M487: mbed-os-tests-mbedtls-selftest test failed

[ccli8]

Description

• Type: Bug
• Priority: Minor

---

Bug

Target
NUMAKER_PFM_M487

Toolchain:
GCC_ARM|ARM|IAR

mbed-cli version:
1.2.2

mbed-os sha:
b590051 Merge pull request #5808 from SenRamakri/sen_ESP8266TestConfig

Greentea test report

mbedgt: test case report:
+--------------------------+------------------+--------------------------------+---------------------------+--------+--------+--------+--------------------+
| target                   | platform_name    | test suite                     | test case                 | passed | failed | result | elapsed_time (sec) |
+--------------------------+------------------+--------------------------------+---------------------------+--------+--------+--------+--------------------+
| NUMAKER_PFM_M487-GCC_ARM | NUMAKER_PFM_M487 | mbed-os-tests-mbedtls-selftest | mbedtls_entropy_self_test | 0      | 1      | FAIL   | 0.08               |
| NUMAKER_PFM_M487-GCC_ARM | NUMAKER_PFM_M487 | mbed-os-tests-mbedtls-selftest | mbedtls_sha256_self_test  | 1      | 0      | OK     | 0.93               |
| NUMAKER_PFM_M487-GCC_ARM | NUMAKER_PFM_M487 | mbed-os-tests-mbedtls-selftest | mbedtls_sha512_self_test  | 1      | 0      | OK     | 0.62               |
+--------------------------+------------------+--------------------------------+---------------------------+--------+--------+--------+--------------------+
mbedgt: test case results: 1 FAIL / 2 OK

Per my check, there is a call flow error with SHA in mbed-os/features/mbedtls/src/entropy.c.
mbedtls_sha256_init/mbedtls_sha512_init is missing in mbedtls_entropy_init. If I fix it as below, the test would be OK:

void mbedtls_entropy_init( mbedtls_entropy_context *ctx )
{
    memset( ctx, 0, sizeof(mbedtls_entropy_context) );

#if defined(MBEDTLS_THREADING_C)
    mbedtls_mutex_init( &ctx->mutex );
#endif

#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
    mbedtls_sha512_init( &ctx->accumulator );
    mbedtls_sha512_starts( &ctx->accumulator, 0 );
#else
     mbedtls_sha256_init( &ctx->accumulator );
    mbedtls_sha256_starts( &ctx->accumulator, 0 );
#endif

void mbedtls_entropy_free( mbedtls_entropy_context *ctx )
{
#if defined(MBEDTLS_HAVEGE_C)
    mbedtls_havege_free( &ctx->havege_data );
#endif

#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
    mbedtls_sha512_free( &ctx->accumulator );
#else
    mbedtls_sha256_free( &ctx->accumulator );
#endif

#if defined(MBEDTLS_THREADING_C)
    mbedtls_mutex_free( &ctx->mutex );
#endif

[0xc0170]

@hanno-arm @mazimkhan Please review

[hanno-becker]

Thanks @ccli8 for reporting this. The code-paths you're referring to indeed only work if zeroization is proper initialization / freeing for SHA contexts, which for some alternative implementations is not the case. I will check if any work has already been done in this direction; if not, we should open a PR for the main Mbed TLS repository with your suggested fix.

[ciarmcom]

ARM Internal Ref: IOTSSL-2014

[hanno-becker]

@ccli8 I couldn't find any pre-existing work on the issue and opened PR's with your suggested fix in the main Mbed TLS repository. See Mbed-TLS/mbedtls#1275. Thanks again for spotting and reporting this! 👍

[0xc0170]

@hanno-arm I see you did some extra bugfixing the PR. Shall this be closed once your fix is integrated and will be part of the next mbed tls version update for mbed OS?

[hanno-becker]

@0xc0170 I have just raised this with @Patater who is planning the next release; it's due very soon, though, and I cannot guarantee the PR will make it.

I don't know how you handle such issues in general, but I'd leave this issue open as long as the fix hasn't made it into both Mbed TLS and Mbed OS.

[hanno-becker]

@ccli8 How would you like to be credited in the ChangeLog?

[ccli8]

How would you like to be credited in the ChangeLog?

@hanno-arm sorry, what do you mean?

[hanno-becker]

@ccli8 In Mbed-TLS/mbedtls#1275 we mention that you have reported the bug that the PR sets out to fix, through an entry in the ChangeLog of Mbed TLS. Could you let us know whether (a) You are ok with that, and (b) If yes, if you would like to be mentioned under your GitHub name (as of now) or, e.g., your full name and affiliation?