7f79bb5cfd
- Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. - Fix side channel in mbedtls_ecp_check_pub_priv() and mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private key that didn't include the uncompressed public key), as well as mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL f_rng argument. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) could fully recover the ECC private key. - Fix issue in Lucky 13 counter-measure that could make it ineffective when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT macros). This would cause the original Lucky 13 attack to be possible in those configurations, allowing an active network attacker to recover plaintext after repeated timing measurements under some conditions. https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07 Switch to github to get latest release Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
72 lines
2.3 KiB
Makefile
72 lines
2.3 KiB
Makefile
################################################################################
|
|
#
|
|
# mbedtls
|
|
#
|
|
################################################################################
|
|
|
|
MBEDTLS_VERSION = 2.16.7
|
|
MBEDTLS_SITE = $(call github,ARMmbed,mbedtls,mbedtls-$(MBEDTLS_VERSION))
|
|
MBEDTLS_CONF_OPTS = \
|
|
-DENABLE_PROGRAMS=$(if $(BR2_PACKAGE_MBEDTLS_PROGRAMS),ON,OFF) \
|
|
-DENABLE_TESTING=OFF
|
|
MBEDTLS_INSTALL_STAGING = YES
|
|
MBEDTLS_LICENSE = Apache-2.0
|
|
MBEDTLS_LICENSE_FILES = apache-2.0.txt
|
|
|
|
# This is mandatory for hiawatha
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_THREADS),y)
|
|
define MBEDTLS_ENABLE_THREADING
|
|
$(SED) "s://#define MBEDTLS_THREADING_C:#define MBEDTLS_THREADING_C:" \
|
|
$(@D)/include/mbedtls/config.h
|
|
$(SED) "s://#define MBEDTLS_THREADING_PTHREAD:#define MBEDTLS_THREADING_PTHREAD:" \
|
|
$(@D)/include/mbedtls/config.h
|
|
endef
|
|
MBEDTLS_POST_PATCH_HOOKS += MBEDTLS_ENABLE_THREADING
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
MBEDTLS_CONF_OPTS += -DLINK_WITH_PTHREAD=ON
|
|
endif
|
|
endif
|
|
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
MBEDTLS_CONF_OPTS += \
|
|
-DUSE_SHARED_MBEDTLS_LIBRARY=OFF -DUSE_STATIC_MBEDTLS_LIBRARY=ON
|
|
else ifeq ($(BR2_SHARED_STATIC_LIBS),y)
|
|
MBEDTLS_CONF_OPTS += \
|
|
-DUSE_SHARED_MBEDTLS_LIBRARY=ON -DUSE_STATIC_MBEDTLS_LIBRARY=ON
|
|
else ifeq ($(BR2_SHARED_LIBS),y)
|
|
MBEDTLS_CONF_OPTS += \
|
|
-DUSE_SHARED_MBEDTLS_LIBRARY=ON -DUSE_STATIC_MBEDTLS_LIBRARY=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_MBEDTLS_COMPRESSION),y)
|
|
MBEDTLS_CONF_OPTS += -DENABLE_ZLIB_SUPPORT=ON
|
|
MBEDTLS_DEPENDENCIES += zlib
|
|
define MBEDTLS_ENABLE_ZLIB
|
|
$(SED) "s://#define MBEDTLS_ZLIB_SUPPORT:#define MBEDTLS_ZLIB_SUPPORT:" \
|
|
$(@D)/include/mbedtls/config.h
|
|
endef
|
|
MBEDTLS_POST_PATCH_HOOKS += MBEDTLS_ENABLE_ZLIB
|
|
else
|
|
MBEDTLS_CONF_OPTS += -DENABLE_ZLIB_SUPPORT=OFF
|
|
endif
|
|
|
|
define MBEDTLS_DISABLE_ASM
|
|
$(SED) '/^#define MBEDTLS_AESNI_C/d' \
|
|
$(@D)/include/mbedtls/config.h
|
|
$(SED) '/^#define MBEDTLS_HAVE_ASM/d' \
|
|
$(@D)/include/mbedtls/config.h
|
|
$(SED) '/^#define MBEDTLS_PADLOCK_C/d' \
|
|
$(@D)/include/mbedtls/config.h
|
|
endef
|
|
|
|
# ARM in thumb mode breaks debugging with asm optimizations
|
|
# Microblaze asm optimizations are broken in general
|
|
# MIPS R6 asm is not yet supported
|
|
ifeq ($(BR2_ENABLE_DEBUG)$(BR2_ARM_INSTRUCTIONS_THUMB)$(BR2_ARM_INSTRUCTIONS_THUMB2),yy)
|
|
MBEDTLS_POST_CONFIGURE_HOOKS += MBEDTLS_DISABLE_ASM
|
|
else ifeq ($(BR2_microblaze)$(BR2_MIPS_CPU_MIPS32R6)$(BR2_MIPS_CPU_MIPS64R6),y)
|
|
MBEDTLS_POST_CONFIGURE_HOOKS += MBEDTLS_DISABLE_ASM
|
|
endif
|
|
|
|
$(eval $(cmake-package))
|