Mbed Crypto H/W Acceleration - SHA-256 final digest process waits for register changes

[Luckyman122]

I implemented TLS processing using the MbedTLS Stack from FSP v6.4.0.

I enabled the MBEDTLS_SHA256_ALT feature to use the hardening hash feature.

renesas.github.io/.../group___r_m___p_s_a___c_r_y_p_t_o.html

However, in this case, if multiple mbedtls_sha256_update calls are made during the hashing process, and the following conditions are met in mbedtls_sha256_finish, an infinite register change wait will occur.

ra\fsp\src\rm_psa_crypto\sha256_alt.c

line: 884~892

        else
        { /* If there is no data in the unaligned ctx buffer and no data in the aligned buffer
            then this is case of 0 total length passed in. */
            ctx->sce_operation_state = SCE_OEM_CMD_HASH_ONESHOT;
            if( ( ret = mbedtls_internal_sha256_process_ext(ctx, ctx->rsip_buffer, 0 ) ) != 0)
            {
            	goto exit;
            }
        }

This condition is reached when multiple mbedtls_sha256_update calls have been made and mbedtls_sha256_finish is called when the total size of the input data reaches 0x80 (128).

"ctx->total[0] == 0x80"

The infinite register change wait occurs in the following section of HW_SCE_ShaGenerateMessageDigestFinalSub.

    WAIT_STS(REG_2030H, 4, 1);

This issue occurs when the third argument of mbedtls_internal_sha256_process_ext is set to 0.

It seems the input data is incorrect, causing an infinite loop due to a register change wait.

The following MCUs have been found to have this issue:

RA8T2: RSIP-E50D (using FreeRTOS)

Disabling MBEDTLS_SHA256_ALT and performing hash processing through software allows for successful hash processing, but the hash processing speed is slow, and I would like to improve this issue.

I have already posted this issue to Renesas Engineering Community.

The person in charge confirmed this issue and concluded it was a bug.

Therefore, I was asked to post it here.

https://community.renesas.com/mcu/ra/f/forum/59019/when-mbedtls_sha256_alt-is-enabled-sha-256-final-digest-process-waits-for-register-changes

Please fix this issue.

[Luckyman122]

What is the status of your review?

[michaelthomasj]

@Luckyman122 , are you using the PSA API or the mbedTLS API when you see this error?

[Luckyman122]

@michaelthomasj
It's the PSA API.
The function causing the problem is being called via psa_hash_finish function.

[michaelthomasj]

@Luckyman122 ,
There is some missing information here.
We test the PSA hash functions on our pipeline for one-shot and multi-step hash calculation.
As your screenshot shows, the mbedtls_ct_hmac() function is calling the PSA hash api.
However, there are two versions of the mbedtls_ct_hmac(). The one you are using is enabled when MBEDTLS_USE_PSA_CRYPTO is enabled.
In FSP, we do not allow the user to enable that via our configurator, because we have not finished testing our implementation with that.
If you disable that, then the TLS layer will use the other implementation.
Please try that out and let me know.

[Luckyman122]

@michaelthomasj
I understand that if MBEDTLS_USE_PSA_CRYPTO is not enabled, the above process will not be reached from the psa_hash_finish function.
I am pointing out a problem when the third argument of 'mbedtls_internal_sha256_process_ext' function is set to 0.
Instead of examining psa_hash_finish, examine the mbedtls_internal_sha256_process_ext function that is called from it.
'mbedtls_internal_sha256_process_ext' function itself is unrelated to whether MBEDTLS_USE_PSA_CRYPTO is enabled or disabled.
Please investigate the standalone operation of the mbedtls_internal_sha256_process_ext function.

[Luckyman122]

@michaelthomasj
How is the verification status of the mbedtls_internal_sha256_process_ext function?

[Luckyman122]

@michaelthomasj
How is the verification status of the mbedtls_internal_sha256_process_ext function?

[michaelthomasj]

@Luckyman122 ,
Please check the FSP 6.5 release from yesterday.

[Luckyman122]

@michaelthomasj
I confirmed this with FSP v6.5.0, and it stopped with the same issue during mbedtls_sha256_update.

This issue occurred when mbedtls_sha256_update was called with the following values:

"ctx->total[0] ==0x426"

mbedtls_sha256_update has been fixed, but it doesn't seem to be completely fixed yet.

Please check this issue.

[hienthehuynh]

Hi @Luckyman122,
I created a test case that calls psa_hash_update three times and then psa_hash_finish, with ctx->total[0] == 0x426, and it passed.

However, I noticed something abnormal. From your screenshot, it seems that psa_hash_update() is processing byte 1062, while in FSP 6.5 RSIP-E50D's implementation the remaining bytes are handled in psa_hash_finish().
Do you see any conditions that I might have missed?

[Luckyman122]

@michaelthomasj
Thank you for your confirmation.

I'm attaching additional information.

When mbedtls_sha256_update was used to stop the process, the command used when calling HW_SCE_ShaGenerateMessageDigestSubGeneral was SCE_OEM_CMD_HASH_ONESHOT.

mbedtls_sha256_update is executed from the following location:

There is no command specified for ctx->sce_operation_state before executing mbedtls_internal_sha256_process_ext.

Therefore, SCE_OEM_CMD_HASH_ONESHOT is set.

Is it okay to specify SCE_OEM_CMD_HASH_ONESHOT when performing hashing operations consecutively?

[Luckyman122]

@michaelthomasj

I now understand the path in which SCE_OEM_CMD_HASH_ONESHOT is used.

This occurs when ssl_update_checksum_start is executed.

ssl_tls.c

    status = psa_hash_update(&ssl->handshake->fin_sha256_psa, buf, len);
    if (status != PSA_SUCCESS) {
        return mbedtls_md_error_from_psa(status);
    }

Therefore, it appears that psa_hash_update is being called without psa_hash_setup.

Which function should psa_hash_setup be executed before ssl_update_checksum_start?

[Luckyman122]

@michaelthomasj
Another condition is that the mbedtls_sha256_update issue occurs when you try to add another TLS connection to an existing TLS connection.