TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-04-03 11:06:14 +02:00
Code Issues Packages Projects Releases Wiki Activity
32,710 Commits 179 Branches 280 Tags
6712bd07b3ef2cfd767416e5725e4d3e384b6365
Commit Graph

7097 Commits

Author SHA1 Message Date
Ronald Cron
6712bd07b3 Add warning in mbedtls_ssl_context_save/load documentation 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-26 13:18:10 +01:00
Ronald Cron
707c8c34ec Merge remote-tracking branch 'mbedtls-restricted/mbedtls-3.6-release-sync' into 'mbedtls-restricted/mbedtls-3.6-restricted' 2026-03-23 12:08:25 +01:00
Manuel Pégourié-Gonnard
b48ddb3f4e Merge pull request #1485 from gilles-peskine-arm/dev-random-config-3.6 
Backport 3.6: Use /dev/random and make it configurable
 2026-03-17 10:54:46 +01:00
Gilles Peskine
03fafd2637 Update a statement about the default value (now /dev/random) 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-16 14:02:47 +01:00
Gilles Peskine
d05d789316 grammar 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-15 19:53:48 +01:00
Gilles Peskine
e6efd3e406 Match macro definition order with order in mbedtls_entropy_init 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-15 19:52:16 +01:00
Gilles Peskine
909055d760 Fix negation that broke psa_random_set_prediction_resistance 
Platform entropy is available when `MBEDTLS_NO_PLATFORM_ENTROPY` is _not_
defined.

This caused the ok/not-supported behavior of `broke
psa_random_set_prediction_resistance() to be inverted, and the unit tests
checking that behavior to be similarly inverted, so the unit tests didn't
catch it.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-15 19:32:39 +01:00
Manuel Pégourié-Gonnard
e24f1e5c2c Merge pull request #10609 from mpg/pk-psa-large-stack-buffers 
[3.6] PK: avoid large stack buffers in "to/from PSA" functions
 2026-03-13 08:53:48 +00:00
Gilles Peskine
9d17d28dda More documentation improvements 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-12 12:39:16 +01:00
Gilles Peskine
f05a711011 Minor documentation improvements 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 12:58:22 +01:00
Gilles Peskine
43afaa5343 Fix Doxygen warning in realfull config 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 12:21:18 +01:00
Gilles Peskine
d8ce52df19 Fix Doxygen comment start 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 10:48:58 +01:00
Gilles Peskine
409427eac4 Fix grammar 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 10:31:59 +01:00
Ronald Cron
828e3817ac Merge pull request #10623 from ronald-cron-arm/dtls-client-hello-defragmentation-3.6 
Backport 3.6: Add support for (D)TLS 1.2 client hello defragmentation
 2026-03-10 14:46:41 +00:00
Gilles Peskine
855e10c108 Merge pull request #10068 from gilles-peskine-arm/pk-0e-prototype-3.6 
Minor documentation fixes in pk.h
 2026-03-09 13:57:34 +00:00
Gilles Peskine
de1a7f2fbb Remove documentation about fork protection 
It's coming, but not here yet.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00
Gilles Peskine
a863415205 New API psa_random_set_prediction_resistance() 
Let applications configure prediction resistance at runtime.

Prediction resistance is always considered disabled when there is no actual
entropy source, only a nonvolatile seed.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00
Gilles Peskine
5093f08415 New API psa_random_deplete(): force a reseed on the next RNG query 
In some scenarios, application or integration code knows that the random
generator should be reseeded, but the reseed cannot or must not happen
immediately and there is no way to report errors. In such scenarios, users
can call the new function `psa_random_deplete()`, which just marks the DRBG
as needing a reseed.

