yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Enable support for psa opaque ECDHE-PSK key exchange on the server side

Browse source 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
This commit is contained in:
Przemek Stekiel 2022-04-14 08:33:29 +02:00
parent 19b80f8151
commit 14d11b0877
2 changed files with 31 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
library/ssl_tls12_server.c
View file

@ -4112,10 +4112,6 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
psa_status_t destruction_status = PSA_ERROR_CORRUPTION_DETECTED;
uint8_t ecpoint_len;
/* Opaque PSKs are currently only supported for PSK-only. */
if( ssl_use_opaque_psk( ssl ) == 1 )
return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
mbedtls_ssl_handshake_params *handshake = ssl->handshake;
if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
@ -4188,6 +4184,10 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
const unsigned char *psk = NULL;
size_t psk_len = 0;
/* In case of opaque psk skip writting psk to pms.
* Opaque key will be handled later. */
if( ssl_use_opaque_psk( ssl ) == 0 )
{
if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
== MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
/*
@ -4209,7 +4209,13 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
psm += psk_len;
ssl->handshake->pmslen = psm - ssl->handshake->premaster;
#else
}
else
{
MBEDTLS_SSL_DEBUG_MSG( 1,
( "skip PMS generation for opaque ECDHE-PSK" ) );
}
#else /* MBEDTLS_USE_PSA_CRYPTO */
if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );

5
programs/ssl/ssl_server2.c
View file

@ -2211,11 +2211,12 @@ int main( int argc, char *argv[] )
* the ciphersuite in advance to set the correct policy for the
* PSK key slot. This limitation might go away in the future. */
if( ( ciphersuite_info->key_exchange != MBEDTLS_KEY_EXCHANGE_PSK &&
ciphersuite_info->key_exchange != MBEDTLS_KEY_EXCHANGE_RSA_PSK ) ||
ciphersuite_info->key_exchange != MBEDTLS_KEY_EXCHANGE_RSA_PSK &&
ciphersuite_info->key_exchange != MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) ||
opt.min_version != MBEDTLS_SSL_MINOR_VERSION_3 )
{
mbedtls_printf( "opaque PSKs are only supported in conjunction \
with forcing TLS 1.2 and a PSK-only, RSA-PSK \
with forcing TLS 1.2 and a PSK-only, RSA-PSK, ECDHE-PSK \
ciphersuites through the 'force_ciphersuite' option.\n" );
ret = 2;
goto usage;