Test merge of development and TLS PR 2028 #73
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add a new function mbedtls_asn1_write_named_bitstring() that removes trailing 0s at the end of DER encoded bitstrings. The function is implemented according to Hanno Becker's suggestions. This commit also changes the functions x509write_crt_set_ns_cert_type and crt_set_key_usage to call the new function as the use named bitstrings instead of the regular bitstrings.
When all.sh invokes check_headers_in_cpp, a backup config.h exists. This causes a stray difference vs cpp_dummy_build.cpp. Fix by only collecting the *.h files in include/mbedtls. Change-Id: Ifd415027e856858579a6699538f06fc49c793570
- Populate the ECDH private key slot with a fresh private EC key designated for the correct algorithm. - Export the public part of the ECDH private key from PSA and reformat it to suite the format of the ClientKeyExchange message. - Perform the PSA-based ECDH key agreement and store the result as the premaster secret for the connection.
It is now required to initialize PSA Crypto operation contexts before calling psa_*_setup(). Otherwise, one gets a PSA_ERROR_BAD_STATE error.
Restartable ECC isn't supported in PSA yet.
Additional work done as part of merge:
- Run ./tests/scripts/check-generated-files.sh and check in the
resulting changes to programs/ssl/query_config.c
Additional work done as part of merge:
- Run ./tests/scripts/check-generated-files.sh and check in the
resulting changes to programs/ssl/query_config.c
Patater
added
the
DO NOT MERGE
Patater
changed the title
|
Testing went well. Manually pushed to development branch. Code landing was already reviewed by TLS team (coming from the TLS development branch) and additionally in Mbed-TLS/mbedtls#2028 (for the code from there) |
gilles-peskine-arm
pushed a commit
to gilles-peskine-arm/mbed-crypto
that referenced
this pull request
May 22, 2019
The fact that self-signed end-entity certs can be explicitly trusted by putting them in the CA list even if they don't have the CA bit was not documented though it's intentional, and tested by "Certificate verification ARMmbed#73 (selfsigned trusted without CA bit)" in test_suite_x509parse.data It is unclear to me whether the restriction that explicitly trusted end-entity certs must be self-signed is a good one. However, it seems intentional as it is tested in tests ARMmbed#42 and ARMmbed#43, so I'm not touching it for now.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For testing:
Merge the current Mbed TLS development branch.
Merge Mbed-TLS/mbedtls#2028
If testing goes well, we'll push this already reviewed and tested code from Mbed TLS into Mbed Crypto
development, as Mbed TLS requires the new functionmbedtls_asn1_write_named_bitstring()present in the crypto submodule in order to pass their tests and be able to merge Mbed-TLS/mbedtls#2028 into Mbed TLSdevelopment.