Skip to content

PKCS5 simplify deps on MBEDTLS_CIPHER_PADDING_PKCS7 + PKCS12 remove test exceptions #9580

Description

@gilles-peskine-arm

analyze_outcomes.py reports that the following test cases are never executed:

        'test_suite_pkcs12': [
            'PBE Decrypt, (Invalid padding & PKCS7 padding disabled)',
            'PBE Encrypt, pad = 8 (PKCS7 padding disabled)',
        ],
        'test_suite_pkcs5': [
            'PBES2 Decrypt (Invalid padding & PKCS7 padding disabled)',
            'PBES2 Encrypt, pad=6 (PKCS7 padding disabled)',
            'PBES2 Encrypt, pad=8 (PKCS7 padding disabled)',
        ],

but both of them can be removed based on the following.

PKCS#12

Support for it has been removed from tf-psa-crypto since Mbed-TLS/TF-PSA-Crypto#389 which landed in 1.0 release. So these tests don't exist anymore in tf-psa-crypto and related exceptions can be removed.

PKCS#5

This is now a private module and the only user is PK which uses it to decrypt encrypted PKCS8 private keys. PK only calls mbedtls_pkcs5_pbes2_ext when MBEDTLS_CIPHER_PADDING_PKCS7 is defined. Also we auto enable MBEDTLS_CIPHER_PADDING_PKCS7 whenever MBEDTLS_PK_PARSE_C && MBEDTLS_PKCS5_C are enabled.
So the tasks in this case are:

  • check the pkcs5.c module to see if it's possible to simplify MBEDTLS_CIPHER_PADDING_PKCS7 dependencies.
  • simplify test data dependencies in test_suite_pkcs5.data removing tests that depends on !MBEDTLS_CIPHER_PADDING_PKCS7 and also removing MBEDTLS_CIPHER_PADDING_PKCS7 from depends_on in other entries.

Metadata

Metadata

Assignees

Labels

component-cryptoCrypto primitives and low-level interfacesenhancementsize-sEstimated task size: small (~2d)

Type

No type

Projects

Status
No status

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions