtls_sha256_context sha256;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
|
||||
mbedtls_sha512_context sha512;
|
||||
#endif
|
||||
} ctx;
|
||||
} mbedtls_psa_hash_operation_t;
|
||||
|
||||
#define MBEDTLS_PSA_HASH_OPERATION_INIT {0, {0}}
|
||||
|
||||
/*
|
||||
* Cipher multi-part operation definitions.
|
||||
*/
|
||||
|
||||
#include "mbedtls/cipher.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_CTR) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_CFB) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_OFB) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_XTS) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7)
|
||||
#define MBEDTLS_PSA_BUILTIN_CIPHER 1
|
||||
#endif
|
||||
|
||||
typedef struct {
|
||||
/* Context structure for the Mbed TLS cipher implementation. */
|
||||
psa_algorithm_t alg;
|
||||
uint8_t iv_length;
|
||||
uint8_t block_length;
|
||||
union {
|
||||
unsigned int dummy;
|
||||
mbedtls_cipher_context_t cipher;
|
||||
} ctx;
|
||||
} mbedtls_psa_cipher_operation_t;
|
||||
|
||||
#define MBEDTLS_PSA_CIPHER_OPERATION_INIT {0, 0, 0, {0}}
|
||||
|
||||
#endif /* PSA_CRYPTO_BUILTIN_PRIMITIVES_H */
|
528
Externals/mbedtls/include/psa/crypto_compat.h
vendored
Normal file
528
Externals/mbedtls/include/psa/crypto_compat.h
vendored
Normal file
@ -0,0 +1,528 @@
|
||||
/**
|
||||
* \file psa/crypto_compat.h
|
||||
*
|
||||
* \brief PSA cryptography module: Backward compatibility aliases
|
||||
*
|
||||
* This header declares alternative names for macro and functions.
|
||||
* New application code should not use these names.
|
||||
* These names may be removed in a future version of Mbed Crypto.
|
||||
*
|
||||
* \note This file may not be included directly. Applications must
|
||||
* include psa/crypto.h.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_COMPAT_H
|
||||
#define PSA_CRYPTO_COMPAT_H
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
* To support both openless APIs and psa_open_key() temporarily, define
|
||||
* psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Do not mark the
|
||||
* type and its utility macros and functions deprecated yet. This will be done
|
||||
* in a subsequent phase.
|
||||
*/
|
||||
typedef mbedtls_svc_key_id_t psa_key_handle_t;
|
||||
|
||||
#define PSA_KEY_HANDLE_INIT MBEDTLS_SVC_KEY_ID_INIT
|
||||
|
||||
/** Check whether an handle is null.
|
||||
*
|
||||
* \param handle Handle
|
||||
*
|
||||
* \return Non-zero if the handle is null, zero otherwise.
|
||||
*/
|
||||
static inline int psa_key_handle_is_null( psa_key_handle_t handle )
|
||||
{
|
||||
return( mbedtls_svc_key_id_is_null( handle ) );
|
||||
}
|
||||
|
||||
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
|
||||
/*
|
||||
* Mechanism for declaring deprecated values
|
||||
*/
|
||||
#if defined(MBEDTLS_DEPRECATED_WARNING) && !defined(MBEDTLS_PSA_DEPRECATED)
|
||||
#define MBEDTLS_PSA_DEPRECATED __attribute__((deprecated))
|
||||
#else
|
||||
#define MBEDTLS_PSA_DEPRECATED
|
||||
#endif
|
||||
|
||||
typedef MBEDTLS_PSA_DEPRECATED size_t mbedtls_deprecated_size_t;
|
||||
typedef MBEDTLS_PSA_DEPRECATED psa_status_t mbedtls_deprecated_psa_status_t;
|
||||
typedef MBEDTLS_PSA_DEPRECATED psa_key_usage_t mbedtls_deprecated_psa_key_usage_t;
|
||||
typedef MBEDTLS_PSA_DEPRECATED psa_ecc_family_t mbedtls_deprecated_psa_ecc_family_t;
|
||||
typedef MBEDTLS_PSA_DEPRECATED psa_dh_family_t mbedtls_deprecated_psa_dh_family_t;
|
||||
typedef MBEDTLS_PSA_DEPRECATED psa_ecc_family_t psa_ecc_curve_t;
|
||||
typedef MBEDTLS_PSA_DEPRECATED psa_dh_family_t psa_dh_group_t;
|
||||
typedef MBEDTLS_PSA_DEPRECATED psa_algorithm_t mbedtls_deprecated_psa_algorithm_t;
|
||||
|
||||
#define PSA_KEY_TYPE_GET_CURVE PSA_KEY_TYPE_ECC_GET_FAMILY
|
||||
#define PSA_KEY_TYPE_GET_GROUP PSA_KEY_TYPE_DH_GET_FAMILY
|
||||
|
||||
#define MBEDTLS_DEPRECATED_CONSTANT( type, value ) \
|
||||
( (mbedtls_deprecated_##type) ( value ) )
|
||||
|
||||
/*
|
||||
* Deprecated PSA Crypto error code definitions (PSA Crypto API <= 1.0 beta2)
|
||||
*/
|
||||
#define PSA_ERROR_UNKNOWN_ERROR \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_GENERIC_ERROR )
|
||||
#define PSA_ERROR_OCCUPIED_SLOT \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_ALREADY_EXISTS )
|
||||
#define PSA_ERROR_EMPTY_SLOT \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_DOES_NOT_EXIST )
|
||||
#define PSA_ERROR_INSUFFICIENT_CAPACITY \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_INSUFFICIENT_DATA )
|
||||
#define PSA_ERROR_TAMPERING_DETECTED \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_CORRUPTION_DETECTED )
|
||||
|
||||
/*
|
||||
* Deprecated PSA Crypto numerical encodings (PSA Crypto API <= 1.0 beta3)
|
||||
*/
|
||||
#define PSA_KEY_USAGE_SIGN \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_key_usage_t, PSA_KEY_USAGE_SIGN_HASH )
|
||||
#define PSA_KEY_USAGE_VERIFY \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_key_usage_t, PSA_KEY_USAGE_VERIFY_HASH )
|
||||
|
||||
/*
|
||||
* Deprecated PSA Crypto size calculation macros (PSA Crypto API <= 1.0 beta3)
|
||||
*/
|
||||
#define PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_SIGNATURE_MAX_SIZE )
|
||||
#define PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE( key_type, key_bits, alg ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_SIGN_OUTPUT_SIZE( key_type, key_bits, alg ) )
|
||||
#define PSA_KEY_EXPORT_MAX_SIZE( key_type, key_bits ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_EXPORT_KEY_OUTPUT_SIZE( key_type, key_bits ) )
|
||||
#define PSA_BLOCK_CIPHER_BLOCK_SIZE( type ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_BLOCK_CIPHER_BLOCK_LENGTH( type ) )
|
||||
#define PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE )
|
||||
#define PSA_HASH_SIZE( alg ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_HASH_LENGTH( alg ) )
|
||||
#define PSA_MAC_FINAL_SIZE( key_type, key_bits, alg ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_MAC_LENGTH( key_type, key_bits, alg ) )
|
||||
#define PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE )
|
||||
|
||||
/*
|
||||
* Deprecated PSA Crypto function names (PSA Crypto API <= 1.0 beta3)
|
||||
*/
|
||||
MBEDTLS_PSA_DEPRECATED static inline psa_status_t psa_asymmetric_sign( psa_key_handle_t key,
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *hash,
|
||||
size_t hash_length,
|
||||
uint8_t *signature,
|
||||
size_t signature_size,
|
||||
size_t *signature_length )
|
||||
{
|
||||
return psa_sign_hash( key, alg, hash, hash_length, signature, signature_size, signature_length );
|
||||
}
|
||||
|
||||
MBEDTLS_PSA_DEPRECATED static inline psa_status_t psa_asymmetric_verify( psa_key_handle_t key,
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *hash,
|
||||
size_t hash_length,
|
||||
const uint8_t *signature,
|
||||
size_t signature_length )
|
||||
{
|
||||
return psa_verify_hash( key, alg, hash, hash_length, signature, signature_length );
|
||||
}
|
||||
|
||||
/*
|
||||
* Size-specific elliptic curve families.
|
||||
*/
|
||||
#define PSA_ECC_CURVE_SECP160K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
|
||||
#define PSA_ECC_CURVE_SECP192K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
|
||||
#define PSA_ECC_CURVE_SECP224K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
|
||||
#define PSA_ECC_CURVE_SECP256K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
|
||||
#define PSA_ECC_CURVE_SECP160R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
|
||||
#define PSA_ECC_CURVE_SECP192R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
|
||||
#define PSA_ECC_CURVE_SECP224R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
|
||||
#define PSA_ECC_CURVE_SECP256R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
|
||||
#define PSA_ECC_CURVE_SECP384R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
|
||||
#define PSA_ECC_CURVE_SECP521R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
|
||||
#define PSA_ECC_CURVE_SECP160R2 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R2 )
|
||||
#define PSA_ECC_CURVE_SECT163K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
|
||||
#define PSA_ECC_CURVE_SECT233K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
|
||||
#define PSA_ECC_CURVE_SECT239K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
|
||||
#define PSA_ECC_CURVE_SECT283K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
|
||||
#define PSA_ECC_CURVE_SECT409K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
|
||||
#define PSA_ECC_CURVE_SECT571K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
|
||||
#define PSA_ECC_CURVE_SECT163R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
|
||||
#define PSA_ECC_CURVE_SECT193R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
|
||||
#define PSA_ECC_CURVE_SECT233R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
|
||||
#define PSA_ECC_CURVE_SECT283R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
|
||||
#define PSA_ECC_CURVE_SECT409R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
|
||||
#define PSA_ECC_CURVE_SECT571R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
|
||||
#define PSA_ECC_CURVE_SECT163R2 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R2 )
|
||||
#define PSA_ECC_CURVE_SECT193R2 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R2 )
|
||||
#define PSA_ECC_CURVE_BRAINPOOL_P256R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_BRAINPOOL_P_R1 )
|
||||
#define PSA_ECC_CURVE_BRAINPOOL_P384R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_BRAINPOOL_P_R1 )
|
||||
#define PSA_ECC_CURVE_BRAINPOOL_P512R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_BRAINPOOL_P_R1 )
|
||||
#define PSA_ECC_CURVE_CURVE25519 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_MONTGOMERY )
|
||||
#define PSA_ECC_CURVE_CURVE448 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_MONTGOMERY )
|
||||
|
||||
/*
|
||||
* Curves that changed name due to PSA specification.
|
||||
*/
|
||||
#define PSA_ECC_CURVE_SECP_K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
|
||||
#define PSA_ECC_CURVE_SECP_R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
|
||||
#define PSA_ECC_CURVE_SECP_R2 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R2 )
|
||||
#define PSA_ECC_CURVE_SECT_K1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
|
||||
#define PSA_ECC_CURVE_SECT_R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
|
||||
#define PSA_ECC_CURVE_SECT_R2 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R2 )
|
||||
#define PSA_ECC_CURVE_BRAINPOOL_P_R1 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_BRAINPOOL_P_R1 )
|
||||
#define PSA_ECC_CURVE_MONTGOMERY \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_MONTGOMERY )
|
||||
|
||||
/*
|
||||
* Finite-field Diffie-Hellman families.
|
||||
*/
|
||||
#define PSA_DH_GROUP_FFDHE2048 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
|
||||
#define PSA_DH_GROUP_FFDHE3072 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
|
||||
#define PSA_DH_GROUP_FFDHE4096 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
|
||||
#define PSA_DH_GROUP_FFDHE6144 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
|
||||
#define PSA_DH_GROUP_FFDHE8192 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
|
||||
|
||||
/*
|
||||
* Diffie-Hellman families that changed name due to PSA specification.
|
||||
*/
|
||||
#define PSA_DH_GROUP_RFC7919 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
|
||||
#define PSA_DH_GROUP_CUSTOM \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_CUSTOM )
|
||||
|
||||
/*
|
||||
* Deprecated PSA Crypto stream cipher algorithms (PSA Crypto API <= 1.0 beta3)
|
||||
*/
|
||||
#define PSA_ALG_ARC4 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_algorithm_t, PSA_ALG_STREAM_CIPHER )
|
||||
#define PSA_ALG_CHACHA20 \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_algorithm_t, PSA_ALG_STREAM_CIPHER )
|
||||
|
||||
/*
|
||||
* Renamed AEAD tag length macros (PSA Crypto API <= 1.0 beta3)
|
||||
*/
|
||||
#define PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH( aead_alg ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_algorithm_t, PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG( aead_alg ) )
|
||||
#define PSA_ALG_AEAD_WITH_TAG_LENGTH( aead_alg, tag_length ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( psa_algorithm_t, PSA_ALG_AEAD_WITH_SHORTENED_TAG( aead_alg, tag_length ) )
|
||||
|
||||
/*
|
||||
* Deprecated PSA AEAD output size macros (PSA Crypto API <= 1.0 beta3)
|
||||
*/
|
||||
|
||||
/** The tag size for an AEAD algorithm, in bytes.
|
||||
*
|
||||
* \param alg An AEAD algorithm
|
||||
* (\c PSA_ALG_XXX value such that
|
||||
* #PSA_ALG_IS_AEAD(\p alg) is true).
|
||||
*
|
||||
* \return The tag size for the specified algorithm.
|
||||
* If the AEAD algorithm does not have an identified
|
||||
* tag that can be distinguished from the rest of
|
||||
* the ciphertext, return 0.
|
||||
* If the AEAD algorithm is not recognized, return 0.
|
||||
*/
|
||||
#define PSA_AEAD_TAG_LENGTH_1_ARG( alg ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, \
|
||||
PSA_ALG_IS_AEAD( alg ) ? \
|
||||
PSA_ALG_AEAD_GET_TAG_LENGTH( alg ) : \
|
||||
0 )
|
||||
|
||||
/** The maximum size of the output of psa_aead_encrypt(), in bytes.
|
||||
*
|
||||
* If the size of the ciphertext buffer is at least this large, it is
|
||||
* guaranteed that psa_aead_encrypt() will not fail due to an
|
||||
* insufficient buffer size. Depending on the algorithm, the actual size of
|
||||
* the ciphertext may be smaller.
|
||||
*
|
||||
* \warning This macro may evaluate its arguments multiple times or
|
||||
* zero times, so you should not pass arguments that contain
|
||||
* side effects.
|
||||
*
|
||||
* \param alg An AEAD algorithm
|
||||
* (\c PSA_ALG_XXX value such that
|
||||
* #PSA_ALG_IS_AEAD(\p alg) is true).
|
||||
* \param plaintext_length Size of the plaintext in bytes.
|
||||
*
|
||||
* \return The AEAD ciphertext size for the specified
|
||||
* algorithm.
|
||||
* If the AEAD algorithm is not recognized, return 0.
|
||||
*/
|
||||
#define PSA_AEAD_ENCRYPT_OUTPUT_SIZE_2_ARG( alg, plaintext_length ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, \
|
||||
PSA_ALG_IS_AEAD( alg ) ? \
|
||||
(plaintext_length) + PSA_ALG_AEAD_GET_TAG_LENGTH( alg ) : \
|
||||
0 )
|
||||
|
||||
/** The maximum size of the output of psa_aead_decrypt(), in bytes.
|
||||
*
|
||||
* If the size of the plaintext buffer is at least this large, it is
|
||||
* guaranteed that psa_aead_decrypt() will not fail due to an
|
||||
* insufficient buffer size. Depending on the algorithm, the actual size of
|
||||
* the plaintext may be smaller.
