From 03cb87ea3ce020d5bcd13bb4399bd84fa3cc68a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Wed, 22 Mar 2023 16:06:47 +0100 Subject: [PATCH] Update psa-limitations.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For recent work and latest plans. Signed-off-by: Manuel Pégourié-Gonnard --- .../psa-migration/psa-limitations.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/docs/architecture/psa-migration/psa-limitations.md b/docs/architecture/psa-migration/psa-limitations.md index c3680231d5..b81aeb47af 100644 --- a/docs/architecture/psa-migration/psa-limitations.md +++ b/docs/architecture/psa-migration/psa-limitations.md @@ -11,11 +11,15 @@ is, of course, to actually do the migration work. Limitations relevant for G1 (performing crypto operations) ========================================================== -Restartable ECC operations --------------------------- +Restartable (aka interruptible) ECC operations +---------------------------------------------- -There is currently no support for that in PSA at all, but it will be added at -some point, see . +Support for interruptible ECDSA sign/verify was added to PSA in Mbed TLS 3.4. +However support for interruptible ECDH is not present yet. Also, PK, X.509 and +TLS have not yet been adapted to take advantage of the new PSA APIs. See: +- ; +- ; +- . Currently, when `MBEDTLS_USE_PSA_CRYPTO` and `MBEDTLS_ECP_RESTARTABLE` are both enabled, some operations that should be restartable are not (ECDH in TLS @@ -78,6 +82,10 @@ the one that requires the most work, but it would deliver value beyond PSA migration by implementing RFC 7919. (Implementing RFC 7919 could be done any time; making it mandatory can only be done in 4.0 or another major version.) +As of early 2023, the plan is to go with option 2 in Mbed TLS 4.0, which has +been announced on the mailing-list and got no push-back, see +. + RSA-PSS parameters ------------------ @@ -321,6 +329,8 @@ probably not acceptable. in the meantime. Such an extension seems inconvenient and not motivated by strong security arguments, so it's unclear whether it would be accepted. +Since Mbed TLS 3.4, option 1 is implemented. + Limitations relevant for G2 (isolation of long-term secrets) ============================================================