lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-11-03 20:33:16 +03:00
Code Activity

Update dependencies documentation

Browse Source 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard
2020-06-17 12:26:54 +02:00
parent 424210a93c
commit 2d91c30f4c
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog.d/ecp-internal-rng.txt
View File

@@ -1,6 +1,7 @@
Changes Changes
* The ECP module, enabled by `MBEDTLS_ECP_C`, now depends on * The ECP module, enabled by `MBEDTLS_ECP_C`, now depends on
`MBEDTLS_CTR_DRBG_C` or `MBEDTLS_HMAC_DRBG_C` for some side-channel `MBEDTLS_CTR_DRBG_C`, `MBEDTLS_HMAC_DRBG_C`, `MBEDTLS_SHA512_C`,
`MBEDTLS_SHA256_C` or `MBEDTLS_SHA1_C` for some side-channel
coutermeasures. If side channels are not a concern, this dependency can coutermeasures. If side channels are not a concern, this dependency can
be avoided by enabling the new option `MBEDTLS_ECP_NO_INTERNAL_RNG`. be avoided by enabling the new option `MBEDTLS_ECP_NO_INTERNAL_RNG`.

11
include/mbedtls/config.h
View File

@@ -788,11 +788,12 @@
* against some side-channel attacks. * against some side-channel attacks.
* *
* This protection introduces a dependency of the ECP module on one of the * This protection introduces a dependency of the ECP module on one of the
* DRBG modules. For very constrained implementations that don't require this * DRBG or SHA modules (HMAC-DRBG, CTR-DRBG, SHA-512, SHA-256 or SHA-1).
* protection (for example, because you're only doing signature verification, * For very constrained applications that don't require this protection
* so not manipulating any secret, or because local/physical side-channel * (for example, because you're only doing signature verification, so not
* attacks are outside your threat model), it might be desirable to get rid of * manipulating any secret, or because local/physical side-channel attacks are
* that dependency. * outside your threat model), it might be desirable to get rid of that
* dependency.
* *
* \warning Enabling this option makes some uses of ECP vulnerable to some * \warning Enabling this option makes some uses of ECP vulnerable to some
* side-channel attacks. Only enable it if you know that's not a problem for * side-channel attacks. Only enable it if you know that's not a problem for