|
||||
*
|
||||
* \warning This macro may evaluate its arguments multiple times or
|
||||
* zero times, so you should not pass arguments that contain
|
||||
* side effects.
|
||||
*
|
||||
* \param alg An AEAD algorithm
|
||||
* (\c PSA_ALG_XXX value such that
|
||||
* #PSA_ALG_IS_AEAD(\p alg) is true).
|
||||
* \param ciphertext_length Size of the plaintext in bytes.
|
||||
*
|
||||
* \return The AEAD ciphertext size for the specified
|
||||
* algorithm.
|
||||
* If the AEAD algorithm is not recognized, return 0.
|
||||
*/
|
||||
#define PSA_AEAD_DECRYPT_OUTPUT_SIZE_2_ARG( alg, ciphertext_length ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, \
|
||||
PSA_ALG_IS_AEAD( alg ) && \
|
||||
(ciphertext_length) > PSA_ALG_AEAD_GET_TAG_LENGTH( alg ) ? \
|
||||
(ciphertext_length) - PSA_ALG_AEAD_GET_TAG_LENGTH( alg ) : \
|
||||
0 )
|
||||
|
||||
/** A sufficient output buffer size for psa_aead_update().
|
||||
*
|
||||
* If the size of the output buffer is at least this large, it is
|
||||
* guaranteed that psa_aead_update() will not fail due to an
|
||||
* insufficient buffer size. The actual size of the output may be smaller
|
||||
* in any given call.
|
||||
*
|
||||
* \warning This macro may evaluate its arguments multiple times or
|
||||
* zero times, so you should not pass arguments that contain
|
||||
* side effects.
|
||||
*
|
||||
* \param alg An AEAD algorithm
|
||||
* (\c PSA_ALG_XXX value such that
|
||||
* #PSA_ALG_IS_AEAD(\p alg) is true).
|
||||
* \param input_length Size of the input in bytes.
|
||||
*
|
||||
* \return A sufficient output buffer size for the specified
|
||||
* algorithm.
|
||||
* If the AEAD algorithm is not recognized, return 0.
|
||||
*/
|
||||
/* For all the AEAD modes defined in this specification, it is possible
|
||||
* to emit output without delay. However, hardware may not always be
|
||||
* capable of this. So for modes based on a block cipher, allow the
|
||||
* implementation to delay the output until it has a full block. */
|
||||
#define PSA_AEAD_UPDATE_OUTPUT_SIZE_2_ARG( alg, input_length ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, \
|
||||
PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER( alg ) ? \
|
||||
PSA_ROUND_UP_TO_MULTIPLE( PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE, (input_length) ) : \
|
||||
(input_length) )
|
||||
|
||||
/** A sufficient ciphertext buffer size for psa_aead_finish().
|
||||
*
|
||||
* If the size of the ciphertext buffer is at least this large, it is
|
||||
* guaranteed that psa_aead_finish() will not fail due to an
|
||||
* insufficient ciphertext buffer size. The actual size of the output may
|
||||
* be smaller in any given call.
|
||||
*
|
||||
* \param alg An AEAD algorithm
|
||||
* (\c PSA_ALG_XXX value such that
|
||||
* #PSA_ALG_IS_AEAD(\p alg) is true).
|
||||
*
|
||||
* \return A sufficient ciphertext buffer size for the
|
||||
* specified algorithm.
|
||||
* If the AEAD algorithm is not recognized, return 0.
|
||||
*/
|
||||
#define PSA_AEAD_FINISH_OUTPUT_SIZE_1_ARG( alg ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, \
|
||||
PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER( alg ) ? \
|
||||
PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE : \
|
||||
0 )
|
||||
|
||||
/** A sufficient plaintext buffer size for psa_aead_verify().
|
||||
*
|
||||
* If the size of the plaintext buffer is at least this large, it is
|
||||
* guaranteed that psa_aead_verify() will not fail due to an
|
||||
* insufficient plaintext buffer size. The actual size of the output may
|
||||
* be smaller in any given call.
|
||||
*
|
||||
* \param alg An AEAD algorithm
|
||||
* (\c PSA_ALG_XXX value such that
|
||||
* #PSA_ALG_IS_AEAD(\p alg) is true).
|
||||
*
|
||||
* \return A sufficient plaintext buffer size for the
|
||||
* specified algorithm.
|
||||
* If the AEAD algorithm is not recognized, return 0.
|
||||
*/
|
||||
#define PSA_AEAD_VERIFY_OUTPUT_SIZE_1_ARG( alg ) \
|
||||
MBEDTLS_DEPRECATED_CONSTANT( size_t, \
|
||||
PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER( alg ) ? \
|
||||
PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE : \
|
||||
0 )
|
||||
|
||||
#endif /* MBEDTLS_DEPRECATED_REMOVED */
|
||||
|
||||
/** Open a handle to an existing persistent key.
|
||||
*
|
||||
* Open a handle to a persistent key. A key is persistent if it was created
|
||||
* with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key
|
||||
* always has a nonzero key identifier, set with psa_set_key_id() when
|
||||
* creating the key. Implementations may provide additional pre-provisioned
|
||||
* keys that can be opened with psa_open_key(). Such keys have an application
|
||||
* key identifier in the vendor range, as documented in the description of
|
||||
* #psa_key_id_t.
|
||||
*
|
||||
* The application must eventually close the handle with psa_close_key() or
|
||||
* psa_destroy_key() to release associated resources. If the application dies
|
||||
* without calling one of these functions, the implementation should perform
|
||||
* the equivalent of a call to psa_close_key().
|
||||
*
|
||||
* Some implementations permit an application to open the same key multiple
|
||||
* times. If this is successful, each call to psa_open_key() will return a
|
||||
* different key handle.
|
||||
*
|
||||
* \note This API is not part of the PSA Cryptography API Release 1.0.0
|
||||
* specification. It was defined in the 1.0 Beta 3 version of the
|
||||
* specification but was removed in the 1.0.0 released version. This API is
|
||||
* kept for the time being to not break applications relying on it. It is not
|
||||
* deprecated yet but will be in the near future.
|
||||
*
|
||||
* \note Applications that rely on opening a key multiple times will not be
|
||||
* portable to implementations that only permit a single key handle to be
|
||||
* opened. See also :ref:\`key-handles\`.
|
||||
*
|
||||
*
|
||||
* \param key The persistent identifier of the key.
|
||||
* \param[out] handle On success, a handle to the key.
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* Success. The application can now use the value of `*handle`
|
||||
* to access the key.
|
||||
* \retval #PSA_ERROR_INSUFFICIENT_MEMORY
|
||||
* The implementation does not have sufficient resources to open the
|
||||
* key. This can be due to reaching an implementation limit on the
|
||||
* number of open keys, the number of open key handles, or available
|
||||
* memory.
|
||||
* \retval #PSA_ERROR_DOES_NOT_EXIST
|
||||
* There is no persistent key with key identifier \p key.
|
||||
* \retval #PSA_ERROR_INVALID_ARGUMENT
|
||||
* \p key is not a valid persistent key identifier.
|
||||
* \retval #PSA_ERROR_NOT_PERMITTED
|
||||
* The specified key exists, but the application does not have the
|
||||
* permission to access it. Note that this specification does not
|
||||
* define any way to create such a key, but it may be possible
|
||||
* through implementation-specific means.
|
||||
* \retval #PSA_ERROR_COMMUNICATION_FAILURE
|
||||
* \retval #PSA_ERROR_CORRUPTION_DETECTED
|
||||
* \retval #PSA_ERROR_STORAGE_FAILURE
|
||||
* \retval #PSA_ERROR_DATA_INVALID
|
||||
* \retval #PSA_ERROR_DATA_CORRUPT
|
||||
* \retval #PSA_ERROR_BAD_STATE
|
||||
* The library has not been previously initialized by psa_crypto_init().
|
||||
* It is implementation-dependent whether a failure to initialize
|
||||
* results in this error code.
|
||||
*/
|
||||
psa_status_t psa_open_key( mbedtls_svc_key_id_t key,
|
||||
psa_key_handle_t *handle );
|
||||
|
||||
/** Close a key handle.
|
||||
*
|
||||
* If the handle designates a volatile key, this will destroy the key material
|
||||
* and free all associated resources, just like psa_destroy_key().
|
||||
*
|
||||
* If this is the last open handle to a persistent key, then closing the handle
|
||||
* will free all resources associated with the key in volatile memory. The key
|
||||
* data in persistent storage is not affected and can be opened again later
|
||||
* with a call to psa_open_key().
|
||||
*
|
||||
* Closing the key handle makes the handle invalid, and the key handle
|
||||
* must not be used again by the application.
|
||||
*
|
||||
* \note This API is not part of the PSA Cryptography API Release 1.0.0
|
||||
* specification. It was defined in the 1.0 Beta 3 version of the
|
||||
* specification but was removed in the 1.0.0 released version. This API is
|
||||
* kept for the time being to not break applications relying on it. It is not
|
||||
* deprecated yet but will be in the near future.
|
||||
*
|
||||
* \note If the key handle was used to set up an active
|
||||
* :ref:\`multipart operation <multipart-operations>\`, then closing the
|
||||
* key handle can cause the multipart operation to fail. Applications should
|
||||
* maintain the key handle until after the multipart operation has finished.
|
||||
*
|
||||
* \param handle The key handle to close.
|
||||
* If this is \c 0, do nothing and return \c PSA_SUCCESS.
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* \p handle was a valid handle or \c 0. It is now closed.
|
||||
* \retval #PSA_ERROR_INVALID_HANDLE
|
||||
* \p handle is not a valid handle nor \c 0.
|
||||
* \retval #PSA_ERROR_COMMUNICATION_FAILURE
|
||||
* \retval #PSA_ERROR_CORRUPTION_DETECTED
|
||||
* \retval #PSA_ERROR_BAD_STATE
|
||||
* The library has not been previously initialized by psa_crypto_init().
|
||||
* It is implementation-dependent whether a failure to initialize
|
||||
* results in this error code.
|
||||
*/
|
||||
psa_status_t psa_close_key(psa_key_handle_t handle);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* PSA_CRYPTO_COMPAT_H */
|
129
Externals/mbedtls/include/psa/crypto_config.h
vendored
Normal file
129
Externals/mbedtls/include/psa/crypto_config.h
vendored
Normal file
@ -0,0 +1,129 @@
|
||||
/**
|
||||
* \file psa/crypto_config.h
|
||||
* \brief PSA crypto configuration options (set of defines)
|
||||
*
|
||||
*/
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
|
||||
/**
|
||||
* When #MBEDTLS_PSA_CRYPTO_CONFIG is enabled in config.h,
|
||||
* this file determines which cryptographic mechanisms are enabled
|
||||
* through the PSA Cryptography API (\c psa_xxx() functions).
|
||||
*
|
||||
* To enable a cryptographic mechanism, uncomment the definition of
|
||||
* the corresponding \c PSA_WANT_xxx preprocessor symbol.
|
||||
* To disable a cryptographic mechanism, comment out the definition of
|
||||
* the corresponding \c PSA_WANT_xxx preprocessor symbol.
|
||||
* The names of cryptographic mechanisms correspond to values
|
||||
* defined in psa/crypto_values.h, with the prefix \c PSA_WANT_ instead
|
||||
* of \c PSA_.
|
||||
*
|
||||
* Note that many cryptographic mechanisms involve two symbols: one for
|
||||
* the key type (\c PSA_WANT_KEY_TYPE_xxx) and one for the algorithm
|
||||
* (\c PSA_WANT_ALG_xxx). Mechanisms with additional parameters may involve
|
||||
* additional symbols.
|
||||
*/
|
||||
#else
|
||||
/**
|
||||
* When \c MBEDTLS_PSA_CRYPTO_CONFIG is disabled in config.h,
|
||||
* this file is not used, and cryptographic mechanisms are supported
|
||||
* through the PSA API if and only if they are supported through the
|
||||
* mbedtls_xxx API.
|
||||
*/
|
||||
#endif
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_CONFIG_H
|
||||
#define PSA_CRYPTO_CONFIG_H
|
||||
|
||||
/*
|
||||
* CBC-MAC is not yet supported via the PSA API in Mbed TLS.
|
||||
*/
|
||||
//#define PSA_WANT_ALG_CBC_MAC 1
|
||||
#define PSA_WANT_ALG_CBC_NO_PADDING 1
|
||||
#define PSA_WANT_ALG_CBC_PKCS7 1
|
||||
#define PSA_WANT_ALG_CCM 1
|
||||
#define PSA_WANT_ALG_CMAC 1
|
||||
#define PSA_WANT_ALG_CFB 1
|
||||
#define PSA_WANT_ALG_CHACHA20_POLY1305 1
|
||||
#define PSA_WANT_ALG_CMAC 1
|
||||
#define PSA_WANT_ALG_CTR 1
|
||||
#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1
|
||||
#define PSA_WANT_ALG_ECB_NO_PADDING 1
|
||||
#define PSA_WANT_ALG_ECDH 1
|
||||
#define PSA_WANT_ALG_ECDSA 1
|
||||
#define PSA_WANT_ALG_GCM 1
|
||||
#define PSA_WANT_ALG_HKDF 1
|
||||
#define PSA_WANT_ALG_HMAC 1
|
||||
#define PSA_WANT_ALG_MD2 1
|
||||
#define PSA_WANT_ALG_MD4 1
|
||||
#define PSA_WANT_ALG_MD5 1
|
||||
#define PSA_WANT_ALG_OFB 1
|
||||
#define PSA_WANT_ALG_RIPEMD160 1
|
||||
#define PSA_WANT_ALG_RSA_OAEP 1
|
||||
#define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1
|
||||
#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1
|
||||
#define PSA_WANT_ALG_RSA_PSS 1
|
||||
#define PSA_WANT_ALG_SHA_1 1
|
||||
#define PSA_WANT_ALG_SHA_224 1
|
||||
#define PSA_WANT_ALG_SHA_256 1
|
||||
#define PSA_WANT_ALG_SHA_384 1
|
||||
#define PSA_WANT_ALG_SHA_512 1
|
||||
#define PSA_WANT_ALG_STREAM_CIPHER 1
|
||||
#define PSA_WANT_ALG_TLS12_PRF 1
|
||||
#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1
|
||||
#define PSA_WANT_ALG_XTS 1
|
||||
|
||||
#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1
|
||||
#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1
|
||||
#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1
|
||||
#define PSA_WANT_ECC_MONTGOMERY_255 1
|
||||
/*
|
||||
* Curve448 is not yet supported via the PSA API in Mbed TLS
|
||||
* (https://github.com/ARMmbed/mbedtls/issues/4249). Thus, do not enable it by
|
||||
* default.
|
||||
*/
|
||||
//#define PSA_WANT_ECC_MONTGOMERY_448 1
|
||||
#define PSA_WANT_ECC_SECP_K1_192 1
|
||||
/*
|
||||
* SECP224K1 is buggy via the PSA API in Mbed TLS
|
||||
* (https://github.com/ARMmbed/mbedtls/issues/3541). Thus, do not enable it by
|
||||
* default.
