TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-04-05 12:06:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Document PSA's need for threading

Browse Source 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
2025-02-20 20:20:19 +01:00
parent c811fb79ad
commit 730be78ce5
1 changed files with 39 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
include/mbedtls/mbedtls_config.h
View File

@@ -1807,6 +1807,11 @@
* running handshake hash) only use PSA crypto if
* #MBEDTLS_USE_PSA_CRYPTO is enabled.
*
* \note In multithreaded applications, you must also enable
* #MBEDTLS_THREADING_C, even if individual TLS contexts are not
* shared between threads, unless only one thread ever calls
* TLS functions.
*
* Uncomment this macro to enable the support for TLS 1.3.
*/
#define MBEDTLS_SSL_PROTO_TLS1_3
@@ -2134,6 +2139,10 @@
*
* \note See docs/use-psa-crypto.md for a complete description this option.
*
* \note In multithreaded applications, you must also enable
* #MBEDTLS_THREADING_C, unless only one thread ever calls
* `psa_xxx()`, PK, X.509 or TLS functions.
*
* Requires: MBEDTLS_PSA_CRYPTO_C.
*
* Uncomment this to enable internal use of PSA Crypto and new associated APIs.
@@ -3211,7 +3220,10 @@
/**
* \def MBEDTLS_PSA_CRYPTO_C
*
* Enable the Platform Security Architecture cryptography API.
* Enable the Platform Security Architecture (PSA) cryptography API.
*
* \note In multithreaded applications, you must enable #MBEDTLS_THREADING_C,
* unless only one thread ever calls `psa_xxx()` functions.
*
* Module: library/psa_crypto.c
*
@@ -3631,10 +3643,33 @@
* \def MBEDTLS_THREADING_C
*
* Enable the threading abstraction layer.
* By default Mbed TLS assumes it is used in a non-threaded environment or that
* contexts are not shared between threads. If you do intend to use contexts
*
* Traditionally, Mbed TLS assumes it is used in a non-threaded environment or
* that contexts are not shared between threads. If you do intend to use contexts
* between threads, you will need to enable this layer to prevent race
* conditions. See also our Knowledge Base article about threading:
* conditions.
*
* The PSA subsystem has an implicit shared context. Therefore, you must
* enable this option if more than one thread may use any part of
* Mbed TLS that is implemented on top of the PSA subsystem.
*
* You must enable this option in multithreaded applications where more than
* one thread performs any of the following operations:
*
* - Any call to a PSA function (`psa_xxx()`).
* - Any call to a TLS, X.509 or PK function (`mbedtls_ssl_xxx()`,
* `mbedtls_x509_xxx()`, `mbedtls_pkcs7_xxx()`, `mbedtls_pk_xxx()`)
* if `MBEDTLS_USE_PSA_CRYPTO` is enabled (regardless of whether individual
* TLS, X.509 or PK contexts are shared between threads).
* - A TLS 1.3 connection, regardless of the compile-time configuration.
* - Any library feature that calculates a hash, except for algorithm-specific
* low-level modules, if `MBEDTLS_MD_C` is disabled.
* - Any library feature that calculates a hash, except for algorithm-specific
* low-level modules, if `MBEDTLS_CIPHER_C` is disabled.
* - Any use of a cryptographic context if the same context is used in
* multiple threads.
*
* See also our Knowledge Base article about threading:
* https://mbed-tls.readthedocs.io/en/latest/kb/development/thread-safety-and-multi-threading
*
* Module: library/threading.c