From cfd6fb4a580795cb30b8293a2cc099766cac09fd Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Fri, 29 May 2026 18:01:16 +0200
Subject: [PATCH 01/18] x509_crt: remove old invalid comment

ssl_preset_default_hashes was removed in
f0cda410a4bca0f45f66bdbf0714cd0eb2ea4718 but the comment in 'x509_crt.c'
wasn't updated.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 library/x509_crt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/library/x509_crt.c b/library/x509_crt.c
index 15d7d2e686..630dccbf24 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -88,8 +88,7 @@ typedef struct {
  * concerns. */
 const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default =
 {
-    /* Hashes from SHA-256 and above. Note that this selection
-     * should be aligned with ssl_preset_default_hashes in ssl_tls.c. */
+    /* Hashes from SHA-256 and above. */
     MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) |
     MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
     MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),

From 9da2709411943abb0cd099133b9a0acec0e20bad Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Fri, 29 May 2026 18:02:59 +0200
Subject: [PATCH 02/18] x509_crt: add SHA3 algs to
 mbedtls_x509_crt_profile_default

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 library/x509_crt.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/library/x509_crt.c b/library/x509_crt.c
index 630dccbf24..a4a4e4103a 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -91,7 +91,10 @@ const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default =
     /* Hashes from SHA-256 and above. */
     MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) |
     MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
-    MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
+    MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512) |
+    MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA3_256) |
+    MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA3_384) |
+    MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA3_512),
     0xFFFFFFF, /* Any PK alg    */
 #if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
     /* Curves at or above 128-bit security level. Note that this selection

From 3215f5378960594ac1bc3c51e18d1d9eea7ee1e7 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Fri, 29 May 2026 18:17:52 +0200
Subject: [PATCH 03/18] x509: make profile checking functions internally
 available

Following functions

- x509_profile_check_md_alg
- x509_profile_check_pk_alg

are made non-static and moved to x509_internal.h so that other library
files can used them.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 library/x509_crt.c      | 26 +++++++++-----------------
 library/x509_internal.h | 15 +++++++++++++++
 2 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/library/x509_crt.c b/library/x509_crt.c
index a4a4e4103a..f9e36470cb 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -168,12 +168,8 @@ const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_none =
     (uint32_t) -1,
 };
 
-/*
- * Check md_alg against profile
- * Return 0 if md_alg is acceptable for this profile, -1 otherwise
- */
-static int x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile,
-                                     mbedtls_md_type_t md_alg)
+int mbedtls_x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile,
+                                      mbedtls_md_type_t md_alg)
 {
     if (md_alg == MBEDTLS_MD_NONE) {
         return -1;
@@ -186,12 +182,8 @@ static int x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile,
     return -1;
 }
 
-/*
- * Check pk_alg against profile
- * Return 0 if pk_alg is acceptable for this profile, -1 otherwise
- */
-static int x509_profile_check_pk_alg(const mbedtls_x509_crt_profile *profile,
-                                     mbedtls_pk_type_t pk_alg)
+int mbedtls_x509_profile_check_pk_alg(const mbedtls_x509_crt_profile *profile,
+                                      mbedtls_pk_type_t pk_alg)
 {
     if (pk_alg == MBEDTLS_PK_NONE) {
         return -1;
@@ -2057,11 +2049,11 @@ static int x509_crt_verifycrl(mbedtls_x509_crt *crt, mbedtls_x509_crt *ca,
         /*
          * Check if CRL is correctly signed by the trusted CA
          */
-        if (x509_profile_check_md_alg(profile, crl_list->sig_md) != 0) {
+        if (mbedtls_x509_profile_check_md_alg(profile, crl_list->sig_md) != 0) {
             flags |= MBEDTLS_X509_BADCRL_BAD_MD;
         }
 
-        if (x509_profile_check_pk_alg(profile, crl_list->sig_pk) != 0) {
+        if (mbedtls_x509_profile_check_pk_alg(profile, crl_list->sig_pk) != 0) {
             flags |= MBEDTLS_X509_BADCRL_BAD_PK;
         }
 
@@ -2592,11 +2584,11 @@ static int x509_crt_verify_chain(
         }
 
         /* Check signature algorithm: MD & PK algs */
-        if (x509_profile_check_md_alg(profile, child->sig_md) != 0) {
+        if (mbedtls_x509_profile_check_md_alg(profile, child->sig_md) != 0) {
             *flags |= MBEDTLS_X509_BADCERT_BAD_MD;
         }
 
-        if (x509_profile_check_pk_alg(profile, child->sig_pk) != 0) {
+        if (mbedtls_x509_profile_check_pk_alg(profile, child->sig_pk) != 0) {
             *flags |= MBEDTLS_X509_BADCERT_BAD_PK;
         }
 
@@ -3104,7 +3096,7 @@ static int x509_crt_verify_restartable_ca_cb(mbedtls_x509_crt *crt,
     /* Check the type and size of the key */
     pk_type = mbedtls_pk_get_type(&crt->pk);
 
