Aksal/nuttx-apps
1
0
Fork 1
mirror of https://github.com/apache/nuttx-apps.git synced 2026-08-01 20:29:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

mbedtls-alt/aes-alt: Illegal parameter detection for aes related functions

Browse source 
(1)aes-xts sets the key length to only 256 and 512 bits
(2)when the key length of aes-xts is 512 bits, MAX_KEY_SIZE needs to be expanded to 64 bytes.
(3)check invalid input length and mode

Signed-off-by: makejian <makejian@xiaomi.com>
This commit is contained in:
makejian 2023-10-20 17:07:33 +08:00 • committed by Xiang Xiao
parent b05c967ae6
commit 4fc6e7ca0c
2 changed files with 82 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
crypto/mbedtls/include/aes_alt.h
View file

@ -30,7 +30,7 @@
* Pre-processor Definitions
****************************************************************************/
#define MAX_KEY_SIZE 36
#define MAX_KEY_SIZE 64
typedef struct mbedtls_aes_context
{

83
crypto/mbedtls/source/aes_alt.c
View file

@ -51,6 +51,18 @@ int mbedtls_aes_setkey_enc(FAR mbedtls_aes_context *ctx,
FAR const unsigned char *key,
unsigned int keybits)
{
switch (keybits)
{
case 128:
break;
case 192:
break;
case 256:
break;
default:
return MBEDTLS_ERR_AES_INVALID_KEY_LENGTH;
}
memcpy(ctx->key, key, keybits / 8);
ctx->dev.session.key = (caddr_t)ctx->key;
ctx->dev.session.keylen = keybits / 8;
@ -74,6 +86,11 @@ int mbedtls_aes_crypt_ecb(FAR mbedtls_aes_context *ctx,
int ret;
unsigned char iv[16];
if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT)
{
return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
}
ctx->dev.session.cipher = CRYPTO_AES_CBC;
ret = cryptodev_get_session(&ctx->dev);
if (ret != 0)
@ -107,6 +124,16 @@ int mbedtls_aes_crypt_cbc(mbedtls_aes_context *ctx,
{
int ret;
if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT)
{
return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
}
if (length % 16)
{
return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
}
ctx->dev.session.cipher = CRYPTO_AES_CBC;
ret = cryptodev_get_session(&ctx->dev);
if (ret != 0)
@ -141,6 +168,11 @@ int mbedtls_aes_crypt_ctr(FAR mbedtls_aes_context *ctx,
{
int ret;
if (*nc_off > 0x0f)
{
return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
}
ctx->dev.session.cipher = CRYPTO_AES_CTR;
memcpy(ctx->key + ctx->dev.session.keylen,
nonce_counter, NONCE_LENGTH);
@ -183,14 +215,22 @@ int mbedtls_aes_xts_setkey_enc(FAR mbedtls_aes_xts_context *ctx,
FAR const unsigned char *key,
unsigned int keybits)
{
return mbedtls_aes_setkey_enc(ctx, key, keybits);
if (keybits != 256 && keybits != 512)
{
return MBEDTLS_ERR_AES_INVALID_KEY_LENGTH;
}
memcpy(ctx->key, key, keybits / 8);
ctx->dev.session.key = (caddr_t)ctx->key;
ctx->dev.session.keylen = keybits / 8;
return 0;
}
int mbedtls_aes_xts_setkey_dec(FAR mbedtls_aes_xts_context *ctx,
FAR const unsigned char *key,
unsigned int keybits)
{
return mbedtls_aes_setkey_dec(ctx, key, keybits);
return mbedtls_aes_xts_setkey_enc(ctx, key, keybits);
}
int mbedtls_aes_crypt_xts(FAR mbedtls_aes_xts_context *ctx,
@ -203,6 +243,25 @@ int mbedtls_aes_crypt_xts(FAR mbedtls_aes_xts_context *ctx,
int ret;
unsigned char iv[16];
if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT)
{
return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
}
/* Data units must be at least 16 bytes long. */
if (length < 16)
{
return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
}
/* NIST SP 800-38E disallows data units larger than 2**20 blocks. */
if (length > (1 << 20) * 16)
{
return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
}
ctx->dev.session.cipher = CRYPTO_AES_XTS;
ret = cryptodev_get_session(&ctx->dev);
if (ret != 0)
@ -238,6 +297,16 @@ int mbedtls_aes_crypt_cfb128(FAR mbedtls_aes_context *ctx,
{
int ret;
if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT)
{
return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
}
if (*iv_off > 15)
{
return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
}
ctx->dev.session.cipher = CRYPTO_AES_CFB_128;
ret = cryptodev_get_session(&ctx->dev);
if (ret != 0)
@ -273,6 +342,11 @@ int mbedtls_aes_crypt_cfb8(FAR mbedtls_aes_context *ctx,
{
int ret;
if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT)
{
return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
}
ctx->dev.session.cipher = CRYPTO_AES_CFB_8;
ret = cryptodev_get_session(&ctx->dev);
if (ret != 0)
@ -306,6 +380,11 @@ int mbedtls_aes_crypt_ofb(FAR mbedtls_aes_context *ctx,
{
int ret;
if (*iv_off > 15)
{
return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
}
ctx->dev.session.cipher = CRYPTO_AES_OFB;
ret = cryptodev_get_session(&ctx->dev);
if (ret != 0)