Upon further consideration we think that a remote attacker close to the
victim might be able to have precise enough timing information to
exploit the side channel as well. Update the Changelog to reflect this.
Signed-off-by: Janos Follath <janos.follath@arm.com>
The signature and naming of the Montgomrey initialisation function in
development and in the LTS was different. Align them for easier
readability and maintenance.
Signed-off-by: Janos Follath <janos.follath@arm.com>
Any timing variance dependant on the output of this function enables a
Bleichenbacher attack. It is extremely difficult to use safely.
In the Marvin attack paper
(https://people.redhat.com/~hkario/marvin/marvin-attack-paper.pdf) the
author suggests that implementations of PKCS 1.5 decryption that don't
include a countermeasure should be considered inherently dangerous.
They suggest that all libraries implement the same countermeasure, as
implementing different countermeasures across libraries enables the
Bleichenbacher attack as well.
This is extremely fragile and therefore we don't implement it. The use
of PKCS 1.5 in Mbed TLS implements the countermeasures recommended in
the TLS standard (7.4.7.1 of RFC 5246) and is not vulnerable.
Add a warning to PKCS 1.5 decryption to warn users about this.
Signed-off-by: Janos Follath <janos.follath@arm.com>
So far we needed it only locally here, but we will need calculating RR
for safe unblinding in RSA as well.
Signed-off-by: Janos Follath <janos.follath@arm.com>
secp224k1 is the one with 225-bit private keys.
The consequences of this mistake were:
* We emitted positive test cases for hypothetical SECP_R1_225 and
SECP_K1_224 curves, which were never executed.
* We emitted useless not-supported test cases for SECP_R1_225 and SECP_K1_224.
* We were missing positive test cases for SECP_R1_224 in automatically
generated tests.
* We were missing not-supported test cases for SECP_R1_224 and SECP_K1_225.
Thus this didn't cause test failures, but it caused missing test coverage
and some never-executed test cases.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Make sure the ctx variable in function mbedtls_timing_self_test is initialized properly, to avoid build
failures with -O3 e.g. on ppc64el
cd /<<PKGBUILDDIR>>/obj-powerpc64le-linux-gnu/library && /usr/bin/cc -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O3 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_428fca9bc1921c25c5121f9da7815cde__ -fno-omit-frame-pointer -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat -Werror=format-security -fdebug-prefix-map=/<<PKGBUILDDIR>>=/usr/src/mbedtls-2.28.6-1 -D__DEB_CANARY_CPPFLAGS_428fca9bc1921c25c5121f9da7815cde__ -Wdate-time -D_FORTIFY_SOURCE=3 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -MD -MT library/CMakeFiles/mbedcrypto_static.dir/xtea.c.o -MF CMakeFiles/mbedcrypto_static.dir/xtea.c.o.d -o CMakeFiles/mbedcrypto_static.dir/xtea.c.o -c /<<PKGBUILDDIR>>/library/xtea.c
In function ‘mbedtls_timing_get_delay’,
inlined from ‘mbedtls_timing_self_test’ at /<<PKGBUILDDIR>>/library/timing.c:427:13:
/<<PKGBUILDDIR>>/library/timing.c:334:12: error: ‘ctx.fin_ms’ may be used uninitialized [-Werror=maybe-uninitialized]
334 | if (ctx->fin_ms == 0) {
| ~~~^~~~~~~~
/<<PKGBUILDDIR>>/library/timing.c: In function ‘mbedtls_timing_self_test’:
/<<PKGBUILDDIR>>/library/timing.c:402:34: note: ‘ctx’ declared here
402 | mbedtls_timing_delay_context ctx;
| ^~~
In function ‘mbedtls_timing_get_delay’,
inlined from ‘mbedtls_timing_self_test’ at /<<PKGBUILDDIR>>/library/timing.c:427:13:
/<<PKGBUILDDIR>>/library/timing.c:344:26: error: ‘ctx.int_ms’ may be used uninitialized [-Werror=maybe-uninitialized]
344 | if (elapsed_ms >= ctx->int_ms) {
| ~~~^~~~~~~~
/<<PKGBUILDDIR>>/library/timing.c: In function ‘mbedtls_timing_self_test’:
/<<PKGBUILDDIR>>/library/timing.c:402:34: note: ‘ctx’ declared here
402 | mbedtls_timing_delay_context ctx;
| ^~~
Signed-off-by: Gianfranco Costamagna <locutusofborg@debian.org>
Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
