mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-22 13:01:16 +03:00
9172417c13
Audited every esp_* PSA driver against its corresponding software driver in mbedtls/library (psa_crypto_cipher.c, psa_crypto_aead.c, psa_crypto_mac.c, psa_crypto_hash.c, psa_crypto_ecp.c, psa_crypto_rsa.c) and fixed gaps in workflow ownership, error-path cleanup, sensitive-data wiping, and BAD_STATE gating per the PSA Crypto API spec. esp_aes (cipher): fix padding oracle in cipher_finish by replacing leaky branches with mbedtls_ct_* primitives; abort wipes the driver-level ctx, not just the inner mbedtls_aes_context; setup routes errors through abort. esp_aes_gcm (AEAD): zeroize the 16-byte full_tag scratch; restore the *output_length = finish_output_size assignment that the SW reference keeps for future ciphers; NULL the inner ctx pointer after free in abort; gate update/finish on a live ctx with PSA_ERROR_BAD_STATE. esp_ecdsa: keep abort-at-exit in the one-shot wrappers so the stack-copy of the hash (needed for little-endian byte order on HW) is wiped per PSA spec 6.3.3, drop the over-defensive public-key qx/qy wipes that the SW driver does not perform. esp_cmac / esp_hmac_transparent / esp_hmac_opaque (MAC): make abort idempotent, route setup errors through abort, gate update/finish/ verify_finish on PSA_ERROR_BAD_STATE, wipe M_last and intermediate hmac[] buffers on completion or HW failure. HMAC opaque gains alg + computed fields to mirror the SW psa_crypto_mac.c state machine. HMAC transparent explicitly aborts the inner SHA context before reusing it for the outer hash. esp_sha: switch the per-op live indicator to (sha_ctx != NULL) so the public esp_sha_operation_type_t enum keeps its original ordinal values; free + NULL sha_ctx on every error path; gate update/finish/clone on a live ctx; wipe per-algorithm core/parallel-engine scratch buffers (W[], A[], state) on HW-engine failure. esp_md5: replace bare memset in abort with mbedtls_platform_zeroize. esp_rsa_ds: complete() no longer frees sig_buffer (abort owns that); start() routes failures through abort; asymmetric_decrypt funnels all cleanup through a single exit: label. RSA-DS utilities wipe the decrypted-plaintext scratch on v15 / OAEP unpad failure.