|
||||
*/
|
||||
//#define PSA_WANT_ECC_SECP_K1_224 1
|
||||
#define PSA_WANT_ECC_SECP_K1_256 1
|
||||
#define PSA_WANT_ECC_SECP_R1_192 1
|
||||
#define PSA_WANT_ECC_SECP_R1_224 1
|
||||
#define PSA_WANT_ECC_SECP_R1_256 1
|
||||
#define PSA_WANT_ECC_SECP_R1_384 1
|
||||
#define PSA_WANT_ECC_SECP_R1_521 1
|
||||
|
||||
#define PSA_WANT_KEY_TYPE_DERIVE 1
|
||||
#define PSA_WANT_KEY_TYPE_HMAC 1
|
||||
#define PSA_WANT_KEY_TYPE_AES 1
|
||||
#define PSA_WANT_KEY_TYPE_ARC4 1
|
||||
#define PSA_WANT_KEY_TYPE_ARIA 1
|
||||
#define PSA_WANT_KEY_TYPE_CAMELLIA 1
|
||||
#define PSA_WANT_KEY_TYPE_CHACHA20 1
|
||||
#define PSA_WANT_KEY_TYPE_DES 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1
|
||||
#define PSA_WANT_KEY_TYPE_RAW_DATA 1
|
||||
#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1
|
||||
#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1
|
||||
|
||||
#endif /* PSA_CRYPTO_CONFIG_H */
|
56
Externals/mbedtls/include/psa/crypto_driver_common.h
vendored
Normal file
56
Externals/mbedtls/include/psa/crypto_driver_common.h
vendored
Normal file
@ -0,0 +1,56 @@
|
||||
/**
|
||||
* \file psa/crypto_driver_common.h
|
||||
* \brief Definitions for all PSA crypto drivers
|
||||
*
|
||||
* This file contains common definitions shared by all PSA crypto drivers.
|
||||
* Do not include it directly: instead, include the header file(s) for
|
||||
* the type(s) of driver that you are implementing. For example, if
|
||||
* you are writing a dynamically registered driver for a secure element,
|
||||
* include `psa/crypto_se_driver.h`.
|
||||
*
|
||||
* This file is part of the PSA Crypto Driver Model, containing functions for
|
||||
* driver developers to implement to enable hardware to be called in a
|
||||
* standardized way by a PSA Cryptographic API implementation. The functions
|
||||
* comprising the driver model, which driver authors implement, are not
|
||||
* intended to be called by application developers.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
#ifndef PSA_CRYPTO_DRIVER_COMMON_H
|
||||
#define PSA_CRYPTO_DRIVER_COMMON_H
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
/* Include type definitions (psa_status_t, psa_algorithm_t,
|
||||
* psa_key_type_t, etc.) and macros to build and analyze values
|
||||
* of these types. */
|
||||
#include "crypto_types.h"
|
||||
#include "crypto_values.h"
|
||||
/* Include size definitions which are used to size some arrays in operation
|
||||
* structures. */
|
||||
#include <psa/crypto_sizes.h>
|
||||
|
||||
/** For encrypt-decrypt functions, whether the operation is an encryption
|
||||
* or a decryption. */
|
||||
typedef enum {
|
||||
PSA_CRYPTO_DRIVER_DECRYPT,
|
||||
PSA_CRYPTO_DRIVER_ENCRYPT
|
||||
} psa_encrypt_or_decrypt_t;
|
||||
|
||||
#endif /* PSA_CRYPTO_DRIVER_COMMON_H */
|
93
Externals/mbedtls/include/psa/crypto_driver_contexts_composites.h
vendored
Normal file
93
Externals/mbedtls/include/psa/crypto_driver_contexts_composites.h
vendored
Normal file
@ -0,0 +1,93 @@
|
||||
/*
|
||||
* Declaration of context structures for use with the PSA driver wrapper
|
||||
* interface. This file contains the context structures for 'composite'
|
||||
* operations, i.e. those operations which need to make use of other operations
|
||||
* from the primitives (crypto_driver_contexts_primitives.h)
|
||||
*
|
||||
* Warning: This file will be auto-generated in the future.
|
||||
*
|
||||
* \note This file may not be included directly. Applications must
|
||||
* include psa/crypto.h.
|
||||
*
|
||||
* \note This header and its content is not part of the Mbed TLS API and
|
||||
* applications must not depend on it. Its main purpose is to define the
|
||||
* multi-part state objects of the PSA drivers included in the cryptographic
|
||||
* library. The definition of these objects are then used by crypto_struct.h
|
||||
* to define the implementation-defined types of PSA multi-part state objects.
|
||||
*/
|
||||
/* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_DRIVER_CONTEXTS_COMPOSITES_H
|
||||
#define PSA_CRYPTO_DRIVER_CONTEXTS_COMPOSITES_H
|
||||
|
||||
#include "psa/crypto_driver_common.h"
|
||||
|
||||
/* Include the context structure definitions for the Mbed TLS software drivers */
|
||||
#include "psa/crypto_builtin_composites.h"
|
||||
|
||||
/* Include the context structure definitions for those drivers that were
|
||||
* declared during the autogeneration process. */
|
||||
|
||||
#if defined(MBEDTLS_TEST_LIBTESTDRIVER1)
|
||||
#include <libtestdriver1/include/psa/crypto.h>
|
||||
#endif
|
||||
|
||||
#if defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \
|
||||
defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_MAC)
|
||||
typedef libtestdriver1_mbedtls_psa_mac_operation_t
|
||||
mbedtls_transparent_test_driver_mac_operation_t;
|
||||
typedef libtestdriver1_mbedtls_psa_mac_operation_t
|
||||
mbedtls_opaque_test_driver_mac_operation_t;
|
||||
|
||||
#define MBEDTLS_TRANSPARENT_TEST_DRIVER_MAC_OPERATION_INIT \
|
||||
LIBTESTDRIVER1_MBEDTLS_PSA_MAC_OPERATION_INIT
|
||||
#define MBEDTLS_OPAQUE_TEST_DRIVER_MAC_OPERATION_INIT \
|
||||
LIBTESTDRIVER1_MBEDTLS_PSA_MAC_OPERATION_INIT
|
||||
|
||||
#else
|
||||
typedef mbedtls_psa_mac_operation_t
|
||||
mbedtls_transparent_test_driver_mac_operation_t;
|
||||
typedef mbedtls_psa_mac_operation_t
|
||||
mbedtls_opaque_test_driver_mac_operation_t;
|
||||
|
||||
#define MBEDTLS_TRANSPARENT_TEST_DRIVER_MAC_OPERATION_INIT \
|
||||
MBEDTLS_PSA_MAC_OPERATION_INIT
|
||||
#define MBEDTLS_OPAQUE_TEST_DRIVER_MAC_OPERATION_INIT \
|
||||
MBEDTLS_PSA_MAC_OPERATION_INIT
|
||||
|
||||
#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 */
|
||||
#endif /* PSA_CRYPTO_DRIVER_TEST */
|
||||
|
||||
/* Define the context to be used for an operation that is executed through the
|
||||
* PSA Driver wrapper layer as the union of all possible driver's contexts.
|
||||
*
|
||||
* The union members are the driver's context structures, and the member names
|
||||
* are formatted as `'drivername'_ctx`. This allows for procedural generation
|
||||
* of both this file and the content of psa_crypto_driver_wrappers.c */
|
||||
|
||||
typedef union {
|
||||
unsigned dummy; /* Make sure this union is always non-empty */
|
||||
mbedtls_psa_mac_operation_t mbedtls_ctx;
|
||||
#if defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
mbedtls_transparent_test_driver_mac_operation_t transparent_test_driver_ctx;
|
||||
mbedtls_opaque_test_driver_mac_operation_t opaque_test_driver_ctx;
|
||||
#endif
|
||||
} psa_driver_mac_context_t;
|
||||
|
||||
#endif /* PSA_CRYPTO_DRIVER_CONTEXTS_COMPOSITES_H */
|
||||
/* End of automatically generated file. */
|
117
Externals/mbedtls/include/psa/crypto_driver_contexts_primitives.h
vendored
Normal file
117
Externals/mbedtls/include/psa/crypto_driver_contexts_primitives.h
vendored
Normal file
@ -0,0 +1,117 @@
|
||||
/*
|
||||
* Declaration of context structures for use with the PSA driver wrapper
|
||||
* interface. This file contains the context structures for 'primitive'
|
||||
* operations, i.e. those operations which do not rely on other contexts.
|
||||
*
|
||||
* Warning: This file will be auto-generated in the future.
|
||||
*
|
||||
* \note This file may not be included directly. Applications must
|
||||
* include psa/crypto.h.
|
||||
*
|
||||
* \note This header and its content is not part of the Mbed TLS API and
|
||||
* applications must not depend on it. Its main purpose is to define the
|
||||
* multi-part state objects of the PSA drivers included in the cryptographic
|
||||
* library. The definition of these objects are then used by crypto_struct.h
|
||||
* to define the implementation-defined types of PSA multi-part state objects.
|
||||
*/
|
||||
/* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_DRIVER_CONTEXTS_PRIMITIVES_H
|
||||
#define PSA_CRYPTO_DRIVER_CONTEXTS_PRIMITIVES_H
|
||||
|
||||
#include "psa/crypto_driver_common.h"
|
||||
|
||||
/* Include the context structure definitions for the Mbed TLS software drivers */
|
||||
#include "psa/crypto_builtin_primitives.h"
|
||||
|
||||
/* Include the context structure definitions for those drivers that were
|
||||
* declared during the autogeneration process. */
|
||||
|
||||
#if defined(MBEDTLS_TEST_LIBTESTDRIVER1)
|
||||
#include <libtestdriver1/include/psa/crypto.h>
|
||||
#endif
|
||||
|
||||
#if defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
|
||||
#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \
|
||||
defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_CIPHER)
|
||||
typedef libtestdriver1_mbedtls_psa_cipher_operation_t
|
||||
mbedtls_transparent_test_driver_cipher_operation_t;
|
||||
|
||||
#define MBEDTLS_TRANSPARENT_TEST_DRIVER_CIPHER_OPERATION_INIT \
|
||||
LIBTESTDRIVER1_MBEDTLS_PSA_CIPHER_OPERATION_INIT
|
||||
#else
|
||||
typedef mbedtls_psa_cipher_operation_t
|
||||
mbedtls_transparent_test_driver_cipher_operation_t;
|
||||
|
||||
#define MBEDTLS_TRANSPARENT_TEST_DRIVER_CIPHER_OPERATION_INIT \
|
||||
MBEDTLS_PSA_CIPHER_OPERATION_INIT
|
||||
#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 &&
|
||||
LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_CIPHER */
|
||||
|
||||
#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \
|
||||
defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_HASH)
|
||||
typedef libtestdriver1_mbedtls_psa_hash_operation_t
|
||||
mbedtls_transparent_test_driver_hash_operation_t;
|
||||
|
||||
#define MBEDTLS_TRANSPARENT_TEST_DRIVER_HASH_OPERATION_INIT \
|
||||
LIBTESTDRIVER1_MBEDTLS_PSA_HASH_OPERATION_INIT
|
||||
#else
|
||||
typedef mbedtls_psa_hash_operation_t
|
||||
mbedtls_transparent_test_driver_hash_operation_t;
|
||||
|
||||
#define MBEDTLS_TRANSPARENT_TEST_DRIVER_HASH_OPERATION_INIT \
|
||||
MBEDTLS_PSA_HASH_OPERATION_INIT
|
||||
#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 &&
|
||||
LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_HASH */
|
||||
|
||||
typedef struct {
|
||||
unsigned int initialised : 1;
|
||||
mbedtls_transparent_test_driver_cipher_operation_t ctx;
|
||||
} mbedtls_opaque_test_driver_cipher_operation_t;
|
||||
|
||||
#define MBEDTLS_OPAQUE_TEST_DRIVER_CIPHER_OPERATION_INIT \
|
||||
{ 0, MBEDTLS_TRANSPARENT_TEST_DRIVER_CIPHER_OPERATION_INIT }
|
||||
|
||||
#endif /* PSA_CRYPTO_DRIVER_TEST */
|
||||
|
||||
/* Define the context to be used for an operation that is executed through the
|
||||
* PSA Driver wrapper layer as the union of all possible driver's contexts.
|
||||
*
|
||||
* The union members are the driver's context structures, and the member names
|
||||
* are formatted as `'drivername'_ctx`. This allows for procedural generation
|
||||
* of both this file and the content of psa_crypto_driver_wrappers.c */
|
||||
|
||||
typedef union {
|
||||
unsigned dummy; /* Make sure this union is always non-empty */
|
||||
mbedtls_psa_hash_operation_t mbedtls_ctx;
|
||||
#if defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
mbedtls_transparent_test_driver_hash_operation_t test_driver_ctx;
|
||||
#endif
|
||||
} psa_driver_hash_context_t;
|
||||
|
||||
typedef union {
|
||||
unsigned dummy; /* Make sure this union is always non-empty */
|
||||
mbedtls_psa_cipher_operation_t mbedtls_ctx;
|
||||
#if defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
mbedtls_transparent_test_driver_cipher_operation_t transparent_test_driver_ctx;
|
||||
mbedtls_opaque_test_driver_cipher_operation_t opaque_test_driver_ctx;
|
||||
#endif
|
||||
} psa_driver_cipher_context_t;
|
||||
|
||||
#endif /* PSA_CRYPTO_DRIVER_CONTEXTS_PRIMITIVES_H */
|
||||
/* End of automatically generated file. */
|
819
Externals/mbedtls/include/psa/crypto_extra.h
vendored
Normal file
819
Externals/mbedtls/include/psa/crypto_extra.h
vendored
Normal file
@ -0,0 +1,819 @@
|
||||
/**
|
||||
* \file psa/crypto_extra.h
|
||||
*
|
||||
* \brief PSA cryptography module: Mbed TLS vendor extensions
|
||||
*
|
||||
* \note This file may not be included directly. Applications must
|
||||
* include psa/crypto.h.
|
||||
*
|
||||
* This file is reserved for vendor-specific definitions.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_EXTRA_H
|
||||
#define PSA_CRYPTO_EXTRA_H
|
||||
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#include "crypto_types.h"
|
||||
#include "crypto_compat.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* UID for secure storage seed */
|
||||
#define PSA_CRYPTO_ITS_RANDOM_SEED_UID 0xFFFFFF52
|
||||
|
||||
/* See config.h for definition */
|
||||
#if !defined(MBEDTLS_PSA_KEY_SLOT_COUNT)
|
||||
#define MBEDTLS_PSA_KEY_SLOT_COUNT 32
|
||||
#endif
|
||||
|
||||
/** \addtogroup attributes
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** \brief Declare the enrollment algorithm for a key.
|
||||
*
|
||||
* An operation on a key may indifferently use the algorithm set with
|
||||
* psa_set_key_algorithm() or with this function.
|
||||
*
|
||||
* \param[out] attributes The attribute structure to write to.
|
||||
* \param alg2 A second algorithm that the key may be used
|
||||
* for, in addition to the algorithm set with
|
||||
* psa_set_key_algorithm().
|
||||
*
|
||||
* \warning Setting an enrollment algorithm is not recommended, because
|
||||
* using the same key with different algorithms can allow some
|
||||
* attacks based on arithmetic relations between different
|
||||
* computations made with the same key, or can escalate harmless
|
||||
* side channels into exploitable ones. Use this function only
|
||||
* if it is necessary to support a protocol for which it has been
|
||||
* verified that the usage of the key with multiple algorithms
|
||||
* is safe.
|
||||
*/
|
||||
static inline void psa_set_key_enrollment_algorithm(
|
||||
psa_key_attributes_t *attributes,
|
||||
psa_algorithm_t alg2)
|
||||
{
|
||||
attributes->core.policy.alg2 = alg2;
|
||||
}
|
||||
|
||||
/** Retrieve the enrollment algorithm policy from key attributes.
|
||||
*
|
||||
* \param[in] attributes The key attribute structure to query.
|
||||
*
|
||||
* \return The enrollment algorithm stored in the attribute structure.
|
||||
*/
|
||||
static inline psa_algorithm_t psa_get_key_enrollment_algorithm(
|
||||
const psa_key_attributes_t *attributes)
|
||||
{
|
||||
return( attributes->core.policy.alg2 );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
||||
|
||||
/** Retrieve the slot number where a key is stored.
|
||||
*
|
||||
* A slot number is only defined for keys that are stored in a secure
|
||||
* element.
|
||||
*
|
||||
* This information is only useful if the secure element is not entirely
|
||||
* managed through the PSA Cryptography API. It is up to the secure
|
||||
* element driver to decide how PSA slot numbers map to any other interface
|
||||
* that the secure element may have.
|
||||
*
|
||||
* \param[in] attributes The key attribute structure to query.
|
||||
* \param[out] slot_number On success, the slot number containing the key.
