Skip to content

Commit 1c7ff7e

Browse files
gilles-peskine-armgilles-peskine-arm
committed
mbedtls_ecp_write_key: document and test smaller output buffer
Document and test the current behavior, even if it is weird: * For Weierstrass keys, the error is MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL, not MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL. * For Weierstrass keys, a smaller output buffer is ok if the output fits. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
1 parent a395bdd commit 1c7ff7e

File tree

3 files changed

+118
-12
lines changed

3 files changed

+118
-12
lines changed

‎include/mbedtls/ecp.h

+10-5
Original file line numberDiff line numberDiff line change
@@ -1331,8 +1331,8 @@ int mbedtls_ecp_read_key(mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
13311331
* \brief This function exports an elliptic curve private key.
13321332
*
13331333
* \note Note that although this function accepts an output
1334-
* buffer that is larger than the key, most key import
1335-
* interfaces require the output to be trimmed to the
1334+
* buffer that is smaller or larger than the key, most key
1335+
* import interfaces require the output to have exactly
13361336
* key's nominal length. It is generally simplest to
13371337
* pass the key's nominal length as \c buflen, after
13381338
* checking that the output buffer is large enough.
@@ -1349,13 +1349,18 @@ int mbedtls_ecp_read_key(mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
13491349
* representation (which is little-endian), padded with
13501350
* null bytes at the end to reach \p buflen bytes.
13511351
* \param buflen The total length of the buffer in bytes.
1352-
* The length of the output is always
1352+
* The length of the output is
13531353
* (`grp->nbits` + 7) / 8 bytes
13541354
* where `grp->nbits` is the private key size in bits.
1355+
* For Weierstrass keys, if the output buffer is smaller,
1356+
* leading zeros are trimmed to fit if possible. For
1357+
* Montgomery keys, the output buffer must always be large
1358+
* enough for the nominal length.
13551359
*
13561360
* \return \c 0 on success.
1357-
* \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key
1358-
representation is larger than the available space in \p buf.
1361+
* \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL or
1362+
* #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the \p key
1363+
* representation is larger than the available space in \p buf.
13591364
* \return Another negative error code on different kinds of failure.
13601365
*/
13611366
int mbedtls_ecp_write_key(mbedtls_ecp_keypair *key,

‎tests/suites/test_suite_ecp.data

+88
Original file line numberDiff line numberDiff line change
@@ -752,6 +752,42 @@ ECP write key: secp256r1, output longer by 33
752752
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
753753
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"f12a1320760270a83cbffd53f6031ef76a5d86c8a204f2c30ca9ebf51f0f0ea7":65:0
754754

755+
ECP write key: secp256r1, output short by 1
756+
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
757+
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"f12a1320760270a83cbffd53f6031ef76a5d86c8a204f2c30ca9ebf51f0f0ea7":31:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
758+
759+
ECP write key: secp256r1, output_size=1
760+
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
761+
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"f12a1320760270a83cbffd53f6031ef76a5d86c8a204f2c30ca9ebf51f0f0ea7":1:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
762+
763+
ECP write key: secp256r1, output_size=0
764+
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
765+
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"f12a1320760270a83cbffd53f6031ef76a5d86c8a204f2c30ca9ebf51f0f0ea7":0:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
766+
767+
ECP write key: secp256r1, top byte = 0, output_size=32
768+
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
769+
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"00ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff":32:0
770+
771+
ECP write key: secp256r1, top byte = 0, output_size=31 (fits)
772+
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
773+
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"00ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff":31:0
774+
775+
ECP write key: secp256r1, top byte = 0, output_size=30 (too small)
776+
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
777+
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"00ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff":30:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
778+
779+
ECP write key: secp256r1, mostly-0 key, output_size=32
780+
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
781+
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"0000000000000000000000000000000000000000000000000000000000000001":32:0
782+
783+
ECP write key: secp256r1, mostly-0 key, output_size=31 (fits)
784+
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
785+
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"0000000000000000000000000000000000000000000000000000000000000001":31:0
786+
787+
ECP write key: secp256r1, mostly-0 key, output_size=1 (fits)
788+
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
789+
ecp_write_key:MBEDTLS_ECP_DP_SECP256R1:"0000000000000000000000000000000000000000000000000000000000000001":1:0
790+
755791
ECP write key: secp384r1, nominal
756792
depends_on:MBEDTLS_ECP_DP_SECP384R1_ENABLED
757793
ecp_write_key:MBEDTLS_ECP_DP_SECP384R1:"d27335ea71664af244dd14e9fd1260715dfd8a7965571c48d709ee7a7962a156d706a90cbcb5df2986f05feadb9376f1":48:0
@@ -768,6 +804,18 @@ ECP write key: secp384r1, output longer by 49
768804
depends_on:MBEDTLS_ECP_DP_SECP384R1_ENABLED
769805
ecp_write_key:MBEDTLS_ECP_DP_SECP384R1:"d27335ea71664af244dd14e9fd1260715dfd8a7965571c48d709ee7a7962a156d706a90cbcb5df2986f05feadb9376f1":97:0
770806

