TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-04-22 03:35:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add warning in mbedtls_ssl_session_load/save documentation

Browse Source 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
This commit is contained in:
Ronald Cron
2026-02-25 09:04:08 +01:00
parent 6712bd07b3
commit dd20b0644a
1 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
include/mbedtls/ssl.h
View File

@@ -3357,6 +3357,27 @@ int mbedtls_ssl_set_session(mbedtls_ssl_context *ssl, const mbedtls_ssl_session
* On server, this can be used for alternative implementations
* of session cache or session tickets.
*
* \warning The serialized data contains highly sensitive material,
* including a resumption key (TLS 1.3) or the master secret
* (TLS 1.2) from which the session's traffic keys are derived.
*
* The serialized data is not cryptographically protected.
* It is the responsibility of the user of the
* mbedtls_ssl_session_save() and
* mbedtls_ssl_session_load() APIs to ensure both its
* confidentiality and integrity while stored or transported.
*
* A breach of confidentiality could result in full compromise
* of the associated TLS session, including loss of
* confidentiality and integrity of past and future
* application data protected under that session.
*
* A breach of integrity may allow modification of the
* serialized data prior to restoration. As it represents
* trusted internal context, tampering could potentially result
* in arbitrary code execution or other severe compromise of
* the hosting process.
*
* \warning If a peer certificate chain is associated with the session,
* the serialized state will only contain the peer's
* end-entity certificate and the result of the chain
@@ -3395,6 +3416,27 @@ int mbedtls_ssl_session_load(mbedtls_ssl_session *session,
*
* \see mbedtls_ssl_session_load()
*
* \warning The serialized data contains highly sensitive material,
* including a resumption key (TLS 1.3) or the master secret
* (TLS 1.2) from which the session's traffic keys are derived.
*
* The serialized data is not cryptographically protected.
* It is the responsibility of the user of the
* mbedtls_ssl_session_save() and
* mbedtls_ssl_session_load() APIs to ensure both its
* confidentiality and integrity while stored or transported.
*
* A breach of confidentiality could result in full compromise
* of the associated TLS session, including loss of
* confidentiality and integrity of past and future
* application data protected under that session.
*
* A breach of integrity may allow modification of the
* serialized data prior to restoration. As it represents
* trusted internal context, tampering could potentially result
* in arbitrary code execution or other severe compromise of
* the hosting process.
*
* \param session The session structure to be saved.
* \param buf The buffer to write the serialized data to. It must be a
* writeable buffer of at least \p buf_len bytes, or may be \c