Skip to content

Commit bc5d916

Browse files
tom-cosgrove-armtom-cosgrove-arm
authored
Merge pull request #8554 from yanrayw/issue/8221/fix-tls-suiteB-profile
TLS: remove RSA signature algorithms in `suite B` profile
2 parents f1ba193 + d8c899c commit bc5d916

File tree

3 files changed

+26
-37
lines changed

3 files changed

+26
-37
lines changed

‎ChangeLog.d/fix-tls-SuiteB.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Bugfix
2+
* Remove accidental introduction of RSA signature algorithms
3+
in TLS Suite B Profile. Fixes #8221.

‎include/mbedtls/ssl.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -447,7 +447,7 @@
447447

448448
/*
449449
* TLS 1.3 signature algorithms
450-
* RFC 8446, Section 4.2.2
450+
* RFC 8446, Section 4.2.3
451451
*/
452452

453453
/* RSASSA-PKCS1-v1_5 algorithms */

‎library/ssl_tls.c‎

Lines changed: 22 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -5118,23 +5118,17 @@ static uint16_t ssl_preset_default_sig_algs[] = {
51185118
// == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512)
51195119
#endif
51205120

5121-
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
5122-
defined(MBEDTLS_MD_CAN_SHA512)
5121+
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_MD_CAN_SHA512)
51235122
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
5124-
#endif \
5125-
/* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_MD_CAN_SHA512 */
5123+
#endif
51265124

5127-
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
5128-
defined(MBEDTLS_MD_CAN_SHA384)
5125+
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_MD_CAN_SHA384)
51295126
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
5130-
#endif \
5131-
/* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_MD_CAN_SHA384 */
5127+
#endif
51325128

5133-
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
5134-
defined(MBEDTLS_MD_CAN_SHA256)
5129+
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_MD_CAN_SHA256)
51355130
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
5136-
#endif \
5137-
/* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_MD_CAN_SHA256 */
5131+
#endif
51385132

51395133
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA512)
51405134
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
@@ -5154,42 +5148,47 @@ static uint16_t ssl_preset_default_sig_algs[] = {
51545148
/* NOTICE: see above */
51555149
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
51565150
static uint16_t ssl_tls12_preset_default_sig_algs[] = {
5151+
51575152
#if defined(MBEDTLS_MD_CAN_SHA512)
51585153
#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
51595154
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512),
51605155
#endif
51615156
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
51625157
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
5163-
#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
5158+
#endif
51645159
#if defined(MBEDTLS_RSA_C)
51655160
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512),
51665161
#endif
5167-
#endif /* MBEDTLS_MD_CAN_SHA512*/
5162+
#endif /* MBEDTLS_MD_CAN_SHA512 */
5163+
51685164
#if defined(MBEDTLS_MD_CAN_SHA384)
51695165
#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
51705166
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384),
51715167
#endif
51725168
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
51735169
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
5174-
#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
5170+
#endif
51755171
#if defined(MBEDTLS_RSA_C)
51765172
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384),
51775173
#endif
5178-
#endif /* MBEDTLS_MD_CAN_SHA384*/
5174+
#endif /* MBEDTLS_MD_CAN_SHA384 */
5175+
51795176
#if defined(MBEDTLS_MD_CAN_SHA256)
51805177
#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
51815178
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256),
51825179
#endif
51835180
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
51845181
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
5185-
#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
5182+
#endif
51865183
#if defined(MBEDTLS_RSA_C)
51875184
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256),
51885185
#endif
5189-
#endif /* MBEDTLS_MD_CAN_SHA256*/
5186+
#endif /* MBEDTLS_MD_CAN_SHA256 */
5187+
51905188
MBEDTLS_TLS_SIG_NONE
51915189
};
51925190
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5191+
51935192
/* NOTICE: see above */
51945193
static uint16_t ssl_preset_suiteb_sig_algs[] = {
51955194

@@ -5207,38 +5206,25 @@ static uint16_t ssl_preset_suiteb_sig_algs[] = {
52075206
// == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384)
52085207
#endif
52095208

5210-
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
5211-
defined(MBEDTLS_MD_CAN_SHA256)
5212-
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
5213-
#endif \
5214-
/* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_MD_CAN_SHA256*/
5215-
5216-
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA256)
5217-
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
5218-
#endif /* MBEDTLS_RSA_C && MBEDTLS_MD_CAN_SHA256*/
5219-
52205209
MBEDTLS_TLS_SIG_NONE
52215210
};
52225211

52235212
/* NOTICE: see above */
52245213
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
52255214
static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
5215+
52265216
#if defined(MBEDTLS_MD_CAN_SHA256)
52275217
#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
52285218
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256),
52295219
#endif
5230-
#if defined(MBEDTLS_RSA_C)
5231-
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256),
5232-
#endif
5233-
#endif /* MBEDTLS_MD_CAN_SHA256*/
5220+
#endif /* MBEDTLS_MD_CAN_SHA256 */
5221+
52345222
#if defined(MBEDTLS_MD_CAN_SHA384)
52355223
#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
52365224
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384),
52375225
#endif
5238-
#if defined(MBEDTLS_RSA_C)
5239-
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384),
5240-
#endif
5241-
#endif /* MBEDTLS_MD_CAN_SHA256*/
5226+
#endif /* MBEDTLS_MD_CAN_SHA384 */
5227+
52425228
MBEDTLS_TLS_SIG_NONE
52435229
};
52445230
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */

0 commit comments

Comments
 (0)