-
Notifications
You must be signed in to change notification settings - Fork 2.1k
sys/psa_crypto: use SHA256 CSPRNG as default #20460
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
I am confused about the history of murdock actions here. The auto merge got aborted due to a failing build but the latest result from murdock succeeded? As far as I can tell, nobody initiated a re-run...so the result should be the same? Maybe I should go home for today... |
So we have a two-stage merge: first, the PR needs to succeed. then github adds the PR to a merge queue, which also has to succeed. if you click on the button "view details" next to the last "github-merge-queue removed this pull request ..." message, on the bottom there's alink to the failed build (https://ci.riot-os.org/details/a8022e73e76440269b7e481861624473). |
@Einhornhool I think you need to black-list more boards :/ |
In theory, the re-triggered Murdock build should have been a full build with no fast fail, i.e., show all board where builds are failing. It should™ thus be sufficient to disable |
Thanks for the update! How did you come up with the boards you've added to the files? The last Murdock build did succeed for |
looks at Release'o'clock Ping @Einhornhool |
I ran 'create_makefile.ci.sh' on all psa test directories. |
Hum strange, maybe a mismatch between the compiler versions used on the CI and on your system. The script should automatically build in Docker, so maybe your local docker container is outdated? Maybe try
Given that the CI performed a full build (i.e. all that would also be built during merge) and only one board was reported as failing, I would suggest to fixup your last commit to only exclude |
I almost never build in docker, so yeah, could be a mismatch. I will update tomorrow morning, when I'm at HAW. |
53aa6e9
to
d8b3ec3
Compare
d8b3ec3
to
7a9e291
Compare
Sorry for the 35 force pushes. Should be fine now. |
Great thanks! Did Feel free to squash already. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks again!
7a9e291
to
1924b06
Compare
Unfortunately not, I am trusting your word right now^^ |
So for the record, I just checked the output of the Given that the symlinks in those tests do not work well with the CI logic, we should consider changing them to actual copies. Or maybe @MrKevinWeiss has another idea? |
Hmmm, I didn't consider the symlink thing... Maybe something like what we did with the ieee802.15.4 radio tests. For example: tests/drivers/cc2420 |
Contribution description
So far the PSA Crypto implementation used MUSL C PRNG as the default random number generator, which is not cryptographically secure.
This PR uses the SHA256 RNG instead, which is a CSPRNG.
Testing procedure
When building
examples/psa_crypto
:make info-modules
should listprng_sha256prng