From 96eceb80226ee96f8e249032b0ef3bd83fbd6925 Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Thu, 30 Jun 2022 18:05:05 +0200 Subject: [PATCH] Refine mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg() when USE_PSA_CRYPTO is selected Signed-off-by: Neil Armstrong --- library/ssl_tls.c | 42 +++++++++++++++--------------------------- 1 file changed, 15 insertions(+), 27 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 23a12d2bf..aa4aa0855 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -7703,39 +7703,27 @@ unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( #if defined(MBEDTLS_USE_PSA_CRYPTO) if( ssl->handshake->key_cert && ssl->handshake->key_cert->key ) { - psa_algorithm_t alg = PSA_ALG_NONE; - psa_algorithm_t alg2 = PSA_ALG_NONE; - psa_key_usage_t usage = 0; - psa_key_usage_t usage2 = 0; + psa_algorithm_t psa_hash_alg = + mbedtls_psa_translate_md( hash_alg_received ); - if( sig_alg_received == MBEDTLS_SSL_SIG_ECDSA ) - { - - alg = PSA_ALG_ECDSA( - mbedtls_psa_translate_md( hash_alg_received ) ); - usage = PSA_KEY_USAGE_SIGN_HASH; - alg2 = PSA_ALG_ECDH; - usage2 = PSA_KEY_USAGE_DERIVE; - } - else if( sig_alg_received == MBEDTLS_SSL_SIG_RSA ) - { - alg = PSA_ALG_RSA_PKCS1V15_SIGN( - mbedtls_psa_translate_md( hash_alg_received ) ); - usage = PSA_KEY_USAGE_SIGN_HASH; - alg2 = PSA_ALG_RSA_PKCS1V15_CRYPT; - usage2 = PSA_KEY_USAGE_DECRYPT; - } - else + if( sig_alg_received == MBEDTLS_SSL_SIG_ECDSA && + ! mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key, + PSA_ALG_ECDSA( psa_hash_alg ), + PSA_KEY_USAGE_SIGN_HASH ) ) continue; - if( ! mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key, - alg, usage ) && - ! mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key, - alg2, usage2 ) ) + if( sig_alg_received == MBEDTLS_SSL_SIG_RSA && + ! ( mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key, + PSA_ALG_RSA_PKCS1V15_CRYPT, + PSA_KEY_USAGE_DECRYPT ) || + mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key, + PSA_ALG_RSA_PKCS1V15_SIGN( + psa_hash_alg ), + PSA_KEY_USAGE_SIGN_HASH ) ) ) continue; } - #endif /* MBEDTLS_USE_PSA_CRYPTO */ + return( hash_alg_received ); } }