From 582b6fbad37b3f0ffde55bc1356f31ea3a1791f2 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 6 Jun 2025 10:12:42 +0200 Subject: [PATCH 1/3] We do support builds where NV seed is the only entropy source We want to support builds where there are no platform entropy sources (`MBEDTLS_NO_PLATFORM_ENTROPY` enabled), and no custom entropy sources (`MBEDTLS_ENTROPY_HARDWARE_ALT` disabled), but `mbedtls_entropy_init()` sets up a working entropy without needing to add sources manually with `mbedtls_entropy_add_source()` (`MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES` disabled) thanks to a nonvolatile seed file injected outside the library's control (`MBEDTLS_ENTROPY_NV_SEED` enabled). Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 4 ---- tests/suites/test_suite_config.crypto_combinations.data | 5 +++++ 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 301bfc403d..52034a1973 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -86,10 +86,6 @@ class CoverageTask(outcome_analysis.CoverageTask): # Untested platform-specific optimizations. # https://github.com/Mbed-TLS/mbedtls/issues/9588 'Config: MBEDTLS_HAVE_SSE2', - # Obsolete configuration option, to be replaced by - # PSA entropy drivers. - # https://github.com/Mbed-TLS/mbedtls/issues/8150 - 'Config: MBEDTLS_NO_PLATFORM_ENTROPY', # Untested aspect of the platform interface. # https://github.com/Mbed-TLS/mbedtls/issues/9589 'Config: MBEDTLS_PLATFORM_NO_STD_FUNCTIONS', diff --git a/tests/suites/test_suite_config.crypto_combinations.data b/tests/suites/test_suite_config.crypto_combinations.data index d3287d266a..9cc09ec895 100644 --- a/tests/suites/test_suite_config.crypto_combinations.data +++ b/tests/suites/test_suite_config.crypto_combinations.data @@ -1,5 +1,10 @@ # Interesting combinations of low-level crypto options +# Entropy: available in mbedtls_entropy_init(), thanks to NV seed, no platform sources, no custom source +Config: entropy: NV seed only +depends_on:!MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES:MBEDTLS_ENTROPY_NV_SEED:MBEDTLS_NO_PLATFORM_ENTROPY:!MBEDTLS_ENTROPY_HARDWARE_ALT +pass: + Config: ECC: Weierstrass curves only depends_on:MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED:!MBEDTLS_ECP_MONTGOMERY_ENABLED pass: From bd6fb46ff67c3d993ef3a9241cf681091465fb88 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 6 Jun 2025 10:18:36 +0200 Subject: [PATCH 2/3] Add a build with NV seed as the only entropy source Signed-off-by: Gilles Peskine --- .../scripts/components-configuration-crypto.sh | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/tests/scripts/components-configuration-crypto.sh b/tests/scripts/components-configuration-crypto.sh index e3096f3d65..c0c39be1e8 100644 --- a/tests/scripts/components-configuration-crypto.sh +++ b/tests/scripts/components-configuration-crypto.sh @@ -426,6 +426,23 @@ component_test_psa_external_rng_use_psa_crypto () { tests/ssl-opt.sh -f 'Default\|opaque' } +component_test_entropy_nv_seed_only () { + msg: "build: full minus platform entropy (NV seed only)" + scripts/config.py full + scripts/config.py set MBEDTLS_NO_PLATFORM_ENTROPY + make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS" + + msg: "build: full minus platform entropy (NV seed only)" + make test + + # Check that the library seems to refer to the seedfile, but not to + # platform entropy sources. + grep seedfile library/platform.o + not grep getrandom library/entropy*.o + not grep /dev/random library/entropy*.o + not grep /dev/.random library/entropy*.o +} + component_test_psa_inject_entropy () { msg "build: full + MBEDTLS_PSA_INJECT_ENTROPY" scripts/config.py full From 361799acbed4366a5513caaf13c566b82a5a7ffa Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 6 Jun 2025 14:51:54 +0200 Subject: [PATCH 3/3] typo Signed-off-by: Gilles Peskine --- tests/scripts/components-configuration-crypto.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/scripts/components-configuration-crypto.sh b/tests/scripts/components-configuration-crypto.sh index c0c39be1e8..04c38f6c36 100644 --- a/tests/scripts/components-configuration-crypto.sh +++ b/tests/scripts/components-configuration-crypto.sh @@ -427,12 +427,12 @@ component_test_psa_external_rng_use_psa_crypto () { } component_test_entropy_nv_seed_only () { - msg: "build: full minus platform entropy (NV seed only)" + msg "build: full minus platform entropy (NV seed only)" scripts/config.py full scripts/config.py set MBEDTLS_NO_PLATFORM_ENTROPY make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS" - msg: "build: full minus platform entropy (NV seed only)" + msg "build: full minus platform entropy (NV seed only)" make test # Check that the library seems to refer to the seedfile, but not to