eden-emu/mbedtls
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Corrections to ChangeLog and Migration guide

Browse source 
Corrections to address wording of ChangeLog
and Migration guide.

Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
This commit is contained in:
Thomas Daubney 2021-05-25 15:00:19 +01:00
parent 3ca92b182c
commit 6f966112c7
2 changed files with 30 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

11
ChangeLog.d/remove-rsa-mode-parameter.txt
View file

@ -1,6 +1,15 @@
Removals
* The RSA module no longer supports private-key operations with the public
key and vice versa. This change only affects applications which use the
wrong mode. In this case the wrong mode is to use mode=MBEDTLS_RSA_PUBLIC
with decryption and signing functions and mode=MBEDTLS_RSA_PRIVATE with
encryption and verification functions. Addresses issue #4278.
API changes API changes
* Remove mode parameter from RSA functions. All encryption, * Remove mode parameter from RSA functions. All encryption,
decryption, sign and verify functions are affected. Also decryption, sign and verify functions are affected. Also
removes the RNG parameters from the RSA verify functions. removes the RNG parameters from the RSA verify functions.
Existing user code which utilises these RSA functions must Existing user code which utilises these RSA functions must
remove the mode parameter. Fixes #4278. remove the mode parameter.
* RNG is now mandatory for all private-key RSA operations. Existing user code
which does not use an RNG with private-key RSA functions must now be
updated to do so.

34
docs/3.0-migration-guide.d/remove-rsa-mode-parameter.md
View file

@ -4,20 +4,26 @@ Remove the mode parameter from RSA functions
This affects all users who use the RSA encryption, decryption, sign and This affects all users who use the RSA encryption, decryption, sign and
verify APIs. verify APIs.
You must delete the mode parameter from your RSA function calls. The RSA module no longer supports private-key operations with the public key or
Using the correct mode is now the default behaviour. Encryption vice versa. As a consequence, RSA operation functions no longer have a mode
and verification functions are now equivalent to their 2.x parameter. If you were calling RSA operations with the normal mode (public key
counterparts with mode=MBEDTLS_RSA_PUBLIC. Decryption and signing for verification or encryption, private key for signature or decryption), remove
functions are now equivalent to their 2.x counterparts with the `MBEDTLS_MODE_PUBLIC` or `MBEDTLS_MODE_PRIVATE` argument. If you were calling
mode=MBEDTLS_RSA_PRIVATE. Note that the constants RSA operations with the wrong mode, which rarely makes sense from a security
MBEDTLS_RSA_PUBLIC and MBEDTLS_RSA_PRIVATE have been removed in 3.0. perspective, this is no longer supported.
Remove the RNG parameter from RSA functions Remove the RNG parameter from RSA verify functions
-------------------------------------------- --------------------------------------------------
This affects all users who use the RSA verify functions. RSA verification functions also no longer take random generator arguments (this
was only needed when using a private key). This affects all applications using
the RSA verify functions.
If you were using the RNG parameters then you must remove RNG is now mandatory in all RSA private key operations
them from your function calls. Since using the wrong mode ------------------------------------------------------
is no longer supported, the RNG parameters namely f_rng
and p_rng are no longer needed. The random generator is now mandatory for blinding in all RSA private-key
operations (`mbedtls_rsa_private`, `mbedtls_rsa_xxx_sign`,
`mbedtls_rsa_xxx_decrypt`) as well as for encryption
(`mbedtls_rsa_xxx_encrypt`). This means that passing a null `f_rng` is no longer
supported.