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* The key is located in a secure element, and \p *slot_number
|
||||
* indicates the slot number that contains it.
|
||||
* \retval #PSA_ERROR_NOT_PERMITTED
|
||||
* The caller is not permitted to query the slot number.
|
||||
* Mbed Crypto currently does not return this error.
|
||||
* \retval #PSA_ERROR_INVALID_ARGUMENT
|
||||
* The key is not located in a secure element.
|
||||
*/
|
||||
psa_status_t psa_get_key_slot_number(
|
||||
const psa_key_attributes_t *attributes,
|
||||
psa_key_slot_number_t *slot_number );
|
||||
|
||||
/** Choose the slot number where a key is stored.
|
||||
*
|
||||
* This function declares a slot number in the specified attribute
|
||||
* structure.
|
||||
*
|
||||
* A slot number is only meaningful for keys that are stored in a secure
|
||||
* element. It is up to the secure element driver to decide how PSA slot
|
||||
* numbers map to any other interface that the secure element may have.
|
||||
*
|
||||
* \note Setting a slot number in key attributes for a key creation can
|
||||
* cause the following errors when creating the key:
|
||||
* - #PSA_ERROR_NOT_SUPPORTED if the selected secure element does
|
||||
* not support choosing a specific slot number.
|
||||
* - #PSA_ERROR_NOT_PERMITTED if the caller is not permitted to
|
||||
* choose slot numbers in general or to choose this specific slot.
|
||||
* - #PSA_ERROR_INVALID_ARGUMENT if the chosen slot number is not
|
||||
* valid in general or not valid for this specific key.
|
||||
* - #PSA_ERROR_ALREADY_EXISTS if there is already a key in the
|
||||
* selected slot.
|
||||
*
|
||||
* \param[out] attributes The attribute structure to write to.
|
||||
* \param slot_number The slot number to set.
|
||||
*/
|
||||
static inline void psa_set_key_slot_number(
|
||||
psa_key_attributes_t *attributes,
|
||||
psa_key_slot_number_t slot_number )
|
||||
{
|
||||
attributes->core.flags |= MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER;
|
||||
attributes->slot_number = slot_number;
|
||||
}
|
||||
|
||||
/** Remove the slot number attribute from a key attribute structure.
|
||||
*
|
||||
* This function undoes the action of psa_set_key_slot_number().
|
||||
*
|
||||
* \param[out] attributes The attribute structure to write to.
|
||||
*/
|
||||
static inline void psa_clear_key_slot_number(
|
||||
psa_key_attributes_t *attributes )
|
||||
{
|
||||
attributes->core.flags &= ~MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER;
|
||||
}
|
||||
|
||||
/** Register a key that is already present in a secure element.
|
||||
*
|
||||
* The key must be located in a secure element designated by the
|
||||
* lifetime field in \p attributes, in the slot set with
|
||||
* psa_set_key_slot_number() in the attribute structure.
|
||||
* This function makes the key available through the key identifier
|
||||
* specified in \p attributes.
|
||||
*
|
||||
* \param[in] attributes The attributes of the existing key.
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* The key was successfully registered.
|
||||
* Note that depending on the design of the driver, this may or may
|
||||
* not guarantee that a key actually exists in the designated slot
|
||||
* and is compatible with the specified attributes.
|
||||
* \retval #PSA_ERROR_ALREADY_EXISTS
|
||||
* There is already a key with the identifier specified in
|
||||
* \p attributes.
|
||||
* \retval #PSA_ERROR_NOT_SUPPORTED
|
||||
* The secure element driver for the specified lifetime does not
|
||||
* support registering a key.
|
||||
* \retval #PSA_ERROR_INVALID_ARGUMENT
|
||||
* The identifier in \p attributes is invalid, namely the identifier is
|
||||
* not in the user range.
|
||||
* \retval #PSA_ERROR_INVALID_ARGUMENT
|
||||
* \p attributes specifies a lifetime which is not located
|
||||
* in a secure element.
|
||||
* \retval #PSA_ERROR_INVALID_ARGUMENT
|
||||
* No slot number is specified in \p attributes,
|
||||
* or the specified slot number is not valid.
|
||||
* \retval #PSA_ERROR_NOT_PERMITTED
|
||||
* The caller is not authorized to register the specified key slot.
|
||||
* \retval #PSA_ERROR_INSUFFICIENT_MEMORY
|
||||
* \retval #PSA_ERROR_INSUFFICIENT_STORAGE
|
||||
* \retval #PSA_ERROR_COMMUNICATION_FAILURE
|
||||
* \retval #PSA_ERROR_DATA_INVALID
|
||||
* \retval #PSA_ERROR_DATA_CORRUPT
|
||||
* \retval #PSA_ERROR_CORRUPTION_DETECTED
|
||||
* \retval #PSA_ERROR_BAD_STATE
|
||||
* The library has not been previously initialized by psa_crypto_init().
|
||||
* It is implementation-dependent whether a failure to initialize
|
||||
* results in this error code.
|
||||
*/
|
||||
psa_status_t mbedtls_psa_register_se_key(
|
||||
const psa_key_attributes_t *attributes);
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
|
||||
|
||||
/**@}*/
|
||||
|
||||
/**
|
||||
* \brief Library deinitialization.
|
||||
*
|
||||
* This function clears all data associated with the PSA layer,
|
||||
* including the whole key store.
|
||||
*
|
||||
* This is an Mbed TLS extension.
|
||||
*/
|
||||
void mbedtls_psa_crypto_free( void );
|
||||
|
||||
/** \brief Statistics about
|
||||
* resource consumption related to the PSA keystore.
|
||||
*
|
||||
* \note The content of this structure is not part of the stable API and ABI
|
||||
* of Mbed Crypto and may change arbitrarily from version to version.
|
||||
*/
|
||||
typedef struct mbedtls_psa_stats_s
|
||||
{
|
||||
/** Number of slots containing key material for a volatile key. */
|
||||
size_t volatile_slots;
|
||||
/** Number of slots containing key material for a key which is in
|
||||
* internal persistent storage. */
|
||||
size_t persistent_slots;
|
||||
/** Number of slots containing a reference to a key in a
|
||||
* secure element. */
|
||||
size_t external_slots;
|
||||
/** Number of slots which are occupied, but do not contain
|
||||
* key material yet. */
|
||||
size_t half_filled_slots;
|
||||
/** Number of slots that contain cache data. */
|
||||
size_t cache_slots;
|
||||
/** Number of slots that are not used for anything. */
|
||||
size_t empty_slots;
|
||||
/** Number of slots that are locked. */
|
||||
size_t locked_slots;
|
||||
/** Largest key id value among open keys in internal persistent storage. */
|
||||
psa_key_id_t max_open_internal_key_id;
|
||||
/** Largest key id value among open keys in secure elements. */
|
||||
psa_key_id_t max_open_external_key_id;
|
||||
} mbedtls_psa_stats_t;
|
||||
|
||||
/** \brief Get statistics about
|
||||
* resource consumption related to the PSA keystore.
|
||||
*
|
||||
* \note When Mbed Crypto is built as part of a service, with isolation
|
||||
* between the application and the keystore, the service may or
|
||||
* may not expose this function.
|
||||
*/
|
||||
void mbedtls_psa_get_stats( mbedtls_psa_stats_t *stats );
|
||||
|
||||
/**
|
||||
* \brief Inject an initial entropy seed for the random generator into
|
||||
* secure storage.
|
||||
*
|
||||
* This function injects data to be used as a seed for the random generator
|
||||
* used by the PSA Crypto implementation. On devices that lack a trusted
|
||||
* entropy source (preferably a hardware random number generator),
|
||||
* the Mbed PSA Crypto implementation uses this value to seed its
|
||||
* random generator.
|
||||
*
|
||||
* On devices without a trusted entropy source, this function must be
|
||||
* called exactly once in the lifetime of the device. On devices with
|
||||
* a trusted entropy source, calling this function is optional.
|
||||
* In all cases, this function may only be called before calling any
|
||||
* other function in the PSA Crypto API, including psa_crypto_init().
|
||||
*
|
||||
* When this function returns successfully, it populates a file in
|
||||
* persistent storage. Once the file has been created, this function
|
||||
* can no longer succeed.
|
||||
*
|
||||
* If any error occurs, this function does not change the system state.
|
||||
* You can call this function again after correcting the reason for the
|
||||
* error if possible.
|
||||
*
|
||||
* \warning This function **can** fail! Callers MUST check the return status.
|
||||
*
|
||||
* \warning If you use this function, you should use it as part of a
|
||||
* factory provisioning process. The value of the injected seed
|
||||
* is critical to the security of the device. It must be
|
||||
* *secret*, *unpredictable* and (statistically) *unique per device*.
|
||||
* You should be generate it randomly using a cryptographically
|
||||
* secure random generator seeded from trusted entropy sources.
|
||||
* You should transmit it securely to the device and ensure
|
||||
* that its value is not leaked or stored anywhere beyond the
|
||||
* needs of transmitting it from the point of generation to
|
||||
* the call of this function, and erase all copies of the value
|
||||
* once this function returns.
|
||||
*
|
||||
* This is an Mbed TLS extension.
|
||||
*
|
||||
* \note This function is only available on the following platforms:
|
||||
* * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled.
|
||||
* Note that you must provide compatible implementations of
|
||||
* mbedtls_nv_seed_read and mbedtls_nv_seed_write.
|
||||
* * In a client-server integration of PSA Cryptography, on the client side,
|
||||
* if the server supports this feature.
|
||||
* \param[in] seed Buffer containing the seed value to inject.
|
||||
* \param[in] seed_size Size of the \p seed buffer.
|
||||
* The size of the seed in bytes must be greater
|
||||
* or equal to both #MBEDTLS_ENTROPY_MIN_PLATFORM
|
||||
* and #MBEDTLS_ENTROPY_BLOCK_SIZE.
|
||||
* It must be less or equal to
|
||||
* #MBEDTLS_ENTROPY_MAX_SEED_SIZE.
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* The seed value was injected successfully. The random generator
|
||||
* of the PSA Crypto implementation is now ready for use.
|
||||
* You may now call psa_crypto_init() and use the PSA Crypto
|
||||
* implementation.
|
||||
* \retval #PSA_ERROR_INVALID_ARGUMENT
|
||||
* \p seed_size is out of range.
|
||||
* \retval #PSA_ERROR_STORAGE_FAILURE
|
||||
* There was a failure reading or writing from storage.
|
||||
* \retval #PSA_ERROR_NOT_PERMITTED
|
||||
* The library has already been initialized. It is no longer
|
||||
* possible to call this function.
|
||||
*/
|
||||
psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed,
|
||||
size_t seed_size);
|
||||
|
||||
/** \addtogroup crypto_types
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** DSA public key.
|
||||
*
|
||||
* The import and export format is the
|
||||
* representation of the public key `y = g^x mod p` as a big-endian byte
|
||||
* string. The length of the byte string is the length of the base prime `p`
|
||||
* in bytes.
|
||||
*/
|
||||
#define PSA_KEY_TYPE_DSA_PUBLIC_KEY ((psa_key_type_t)0x4002)
|
||||
|
||||
/** DSA key pair (private and public key).
|
||||
*
|
||||
* The import and export format is the
|
||||
* representation of the private key `x` as a big-endian byte string. The
|
||||
* length of the byte string is the private key size in bytes (leading zeroes
|
||||
* are not stripped).
|
||||
*
|
||||
* Determinstic DSA key derivation with psa_generate_derived_key follows
|
||||
* FIPS 186-4 §B.1.2: interpret the byte string as integer
|
||||
* in big-endian order. Discard it if it is not in the range
|
||||
* [0, *N* - 2] where *N* is the boundary of the private key domain
|
||||
* (the prime *p* for Diffie-Hellman, the subprime *q* for DSA,
|
||||
* or the order of the curve's base point for ECC).
|
||||
* Add 1 to the resulting integer and use this as the private key *x*.
|
||||
*
|
||||
*/
|
||||
#define PSA_KEY_TYPE_DSA_KEY_PAIR ((psa_key_type_t)0x7002)
|
||||
|
||||
/** Whether a key type is an DSA key (pair or public-only). */
|
||||
#define PSA_KEY_TYPE_IS_DSA(type) \
|
||||
(PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) == PSA_KEY_TYPE_DSA_PUBLIC_KEY)
|
||||
|
||||
#define PSA_ALG_DSA_BASE ((psa_algorithm_t)0x06000400)
|
||||
/** DSA signature with hashing.
|
||||
*
|
||||
* This is the signature scheme defined by FIPS 186-4,
|
||||
* with a random per-message secret number (*k*).
|
||||
*
|
||||
* \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that
|
||||
* #PSA_ALG_IS_HASH(\p hash_alg) is true).
|
||||
* This includes #PSA_ALG_ANY_HASH
|
||||
* when specifying the algorithm in a usage policy.
|
||||
*
|
||||
* \return The corresponding DSA signature algorithm.
|
||||
* \return Unspecified if \p hash_alg is not a supported
|
||||
* hash algorithm.
|
||||
*/
|
||||
#define PSA_ALG_DSA(hash_alg) \
|
||||
(PSA_ALG_DSA_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))
|
||||
#define PSA_ALG_DETERMINISTIC_DSA_BASE ((psa_algorithm_t)0x06000500)
|
||||
#define PSA_ALG_DSA_DETERMINISTIC_FLAG PSA_ALG_ECDSA_DETERMINISTIC_FLAG
|
||||
/** Deterministic DSA signature with hashing.
|
||||
*
|
||||
* This is the deterministic variant defined by RFC 6979 of
|
||||
* the signature scheme defined by FIPS 186-4.
|
||||
*
|
||||
* \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that
|
||||
* #PSA_ALG_IS_HASH(\p hash_alg) is true).
|
||||
* This includes #PSA_ALG_ANY_HASH
|
||||
* when specifying the algorithm in a usage policy.
|
||||
*
|
||||
* \return The corresponding DSA signature algorithm.
|
||||
* \return Unspecified if \p hash_alg is not a supported
|
||||
* hash algorithm.
