Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bignum and ECC API evolution: study fuzzers #9070

Open
gilles-peskine-arm opened this issue Apr 29, 2024 · 0 comments
Open

Bignum and ECC API evolution: study fuzzers #9070

gilles-peskine-arm opened this issue Apr 29, 2024 · 0 comments
Labels
component-crypto Crypto primitives and low-level interfaces size-s Estimated task size: small (~2d)

Comments

@gilles-peskine-arm
Copy link
Contributor

gilles-peskine-arm commented Apr 29, 2024

OSS-Fuzz runs three differential fuzzers that access low-level APIs in Mbed TLS:

  • cryptofuzz: high level APIs (we're in the process of adding PSA), many bignum functions, some ECC functions.
  • bignum-fuzzer: many bignum functions. I'm not sure if it's still relevant as cryptofuzz (by the same maintainer) is meant to eventually replace bignum-fuzzer.
  • ecc-diff-fuzzer: ECC functions. I'm not sure if it's still relevant as cryptofuzz (by a diffferent maintainer) is has similar functionality.

We are likely to remove bignum and ECC APIs from the public interface in Mbed TLS 4.0 and TF-PSA-Crypto 1.0. The goal of this issue is to design how we will fuzz bignum and ECC. Definition of done: there is a documented design (in a document or on GitHub) and issues to implement that design have been filed and scheduled.

Plausible solution: we edit the build scripts in OSS-Fuzz to access internal headers, and we build the fuzzer(s) in our CI to ensure that we preserve the APIs that they use.

@gilles-peskine-arm gilles-peskine-arm added component-crypto Crypto primitives and low-level interfaces size-s Estimated task size: small (~2d) labels Apr 29, 2024
@gilles-peskine-arm gilles-peskine-arm added this to Mbed TLS 4.0 MUST in Backlog for Mbed TLS Apr 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component-crypto Crypto primitives and low-level interfaces size-s Estimated task size: small (~2d)
Projects
Backlog for Mbed TLS
Mbed TLS 4.0 MUST
Development

No branches or pull requests

1 participant