807+
ECP write key: secp384r1, output short by 1
808+
depends_on:MBEDTLS_ECP_DP_SECP384R1_ENABLED
809+
ecp_write_key:MBEDTLS_ECP_DP_SECP384R1:"d27335ea71664af244dd14e9fd1260715dfd8a7965571c48d709ee7a7962a156d706a90cbcb5df2986f05feadb9376f1":47:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
810+
811+
ECP write key: secp384r1, output_size=1
812+
depends_on:MBEDTLS_ECP_DP_SECP384R1_ENABLED
813+
ecp_write_key:MBEDTLS_ECP_DP_SECP384R1:"d27335ea71664af244dd14e9fd1260715dfd8a7965571c48d709ee7a7962a156d706a90cbcb5df2986f05feadb9376f1":1:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
814+
815+
ECP write key: secp384r1, output_size=0
816+
depends_on:MBEDTLS_ECP_DP_SECP384R1_ENABLED
817+
ecp_write_key:MBEDTLS_ECP_DP_SECP384R1:"d27335ea71664af244dd14e9fd1260715dfd8a7965571c48d709ee7a7962a156d706a90cbcb5df2986f05feadb9376f1":0:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
818+
771819
ECP write key: Curve25519, nominal
772820
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
773821
ecp_write_key:MBEDTLS_ECP_DP_CURVE25519:"a046e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449a44":32:0
@@ -784,6 +832,26 @@ ECP write key: Curve25519, output longer by 33
784832
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
785833
ecp_write_key:MBEDTLS_ECP_DP_CURVE25519:"a046e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449a44":65:0
786834

835+
ECP write key: Curve25519, output short by 1
836+
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
837+
ecp_write_key:MBEDTLS_ECP_DP_CURVE25519:"a046e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449a44":31:MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL
838+
839+
ECP write key: Curve25519, output_size=1
840+
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
841+
ecp_write_key:MBEDTLS_ECP_DP_CURVE25519:"a046e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449a44":1:MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL
842+
843+
ECP write key: Curve25519, output_size=0
844+
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
845+
ecp_write_key:MBEDTLS_ECP_DP_CURVE25519:"a046e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449a44":0:MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL
846+
847+
ECP write key: Curve25519, mostly-0 key, output_size=32
848+
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
849+
ecp_write_key:MBEDTLS_ECP_DP_CURVE25519:"0000000000000000000000000000000000000000000000000000000000000040":32:0
850+
851+
ECP write key: Curve25519, mostly-0 key, output_size=31
852+
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
853+
ecp_write_key:MBEDTLS_ECP_DP_CURVE25519:"0000000000000000000000000000000000000000000000000000000000000040":31:MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL
854+
787855
ECP write key: Curve448, nominal
788856
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
789857
ecp_write_key:MBEDTLS_ECP_DP_CURVE448:"3c262fddf9ec8e88495266fea19a34d28882acef045104d0d1aae121700a779c984c24f8cdd78fbff44943eba368f54b29259a4f1c600ad3":56:0
@@ -800,6 +868,26 @@ ECP write key: Curve448, output longer by 33
800868
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
801869
ecp_write_key:MBEDTLS_ECP_DP_CURVE448:"3c262fddf9ec8e88495266fea19a34d28882acef045104d0d1aae121700a779c984c24f8cdd78fbff44943eba368f54b29259a4f1c600ad3":113:0
802870