|
||||
*/
|
||||
#define PSA_ALG_DETERMINISTIC_DSA(hash_alg) \
|
||||
(PSA_ALG_DETERMINISTIC_DSA_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))
|
||||
#define PSA_ALG_IS_DSA(alg) \
|
||||
(((alg) & ~PSA_ALG_HASH_MASK & ~PSA_ALG_DSA_DETERMINISTIC_FLAG) == \
|
||||
PSA_ALG_DSA_BASE)
|
||||
#define PSA_ALG_DSA_IS_DETERMINISTIC(alg) \
|
||||
(((alg) & PSA_ALG_DSA_DETERMINISTIC_FLAG) != 0)
|
||||
#define PSA_ALG_IS_DETERMINISTIC_DSA(alg) \
|
||||
(PSA_ALG_IS_DSA(alg) && PSA_ALG_DSA_IS_DETERMINISTIC(alg))
|
||||
#define PSA_ALG_IS_RANDOMIZED_DSA(alg) \
|
||||
(PSA_ALG_IS_DSA(alg) && !PSA_ALG_DSA_IS_DETERMINISTIC(alg))
|
||||
|
||||
|
||||
/* We need to expand the sample definition of this macro from
|
||||
* the API definition. */
|
||||
#undef PSA_ALG_IS_VENDOR_HASH_AND_SIGN
|
||||
#define PSA_ALG_IS_VENDOR_HASH_AND_SIGN(alg) \
|
||||
PSA_ALG_IS_DSA(alg)
|
||||
|
||||
/**@}*/
|
||||
|
||||
/** \addtogroup attributes
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** Custom Diffie-Hellman group.
|
||||
*
|
||||
* For keys of type #PSA_KEY_TYPE_DH_PUBLIC_KEY(#PSA_DH_FAMILY_CUSTOM) or
|
||||
* #PSA_KEY_TYPE_DH_KEY_PAIR(#PSA_DH_FAMILY_CUSTOM), the group data comes
|
||||
* from domain parameters set by psa_set_key_domain_parameters().
|
||||
*/
|
||||
#define PSA_DH_FAMILY_CUSTOM ((psa_dh_family_t) 0x7e)
|
||||
|
||||
|
||||
/**
|
||||
* \brief Set domain parameters for a key.
|
||||
*
|
||||
* Some key types require additional domain parameters in addition to
|
||||
* the key type identifier and the key size. Use this function instead
|
||||
* of psa_set_key_type() when you need to specify domain parameters.
|
||||
*
|
||||
* The format for the required domain parameters varies based on the key type.
|
||||
*
|
||||
* - For RSA keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY or #PSA_KEY_TYPE_RSA_KEY_PAIR),
|
||||
* the domain parameter data consists of the public exponent,
|
||||
* represented as a big-endian integer with no leading zeros.
|
||||
* This information is used when generating an RSA key pair.
|
||||
* When importing a key, the public exponent is read from the imported
|
||||
* key data and the exponent recorded in the attribute structure is ignored.
|
||||
* As an exception, the public exponent 65537 is represented by an empty
|
||||
* byte string.
|
||||
* - For DSA keys (#PSA_KEY_TYPE_DSA_PUBLIC_KEY or #PSA_KEY_TYPE_DSA_KEY_PAIR),
|
||||
* the `Dss-Parms` format as defined by RFC 3279 §2.3.2.
|
||||
* ```
|
||||
* Dss-Parms ::= SEQUENCE {
|
||||
* p INTEGER,
|
||||
* q INTEGER,
|
||||
* g INTEGER
|
||||
* }
|
||||
* ```
|
||||
* - For Diffie-Hellman key exchange keys
|
||||
* (#PSA_KEY_TYPE_DH_PUBLIC_KEY(#PSA_DH_FAMILY_CUSTOM) or
|
||||
* #PSA_KEY_TYPE_DH_KEY_PAIR(#PSA_DH_FAMILY_CUSTOM)), the
|
||||
* `DomainParameters` format as defined by RFC 3279 §2.3.3.
|
||||
* ```
|
||||
* DomainParameters ::= SEQUENCE {
|
||||
* p INTEGER, -- odd prime, p=jq +1
|
||||
* g INTEGER, -- generator, g
|
||||
* q INTEGER, -- factor of p-1
|
||||
* j INTEGER OPTIONAL, -- subgroup factor
|
||||
* validationParms ValidationParms OPTIONAL
|
||||
* }
|
||||
* ValidationParms ::= SEQUENCE {
|
||||
* seed BIT STRING,
|
||||
* pgenCounter INTEGER
|
||||
* }
|
||||
* ```
|
||||
*
|
||||
* \note This function may allocate memory or other resources.
|
||||
* Once you have called this function on an attribute structure,
|
||||
* you must call psa_reset_key_attributes() to free these resources.
|
||||
*
|
||||
* \note This is an experimental extension to the interface. It may change
|
||||
* in future versions of the library.
|
||||
*
|
||||
* \param[in,out] attributes Attribute structure where the specified domain
|
||||
* parameters will be stored.
|
||||
* If this function fails, the content of
|
||||
* \p attributes is not modified.
|
||||
* \param type Key type (a \c PSA_KEY_TYPE_XXX value).
|
||||
* \param[in] data Buffer containing the key domain parameters.
|
||||
* The content of this buffer is interpreted
|
||||
* according to \p type as described above.
|
||||
* \param data_length Size of the \p data buffer in bytes.
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* \retval #PSA_ERROR_INVALID_ARGUMENT
|
||||
* \retval #PSA_ERROR_NOT_SUPPORTED
|
||||
* \retval #PSA_ERROR_INSUFFICIENT_MEMORY
|
||||
*/
|
||||
psa_status_t psa_set_key_domain_parameters(psa_key_attributes_t *attributes,
|
||||
psa_key_type_t type,
|
||||
const uint8_t *data,
|
||||
size_t data_length);
|
||||
|
||||
/**
|
||||
* \brief Get domain parameters for a key.
|
||||
*
|
||||
* Get the domain parameters for a key with this function, if any. The format
|
||||
* of the domain parameters written to \p data is specified in the
|
||||
* documentation for psa_set_key_domain_parameters().
|
||||
*
|
||||
* \note This is an experimental extension to the interface. It may change
|
||||
* in future versions of the library.
|
||||
*
|
||||
* \param[in] attributes The key attribute structure to query.
|
||||
* \param[out] data On success, the key domain parameters.
|
||||
* \param data_size Size of the \p data buffer in bytes.
|
||||
* The buffer is guaranteed to be large
|
||||
* enough if its size in bytes is at least
|
||||
* the value given by
|
||||
* PSA_KEY_DOMAIN_PARAMETERS_SIZE().
|
||||
* \param[out] data_length On success, the number of bytes
|
||||
* that make up the key domain parameters data.
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* \retval #PSA_ERROR_BUFFER_TOO_SMALL
|
||||
*/
|
||||
psa_status_t psa_get_key_domain_parameters(
|
||||
const psa_key_attributes_t *attributes,
|
||||
uint8_t *data,
|
||||
size_t data_size,
|
||||
size_t *data_length);
|
||||
|
||||
/** Safe output buffer size for psa_get_key_domain_parameters().
|
||||
*
|
||||
* This macro returns a compile-time constant if its arguments are
|
||||
* compile-time constants.
|
||||
*
|
||||
* \warning This function may call its arguments multiple times or
|
||||
* zero times, so you should not pass arguments that contain
|
||||
* side effects.
|
||||
*
|
||||
* \note This is an experimental extension to the interface. It may change
|
||||
* in future versions of the library.
|
||||
*
|
||||
* \param key_type A supported key type.
|
||||
* \param key_bits The size of the key in bits.
|
||||
*
|
||||
* \return If the parameters are valid and supported, return
|
||||
* a buffer size in bytes that guarantees that
|
||||
* psa_get_key_domain_parameters() will not fail with
|
||||
* #PSA_ERROR_BUFFER_TOO_SMALL.
|
||||
* If the parameters are a valid combination that is not supported
|
||||
* by the implementation, this macro shall return either a
|
||||
* sensible size or 0.
|
||||
* If the parameters are not valid, the
|
||||
* return value is unspecified.
|
||||
*/
|
||||
#define PSA_KEY_DOMAIN_PARAMETERS_SIZE(key_type, key_bits) \
|
||||
(PSA_KEY_TYPE_IS_RSA(key_type) ? sizeof(int) : \
|
||||
PSA_KEY_TYPE_IS_DH(key_type) ? PSA_DH_KEY_DOMAIN_PARAMETERS_SIZE(key_bits) : \
|
||||
PSA_KEY_TYPE_IS_DSA(key_type) ? PSA_DSA_KEY_DOMAIN_PARAMETERS_SIZE(key_bits) : \
|
||||
0)
|
||||
#define PSA_DH_KEY_DOMAIN_PARAMETERS_SIZE(key_bits) \
|
||||
(4 + (PSA_BITS_TO_BYTES(key_bits) + 5) * 3 /*without optional parts*/)
|
||||
#define PSA_DSA_KEY_DOMAIN_PARAMETERS_SIZE(key_bits) \
|
||||
(4 + (PSA_BITS_TO_BYTES(key_bits) + 5) * 2 /*p, g*/ + 34 /*q*/)
|
||||
|
||||
/**@}*/
|
||||
|
||||
/** \defgroup psa_tls_helpers TLS helper functions
|
||||
* @{
|
||||
*/
|
||||
|
||||
#if defined(MBEDTLS_ECP_C)
|
||||
#include <mbedtls/ecp.h>
|
||||
|
||||
/** Convert an ECC curve identifier from the Mbed TLS encoding to PSA.
|
||||
*
|
||||
* \note This function is provided solely for the convenience of
|
||||
* Mbed TLS and may be removed at any time without notice.
|
||||
*
|
||||
* \param grpid An Mbed TLS elliptic curve identifier
|
||||
* (`MBEDTLS_ECP_DP_xxx`).
|
||||
* \param[out] bits On success, the bit size of the curve.
|
||||
*
|
||||
* \return The corresponding PSA elliptic curve identifier
|
||||
* (`PSA_ECC_FAMILY_xxx`).
|
||||
* \return \c 0 on failure (\p grpid is not recognized).
|
||||
*/
|
||||
static inline psa_ecc_family_t mbedtls_ecc_group_to_psa( mbedtls_ecp_group_id grpid,
|
||||
size_t *bits )
|
||||
{
|
||||
switch( grpid )
|
||||
{
|
||||
case MBEDTLS_ECP_DP_SECP192R1:
|
||||
*bits = 192;
|
||||
return( PSA_ECC_FAMILY_SECP_R1 );
|
||||
case MBEDTLS_ECP_DP_SECP224R1:
|
||||
*bits = 224;
|
||||
return( PSA_ECC_FAMILY_SECP_R1 );
|
||||
case MBEDTLS_ECP_DP_SECP256R1:
|
||||
*bits = 256;
|
||||
return( PSA_ECC_FAMILY_SECP_R1 );
|
||||
case MBEDTLS_ECP_DP_SECP384R1:
|
||||
*bits = 384;
|
||||
return( PSA_ECC_FAMILY_SECP_R1 );
|
||||
case MBEDTLS_ECP_DP_SECP521R1:
|
||||
*bits = 521;
|
||||
return( PSA_ECC_FAMILY_SECP_R1 );
|
||||
case MBEDTLS_ECP_DP_BP256R1:
|
||||
*bits = 256;
|
||||
return( PSA_ECC_FAMILY_BRAINPOOL_P_R1 );
|
||||
case MBEDTLS_ECP_DP_BP384R1:
|
||||
*bits = 384;
|
||||
return( PSA_ECC_FAMILY_BRAINPOOL_P_R1 );
|
||||
case MBEDTLS_ECP_DP_BP512R1:
|
||||
*bits = 512;
|
||||
return( PSA_ECC_FAMILY_BRAINPOOL_P_R1 );
|
||||
case MBEDTLS_ECP_DP_CURVE25519:
|
||||
*bits = 255;
|
||||
return( PSA_ECC_FAMILY_MONTGOMERY );
|
||||
case MBEDTLS_ECP_DP_SECP192K1:
|
||||
*bits = 192;
|
||||
return( PSA_ECC_FAMILY_SECP_K1 );
|
||||
case MBEDTLS_ECP_DP_SECP224K1:
|
||||
*bits = 224;
|
||||
return( PSA_ECC_FAMILY_SECP_K1 );
|
||||
case MBEDTLS_ECP_DP_SECP256K1:
|
||||
*bits = 256;
|
||||
return( PSA_ECC_FAMILY_SECP_K1 );
|
||||
case MBEDTLS_ECP_DP_CURVE448:
|
||||
*bits = 448;
|
||||
return( PSA_ECC_FAMILY_MONTGOMERY );
|
||||
default:
|
||||
*bits = 0;
|
||||
return( 0 );
|
||||
}
|
||||
}
|
||||
|
||||
/** Convert an ECC curve identifier from the PSA encoding to Mbed TLS.
|
||||
*
|
||||
* \note This function is provided solely for the convenience of
|
||||
* Mbed TLS and may be removed at any time without notice.
|
||||
*
|
||||
* \param curve A PSA elliptic curve identifier
|
||||
* (`PSA_ECC_FAMILY_xxx`).
|
||||
* \param bits The bit-length of a private key on \p curve.
|
||||
* \param bits_is_sloppy If true, \p bits may be the bit-length rounded up
|
||||
* to the nearest multiple of 8. This allows the caller
|
||||
* to infer the exact curve from the length of a key
|
||||
* which is supplied as a byte string.
|
||||
*
|
||||
* \return The corresponding Mbed TLS elliptic curve identifier
|
||||
* (`MBEDTLS_ECP_DP_xxx`).
|
||||
* \return #MBEDTLS_ECP_DP_NONE if \c curve is not recognized.
|
||||
* \return #MBEDTLS_ECP_DP_NONE if \p bits is not
|
||||
* correct for \p curve.
|
||||
*/
|
||||
mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
|
||||
size_t bits,
|
||||
int bits_is_sloppy );
|
||||
#endif /* MBEDTLS_ECP_C */
|
||||
|
||||
/**@}*/
|
||||
|
||||
/** \defgroup psa_external_rng External random generator
|
||||
* @{
|
||||
*/
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
|
||||
/** External random generator function, implemented by the platform.
|
||||
*
|
||||
* When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled,
|
||||
* this function replaces Mbed TLS's entropy and DRBG modules for all
|
||||
* random generation triggered via PSA crypto interfaces.
|
||||
*
|
||||
* \note This random generator must deliver random numbers with cryptographic
|
||||
* quality and high performance. It must supply unpredictable numbers
|
||||
* with a uniform distribution. The implementation of this function
|
||||
* is responsible for ensuring that the random generator is seeded
|
||||
* with sufficient entropy. If you have a hardware TRNG which is slow
|
||||
* or delivers non-uniform output, declare it as an entropy source
|
||||
* with mbedtls_entropy_add_source() instead of enabling this option.
|
||||
*
|
||||
* \param[in,out] context Pointer to the random generator context.
|
||||
* This is all-bits-zero on the first call
|
||||
* and preserved between successive calls.
|
||||
* \param[out] output Output buffer. On success, this buffer
|
||||
* contains random data with a uniform
|
||||
* distribution.
|
||||
* \param output_size The size of the \p output buffer in bytes.
|
||||
* \param[out] output_length On success, set this value to \p output_size.
