tree a28ad7076d135d4f0c941ca1af24220ca7254c54
parent a8da331afdcdd278ea998e374d616ac09434e002
author Christian Huitema <huitema@huitema.net> 1704778671 -0800
committer GitHub <noreply@github.com> 1704778671 -0800
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJlnNuvCRBK7hj4Ov3rIwAAe3wIAF9ULB5+pqtqpY1hrdOhp7Xx
 zpQ9ComzeVBSicOqpxvsGLx2JARjlBhCGcT8MJyfeH8VrWi2Cyj9UcAJSEpCND26
 g5r9MU1ilgn4uvhv9oojzEflE1JnerSQeY99uQ1ci9vYY8iiRLu60Tl4NPNvsiBW
 QwNGpN4y8SX7b1O+0SQjDwUrwpmW0EqhXAQ8/3EmSVjbZ8KsUcjEgNL9dZh4Cabb
 Ns5xZyYpeq8Z+GissMTMvz2Eh5OF3H1UzJwR0uTSkJWxTKpRQFUFh0QpkWby6niK
 Sh/vuktC9xbpD2lPYjXk3ffolMxp1X9vvNEkc9uHzjcpKp6aZ86wEDjtIv9Y+Uc=
 =L87d
 -----END PGP SIGNATURE-----
 

Merge from Picotls Jan 8, 2024 (#12)

* Incorporate mbedtls in cmake

* include find mbedtls

* Add cmake module path

* Add find package

* Update MbedTLS find

* Add missing endif

* Check mbedtls found condition

* Struggling with Found condition.

* Remove error condition for debug

* update mbedtls test

* fix typo

* Add github action for mbedtls

* Debugging github action.

* Decomposing the build steps

* More debugging of github action

* Build mbedtls parallel to picotls

* Add sha512 and sha384

* Update sha384 definitions and test

* Add aes256gcm

* Add chachapoly

* Add test definition.

* Fix copy paste errors

* Another typo to fix

* Fix declarations

* use chacha20 test

* Fix chacha20 declaration

* One last typo, hopefully

* That's for coding when half asleep

* Provide capability to segment session resumption using user-supplied value

* Fix initialization of chacha20-ctr

* Add mbedtls to ptlsbench

* Fix debug message

* Condition fusion to PTLS_HAVE_FUSION

* Declare cipher suites

* Add support for MbedTLS random

* typo

* [minicrypto] x25519 key derivation must fail when output is all-zero

* use high level PSA API

* msvc compatibility

* here also

* Fix test random

* Fix typo

* Add code of sec256r1

* [boringssl] check x25519 bad key

* clear secret

* use macro to avoid compile errors

* Simplify aead setup

* Add x25519

* Add test of mbedtls key exchanges

* Fix reference to test_key_exchange

* [evp_keyex_init] keep refcount unchanged when the function fails

* add the failing case

* extensions block is optional in TLS/1.2 also

* even though we do not test what is recorded, clear it otherwise tests that follow fail

* [fusion] unify detection scheme to the best one that we have (which we have had in h2o)

* maybe `_mm_insert_epi64` is unavailable on i386?

* clang-format

* rename files following the convention that backends use just the backend name

* `()` in a prototype means any number of args, no zero

* ensure that MBEDTLS_SHA384_C is detected regardless of include order

* API doc goes into .h

* add capability to define custom clone functions for hash contexts

* [xcode] add files

* rename (amends 08e5319)

* these files are included by `crypto.h`

* when building picotls, picotls is not part of the system

* when building picotls, picotls is not part of the system, whereas mbedtls is

* define hash implementations using `ptls_define_hash`

* mbedtls is dependency

* it is our convention to let the user initialize the crypto backends (see openssl)

* PRNG might fail too

* reduce state of symmentric ciphers; no need to set key for every IV

* engines can be tested using `test_picotls`

* report error in detail

* have ones own

* amend 2106299

* `ptls_cipher_init` is not called in ECB mode

* key_schedule_new might fail due to malloc failing

* limit scope of `psa_key_attributes_t`

* move useful comments to `.h`, as they are not specific to the mbedtls backend

* simply AEAD code by only supporting the mandatory operation types

* update test code to not rely on init-update-final cycle that is now optional (see doc-comment of ptls_aead_context_t)

* fail the same way

* expand doc-comment in picotls.h instead

* reduce state, release memory regardless of errors

* add missing `static`

* no need to have prefix for static functions

* consolidate duplicated constants into `const struct`

* reduce state

* ... and we find a bug

* update the hidden chacha20 backend

* no need to have a wrapper for CTR mode

* remove verbose doc comments

* [xcode] add files

* use standard names (e.g., <LIB>_ROOT_DIR), and UNIX-style search paths (/usr/local, lib)

* sha384 might not be available

* mbedtls of ubuntu2204 does not have these files, we can remove them and still refer to `MBEDTLS_SHA384_C` at least on homebrew

* run mbedtls test as part of the main CI (builds on top of https://github.com/h2o/h2o/pull/3311)

* remove non-standard directory

* Replace the TLS_AEGIS_256_SHA384 ciphersuite with TLS_AEGIS_256_SHA512

The latest AEGIS draft, as well as the IANA TLS registry [1] have been
updated to replace TLS_AEGIS_256_SHA384 with TLS_AEGIS_256_SHA512.

This follows the recommendations from [2] for new cipher suites.

[1] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4
[2] https://eprint.iacr.org/2023/913.pdf

* core does not depend on any crypto backend

* minicrypto symbols can be found in the header files

* add aegis files to xcode

* raise error if a TLS struct does not fit

* add test

* fix errors in tests

* cannot test if `capacity` is equal to or greater than size_t

* add support for CERTIFICATE_AUTHORITIES extension

* adjust comments

---------

Co-authored-by: Christian Huitema <christianhuitema@Christians-iMac.local>
Co-authored-by: Roberto Guimaraes <rguimaraes@fastly.com>
Co-authored-by: Kazuho Oku <kazuhooku@gmail.com>
Co-authored-by: Frank Denis <github@pureftpd.org>
Co-authored-by: ha0li <hli@fastly.com>