871+
ECP write key: Curve448, output short by 1
872+
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
873+
ecp_write_key:MBEDTLS_ECP_DP_CURVE448:"3c262fddf9ec8e88495266fea19a34d28882acef045104d0d1aae121700a779c984c24f8cdd78fbff44943eba368f54b29259a4f1c600ad3":55:MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL
874+
875+
ECP write key: Curve448, output_size=1
876+
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
877+
ecp_write_key:MBEDTLS_ECP_DP_CURVE448:"3c262fddf9ec8e88495266fea19a34d28882acef045104d0d1aae121700a779c984c24f8cdd78fbff44943eba368f54b29259a4f1c600ad3":1:MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL
878+
879+
ECP write key: Curve448, output_size=0
880+
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
881+
ecp_write_key:MBEDTLS_ECP_DP_CURVE448:"3c262fddf9ec8e88495266fea19a34d28882acef045104d0d1aae121700a779c984c24f8cdd78fbff44943eba368f54b29259a4f1c600ad3":0:MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL
882+
883+
ECP write key: Curve448, mostly-0 key, output_size=56
884+
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
885+
ecp_write_key:MBEDTLS_ECP_DP_CURVE448:"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080":56:0
886+
887+
ECP write key: Curve448, mostly-0 key, output_size=55
888+
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
889+
ecp_write_key:MBEDTLS_ECP_DP_CURVE448:"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080":55:MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL
890+
803891
ECP mod p192 small (more than 192 bits, less limbs than 2 * 192 bits)
804892
depends_on:MBEDTLS_ECP_DP_SECP192R1_ENABLED:MBEDTLS_ECP_NIST_OPTIM
805893
ecp_fast_mod:MBEDTLS_ECP_DP_SECP192R1:"0100000000000103010000000000010201000000000001010100000000000100"

‎tests/suites/test_suite_ecp.function

+20-7
Original file line numberDiff line numberDiff line change
@@ -1252,28 +1252,41 @@ void ecp_write_key(int grp_id, data_t *in_key,
12521252

12531253
if (expected_ret == 0) {
12541254
size_t length = (key.grp.nbits + 7) / 8;
1255-
TEST_LE_U(length, exported_size);
1256-
12571255
const unsigned char *key_start = NULL;
12581256
const unsigned char *zeros_start = NULL;
12591257
switch (mbedtls_ecp_get_type(&key.grp)) {
12601258
case MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS:
1259+
if ((size_t) exported_size < length) {
1260+
length = exported_size;
1261+
}
12611262
key_start = exported + exported_size - length;
12621263
zeros_start = exported;
12631264
break;
12641265
case MBEDTLS_ECP_TYPE_MONTGOMERY:
1266+
TEST_LE_U(length, exported_size);
12651267
key_start = exported;
12661268
zeros_start = exported + length;
12671269
break;
12681270
default:
12691271
TEST_FAIL("Unknown ECP curve type");
12701272
break;
12711273
}
1272-
TEST_MEMORY_COMPARE(in_key->x, in_key->len,
1273-
key_start, length);
1274-
for (size_t i = 0; i < exported_size - length; i++) {
1275-
mbedtls_test_set_step(i);
1276-
TEST_EQUAL(zeros_start[i], 0);
1274+
1275+
if (length < in_key->len) {
1276+
/* Shorter output (only possible with Weierstrass keys) */
1277+
for (size_t i = 0; i < in_key->len - length; i++) {
1278+
mbedtls_test_set_step(i);
1279+
TEST_EQUAL(in_key->x[i], 0);
1280+
}
1281+
TEST_MEMORY_COMPARE(in_key->x + in_key->len - length, length,
1282+
key_start, length);
1283+
} else {
1284+
TEST_MEMORY_COMPARE(in_key->x, in_key->len,
1285+
key_start, length);
1286+
for (size_t i = 0; i < exported_size - length; i++) {
1287+
mbedtls_test_set_step(i);
1288+
TEST_EQUAL(zeros_start[i], 0);
1289+
}
12771290
}
12781291
}
12791292

0 commit comments

Comments
 (0)