Merge pull request #4604 from gilles-peskine-arm/default-hashes-curves-3.0
Update the default hash and curve selection for X.509 and TLS
This commit is contained in:
Manuel Pégourié-Gonnard
GitHub
commit
3e7ddb2bb6
16 changed files with 235 additions and 152 deletions
|
|
@ -3033,7 +3033,7 @@
|
|||
//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
|
||||
|
||||
/* ECP options */
|
||||
//#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */
|
||||
//#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< Maximum window size used */
|
||||
//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
|
||||
|
||||
/* Entropy options */
|
||||
|
|
@ -3214,23 +3214,6 @@
|
|||
//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */
|
||||
//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */
|
||||
|
||||
/**
|
||||
* Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake
|
||||
* signature and ciphersuite selection. Without this build-time option, SHA-1
|
||||
* support must be activated explicitly through mbedtls_ssl_conf_sig_hashes.
|
||||
* The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by
|
||||
* default. At the time of writing, there is no practical attack on the use
|
||||
* of SHA-1 in handshake signatures, hence this option is turned on by default
|
||||
* to preserve compatibility with existing peers, but the general
|
||||
* warning applies nonetheless:
|
||||
*
|
||||
* \warning SHA-1 is considered a weak message digest and its use constitutes
|
||||
* a security risk. If possible, we recommend avoiding dependencies
|
||||
* on it, and considering stronger message digests instead.
|
||||
*
|
||||
*/
|
||||
#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE
|
||||
|
||||
/**
|
||||
* Uncomment the macro to let mbed TLS use your alternate implementation of
|
||||
* mbedtls_platform_zeroize(). This replaces the default implementation in
|
||||
|
|
|
|||
|
|
@ -255,7 +255,8 @@ mbedtls_ecp_group;
|
|||
#if !defined(MBEDTLS_ECP_WINDOW_SIZE)
|
||||
/*
|
||||
* Maximum "window" size used for point multiplication.
|
||||
* Default: 6.
|
||||
* Default: a point where higher memory usage yields disminishing performance
|
||||
* returns.
|
||||
* Minimum value: 2. Maximum value: 7.
|
||||
*
|
||||
* Result is an array of at most ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) )
|
||||
|
|
@ -272,7 +273,7 @@ mbedtls_ecp_group;
|
|||
* 224 475 475 453 398 342
|
||||
* 192 640 640 633 587 476
|
||||
*/
|
||||
#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< The maximum window size used. */
|
||||
#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< The maximum window size used. */
|
||||
#endif /* MBEDTLS_ECP_WINDOW_SIZE */
|
||||
|
||||
#if !defined(MBEDTLS_ECP_FIXED_POINT_OPTIM)
|
||||
|
|
@ -505,8 +506,7 @@ mbedtls_ecp_curve_type mbedtls_ecp_get_type( const mbedtls_ecp_group *grp );
|
|||
|
||||
/**
|
||||
* \brief This function retrieves the information defined in
|
||||
* mbedtls_ecp_curve_info() for all supported curves in order
|
||||
* of preference.
|
||||
* mbedtls_ecp_curve_info() for all supported curves.
|
||||
*
|
||||
* \note This function returns information about all curves
|
||||
* supported by the library. Some curves may not be
|
||||
|
|
|
|||
|
|
@ -2901,7 +2901,6 @@ void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
|
|||
#if defined(MBEDTLS_ECP_C)
|
||||
/**
|
||||
* \brief Set the allowed curves in order of preference.
|
||||
* (Default: all defined curves.)
|
||||
*
|
||||
* On server: this only affects selection of the ECDHE curve;
|
||||
* the curves used for ECDH and ECDSA are determined by the
|
||||
|
|
@ -2922,6 +2921,19 @@ void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
|
|||
* \note This list should be ordered by decreasing preference
|
||||
* (preferred curve first).
|
||||
*
|
||||
* \note The default list is the same set of curves that
|
||||
* #mbedtls_x509_crt_profile_default allows, plus
|
||||
* ECDHE-only curves selected according to the same criteria.
|
||||
* The order favors curves with the lowest resource usage.
|
||||
*
|
||||
* \note New minor versions of Mbed TLS may extend this list,
|
||||
* for example if new curves are added to the library.
|
||||
* New minor versions of Mbed TLS will not remove items
|
||||
* from this list unless serious security concerns require it.
|
||||
* New minor versions of Mbed TLS may change the order in
|
||||
* keeping with the general principle of favoring the lowest
|
||||
* resource usage.
|
||||
*
|
||||
* \param conf SSL configuration
|
||||
* \param curves Ordered list of allowed curves,
|
||||
* terminated by MBEDTLS_ECP_DP_NONE.
|
||||
|
|
@ -2933,7 +2945,6 @@ void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
|
|||
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
|
||||
/**
|
||||
* \brief Set the allowed hashes for signatures during the handshake.
|
||||
* (Default: all available hashes except MD5.)
|
||||
*
|
||||
* \note This only affects which hashes are offered and can be used
|
||||
* for signatures during the handshake. Hashes for message
|
||||
|
|
@ -2945,6 +2956,18 @@ void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
|
|||
* \note This list should be ordered by decreasing preference
|
||||
* (preferred hash first).
|
||||
*
|
||||
* \note By default, all supported hashes whose length is at least
|
||||
* 256 bits are allowed. This is the same set as the default
|
||||
* for certificate verification
|
||||
* (#mbedtls_x509_crt_profile_default).
|
||||
* The preference order is currently unspecified and may
|
||||
* change in future versions.
|
||||
*
|
||||
* \note New minor versions of Mbed TLS may extend this list,
|
||||
* for example if new curves are added to the library.
|
||||
* New minor versions of Mbed TLS will not remove items
|
||||
* from this list unless serious security concerns require it.
|
||||
*
|
||||
* \param conf SSL configuration
|
||||
* \param hashes Ordered list of allowed signature hashes,
|
||||
* terminated by \c MBEDTLS_MD_NONE.
|
||||
|
|
|
|||
|
|
@ -332,12 +332,22 @@ typedef void mbedtls_x509_crt_restart_ctx;
|
|||
/**
|
||||
* Default security profile. Should provide a good balance between security
|
||||
* and compatibility with current deployments.
|
||||
*
|
||||
* This profile permits:
|
||||
* - SHA2 hashes with at least 256 bits: SHA-256, SHA-384, SHA-512.
|
||||
* - Elliptic curves with 255 bits and above except secp256k1.
|
||||
* - RSA with 2048 bits and above.
|
||||
*
|
||||
* New minor versions of Mbed TLS may extend this profile, for example if
|
||||
* new algorithms are added to the library. New minor versions of Mbed TLS will
|
||||
* not reduce this profile unless serious security concerns require it.
|
||||
*/
|
||||
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default;
|
||||
|
||||
/**
|
||||
* Expected next default profile. Recommended for new deployments.
|
||||
* Currently targets a 128-bit security level, except for RSA-2048.
|
||||
* Currently targets a 128-bit security level, except for allowing RSA-2048.
|
||||
* This profile may change at any time.
|
||||
*/
|
||||
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next;
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue