Add a note about CTR_DRBG security strength to config.h

gilles-peskine-arm · gilles-peskine-arm · commit 7e27936767c1 · 2019-10-04T11:16:31.000+02:00
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
@@ -1304,6 +1304,10 @@
  * The CTR_DRBG generator uses AES-256 by default.
  * To use AES-128 instead, enable \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY above.
  *
+ * \note To achieve a 256-bit security strength with CTR_DRBG,
+ *       you must use AES-256 *and* use sufficient entropy.
+ *       See ctr_drbg.h for more details.
+ *
  * Module:  library/ctr_drbg.c
  * Caller:
  *

Original file line number	Diff line number	Diff line change
`@@ -1304,6 +1304,10 @@`
`1304`	`1304`	`* The CTR_DRBG generator uses AES-256 by default.`
`1305`	`1305`	`* To use AES-128 instead, enable \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY above.`
`1306`	`1306`	`*`
	`1307`	`+ * \note To achieve a 256-bit security strength with CTR_DRBG,`
	`1308`	`+ * you must use AES-256 and use sufficient entropy.`
	`1309`	`+ * See ctr_drbg.h for more details.`
	`1310`	`+ *`
`1307`	`1311`	`* Module: library/ctr_drbg.c`
`1308`	`1312`	`* Caller:`
`1309`	`1313`	`*`