Point OSS-Fuzz to TF-PSA-Crypto #100

Open
opened 2024-04-29 13:36:44 -05:00 by gilles-peskine-arm · 1 comment
gilles-peskine-arm commented 2024-04-29 13:36:44 -05:00 (Migrated from github.com)

Once TF-PSA-Crypto hosts crypto, we should migrate the OSS-Fuzz crypto fuzzing from Mbed TLS to TF-PSA-Crypto. Mbed TLS is fuzzed via four projects in OSS-Fuzz:

  • mbedtls — pk, x509 and ssl fuzzing. Stays in mbedtls, unless we want to migrate the pk fuzzers?
  • bignum-fuzzer — if it's still relevant, as its functionality is partly subsumed by cryptofuzz?
  • ecc-diff-fuzzer — if it's still relevant, as its functionality is partly subsumed by cryptofuzz?
  • cryptofuzz

This can be done before or after the 1.0 release: it's ok if the fuzzers keep fuzzing crypto APIs as they are re-exported by Mbed TLS. But we may want to combine this with https://github.com/Mbed-TLS/mbedtls/issues/9071.

Once TF-PSA-Crypto hosts crypto, we should migrate the [OSS-Fuzz](https://github.com/google/oss-fuzz) crypto fuzzing from Mbed TLS to TF-PSA-Crypto. Mbed TLS is fuzzed via four projects in OSS-Fuzz: * [mbedtls](https://github.com/google/oss-fuzz/tree/master/projects/mbedtls) — pk, x509 and ssl fuzzing. Stays in mbedtls, unless we want to migrate the pk fuzzers? * [bignum-fuzzer](https://github.com/google/oss-fuzz/tree/master/projects/bignum-fuzzer) — if it's still relevant, as its functionality is partly subsumed by cryptofuzz? * [ecc-diff-fuzzer](https://github.com/google/oss-fuzz/tree/master/projects/ecc-diff-fuzzer) — if it's still relevant, as its functionality is partly subsumed by cryptofuzz? * [cryptofuzz](https://github.com/google/oss-fuzz/tree/master/projects/cryptofuzz) This can be done before or after the 1.0 release: it's ok if the fuzzers keep fuzzing crypto APIs as they are re-exported by Mbed TLS. But we may want to combine this with https://github.com/Mbed-TLS/mbedtls/issues/9071.
gilles-peskine-arm commented 2025-12-11 09:38:46 -06:00 (Migrated from github.com)

This is on hold since OSS-Fuzz is currently unmaintained and bitrotted.

This is on hold since OSS-Fuzz is currently unmaintained and bitrotted.
Sign in to join this conversation.
No milestone
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
gh-Mbed-TLS/TF-PSA-Crypto#100
No description provided.