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* Success. The output buffer contains \p output_size bytes of
|
||||
* cryptographic-quality random data, and \c *output_length is
|
||||
* set to \p output_size.
|
||||
* \retval #PSA_ERROR_INSUFFICIENT_ENTROPY
|
||||
* The random generator requires extra entropy and there is no
|
||||
* way to obtain entropy under current environment conditions.
|
||||
* This error should not happen under normal circumstances since
|
||||
* this function is responsible for obtaining as much entropy as
|
||||
* it needs. However implementations of this function may return
|
||||
* #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain
|
||||
* entropy without blocking indefinitely.
|
||||
* \retval #PSA_ERROR_HARDWARE_FAILURE
|
||||
* A failure of the random generator hardware that isn't covered
|
||||
* by #PSA_ERROR_INSUFFICIENT_ENTROPY.
|
||||
*/
|
||||
psa_status_t mbedtls_psa_external_get_random(
|
||||
mbedtls_psa_external_random_context_t *context,
|
||||
uint8_t *output, size_t output_size, size_t *output_length );
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
|
||||
|
||||
/**@}*/
|
||||
|
||||
/** \defgroup psa_builtin_keys Built-in keys
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** The minimum value for a key identifier that is built into the
|
||||
* implementation.
|
||||
*
|
||||
* The range of key identifiers from #MBEDTLS_PSA_KEY_ID_BUILTIN_MIN
|
||||
* to #MBEDTLS_PSA_KEY_ID_BUILTIN_MAX within the range from
|
||||
* #PSA_KEY_ID_VENDOR_MIN and #PSA_KEY_ID_VENDOR_MAX and must not intersect
|
||||
* with any other set of implementation-chosen key identifiers.
|
||||
*
|
||||
* This value is part of the library's ABI since changing it would invalidate
|
||||
* the values of built-in key identifiers in applications.
|
||||
*/
|
||||
#define MBEDTLS_PSA_KEY_ID_BUILTIN_MIN ((psa_key_id_t)0x7fff0000)
|
||||
|
||||
/** The maximum value for a key identifier that is built into the
|
||||
* implementation.
|
||||
*
|
||||
* See #MBEDTLS_PSA_KEY_ID_BUILTIN_MIN for more information.
|
||||
*/
|
||||
#define MBEDTLS_PSA_KEY_ID_BUILTIN_MAX ((psa_key_id_t)0x7fffefff)
|
||||
|
||||
/** A slot number identifying a key in a driver.
|
||||
*
|
||||
* Values of this type are used to identify built-in keys.
|
||||
*/
|
||||
typedef uint64_t psa_drv_slot_number_t;
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS)
|
||||
/** Test whether a key identifier belongs to the builtin key range.
|
||||
*
|
||||
* \param key_id Key identifier to test.
|
||||
*
|
||||
* \retval 1
|
||||
* The key identifier is a builtin key identifier.
|
||||
* \retval 0
|
||||
* The key identifier is not a builtin key identifier.
|
||||
*/
|
||||
static inline int psa_key_id_is_builtin( psa_key_id_t key_id )
|
||||
{
|
||||
return( ( key_id >= MBEDTLS_PSA_KEY_ID_BUILTIN_MIN ) &&
|
||||
( key_id <= MBEDTLS_PSA_KEY_ID_BUILTIN_MAX ) );
|
||||
}
|
||||
|
||||
/** Platform function to obtain the location and slot number of a built-in key.
|
||||
*
|
||||
* An application-specific implementation of this function must be provided if
|
||||
* #MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS is enabled. This would typically be provided
|
||||
* as part of a platform's system image.
|
||||
*
|
||||
* #MBEDTLS_SVC_KEY_ID_GET_KEY_ID(\p key_id) needs to be in the range from
|
||||
* #MBEDTLS_PSA_KEY_ID_BUILTIN_MIN to #MBEDTLS_PSA_KEY_ID_BUILTIN_MAX.
|
||||
*
|
||||
* In a multi-application configuration
|
||||
* (\c MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER is defined),
|
||||
* this function should check that #MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(\p key_id)
|
||||
* is allowed to use the given key.
|
||||
*
|
||||
* \param key_id The key ID for which to retrieve the
|
||||
* location and slot attributes.
|
||||
* \param[out] lifetime On success, the lifetime associated with the key
|
||||
* corresponding to \p key_id. Lifetime is a
|
||||
* combination of which driver contains the key,
|
||||
* and with what persistence level the key is
|
||||
* intended to be used. If the platform
|
||||
* implementation does not contain specific
|
||||
* information about the intended key persistence
|
||||
* level, the persistence level may be reported as
|
||||
* #PSA_KEY_PERSISTENCE_DEFAULT.
|
||||
* \param[out] slot_number On success, the slot number known to the driver
|
||||
* registered at the lifetime location reported
|
||||
* through \p lifetime which corresponds to the
|
||||
* requested built-in key.
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* The requested key identifier designates a built-in key.
|
||||
* In a multi-application configuration, the requested owner
|
||||
* is allowed to access it.
|
||||
* \retval #PSA_ERROR_DOES_NOT_EXIST
|
||||
* The requested key identifier is not a built-in key which is known
|
||||
* to this function. If a key exists in the key storage with this
|
||||
* identifier, the data from the storage will be used.
|
||||
* \return (any other error)
|
||||
* Any other error is propagated to the function that requested the key.
|
||||
* Common errors include:
|
||||
* - #PSA_ERROR_NOT_PERMITTED: the key exists but the requested owner
|
||||
* is not allowed to access it.
|
||||
*/
|
||||
psa_status_t mbedtls_psa_platform_get_builtin_key(
|
||||
mbedtls_svc_key_id_t key_id,
|
||||
psa_key_lifetime_t *lifetime,
|
||||
psa_drv_slot_number_t *slot_number );
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */
|
||||
|
||||
/** @} */
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* PSA_CRYPTO_EXTRA_H */
|
111
Externals/mbedtls/include/psa/crypto_platform.h
vendored
Normal file
111
Externals/mbedtls/include/psa/crypto_platform.h
vendored
Normal file
@ -0,0 +1,111 @@
|
||||
/**
|
||||
* \file psa/crypto_platform.h
|
||||
*
|
||||
* \brief PSA cryptography module: Mbed TLS platform definitions
|
||||
*
|
||||
* \note This file may not be included directly. Applications must
|
||||
* include psa/crypto.h.
|
||||
*
|
||||
* This file contains platform-dependent type definitions.
|
||||
*
|
||||
* In implementations with isolation between the application and the
|
||||
* cryptography module, implementers should take care to ensure that
|
||||
* the definitions that are exposed to applications match what the
|
||||
* module implements.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_PLATFORM_H
|
||||
#define PSA_CRYPTO_PLATFORM_H
|
||||
|
||||
/* Include the Mbed TLS configuration file, the way Mbed TLS does it
|
||||
* in each of its header files. */
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
/* Translate between classic MBEDTLS_xxx feature symbols and PSA_xxx
|
||||
* feature symbols. */
|
||||
#include "mbedtls/config_psa.h"
|
||||
|
||||
/* PSA requires several types which C99 provides in stdint.h. */
|
||||
#include <stdint.h>
|
||||
|
||||
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
||||
!defined(inline) && !defined(__cplusplus)
|
||||
#define inline __inline
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
|
||||
|
||||
/* Building for the PSA Crypto service on a PSA platform, a key owner is a PSA
|
||||
* partition identifier.
|
||||
*
|
||||
* The function psa_its_identifier_of_slot() in psa_crypto_storage.c that
|
||||
* translates a key identifier to a key storage file name assumes that
|
||||
* mbedtls_key_owner_id_t is an 32 bits integer. This function thus needs
|
||||
* reworking if mbedtls_key_owner_id_t is not defined as a 32 bits integer
|
||||
* here anymore.
|
||||
*/
|
||||
typedef int32_t mbedtls_key_owner_id_t;
|
||||
|
||||
/** Compare two key owner identifiers.
|
||||
*
|
||||
* \param id1 First key owner identifier.
|
||||
* \param id2 Second key owner identifier.
|
||||
*
|
||||
* \return Non-zero if the two key owner identifiers are equal, zero otherwise.
|
||||
*/
|
||||
static inline int mbedtls_key_owner_id_equal( mbedtls_key_owner_id_t id1,
|
||||
mbedtls_key_owner_id_t id2 )
|
||||
{
|
||||
return( id1 == id2 );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER */
|
||||
|
||||
/*
|
||||
* When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is being built for SPM
|
||||
* (Secure Partition Manager) integration which separates the code into two
|
||||
* parts: NSPE (Non-Secure Processing Environment) and SPE (Secure Processing
|
||||
* Environment). When building for the SPE, an additional header file should be
|
||||
* included.
|
||||
*/
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SPM)
|
||||
#define PSA_CRYPTO_SECURE 1
|
||||
#include "crypto_spe.h"
|
||||
#endif // MBEDTLS_PSA_CRYPTO_SPM
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
|
||||
/** The type of the context passed to mbedtls_psa_external_get_random().
|
||||
*
|
||||
* Mbed TLS initializes the context to all-bits-zero before calling
|
||||
* mbedtls_psa_external_get_random() for the first time.
|
||||
*
|
||||
* The definition of this type in the Mbed TLS source code is for
|
||||
* demonstration purposes. Implementers of mbedtls_psa_external_get_random()
|
||||
* are expected to replace it with a custom definition.
|
||||
*/
|
||||
typedef struct {
|
||||
uintptr_t opaque[2];
|
||||
} mbedtls_psa_external_random_context_t;
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
|
||||
|
||||
#endif /* PSA_CRYPTO_PLATFORM_H */
|
1395
Externals/mbedtls/include/psa/crypto_se_driver.h
vendored
Normal file
1395
Externals/mbedtls/include/psa/crypto_se_driver.h
vendored
Normal file
File diff suppressed because it is too large
Load Diff
1171
Externals/mbedtls/include/psa/crypto_sizes.h
vendored
Normal file
1171
Externals/mbedtls/include/psa/crypto_sizes.h
vendored
Normal file
File diff suppressed because it is too large
Load Diff
478
Externals/mbedtls/include/psa/crypto_struct.h
vendored
Normal file
478
Externals/mbedtls/include/psa/crypto_struct.h
vendored
Normal file
@ -0,0 +1,478 @@
|
||||
/**
|
||||
* \file psa/crypto_struct.h
|
||||
*
|
||||
* \brief PSA cryptography module: Mbed TLS structured type implementations
|
||||
*
|
||||
* \note This file may not be included directly. Applications must
|
||||
* include psa/crypto.h.
|
||||
*
|
||||
* This file contains the definitions of some data structures with
|
||||
* implementation-specific definitions.
|
||||
*
|
||||
* In implementations with isolation between the application and the
|
||||
* cryptography module, it is expected that the front-end and the back-end
|
||||
* would have different versions of this file.
|
||||
*
|
||||
* <h3>Design notes about multipart operation structures</h3>
|
||||
*
|
||||
* For multipart operations without driver delegation support, each multipart
|
||||
* operation structure contains a `psa_algorithm_t alg` field which indicates
|
||||
* which specific algorithm the structure is for. When the structure is not in
|
||||
* use, `alg` is 0. Most of the structure consists of a union which is
|
||||
* discriminated by `alg`.
|
||||
*
|
||||
* For multipart operations with driver delegation support, each multipart
|
||||
* operation structure contains an `unsigned int id` field indicating which
|
||||
* driver got assigned to do the operation. When the structure is not in use,
|
||||
* 'id' is 0. The structure contains also a driver context which is the union
|
||||
* of the contexts of all drivers able to handle the type of multipart
|
||||
* operation.
|
||||
*
|
||||
* Note that when `alg` or `id` is 0, the content of other fields is undefined.
|
||||
* In particular, it is not guaranteed that a freshly-initialized structure
|
||||
* is all-zero: we initialize structures to something like `{0, 0}`, which
|
||||
* is only guaranteed to initializes the first member of the union;
|
||||
* GCC and Clang initialize the whole structure to 0 (at the time of writing),
|
||||
* but MSVC and CompCert don't.
|
||||
*
|
||||
* In Mbed Crypto, multipart operation structures live independently from
|
||||
* the key. This allows Mbed Crypto to free the key objects when destroying
|
||||
* a key slot. If a multipart operation needs to remember the key after
|
||||
* the setup function returns, the operation structure needs to contain a
|
||||
* copy of the key.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_STRUCT_H
|
||||
#define PSA_CRYPTO_STRUCT_H
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* Include the Mbed TLS configuration file, the way Mbed TLS does it
|
||||
* in each of its header files. */
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "mbedtls/cmac.h"
|
||||
#include "mbedtls/gcm.h"
|
||||
|
||||
/* Include the context definition for the compiled-in drivers for the primitive
|
||||
* algorithms. */
|
||||
#include "psa/crypto_driver_contexts_primitives.h"
|
||||
|
||||
struct psa_hash_operation_s
|
||||
{
|
||||
/** Unique ID indicating which driver got assigned to do the
|
||||
* operation. Since driver contexts are driver-specific, swapping
|
||||
* drivers halfway through the operation is not supported.
|
||||
* ID values are auto-generated in psa_driver_wrappers.h.
|
||||
* ID value zero means the context is not valid or not assigned to
|
||||
* any driver (i.e. the driver context is not active, in use). */
|
||||
unsigned int id;
|
||||
psa_driver_hash_context_t ctx;
|
||||
};
|
||||
|
||||
#define PSA_HASH_OPERATION_INIT {0, {0}}
|
||||
static inline struct psa_hash_operation_s psa_hash_operation_init( void )
|
||||
{
|
||||
const struct psa_hash_operation_s v = PSA_HASH_OPERATION_INIT;
|
||||
return( v );
|
||||
}
|
||||
|
||||
struct psa_cipher_operation_s
|
||||
{
|
||||
/** Unique ID indicating which driver got assigned to do the
|
||||
* operation. Since driver contexts are driver-specific, swapping
|
||||
* drivers halfway through the operation is not supported.
|
||||
* ID values are auto-generated in psa_crypto_driver_wrappers.h
|
||||
* ID value zero means the context is not valid or not assigned to
|
||||
* any driver (i.e. none of the driver contexts are active). */
|
||||
unsigned int id;
|
||||
|
||||
unsigned int iv_required : 1;
|
||||
unsigned int iv_set : 1;
|
||||
|
||||
uint8_t default_iv_length;
|
||||
|
||||
psa_driver_cipher_context_t ctx;
|
||||
};
|
||||
|
||||
#define PSA_CIPHER_OPERATION_INIT {0, 0, 0, 0, {0}}
|
||||
static inline struct psa_cipher_operation_s psa_cipher_operation_init( void )
|
||||
{
|
||||
const struct psa_cipher_operation_s v = PSA_CIPHER_OPERATION_INIT;
|
||||
return( v );
|
||||
}
|
||||
|
||||
/* Include the context definition for the compiled-in drivers for the composite
|
||||
* algorithms. */
|
||||
#include "psa/crypto_driver_contexts_composites.h"
|
||||
|
||||
struct psa_mac_operation_s
|
||||
{
|
||||
/** Unique ID indicating which driver got assigned to do the
|
||||
* operation. Since driver contexts are driver-specific, swapping
|
||||
* drivers halfway through the operation is not supported.
