coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1612 from valeriosetti/issue1569

Browse Source 
[development] TLS 1.3 certificate chain signature algorithm policy gap
This commit is contained in:
Ronald Cron 2026-05-29 13:35:32 +02:00 committed by GitHub
commit 05bd7f6429
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog.d/security-issue1569.txt Normal file
View File

@ -0,0 +1,4 @@
Security
* Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that
this function only sets signature algorithms that are enforced during
TLS key exchange and not on certificate verification.

9
include/mbedtls/ssl.h
View File

@ -3411,7 +3411,7 @@ int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf, size_t len,
*
* \note The restrictions are enforced for all certificates in the
* chain. However, signatures in the handshake are not covered
* by this setting but by \b mbedtls_ssl_conf_sig_algs().
* by this setting but by \c mbedtls_ssl_conf_sig_algs().
*
* \param conf SSL configuration
* \param profile Profile to use
@ -3899,7 +3899,12 @@ void mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf,
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
/**
* \brief Configure allowed signature algorithms for use in TLS
* \brief Configure allowed signature algorithms for use in TLS key
* exchange.
*
* \note This only covers signature algorithms used in the key
* exchange. To also enforce restrictions in certificate verification
* refer to \c mbedtls_ssl_conf_cert_profile().
*
* \param conf The SSL configuration to use.
* \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms,