Document another limitation of driver-only hashes
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
parent
339406daf9
commit
18a3856a03
2 changed files with 30 additions and 6 deletions
|
@ -8,12 +8,16 @@ Features
|
|||
are only provided by PSA drivers. In these configurations, you need to
|
||||
call `psa_crypto_init()` before you call any function from those
|
||||
modules; this is not required in configurations where the built-in
|
||||
implementation is still available. Note that some crypto modules and
|
||||
features still depend on the built-in implementation of hashes:
|
||||
MBEDTLS_HKDF_C (but the PSA HKDF function do not depend on it),
|
||||
MBEDTLS_ENTROPY_C, MBEDTLS_HMAC_DRBG_C and MBEDTLS_ECDSA_DETERMINISTIC.
|
||||
In particular, for now, compiling without built-in hashes requires use
|
||||
of MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
|
||||
implementation is still available. Note that for modules that use MD
|
||||
(RSA, PKCS5, PKCS12, EC J-PAKE) in builds that have MBEDTLS_MD_C enabled,
|
||||
all hashes used with those modules need to be built-in, as drivers are only
|
||||
used when MBEDTLS_MD_C is disabled; configurations where some hashes are
|
||||
available as built-ins, and some only from drivers, are currently not
|
||||
supported. Also note that some crypto modules and features still depend on
|
||||
the built-in implementation of hashes: MBEDTLS_HKDF_C (but the PSA HKDF
|
||||
functions do not depend on it), MBEDTLS_ENTROPY_C, MBEDTLS_HMAC_DRBG_C and
|
||||
MBEDTLS_ECDSA_DETERMINISTIC. In particular, for now, compiling without
|
||||
built-in hashes requires use of MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
|
||||
* When MBEDTLS_USE_PSA_CRYPTO is enabled, X.509, TLS 1.2 and TLS 1.3 no
|
||||
longer depend on MD. This means it is now possible to use them in
|
||||
configurations where the built-in implementations of hashes are excluded
|
||||
|
|
|
@ -1146,6 +1146,11 @@
|
|||
* \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init()
|
||||
* before doing any PKCS#1 v2.1 operation.
|
||||
*
|
||||
* \warning When building with MBEDTLS_MD_C, all hashes used with this
|
||||
* need to be available a built-ins (that is, for SHA-256, MBEDTLS_SHA256_C,
|
||||
* etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by
|
||||
* this module in builds where MBEDTLS_MD_C is disabled.
|
||||
*
|
||||
* This enables support for RSAES-OAEP and RSASSA-PSS operations.
|
||||
*/
|
||||
#define MBEDTLS_PKCS1_V21
|
||||
|
@ -2433,6 +2438,11 @@
|
|||
*
|
||||
* \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init()
|
||||
* before doing any EC J-PAKE operations.
|
||||
*
|
||||
* \warning When building with MBEDTLS_MD_C, all hashes used with this
|
||||
* need to be available a built-ins (that is, for SHA-256, MBEDTLS_SHA256_C,
|
||||
* etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by
|
||||
* this module in builds where MBEDTLS_MD_C is disabled.
|
||||
*/
|
||||
#define MBEDTLS_ECJPAKE_C
|
||||
|
||||
|
@ -2777,6 +2787,11 @@
|
|||
* \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init()
|
||||
* before doing any PKCS5 operation.
|
||||
*
|
||||
* \warning When building with MBEDTLS_MD_C, all hashes used with this
|
||||
* need to be available a built-ins (that is, for SHA-256, MBEDTLS_SHA256_C,
|
||||
* etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by
|
||||
* this module in builds where MBEDTLS_MD_C is disabled.
|
||||
*
|
||||
* This module adds support for the PKCS#5 functions.
|
||||
*/
|
||||
#define MBEDTLS_PKCS5_C
|
||||
|
@ -2796,6 +2811,11 @@
|
|||
* \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init()
|
||||
* before doing any PKCS12 operation.
|
||||
*
|
||||
* \warning When building with MBEDTLS_MD_C, all hashes used with this
|
||||
* need to be available a built-ins (that is, for SHA-256, MBEDTLS_SHA256_C,
|
||||
* etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by
|
||||
* this module in builds where MBEDTLS_MD_C is disabled.
|
||||
*
|
||||
* This module enables PKCS#12 functions.
|
||||
*/
|
||||
#define MBEDTLS_PKCS12_C
|
||||
|
|
Loading…
Reference in a new issue