lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Revert rsa_pss_rsae_* support for tls12

Browse Source 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
This commit is contained in:
Jerry Yu
2022-06-23 10:16:33 +08:00
parent 53f5c15155
commit 9bb3ee436b
3 changed files with 105 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
programs/ssl/ssl_test_common_source.c
View File

@ -264,10 +264,14 @@ int send_cb( void *ctx, unsigned char const *buf, size_t len )
#if defined(MBEDTLS_X509_CRT_PARSE_C)
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_RSA_C)
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
/* To fix version negotiation fail with RSA server key.
* - With TLS1.3 server, `rsa_pss_rsae_*` must be sent.
* - With TLS1.2 server, `rsa_pkcs1_*` must be sent before `rsa_pss_rsae_*`
* - This point is only tested with OpenSSL now.
/*
* `rsa_pss_rsae_*` MUST BE PUT ARTER `rsa_pkcs1_*` before below compitable fixed
* The compitable issue is When
* - GnuTLS/OpenSSL is configured as tls12 server with rsa key
* - `mebedTLS` is configured as hybrid mode.
* - The order is `rsa_pss_rsae_*`, `rsa_pkcs1_*`.
* GnuTLS/OpenSSL will return `rsa_pss_rsae_*` which are not supported by
* TLS 1.2 in mbedTLS.
*/
#define MBEDTLS_SSL_SIG_ALG( hash ) (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA), \
(( hash << 8 ) | MBEDTLS_SSL_SIG_RSA), \