|
||||
* ID values are auto-generated in psa_driver_wrappers.h
|
||||
* ID value zero means the context is not valid or not assigned to
|
||||
* any driver (i.e. none of the driver contexts are active). */
|
||||
unsigned int id;
|
||||
uint8_t mac_size;
|
||||
unsigned int is_sign : 1;
|
||||
psa_driver_mac_context_t ctx;
|
||||
};
|
||||
|
||||
#define PSA_MAC_OPERATION_INIT {0, 0, 0, {0}}
|
||||
static inline struct psa_mac_operation_s psa_mac_operation_init( void )
|
||||
{
|
||||
const struct psa_mac_operation_s v = PSA_MAC_OPERATION_INIT;
|
||||
return( v );
|
||||
}
|
||||
|
||||
struct psa_aead_operation_s
|
||||
{
|
||||
psa_algorithm_t alg;
|
||||
unsigned int key_set : 1;
|
||||
unsigned int iv_set : 1;
|
||||
uint8_t iv_size;
|
||||
uint8_t block_size;
|
||||
union
|
||||
{
|
||||
unsigned dummy; /* Enable easier initializing of the union. */
|
||||
mbedtls_cipher_context_t cipher;
|
||||
} ctx;
|
||||
};
|
||||
|
||||
#define PSA_AEAD_OPERATION_INIT {0, 0, 0, 0, 0, {0}}
|
||||
static inline struct psa_aead_operation_s psa_aead_operation_init( void )
|
||||
{
|
||||
const struct psa_aead_operation_s v = PSA_AEAD_OPERATION_INIT;
|
||||
return( v );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
|
||||
typedef struct
|
||||
{
|
||||
uint8_t *info;
|
||||
size_t info_length;
|
||||
#if PSA_HASH_MAX_SIZE > 0xff
|
||||
#error "PSA_HASH_MAX_SIZE does not fit in uint8_t"
|
||||
#endif
|
||||
uint8_t offset_in_block;
|
||||
uint8_t block_number;
|
||||
unsigned int state : 2;
|
||||
unsigned int info_set : 1;
|
||||
uint8_t output_block[PSA_HASH_MAX_SIZE];
|
||||
uint8_t prk[PSA_HASH_MAX_SIZE];
|
||||
struct psa_mac_operation_s hmac;
|
||||
} psa_hkdf_key_derivation_t;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
|
||||
typedef enum
|
||||
{
|
||||
PSA_TLS12_PRF_STATE_INIT, /* no input provided */
|
||||
PSA_TLS12_PRF_STATE_SEED_SET, /* seed has been set */
|
||||
PSA_TLS12_PRF_STATE_KEY_SET, /* key has been set */
|
||||
PSA_TLS12_PRF_STATE_LABEL_SET, /* label has been set */
|
||||
PSA_TLS12_PRF_STATE_OUTPUT /* output has been started */
|
||||
} psa_tls12_prf_key_derivation_state_t;
|
||||
|
||||
typedef struct psa_tls12_prf_key_derivation_s
|
||||
{
|
||||
#if PSA_HASH_MAX_SIZE > 0xff
|
||||
#error "PSA_HASH_MAX_SIZE does not fit in uint8_t"
|
||||
#endif
|
||||
|
||||
/* Indicates how many bytes in the current HMAC block have
|
||||
* not yet been read by the user. */
|
||||
uint8_t left_in_block;
|
||||
|
||||
/* The 1-based number of the block. */
|
||||
uint8_t block_number;
|
||||
|
||||
psa_tls12_prf_key_derivation_state_t state;
|
||||
|
||||
uint8_t *secret;
|
||||
size_t secret_length;
|
||||
uint8_t *seed;
|
||||
size_t seed_length;
|
||||
uint8_t *label;
|
||||
size_t label_length;
|
||||
|
||||
uint8_t Ai[PSA_HASH_MAX_SIZE];
|
||||
|
||||
/* `HMAC_hash( prk, A(i) + seed )` in the notation of RFC 5246, Sect. 5. */
|
||||
uint8_t output_block[PSA_HASH_MAX_SIZE];
|
||||
} psa_tls12_prf_key_derivation_t;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
|
||||
* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
|
||||
|
||||
struct psa_key_derivation_s
|
||||
{
|
||||
psa_algorithm_t alg;
|
||||
unsigned int can_output_key : 1;
|
||||
size_t capacity;
|
||||
union
|
||||
{
|
||||
/* Make the union non-empty even with no supported algorithms. */
|
||||
uint8_t dummy;
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
|
||||
psa_hkdf_key_derivation_t hkdf;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
|
||||
psa_tls12_prf_key_derivation_t tls12_prf;
|
||||
#endif
|
||||
} ctx;
|
||||
};
|
||||
|
||||
/* This only zeroes out the first byte in the union, the rest is unspecified. */
|
||||
#define PSA_KEY_DERIVATION_OPERATION_INIT {0, 0, 0, {0}}
|
||||
static inline struct psa_key_derivation_s psa_key_derivation_operation_init( void )
|
||||
{
|
||||
const struct psa_key_derivation_s v = PSA_KEY_DERIVATION_OPERATION_INIT;
|
||||
return( v );
|
||||
}
|
||||
|
||||
struct psa_key_policy_s
|
||||
{
|
||||
psa_key_usage_t usage;
|
||||
psa_algorithm_t alg;
|
||||
psa_algorithm_t alg2;
|
||||
};
|
||||
typedef struct psa_key_policy_s psa_key_policy_t;
|
||||
|
||||
#define PSA_KEY_POLICY_INIT {0, 0, 0}
|
||||
static inline struct psa_key_policy_s psa_key_policy_init( void )
|
||||
{
|
||||
const struct psa_key_policy_s v = PSA_KEY_POLICY_INIT;
|
||||
return( v );
|
||||
}
|
||||
|
||||
/* The type used internally for key sizes.
|
||||
* Public interfaces use size_t, but internally we use a smaller type. */
|
||||
typedef uint16_t psa_key_bits_t;
|
||||
/* The maximum value of the type used to represent bit-sizes.
|
||||
* This is used to mark an invalid key size. */
|
||||
#define PSA_KEY_BITS_TOO_LARGE ( (psa_key_bits_t) ( -1 ) )
|
||||
/* The maximum size of a key in bits.
|
||||
* Currently defined as the maximum that can be represented, rounded down
|
||||
* to a whole number of bytes.
|
||||
* This is an uncast value so that it can be used in preprocessor
|
||||
* conditionals. */
|
||||
#define PSA_MAX_KEY_BITS 0xfff8
|
||||
|
||||
/** A mask of flags that can be stored in key attributes.
|
||||
*
|
||||
* This type is also used internally to store flags in slots. Internal
|
||||
* flags are defined in library/psa_crypto_core.h. Internal flags may have
|
||||
* the same value as external flags if they are properly handled during
|
||||
* key creation and in psa_get_key_attributes.
|
||||
*/
|
||||
typedef uint16_t psa_key_attributes_flag_t;
|
||||
|
||||
#define MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER \
|
||||
( (psa_key_attributes_flag_t) 0x0001 )
|
||||
|
||||
/* A mask of key attribute flags used externally only.
|
||||
* Only meant for internal checks inside the library. */
|
||||
#define MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ( \
|
||||
MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER | \
|
||||
0 )
|
||||
|
||||
/* A mask of key attribute flags used both internally and externally.
|
||||
* Currently there aren't any. */
|
||||
#define MBEDTLS_PSA_KA_MASK_DUAL_USE ( \
|
||||
0 )
|
||||
|
||||
typedef struct
|
||||
{
|
||||
psa_key_type_t type;
|
||||
psa_key_bits_t bits;
|
||||
psa_key_lifetime_t lifetime;
|
||||
mbedtls_svc_key_id_t id;
|
||||
psa_key_policy_t policy;
|
||||
psa_key_attributes_flag_t flags;
|
||||
} psa_core_key_attributes_t;
|
||||
|
||||
#define PSA_CORE_KEY_ATTRIBUTES_INIT {PSA_KEY_TYPE_NONE, 0, PSA_KEY_LIFETIME_VOLATILE, MBEDTLS_SVC_KEY_ID_INIT, PSA_KEY_POLICY_INIT, 0}
|
||||
|
||||
struct psa_key_attributes_s
|
||||
{
|
||||
psa_core_key_attributes_t core;
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
||||
psa_key_slot_number_t slot_number;
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
|
||||
void *domain_parameters;
|
||||
size_t domain_parameters_size;
|
||||
};
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
||||
#define PSA_KEY_ATTRIBUTES_INIT {PSA_CORE_KEY_ATTRIBUTES_INIT, 0, NULL, 0}
|
||||
#else
|
||||
#define PSA_KEY_ATTRIBUTES_INIT {PSA_CORE_KEY_ATTRIBUTES_INIT, NULL, 0}
|
||||
#endif
|
||||
|
||||
static inline struct psa_key_attributes_s psa_key_attributes_init( void )
|
||||
{
|
||||
const struct psa_key_attributes_s v = PSA_KEY_ATTRIBUTES_INIT;
|
||||
return( v );
|
||||
}
|
||||
|
||||
static inline void psa_set_key_id( psa_key_attributes_t *attributes,
|
||||
mbedtls_svc_key_id_t key )
|
||||
{
|
||||
psa_key_lifetime_t lifetime = attributes->core.lifetime;
|
||||
|
||||
attributes->core.id = key;
|
||||
|
||||
if( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
|
||||
{
|
||||
attributes->core.lifetime =
|
||||
PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
|
||||
PSA_KEY_LIFETIME_PERSISTENT,
|
||||
PSA_KEY_LIFETIME_GET_LOCATION( lifetime ) );
|
||||
}
|
||||
}
|
||||
|
||||
static inline mbedtls_svc_key_id_t psa_get_key_id(
|
||||
const psa_key_attributes_t *attributes)
|
||||
{
|
||||
return( attributes->core.id );
|
||||
}
|
||||
|
||||
#ifdef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
|
||||
static inline void mbedtls_set_key_owner_id( psa_key_attributes_t *attributes,
|
||||
mbedtls_key_owner_id_t owner )
|
||||
{
|
||||
attributes->core.id.owner = owner;
|
||||
}
|
||||
#endif
|
||||
|
||||
static inline void psa_set_key_lifetime(psa_key_attributes_t *attributes,
|
||||
psa_key_lifetime_t lifetime)
|
||||
{
|
||||
attributes->core.lifetime = lifetime;
|
||||
if( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
|
||||
{
|
||||
#ifdef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
|
||||
attributes->core.id.key_id = 0;
|
||||
#else
|
||||
attributes->core.id = 0;
|
||||
#endif
|
||||
}
|
||||
}
|
||||
|
||||
static inline psa_key_lifetime_t psa_get_key_lifetime(
|
||||
const psa_key_attributes_t *attributes)
|
||||
{
|
||||
return( attributes->core.lifetime );
|
||||
}
|
||||
|
||||
static inline void psa_extend_key_usage_flags( psa_key_usage_t *usage_flags )
|
||||
{
|
||||
if( *usage_flags & PSA_KEY_USAGE_SIGN_HASH )
|
||||
*usage_flags |= PSA_KEY_USAGE_SIGN_MESSAGE;
|
||||
|
||||
if( *usage_flags & PSA_KEY_USAGE_VERIFY_HASH )
|
||||
*usage_flags |= PSA_KEY_USAGE_VERIFY_MESSAGE;
|
||||
}
|
||||
|
||||
static inline void psa_set_key_usage_flags(psa_key_attributes_t *attributes,
|
||||
psa_key_usage_t usage_flags)
|
||||
{
|
||||
psa_extend_key_usage_flags( &usage_flags );
|
||||
attributes->core.policy.usage = usage_flags;
|
||||
}
|
||||
|
||||
static inline psa_key_usage_t psa_get_key_usage_flags(
|
||||
const psa_key_attributes_t *attributes)
|
||||
{
|
||||
return( attributes->core.policy.usage );
|
||||
}
|
||||
|
||||
static inline void psa_set_key_algorithm(psa_key_attributes_t *attributes,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
attributes->core.policy.alg = alg;
|
||||
}
|
||||
|
||||
static inline psa_algorithm_t psa_get_key_algorithm(
|
||||
const psa_key_attributes_t *attributes)
|
||||
{
|
||||
return( attributes->core.policy.alg );
|
||||
}
|
||||
|
||||
/* This function is declared in crypto_extra.h, which comes after this
|
||||
* header file, but we need the function here, so repeat the declaration. */
|
||||
psa_status_t psa_set_key_domain_parameters(psa_key_attributes_t *attributes,
|
||||
psa_key_type_t type,
|
||||
const uint8_t *data,
|
||||
size_t data_length);
|
||||
|
||||
static inline void psa_set_key_type(psa_key_attributes_t *attributes,
|
||||
psa_key_type_t type)
|
||||
{
|
||||
if( attributes->domain_parameters == NULL )
|
||||
{
|
||||
/* Common case: quick path */
|
||||
attributes->core.type = type;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Call the bigger function to free the old domain paramteres.
|
||||
* Ignore any errors which may arise due to type requiring
|
||||
* non-default domain parameters, since this function can't
|
||||
* report errors. */
|
||||
(void) psa_set_key_domain_parameters( attributes, type, NULL, 0 );
|
||||
}
|
||||
}
|
||||
|
||||
static inline psa_key_type_t psa_get_key_type(
|
||||
const psa_key_attributes_t *attributes)
|
||||
{
|
||||
return( attributes->core.type );
|
||||
}
|
||||
|
||||
static inline void psa_set_key_bits(psa_key_attributes_t *attributes,
|
||||
size_t bits)
|
||||
{
|
||||
if( bits > PSA_MAX_KEY_BITS )
|
||||
attributes->core.bits = PSA_KEY_BITS_TOO_LARGE;
|
||||
else
|
||||
attributes->core.bits = (psa_key_bits_t) bits;
|
||||
}
|
||||
|
||||
static inline size_t psa_get_key_bits(
|
||||
const psa_key_attributes_t *attributes)
|
||||
{
|
||||
return( attributes->core.bits );
|
||||
}
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* PSA_CRYPTO_STRUCT_H */
|
383
Externals/mbedtls/include/psa/crypto_types.h
vendored
Normal file
383
Externals/mbedtls/include/psa/crypto_types.h
vendored
Normal file
@ -0,0 +1,383 @@
|
||||
/**
|
||||
* \file psa/crypto_types.h
|
||||
*
|
||||
* \brief PSA cryptography module: type aliases.
|
||||
*
|
||||
* \note This file may not be included directly. Applications must
|
||||
* include psa/crypto.h. Drivers must include the appropriate driver
|
||||
* header file.
|
||||
*
|
||||
* This file contains portable definitions of integral types for properties
|
||||
* of cryptographic keys, designations of cryptographic algorithms, and
|
||||
* error codes returned by the library.
|
||||
*
|
||||
* This header file does not declare any function.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_TYPES_H
|
||||
#define PSA_CRYPTO_TYPES_H
|
||||
|
||||
#include "crypto_platform.h"
|
||||
|
||||
/* If MBEDTLS_PSA_CRYPTO_C is defined, make sure MBEDTLS_PSA_CRYPTO_CLIENT
|
||||
* is defined as well to include all PSA code.
|
||||
*/
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
#define MBEDTLS_PSA_CRYPTO_CLIENT
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
/** \defgroup error Error codes
|
||||
* @{
|
||||
*/
|
||||
|
||||
/**
|
||||
* \brief Function return status.
|
||||
*
|
||||
* This is either #PSA_SUCCESS (which is zero), indicating success,
|
||||
* or a small negative value indicating that an error occurred. Errors are
|
||||
* encoded as one of the \c PSA_ERROR_xxx values defined here. */
|
||||
/* If #PSA_SUCCESS is already defined, it means that #psa_status_t
|
||||
* is also defined in an external header, so prevent its multiple
|
||||
* definition.
