Skip to content

Commit

Permalink
mbedtls: add TEST_CSPRNG_GENERATOR to the list of non-CS sources
Browse files Browse the repository at this point in the history
Strong entropy/random sources are a must to get secure crypto algorithms,
but sometimes its useful to allow non-CS sources as well for sake of
test purposes. MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG_ALLOW_NON_CSPRNG was
designed exactly for this scope, but recently also TEST_CSPRNG_GENERATOR
was added and it acts similarly:

- MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG_ALLOW_NON_CSPRNG operates in
  "zephyr/modules/mbedtls/zephyr_entropy.c" allowing
  mbedtls_psa_external_get_random() to try both sys_csrand_get() first
  and then sys_rand_get() as fallback.

- TEST_CSPRNG_GENERATOR instead operates in
  "zephyr/subsys/random/random_test_csprng.c" and it basically wraps
  the call to sys_csrand_get() with a call to sys_rand_get().

Albeit they operate at different level, the result is identical, so
Mbed TLS should support both of them when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
is set and there is no CSPRNG_ENABLED.

Signed-off-by: Valerio Setti <[email protected]>
  • Loading branch information
valeriosetti authored and kartben committed Dec 19, 2024
1 parent bc3baf0 commit 46b8536
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion modules/mbedtls/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,8 @@ zephyr_interface_library_named(mbedTLS)
endif()

if(CONFIG_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
if(CONFIG_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG_ALLOW_NON_CSPRNG)
if(CONFIG_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG_ALLOW_NON_CSPRNG OR
CONFIG_TEST_CSPRNG_GENERATOR)
message(WARNING "
Non cryptographycally secure sources are enabled for psa_generate_random().
This is meant to be used only for tests, not in production!")
Expand Down

0 comments on commit 46b8536

Please sign in to comment.