TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-04-03 11:06:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add warning in mbedtls_ssl_context_save/load documentation

Browse Source 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
This commit is contained in:
Ronald Cron
2026-02-25 08:40:28 +01:00
parent 3746d7bbe0
commit 6712bd07b3
1 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
include/mbedtls/ssl.h
View File

@@ -5570,6 +5570,27 @@ void mbedtls_ssl_free(mbedtls_ssl_context *ssl);
*
* \see mbedtls_ssl_context_load()
*
* \warning The serialized data contains highly sensitive material,
* including the master secret from which the session's traffic
* keys are derived.
*
* The serialized data is not cryptographically protected.
* It is the responsibility of the user of the
* mbedtls_ssl_context_save() and
* mbedtls_ssl_context_load() APIs to ensure both its
* confidentiality and integrity while stored or transported.
*
* A breach of confidentiality could result in full compromise
* of the associated TLS session, including loss of
* confidentiality and integrity of past and future
* application data protected under that session.
*
* A breach of integrity may allow modification of the
* serialized data prior to restoration. As it represents
* trusted internal context, tampering could potentially result
* in arbitrary code execution or other severe compromise of
* the hosting process.
* \note The serialized data only contains the data that is
* necessary to resume the connection: negotiated protocol
* options, session identifier, keys, etc.
@@ -5636,6 +5657,27 @@ int mbedtls_ssl_context_save(mbedtls_ssl_context *ssl,
* more than one context would cause severe security failures
* including but not limited to loss of confidentiality.
*
* \warning The serialized data contains highly sensitive material,
* including the master secret from which the session's traffic
* keys are derived.
*
* The serialized data is not cryptographically protected.
* It is the responsibility of the user of the
* mbedtls_ssl_context_save() and
* mbedtls_ssl_context_load() APIs to ensure both its
* confidentiality and integrity while stored or transported.
*
* A breach of confidentiality could result in full compromise
* of the associated TLS session, including loss of
* confidentiality and integrity of past and future
* application data protected under that session.
*
* A breach of integrity may allow modification of the
* serialized data prior to restoration. As it represents
* trusted internal context, tampering could potentially result
* in arbitrary code execution or other severe compromise of
* the hosting process.
*
* \note Before calling this function, the SSL context must be
* prepared in one of the two following ways. The first way is
* to take a context freshly initialised with