yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix dependency for TLS 1.3 as well

Browse source 
Turns out TLS 1.3 is using the PK layer for signature generation &
verification, and the PK layer is influenced by USE_PSA_CRYPTO.

Also update docs/use-psa-crypto.md accordingly.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2023-03-10 12:33:15 +01:00
parent 45bcb6aac8
commit 439dbc5c60
2 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
docs/use-psa-crypto.md
View file

@ -11,12 +11,15 @@ General considerations
`psa_crypto_init()` before calling any function from the SSL/TLS, X.509 or PK `psa_crypto_init()` before calling any function from the SSL/TLS, X.509 or PK
module. module.
**Scope:** `MBEDTLS_USE_PSA_CRYPTO` has no effect on the parts of the code that **Scope:** `MBEDTLS_USE_PSA_CRYPTO` has no effect on the most of the TLS 1.3
are specific to TLS 1.3; those parts always use PSA Crypto. The parts of the code, which always uses PSA crypto. The parts of the TLS 1.3 code that will
TLS 1.3 code that are common with TLS 1.2, however, follow this option; use PSA Crypto or not depending on the value of this option are:
currently this is the record protection code, computation of the running - record protection;
handshake hash, and X.509. You need to enable `MBEDTLS_USE_PSA_CRYPTO` if you - running handshake hash;
want TLS 1.3 to use PSA everywhere. - asymmetric signature verification & generation;
- X.509 certificate chain verification.
You need to enable `MBEDTLS_USE_PSA_CRYPTO` if you want TLS 1.3 to use PSA
everywhere.
New APIs / API extensions New APIs / API extensions
------------------------- -------------------------

2
include/mbedtls/check_config.h
View file

@ -783,7 +783,7 @@
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
#if !( defined(MBEDTLS_ECDH_C) && defined(MBEDTLS_X509_CRT_PARSE_C) && \ #if !( defined(MBEDTLS_ECDH_C) && defined(MBEDTLS_X509_CRT_PARSE_C) && \
( defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_PKCS1_V21) ) ) ( defined(MBEDTLS_PK_HAVE_ECDSA) || defined(MBEDTLS_PKCS1_V21) ) )
#error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED defined, but not all prerequisites" #error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED defined, but not all prerequisites"
#endif #endif
#endif #endif