commit 39b1a51cc353cf58abc70014533068185ce92c74
author Gilles Peskine <Gilles.Peskine@arm.com> Tue Apr 13 22:10:24 2021 +0200
committer Ronald Cron <ronald.cron@arm.com> Thu Jun 10 10:40:37 2021 +0200
tree 1f210b2f2bb1aa48ee8ca6a5c4d2902def579c68
parent b4367a358f6f53e135d82c804173623ab46d58a4

DHM: add notes about leading zeros

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

library/dhm.c

diff --git a/library/dhm.c b/library/dhm.c
index 6fa5435..535b698 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -263,7 +263,8 @@
         goto cleanup;
 
     /*
-     * export P, G, GX
+     * Export P, G, GX. RFC 5246 §4.4 states that "leading zero octets are
+     * not required". We omit leading zeros for compactness.
      */
 #define DHM_MPI_EXPORT( X, n )                                          \
     do {                                                                \
@@ -477,8 +478,9 @@
         MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->K, &ctx->K, &ctx->P ) );
     }
 
+    /* Output the secret without any leading zero byte. This is mandatory
+     * for TLS per RFC 5246 §8.1.2. */
     *olen = mbedtls_mpi_size( &ctx->K );
-
     MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->K, output, *olen ) );
 
 cleanup:

tests/suites/test_suite_dhm.function

diff --git a/tests/suites/test_suite_dhm.function b/tests/suites/test_suite_dhm.function
index 7dd9e97..43dcd56 100644
--- a/tests/suites/test_suite_dhm.function
+++ b/tests/suites/test_suite_dhm.function
@@ -14,6 +14,8 @@
     TEST_ASSERT( size >= *offset + 2 );
     n = ( buffer[*offset] << 8 ) | buffer[*offset + 1];
     *offset += 2;
+    /* The DHM param output from Mbed TLS has leading zeros stripped, as
+     * permitted but not required by RFC 5246 \S4.4. */
     TEST_EQUAL( n, mbedtls_mpi_size( expected ) );
     TEST_ASSERT( size >= *offset + n );
     TEST_EQUAL( 0, mbedtls_mpi_read_binary( &actual, buffer + *offset, n ) );