adafruit-mirror/zephyr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 9

random: remove TinyCrypt usage

Browse source 
Following the deprecation of TinyCrypt (#79566) we remove
TinyCrypt usage in random generators. This basically only affects
the CTR-DRBG random generator which from now only will only make
use of Mbed TLS.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
This commit is contained in:
Valerio Setti 2024-10-10 13:17:03 +02:00 committed by Mahesh Mahadevan
parent f4b7d151c5
commit 3d45ee7cb7
3 changed files with 10 additions and 78 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
doc/releases/migration-guide-4.0.rst
View file

@ -559,6 +559,14 @@ MCUmgr
Modem
=====
Random
======
* Following the deprecation of the TinyCrypt library (:github:`79566`), usage
of TinyCrypt in the CTR-DRBG random number generator was removed. From now on
Mbed TLS is required to enable :kconfig:option:`CONFIG_CTR_DRBG_CSPRNG_GENERATOR`.
(:github:`79653`)
Shell
=====

6
subsys/random/Kconfig
View file

@ -106,11 +106,9 @@ config HARDWARE_DEVICE_CS_GENERATOR
config CTR_DRBG_CSPRNG_GENERATOR
bool "Use CTR-DRBG CSPRNG"
depends on MBEDTLS || TINYCRYPT
depends on MBEDTLS
depends on ENTROPY_HAS_DRIVER
select MBEDTLS_CIPHER_AES_ENABLED if MBEDTLS
select TINYCRYPT_CTR_PRNG if TINYCRYPT
select TINYCRYPT_AES if TINYCRYPT
select MBEDTLS_CIPHER_AES_ENABLED
help
Enables the CTR-DRBG pseudo-random number generator. This CSPRNG
shall use the entropy API for an initialization seed. The CTR-DRBG

74
subsys/random/random_ctr_drbg.c
View file

@ -10,7 +10,6 @@
#include <zephyr/kernel.h>
#include <string.h>
#if defined(CONFIG_MBEDTLS)
#if !defined(CONFIG_MBEDTLS_CFG_FILE)
#include "mbedtls/config.h"
#else
@ -18,14 +17,6 @@
#endif /* CONFIG_MBEDTLS_CFG_FILE */
#include <mbedtls/ctr_drbg.h>
#elif defined(CONFIG_TINYCRYPT)
#include <tinycrypt/ctr_prng.h>
#include <tinycrypt/aes.h>
#include <tinycrypt/constants.h>
#endif /* CONFIG_MBEDTLS */
/*
* entropy_dev is initialized at runtime to allow first time initialization
* of the ctr_drbg engine.
@ -35,8 +26,6 @@ static const unsigned char drbg_seed[] = CONFIG_CS_CTR_DRBG_PERSONALIZATION;
static bool ctr_initialised;
static struct k_mutex ctr_lock;
#if defined(CONFIG_MBEDTLS)
static mbedtls_ctr_drbg_context ctr_ctx;
static int ctr_drbg_entropy_func(void *ctx, unsigned char *buf, size_t len)
@ -44,13 +33,6 @@ static int ctr_drbg_entropy_func(void *ctx, unsigned char *buf, size_t len)
return entropy_get_entropy(entropy_dev, (void *)buf, len);
}
#elif defined(CONFIG_TINYCRYPT)
static TCCtrPrng_t ctr_ctx;
#endif /* CONFIG_MBEDTLS */
static int ctr_drbg_initialize(void)
{
int ret;
@ -62,8 +44,6 @@ static int ctr_drbg_initialize(void)
return -ENODEV;
}
#if defined(CONFIG_MBEDTLS)
mbedtls_ctr_drbg_init(&ctr_ctx);
ret = mbedtls_ctr_drbg_seed(&ctr_ctx,
@ -77,27 +57,6 @@ static int ctr_drbg_initialize(void)
return -EIO;
}
#elif defined(CONFIG_TINYCRYPT)
uint8_t entropy[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
ret = entropy_get_entropy(entropy_dev, (void *)&entropy,
sizeof(entropy));
if (ret != 0) {
return -EIO;
}
ret = tc_ctr_prng_init(&ctr_ctx,
(uint8_t *)&entropy,
sizeof(entropy),
(uint8_t *)drbg_seed,
sizeof(drbg_seed));
if (ret == TC_CRYPTO_FAIL) {
return -EIO;
}
#endif
ctr_initialised = true;
return 0;
}
@ -117,41 +76,8 @@ int z_impl_sys_csrand_get(void *dst, uint32_t outlen)
}
}
#if defined(CONFIG_MBEDTLS)
ret = mbedtls_ctr_drbg_random(&ctr_ctx, (unsigned char *)dst, outlen);
#elif defined(CONFIG_TINYCRYPT)
uint8_t entropy[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
ret = tc_ctr_prng_generate(&ctr_ctx, 0, 0, (uint8_t *)dst, outlen);
if (ret == TC_CRYPTO_SUCCESS) {
ret = 0;
} else if (ret == TC_CTR_PRNG_RESEED_REQ) {
ret = entropy_get_entropy(entropy_dev,
(void *)&entropy, sizeof(entropy));
if (ret != 0) {
ret = -EIO;
goto end;
}
ret = tc_ctr_prng_reseed(&ctr_ctx,
entropy,
sizeof(entropy),
drbg_seed,
sizeof(drbg_seed));
ret = tc_ctr_prng_generate(&ctr_ctx, 0, 0,
(uint8_t *)dst, outlen);
ret = (ret == TC_CRYPTO_SUCCESS) ? 0 : -EIO;
} else {
ret = -EIO;
}
#endif
end:
k_mutex_unlock(&ctr_lock);