HMAC DRBG requires more entropy than what Mbed Crypto's entropy implementation offers #237

New issue

Closed

opened 2019-08-26 08:01:28 -05:00 by hanno-becker · 1 comment

hanno-becker commented

2019-08-26 08:01:28 -05:00

(Migrated from github.com)

This is a report on behalf of @artokin who discovered this issue.

Summary: Mbed Crypto's HMAC DRBG implementation doesn't work together with Mbed Crypto's default entropy implementation if MBEDTLS_SHA512_C is disabled, due to a mismatch in the amount of entropy HMAC DRBG requires in this case, and what the entropy module can provide.

Details: During seeding, the HMAC DRBG implementation queries the configured entropy callback for entropy, the amount of which depending on the digest function chosen: github.com/ARMmbed/mbed-crypto@85c78b48a9/library/hmac_drbg.c (L236-L250)
In particular, if the chosen hash is not SHA-1, this requires at least 24 * 3/2 = 36 Bytes to be
provided by the underlying entropy callback entropy(). However, because of
github.com/ARMmbed/mbed-crypto@85c78b48a9/library/entropy.c (L326-L333)
Mbed Crypto's entropy implementation rejects requests beyond MBEDTLS_ENTROPY_BLOCK_SIZE Bytes, that is, beyond 32 Bytes if MBEDTLS_SHA512_C is disabled: github.com/ARMmbed/mbed-crypto@85c78b48a9/include/mbedtls/entropy.h (L77-L81)

This leads to failures when trying to use HMAC DRBG with the default entropy module in SHA-256-only configurations.

Apart from the issue itself, this also highlights a test gap, because we should test this very natural combination. When considering the use of Mbed Crypto in Mbed TLS, for example, the ssl_client2 and ssl_server2 example application should be able to use HMAC DRBG instead of CTR DRBG if the latter is disabled, which would trigger this bug. (Internal: See PR https://github.com/ARMmbed/mbedtls-restricted/pull/646).

This is a report on behalf of @artokin who discovered this issue. __Summary:__ Mbed Crypto's HMAC DRBG implementation doesn't work together with Mbed Crypto's default entropy implementation if `MBEDTLS_SHA512_C` is disabled, due to a mismatch in the amount of entropy HMAC DRBG requires in this case, and what the entropy module can provide. __Details:__ During seeding, the HMAC DRBG implementation queries the configured entropy callback for entropy, the amount of which depending on the digest function chosen: https://github.com/ARMmbed/mbed-crypto/blob/85c78b48a94a29cea682fa67ba743c8e89459e23/library/hmac_drbg.c#L236-L250 In particular, if the chosen hash is not SHA-1, this requires at least `24 * 3/2 = 36` Bytes to be provided by the underlying entropy callback `entropy()`. However, because of https://github.com/ARMmbed/mbed-crypto/blob/85c78b48a94a29cea682fa67ba743c8e89459e23/library/entropy.c#L326-L333 Mbed Crypto's entropy implementation rejects requests beyond `MBEDTLS_ENTROPY_BLOCK_SIZE` Bytes, that is, beyond 32 Bytes if `MBEDTLS_SHA512_C` is disabled: https://github.com/ARMmbed/mbed-crypto/blob/85c78b48a94a29cea682fa67ba743c8e89459e23/include/mbedtls/entropy.h#L77-L81 This leads to failures when trying to use HMAC DRBG with the default entropy module in SHA-256-only configurations. Apart from the issue itself, this also highlights a test gap, because we should test this very natural combination. When considering the use of Mbed Crypto in Mbed TLS, for example, the `ssl_client2` and `ssl_server2` example application should be able to use HMAC DRBG instead of CTR DRBG if the latter is disabled, which would trigger this bug. (Internal: See PR https://github.com/ARMmbed/mbedtls-restricted/pull/646).

gilles-peskine-arm commented

2019-09-03 11:52:45 -05:00

(Migrated from github.com)

the ssl_client2 and ssl_server2 example application should be able to use HMAC DRBG instead of CTR DRBG if the latter is disabled

I have a patch for that in https://github.com/gilles-peskine-arm/mbedtls/tree/build_with_only_montgomery_curves which is an earlier version of https://github.com/ARMmbed/mbedtls/pull/2019 which is still waiting for me or someone else to rework it.

> the ssl_client2 and ssl_server2 example application should be able to use HMAC DRBG instead of CTR DRBG if the latter is disabled I have a patch for that in https://github.com/gilles-peskine-arm/mbedtls/tree/build_with_only_montgomery_curves which is an earlier version of https://github.com/ARMmbed/mbedtls/pull/2019 which is still waiting for me or someone else to rework it.