lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-01 10:06:53 +03:00
Code Activity

fix various issues

Browse Source 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
This commit is contained in:
Jerry Yu
2022-06-24 10:10:47 +08:00
parent 9bb3ee436b
commit a1255e6b8c
4 changed files with 19 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
library/ssl_tls.c
View File

@ -4095,13 +4095,12 @@ static int ssl_preset_suiteb_ciphersuites[] = {
* - ssl_tls12_present* is for TLS 1.2 use only.
* - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
*
* `rsa_pss_rsae_*` MUST BE PUT ARTER `rsa_pkcs1_*` before below compitable fixed
* The compitable issue is When
* - GnuTLS/OpenSSL is configured as tls12 server with rsa key
* - `mebedTLS` is configured as hybrid mode.
* - The order is `rsa_pss_rsae_*`, `rsa_pkcs1_*`.
* GnuTLS/OpenSSL will return `rsa_pss_rsae_*` which are not supported by
* TLS 1.2 in mbedTLS.
* When GnuTLS/Openssl server is configured in TLS 1.2 mode with a certificate
* declaring an RSA public key and Mbed TLS is configured in hybrid mode, if
* `rsa_pss_rsae_*` algorithms are before `rsa_pkcs1_*` ones in this list then
* the GnuTLS/Openssl server chooses an `rsa_pss_rsae_*` signature algorithm
* for its signature in the key exchange message and as Mbed TLS 1.2 does not
* support them, the handshake fails.
*/
static uint16_t ssl_preset_default_sig_algs[] = {