Hanshake serialization requires that the selected ciphersuite uses
an AEAD algorithm. However, following the DHE-RSA removal, trying to
still use RSA signature might select a ciphersuite which is not using
AEAD, but CBC instead (see preference order in "ssl_ciphersuite.c").
This is especially problematic in tests scenarios where both GCM and
ChaChaPoly are disabled, so that CCM remains as the only AEAD algorithm.
Ciphersuites using RSA signature and CCM are very low on the preference
list, so very unlikely to be picked in tests. This cause a CBC one to
be selected in this case and the handshake_serialization() function
to fail.
In order to prevent failures from happening, in this commit we require
that either GCM or ChaChaPoly are enabled, so that ciphersuites using one
of these are likely to be picked.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
In this commit also MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED is removed.
This cause some code in "ssl_ciphersuites_internal.h" and
"ssl_tls12_server.c" to became useless, so these blocks are removed
as well.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
The following files are moved to the framework repo (deleted here):
tests/scripts/test_psa_compliance.py
tests/scripts/test_psa_constant_names.py
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This commit updates configs/ext/README.md to reflect the necessary files
which were removed from Mbed TLS.
Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
This commit moves config-symmetric-only.h,
crypto-config-ccm-aes-sha256.h and crypto_config_profile_medium.h to
TF-PSA-Crypto.
Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
This commit updates the framework pointer to include changes to enable
check_names.py to run independently for TF-PSA-Crypto and Mbed TLS.
Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
Improve the description of the API changes in the changelog and
fix some incorrect alg selection variables in ssl_server2.c.
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
This commit moves macro checks specifically for Mbed TLS from
TF-PSA-Crypto to Mbed TLS where they more approriately belong.
Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
There was two versions of this function with different arguments. Update
the documentation to match the signature of the function we kept.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This was the last occurrence found by:
git grep -c 'MBEDTLS_USE_PSA_CRYPTO' library include
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
I was going to describe those changes as temporary, to be undone after
applying unifdef, but it turns out they're both in dead code, so there
will be nothing to undo after unifdef has run.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
unifdef -m -DMBEDTLS_USE_PSA_CRYPTO library/ssl_msg.c
Took care of everything in this file
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
