cuberite/polarssl
1
0
Fork 0
mirror of https://github.com/cuberite/polarssl.git synced 2025-10-03 10:34:16 -04:00
Code Issues Packages Projects Releases Wiki Activity

Improve ChangeLog entry for driver-only hashes

Browse Source 
- avoid long unstructured paragraph with long messy sentences
- de-emphasize "no longer depends on MD" and emphasize "can work in
some driver-only builds" instead - that's what users are interested in
(building without MD is just the current way to accomplish that, but
that will change in the future)

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2022-11-23 13:14:52 +01:00
parent 18a3856a03
commit 3518fb11d0
1 changed files with 18 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
ChangeLog.d/driver-only-hashes.txt
View File

@ -1,24 +1,19 @@
Features Features
* Some crypto modules that previously depended on MD or a low-level hash * Some modules can now use PSA drivers for hashes, including with no
module, either unconditionally (RSA, PK, PKCS5, PKCS12, EC J-PAKE), or built-in implementation present, but only in some configurations.
for some features (PEM for encrypted files), are now able to use PSA - RSA PKCS#1 v2.1, PKCS5, PKCS12 and EC J-PAKE now use hashes from PSA
Crypto instead when the legacy API is not available. This means it is when (and only when) MBEDTLS_MD_C is disabled.
now possible to use all features from those modules in configurations - PEM parsing of encrypted files now uses MD-5 from PSA when (and only
where the built-in implementations of hashes are excluded and the hashes when) MBEDTLS_MD5_C is disabled.
are only provided by PSA drivers. In these configurations, you need to See the documentation of the corresponding macros in mbedtls_config.h for
call `psa_crypto_init()` before you call any function from those details.
modules; this is not required in configurations where the built-in Note that some modules are not able to use hashes from PSA yet, including
implementation is still available. Note that for modules that use MD the entropy module. As a consequence, for now the only way to build with
(RSA, PKCS5, PKCS12, EC J-PAKE) in builds that have MBEDTLS_MD_C enabled, all hashes only provided by drivers (no built-in hash) is to use
all hashes used with those modules need to be built-in, as drivers are only MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
used when MBEDTLS_MD_C is disabled; configurations where some hashes are * When MBEDTLS_USE_PSA_CRYPTO is enabled, X.509, TLS 1.2 and TLS 1.3 now
available as built-ins, and some only from drivers, are currently not properly negotiate/accept hashes based on their availability in PSA.
supported. Also note that some crypto modules and features still depend on As a consequence, they now work in configurations where the built-in
the built-in implementation of hashes: MBEDTLS_HKDF_C (but the PSA HKDF implementations of (some) hashes are excluded and those hashes are only
functions do not depend on it), MBEDTLS_ENTROPY_C, MBEDTLS_HMAC_DRBG_C and provided by PSA drivers. (See previous entry for limitation on RSA-PSS
MBEDTLS_ECDSA_DETERMINISTIC. In particular, for now, compiling without though: that module only use hashes from PSA when MBEDTLS_MD_C is off).
built-in hashes requires use of MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
* When MBEDTLS_USE_PSA_CRYPTO is enabled, X.509, TLS 1.2 and TLS 1.3 no
longer depend on MD. This means it is now possible to use them in
configurations where the built-in implementations of hashes are excluded
and the hashes are only provided by PSA drivers.