This change requires DRBG modules to treat `reseed_counter == reseed_interval`
as a condition that requires a reseed. Historically they reseeded when
`reseed_counter > reseed_interval`, but that made it impossible to require
a reseed when `reseed_interval == MAX_INT`. Note that this edge case is not
tested.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00
Gilles Peskine
bd57d52490 DRBG: make reseed_counter not be off by 1 
Change `reseed_counter` to be the number of requests made since the last
reseed, rather than this number minus 1. Thus, reseed when
`reseed_counter >= reseed_interval` rather than
`reseed_counter > reseed_interval`. The field `reseed_counter` is private so
this is not an API change.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00
Gilles Peskine
ccfb7357a3 New function psa_random_reseed() 
Explicit reseed of the PSA random generator.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00
Gilles Peskine
2a92659034 Define derived config macros for entropy sources 
Define `MBEDTLS_ENTROPY_TRUE_SOURCES` and `MBEDTLS_ENTROPY_HAVE_SOURCES`
similarly to TF-PSA-Crypto 1.0. Also define
`MBEDTLS_ENTROPY_HAVE_TRUE_SOURCES` for test function dependencies.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00
Gilles Peskine
3f8f4a0c3f Improve advice 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-02-27 20:45:48 +01:00
Gilles Peskine
6f63121a00 Change the default from /dev/urandom to /dev/random 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-02-27 20:37:28 +01:00
Gilles Peskine
409baa7b7b Document /dev/random vs /dev/urandom on Linux 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-02-25 22:43:19 +01:00
Gilles Peskine
8f962c1b22 Add MBEDTLS_PLATFORM_DEV_RANDOM as a compile-time option 
Document when this is not used. This was the case in TF-PSA-Crypto 1.0.0,
but not yet in Mbed TLS 3.6.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-02-25 22:43:19 +01:00
Gilles Peskine
2ccda0f48c Make the random device configurable 
Instead of unconditionally using `/dev/urandom`, make the device path
configurable at compile time through `MBEDTLS_PLATFORM_DEV_RANDOM` or
at run time through `mbedtls_platform_dev_random`.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-02-25 22:10:17 +01:00
Ronald Cron
1bdb0901c9 Update mbedtls_ssl_handshake() documentation 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-02-24 15:37:28 +01:00
Manuel Pégourié-Gonnard
4bebabb687 PSA: improve PSA_EXPORT_KEY_OUTPUT_SIZE; PK: use it 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-02-23 09:42:06 +01:00
Manuel Pégourié-Gonnard
1cc0e98f68 PSA: add and use PSA_EXPORT_ASYMMETRIC_KEY_MAX_SIZE 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-02-23 09:42:06 +01:00
Valerio Setti
32649e1e33 include: fix guard in asn1write.h 
Fix the location of the ending braket of "extern C" block in order to
have it balanced between C guards.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-02-16 14:03:48 +01:00
David Horstmann
337218d667 Merge pull request #10165 from davidhorstmann-arm/fix-mingw-ansi-stdio-3.6 
[3.6] Fix format specifiers for MinGW ANSI stdio
 2026-01-28 16:42:07 +00:00
Manuel Pégourié-Gonnard
12b3c46d6a Merge pull request #10347 from aphroteus/mbedtls-3.6 
[3.6] Fix a build failure that occurs in environments using Code Page 950
 2025-12-16 08:14:04 +00:00
Luc Schrijvers
b044efeb61 Use GNUInstallDirs CMAKE_INSTALL_INCLUDEDDIR path for headers installation 
Signed-off-by: Luc Schrijvers <begasus@gmail.com>
 2025-10-23 11:37:58 +02:00
Gilles Peskine
6dacfdc59e Merge pull request #10447 from valeriosetti/static-key-store-fix-size 
[3.6] psa: improve buffer size computation for static key slots
 2025-10-20 13:42:04 +00:00
Valerio Setti
5306324015 psa: crypto_extra: update documentation of MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-10-16 16:36:50 +02:00
Valerio Setti
45574797e7 psa: crypto_extra: improve buffer size computation for static key slots 
Take also MAC's key types into account when computing the size of the
buffer to store key material in static key slot configuration.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-10-15 16:22:39 +02:00
Minos Galanakis
ad63800090 Version bump for mbedtls-3.5.6 
./scripts/bump_version.sh --version 3.6.5

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2025-10-10 18:04:55 +01:00
Gilles Peskine
0c4a951b37 Be more precise about the user/peer ID limitation 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
(cherry picked from commit 84a9b26b88)
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2025-10-10 18:04:55 +01:00
Gilles Peskine
90eac7fc7a Document JPAKE limitations 
Document limitations on the user ID, peer ID, primitive (elliptic curve) and
hash for `PSA_ALG_JPAKE`.

https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/502
https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/503
https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/504

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
(cherry picked from commit 8ca2a5bf95)
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2025-10-10 18:04:55 +01:00
Gilles Peskine
84a9b26b88 Be more precise about the user/peer ID limitation 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-10-10 12:08:21 +02:00
Gilles Peskine
8ca2a5bf95 Document JPAKE limitations 
Document limitations on the user ID, peer ID, primitive (elliptic curve) and
hash for `PSA_ALG_JPAKE`.

https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/502
https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/503
https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/504

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-10-08 17:39:23 +02:00
Gilles Peskine
334dfa8799 Merge remote-tracking branch '3.6' into restricted-3.6-merge-public-20250916 
Conflicts:

* `framework`: update submodule to the merge of `main` and `main-restricted`.
 2025-09-16 16:16:53 +02:00
Gilles Peskine
9a5444a3b8 Fix copypasta 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-09-12 11:27:11 +02:00
Gilles Peskine
6e1b66320a Improve documentation 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-09-12 11:27:09 +02:00
Gilles Peskine
3aee15b8e5 Declare psa_can_do_cipher() in a public header 
Integrators in a client-server architecture need to provide this function on
the client side.

Fixes mbedtls/issues#10341.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-09-12 11:27:07 +02:00
Gilles Peskine
9d7d0e63ae Merge pull request #1407 from gilles-peskine-arm/mbedtls_cipher_finish_padded-3.6 
Backport 3.6: Introduce mbedtls_cipher_finish_padded
 2025-09-08 12:18:50 +02:00
Gilles Peskine
df13694ecd Improve documentation of MBEDTLS_THREADING_ALT 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-09-07 14:45:15 +02:00
Gilles Peskine
fe00817fe7 Improve documentation of mutex primitives 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-09-07 14:42:54 +02:00
Gilles Peskine
f845e9d111 Minor documentation improvements 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-08-25 16:48:42 +02:00
Manuel Pégourié-Gonnard
381d4ba03b Make mbedtls_mpi_gcd() more consistent 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2025-08-13 09:01:45 +02:00