|
||||
*/
|
||||
#ifndef PSA_SUCCESS
|
||||
typedef int32_t psa_status_t;
|
||||
#endif
|
||||
|
||||
/**@}*/
|
||||
|
||||
/** \defgroup crypto_types Key and algorithm types
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** \brief Encoding of a key type.
|
||||
*/
|
||||
typedef uint16_t psa_key_type_t;
|
||||
|
||||
/** The type of PSA elliptic curve family identifiers.
|
||||
*
|
||||
* The curve identifier is required to create an ECC key using the
|
||||
* PSA_KEY_TYPE_ECC_KEY_PAIR() or PSA_KEY_TYPE_ECC_PUBLIC_KEY()
|
||||
* macros.
|
||||
*
|
||||
* Values defined by this standard will never be in the range 0x80-0xff.
|
||||
* Vendors who define additional families must use an encoding in this range.
|
||||
*/
|
||||
typedef uint8_t psa_ecc_family_t;
|
||||
|
||||
/** The type of PSA Diffie-Hellman group family identifiers.
|
||||
*
|
||||
* The group identifier is required to create an Diffie-Hellman key using the
|
||||
* PSA_KEY_TYPE_DH_KEY_PAIR() or PSA_KEY_TYPE_DH_PUBLIC_KEY()
|
||||
* macros.
|
||||
*
|
||||
* Values defined by this standard will never be in the range 0x80-0xff.
|
||||
* Vendors who define additional families must use an encoding in this range.
|
||||
*/
|
||||
typedef uint8_t psa_dh_family_t;
|
||||
|
||||
/** \brief Encoding of a cryptographic algorithm.
|
||||
*
|
||||
* For algorithms that can be applied to multiple key types, this type
|
||||
* does not encode the key type. For example, for symmetric ciphers
|
||||
* based on a block cipher, #psa_algorithm_t encodes the block cipher
|
||||
* mode and the padding mode while the block cipher itself is encoded
|
||||
* via #psa_key_type_t.
|
||||
*/
|
||||
typedef uint32_t psa_algorithm_t;
|
||||
|
||||
/**@}*/
|
||||
|
||||
/** \defgroup key_lifetimes Key lifetimes
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** Encoding of key lifetimes.
|
||||
*
|
||||
* The lifetime of a key indicates where it is stored and what system actions
|
||||
* may create and destroy it.
|
||||
*
|
||||
* Lifetime values have the following structure:
|
||||
* - Bits 0-7 (#PSA_KEY_LIFETIME_GET_PERSISTENCE(\c lifetime)):
|
||||
* persistence level. This value indicates what device management
|
||||
* actions can cause it to be destroyed. In particular, it indicates
|
||||
* whether the key is _volatile_ or _persistent_.
|
||||
* See ::psa_key_persistence_t for more information.
|
||||
* - Bits 8-31 (#PSA_KEY_LIFETIME_GET_LOCATION(\c lifetime)):
|
||||
* location indicator. This value indicates which part of the system
|
||||
* has access to the key material and can perform operations using the key.
|
||||
* See ::psa_key_location_t for more information.
|
||||
*
|
||||
* Volatile keys are automatically destroyed when the application instance
|
||||
* terminates or on a power reset of the device. Persistent keys are
|
||||
* preserved until the application explicitly destroys them or until an
|
||||
* integration-specific device management event occurs (for example,
|
||||
* a factory reset).
|
||||
*
|
||||
* Persistent keys have a key identifier of type #mbedtls_svc_key_id_t.
|
||||
* This identifier remains valid throughout the lifetime of the key,
|
||||
* even if the application instance that created the key terminates.
|
||||
* The application can call psa_open_key() to open a persistent key that
|
||||
* it created previously.
|
||||
*
|
||||
* The default lifetime of a key is #PSA_KEY_LIFETIME_VOLATILE. The lifetime
|
||||
* #PSA_KEY_LIFETIME_PERSISTENT is supported if persistent storage is
|
||||
* available. Other lifetime values may be supported depending on the
|
||||
* library configuration.
|
||||
*/
|
||||
typedef uint32_t psa_key_lifetime_t;
|
||||
|
||||
/** Encoding of key persistence levels.
|
||||
*
|
||||
* What distinguishes different persistence levels is what device management
|
||||
* events may cause keys to be destroyed. _Volatile_ keys are destroyed
|
||||
* by a power reset. Persistent keys may be destroyed by events such as
|
||||
* a transfer of ownership or a factory reset. What management events
|
||||
* actually affect persistent keys at different levels is outside the
|
||||
* scope of the PSA Cryptography specification.
|
||||
*
|
||||
* The PSA Cryptography specification defines the following values of
|
||||
* persistence levels:
|
||||
* - \c 0 = #PSA_KEY_PERSISTENCE_VOLATILE: volatile key.
|
||||
* A volatile key is automatically destroyed by the implementation when
|
||||
* the application instance terminates. In particular, a volatile key
|
||||
* is automatically destroyed on a power reset of the device.
|
||||
* - \c 1 = #PSA_KEY_PERSISTENCE_DEFAULT:
|
||||
* persistent key with a default lifetime.
|
||||
* - \c 2-254: currently not supported by Mbed TLS.
|
||||
* - \c 255 = #PSA_KEY_PERSISTENCE_READ_ONLY:
|
||||
* read-only or write-once key.
|
||||
* A key with this persistence level cannot be destroyed.
|
||||
* Mbed TLS does not currently offer a way to create such keys, but
|
||||
* integrations of Mbed TLS can use it for built-in keys that the
|
||||
* application cannot modify (for example, a hardware unique key (HUK)).
|
||||
*
|
||||
* \note Key persistence levels are 8-bit values. Key management
|
||||
* interfaces operate on lifetimes (type ::psa_key_lifetime_t) which
|
||||
* encode the persistence as the lower 8 bits of a 32-bit value.
|
||||
*/
|
||||
typedef uint8_t psa_key_persistence_t;
|
||||
|
||||
/** Encoding of key location indicators.
|
||||
*
|
||||
* If an integration of Mbed TLS can make calls to external
|
||||
* cryptoprocessors such as secure elements, the location of a key
|
||||
* indicates which secure element performs the operations on the key.
|
||||
* Depending on the design of the secure element, the key
|
||||
* material may be stored either in the secure element, or
|
||||
* in wrapped (encrypted) form alongside the key metadata in the
|
||||
* primary local storage.
|
||||
*
|
||||
* The PSA Cryptography API specification defines the following values of
|
||||
* location indicators:
|
||||
* - \c 0: primary local storage.
|
||||
* This location is always available.
|
||||
* The primary local storage is typically the same storage area that
|
||||
* contains the key metadata.
|
||||
* - \c 1: primary secure element.
|
||||
* Integrations of Mbed TLS should support this value if there is a secure
|
||||
* element attached to the operating environment.
|
||||
* As a guideline, secure elements may provide higher resistance against
|
||||
* side channel and physical attacks than the primary local storage, but may
|
||||
* have restrictions on supported key types, sizes, policies and operations
|
||||
* and may have different performance characteristics.
|
||||
* - \c 2-0x7fffff: other locations defined by a PSA specification.
|
||||
* The PSA Cryptography API does not currently assign any meaning to these
|
||||
* locations, but future versions of that specification or other PSA
|
||||
* specifications may do so.
|
||||
* - \c 0x800000-0xffffff: vendor-defined locations.
|
||||
* No PSA specification will assign a meaning to locations in this range.
|
||||
*
|
||||
* \note Key location indicators are 24-bit values. Key management
|
||||
* interfaces operate on lifetimes (type ::psa_key_lifetime_t) which
|
||||
* encode the location as the upper 24 bits of a 32-bit value.
|
||||
*/
|
||||
typedef uint32_t psa_key_location_t;
|
||||
|
||||
/** Encoding of identifiers of persistent keys.
|
||||
*
|
||||
* - Applications may freely choose key identifiers in the range
|
||||
* #PSA_KEY_ID_USER_MIN to #PSA_KEY_ID_USER_MAX.
|
||||
* - The implementation may define additional key identifiers in the range
|
||||
* #PSA_KEY_ID_VENDOR_MIN to #PSA_KEY_ID_VENDOR_MAX.
|
||||
* - 0 is reserved as an invalid key identifier.
|
||||
* - Key identifiers outside these ranges are reserved for future use.
|
||||
*/
|
||||
typedef uint32_t psa_key_id_t;
|
||||
|
||||
#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
|
||||
typedef psa_key_id_t mbedtls_svc_key_id_t;
|
||||
|
||||
#else /* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER */
|
||||
/* Implementation-specific: The Mbed Cryptography library can be built as
|
||||
* part of a multi-client service that exposes the PSA Cryptograpy API in each
|
||||
* client and encodes the client identity in the key identifier argument of
|
||||
* functions such as psa_open_key().
|
||||
*/
|
||||
typedef struct
|
||||
{
|
||||
psa_key_id_t key_id;
|
||||
mbedtls_key_owner_id_t owner;
|
||||
} mbedtls_svc_key_id_t;
|
||||
|
||||
#endif /* !MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER */
|
||||
|
||||
/**@}*/
|
||||
|
||||
/** \defgroup policy Key policies
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** \brief Encoding of permitted usage on a key. */
|
||||
typedef uint32_t psa_key_usage_t;
|
||||
|
||||
/**@}*/
|
||||
|
||||
/** \defgroup attributes Key attributes
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** The type of a structure containing key attributes.
|
||||
*
|
||||
* This is an opaque structure that can represent the metadata of a key
|
||||
* object. Metadata that can be stored in attributes includes:
|
||||
* - The location of the key in storage, indicated by its key identifier
|
||||
* and its lifetime.
|
||||
* - The key's policy, comprising usage flags and a specification of
|
||||
* the permitted algorithm(s).
|
||||
* - Information about the key itself: the key type and its size.
|
||||
* - Additional implementation-defined attributes.
|
||||
*
|
||||
* The actual key material is not considered an attribute of a key.
|
||||
* Key attributes do not contain information that is generally considered
|
||||
* highly confidential.
|
||||
*
|
||||
* An attribute structure works like a simple data structure where each function
|
||||
* `psa_set_key_xxx` sets a field and the corresponding function
|
||||
* `psa_get_key_xxx` retrieves the value of the corresponding field.
|
||||
* However, a future version of the library may report values that are
|
||||
* equivalent to the original one, but have a different encoding. Invalid
|
||||
* values may be mapped to different, also invalid values.
|
||||
*
|
||||
* An attribute structure may contain references to auxiliary resources,
|
||||
* for example pointers to allocated memory or indirect references to
|
||||
* pre-calculated values. In order to free such resources, the application
|
||||
* must call psa_reset_key_attributes(). As an exception, calling
|
||||
* psa_reset_key_attributes() on an attribute structure is optional if
|
||||
* the structure has only been modified by the following functions
|
||||
* since it was initialized or last reset with psa_reset_key_attributes():
|
||||
* - psa_set_key_id()
|
||||
* - psa_set_key_lifetime()
|
||||
* - psa_set_key_type()
|
||||
* - psa_set_key_bits()
|
||||
* - psa_set_key_usage_flags()
|
||||
* - psa_set_key_algorithm()
|
||||
*
|
||||
* Before calling any function on a key attribute structure, the application
|
||||
* must initialize it by any of the following means:
|
||||
* - Set the structure to all-bits-zero, for example:
|
||||
* \code
|
||||
* psa_key_attributes_t attributes;
|
||||
* memset(&attributes, 0, sizeof(attributes));
|
||||
* \endcode
|
||||
* - Initialize the structure to logical zero values, for example:
|
||||
* \code
|
||||
* psa_key_attributes_t attributes = {0};
|
||||
* \endcode
|
||||
* - Initialize the structure to the initializer #PSA_KEY_ATTRIBUTES_INIT,
|
||||
* for example:
|
||||
* \code
|
||||
* psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
* \endcode
|
||||
* - Assign the result of the function psa_key_attributes_init()
|
||||
* to the structure, for example:
|
||||
* \code
|
||||
* psa_key_attributes_t attributes;
|
||||
* attributes = psa_key_attributes_init();
|
||||
* \endcode
|
||||
*
|
||||
* A freshly initialized attribute structure contains the following
|
||||
* values:
|
||||
*
|
||||
* - lifetime: #PSA_KEY_LIFETIME_VOLATILE.
|
||||
* - key identifier: 0 (which is not a valid key identifier).
|
||||
* - type: \c 0 (meaning that the type is unspecified).
|
||||
* - key size: \c 0 (meaning that the size is unspecified).
|
||||
* - usage flags: \c 0 (which allows no usage except exporting a public key).
|
||||
* - algorithm: \c 0 (which allows no cryptographic usage, but allows
|
||||
* exporting).
|
||||
*
|
||||
* A typical sequence to create a key is as follows:
|
||||
* -# Create and initialize an attribute structure.
|
||||
* -# If the key is persistent, call psa_set_key_id().
|
||||
* Also call psa_set_key_lifetime() to place the key in a non-default
|
||||
* location.
|
||||
* -# Set the key policy with psa_set_key_usage_flags() and
|
||||
* psa_set_key_algorithm().
|
||||
* -# Set the key type with psa_set_key_type().
|
||||
* Skip this step if copying an existing key with psa_copy_key().
|
||||
* -# When generating a random key with psa_generate_key() or deriving a key
|
||||
* with psa_key_derivation_output_key(), set the desired key size with
|
||||
* psa_set_key_bits().
|
||||
* -# Call a key creation function: psa_import_key(), psa_generate_key(),
|
||||
* psa_key_derivation_output_key() or psa_copy_key(). This function reads
|
||||
* the attribute structure, creates a key with these attributes, and
|
||||
* outputs a key identifier to the newly created key.
|
||||
* -# The attribute structure is now no longer necessary.
|
||||
* You may call psa_reset_key_attributes(), although this is optional
|
||||
* with the workflow presented here because the attributes currently
|
||||
* defined in this specification do not require any additional resources
|
||||
* beyond the structure itself.
|
||||
*
|
||||
* A typical sequence to query a key's attributes is as follows:
|
||||
* -# Call psa_get_key_attributes().
|
||||
* -# Call `psa_get_key_xxx` functions to retrieve the attribute(s) that
|
||||
* you are interested in.
|
||||
* -# Call psa_reset_key_attributes() to free any resources that may be
|
||||
* used by the attribute structure.
|
||||
*
|
||||
* Once a key has been created, it is impossible to change its attributes.
|
||||
*/
|
||||
typedef struct psa_key_attributes_s psa_key_attributes_t;
|
||||
|
||||
|
||||
#ifndef __DOXYGEN_ONLY__
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
||||
/* Mbed Crypto defines this type in crypto_types.h because it is also
|
||||
* visible to applications through an implementation-specific extension.
|
||||
* For the PSA Cryptography specification, this type is only visible
|
||||
* via crypto_se_driver.h. */
|
||||
typedef uint64_t psa_key_slot_number_t;
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
|
||||
#endif /* !__DOXYGEN_ONLY__ */
|
||||
|
||||
/**@}*/
|
||||
|
||||
/** \defgroup derivation Key derivation
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** \brief Encoding of the step of a key derivation. */
|
||||
typedef uint16_t psa_key_derivation_step_t;
|
||||
|
||||
/**@}*/
|
||||
|
||||
#endif /* PSA_CRYPTO_TYPES_H */
|
2325
Externals/mbedtls/include/psa/crypto_values.h
vendored
Normal file
2325
Externals/mbedtls/include/psa/crypto_values.h
vendored
Normal file
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user