* restricted/development-restricted: (30 commits)
Tiny fix in ChangeLog pt 2
Tiny fix in ChangeLog
Changelog entry for the RSA memory leak
Edit ChangeLog entry
Update ChangeLog
Add test cases for extKeyUsage
Rationalize extKeyUsage tests
Use P_CLI when O_CLI's status is not reliable
Rationalize keyUsage testing, round 2
Always print detailed cert errors in test programs
Fix 1.3 failure to update flags for (ext)KeyUsage
Rationalize ssl-opt tests for keyUsage
Test cert alert KEY_USAGE -> UNSUPPORTED_CERT
Free allocated memory where methods were returning without freeing
Force MBEDTLS_PSA_HMAC_DRBG_MD_TYPE based on CTR_DRBG
Document that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not force HMAC
Clean up constant-flow memsan testing
Improve description of who is affected
More diversified sizes in tests
Fix stack buffer overflow in ECDSA signature format conversions
...
Avoid compiler warning about size comparison (like in commit 7910cdd):
Clang builds fail, warning about comparing uint8_t to a size that may be >255.
Signed-off-by: Michael Schuster <michael@schuster.ms>
Fix interference between PSA volatile keys and built-in keys
when MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS is enabled and
MBEDTLS_PSA_KEY_SLOT_COUNT is more than 4096. This overlap used to make it
possible that a volatile key would receive the identifier of a built-in key,
and is now caught by a static assertion.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
mbedtls_psa_register_se_key() is not usable with volatile keys, since there
is no way to return the implementation-chosen key identifier which would be
needed to use the key. Document this limitation. Reject an attempt to create
such an unusable key. Fixes#9253.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Remove the experimental functions psa_generate_key_ext() and
psa_key_derivation_output_key_ext(), which require a flexible array member
and therefore break C++ code that includes Mbed TLS headers. They have been
replaced by psa_generate_key_custom() and
psa_key_derivation_output_key_custom().
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Document psa_generate_key_ext() and psa_key_derivation_output_key_ext() as
deprecated in favor of psa_generate_key_custom() and
psa_key_derivation_output_key_custom(), and no longer declared in C++ builds.
Resolves#9020.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
MBEDTLS_PSA_HMAC_DRBG_MD_TYPE was documented and announced as causing the
PSA DRBG to be HMAC_DRBG. However, that was never actually implemented:
CTR_DRBG is prioritized if enabled.
Since there is a simple workaround of disabling MBEDTLS_CTR_DRBG_C if you
want to use HMAC_DRBG, we have decided to accept the actual behavior and fix
the documentation.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