-    if (x509_profile_check_pk_alg(profile, pk_type) != 0) {
+    if (mbedtls_x509_profile_check_pk_alg(profile, pk_type) != 0) {
         ee_flags |= MBEDTLS_X509_BADCERT_BAD_PK;
     }
 
diff --git a/library/x509_internal.h b/library/x509_internal.h
index 8a2d2ed007..0ebd3dc038 100644
--- a/library/x509_internal.h
+++ b/library/x509_internal.h
@@ -14,6 +14,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/x509.h"
+#include "mbedtls/x509_crt.h"
 #include "mbedtls/asn1.h"
 #include "pk_internal.h"
 
@@ -83,4 +84,18 @@ int mbedtls_x509_info_key_usage(char **buf, size_t *size,
 int mbedtls_x509_write_set_san_common(mbedtls_asn1_named_data **extensions,
                                       const mbedtls_x509_san_list *san_list);
 
+/*
+ * Check md_alg against profile
+ * Return 0 if md_alg is acceptable for this profile, -1 otherwise
+ */
+int mbedtls_x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile,
+                                      mbedtls_md_type_t md_alg);
+
+/*
+ * Check pk_alg against profile
+ * Return 0 if pk_alg is acceptable for this profile, -1 otherwise
+ */
+int mbedtls_x509_profile_check_pk_alg(const mbedtls_x509_crt_profile *profile,
+                                      mbedtls_pk_type_t pk_alg);
+
 #endif /* MBEDTLS_X509_INTERNAL_H */

From a38ea44d97fbf613f1730b395eafac1cdadbad0a Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Fri, 29 May 2026 18:22:51 +0200
Subject: [PATCH 04/18] pkcs7: fail verification if MD alg or sig_alg are not
 secure

Add a check on mbedtls_pkcs7_data_or_hash_verify() so that the verification
fails if the MD alg specified in PKCS7 structure or the signature
algorithm specified in the X.509 certificate are not in the list of
secure algorithms (i.e. mbedtls_x509_crt_profile_default).

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 library/pkcs7.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/library/pkcs7.c b/library/pkcs7.c
index 3aac662ba6..cd56b4a5b7 100644
--- a/library/pkcs7.c
+++ b/library/pkcs7.c
@@ -666,6 +666,14 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7,
         return ret;
     }
 
+    /* Ensure the MD alg from the PKCS#7 context and signature algorithm from
+     * the certificate belong to the list of secure algorithms
+     * (i.e. mbedtls_x509_crt_profile_default). */
+    if (mbedtls_x509_profile_check_md_alg(&mbedtls_x509_crt_profile_default, md_alg) ||
+        mbedtls_x509_profile_check_pk_alg(&mbedtls_x509_crt_profile_default, cert->sig_pk)) {
+        return MBEDTLS_ERR_PKCS7_VERIFY_FAIL;
+    }
+
     md_info = mbedtls_md_info_from_type(md_alg);
     if (md_info == NULL) {
         return MBEDTLS_ERR_PKCS7_VERIFY_FAIL;

From 42471969d17bfa0e2d415bc3e1ef2b7d31b332f8 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Wed, 10 Jun 2026 12:03:27 +0200
Subject: [PATCH 05/18] tests: pkcs7: adjust return code in SHA-1 based PKCS7
 test

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 tests/suites/test_suite_pkcs7.data | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data
index 7c0b2cefbc..ca8694f98f 100644
--- a/tests/suites/test_suite_pkcs7.data
+++ b/tests/suites/test_suite_pkcs7.data
@@ -86,9 +86,9 @@ PKCS7 Signed Data Verification Pass SHA256 #9.1
 depends_on:MBEDTLS_MD_CAN_SHA256
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0
 
-PKCS7 Signed Data Verification Pass SHA1 #10
+PKCS7 Signed Data Verification Fail SHA1 #10
 depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256
-pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_VERIFY_FAIL
 
 PKCS7 Signed Data Verification Pass SHA512 #11
 depends_on:MBEDTLS_MD_CAN_SHA512:MBEDTLS_MD_CAN_SHA256

From c6f5f2547d3171dedfe4e24bc9297dddda87c6b3 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Wed, 10 Jun 2026 16:44:36 +0200
Subject: [PATCH 06/18] changelog: add note for PKCS7 rejecting weak hash
 algorithms

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 ChangeLog.d/pkcs7-reject-weak-hashes.txt | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 ChangeLog.d/pkcs7-reject-weak-hashes.txt

diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
new file mode 100644
index 0000000000..61cc03affe
--- /dev/null
+++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
@@ -0,0 +1,3 @@
+Security
+   * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1) on signature
+     verification.

From 48c0911bc84d7e55748b237bddc873117140ece1 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Thu, 11 Jun 2026 17:15:14 +0200
Subject: [PATCH 07/18] tests: pkcs7: add negative tests using MD5 and
 RIPEMD160

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 tests/suites/test_suite_pkcs7.data | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data
index ca8694f98f..f462f1a629 100644
--- a/tests/suites/test_suite_pkcs7.data
+++ b/tests/suites/test_suite_pkcs7.data
@@ -94,6 +94,14 @@ PKCS7 Signed Data Verification Pass SHA512 #11
 depends_on:MBEDTLS_MD_CAN_SHA512:MBEDTLS_MD_CAN_SHA256
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
 
+PKCS7 Signed Data Verification Fail MD5 #12
+depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_MD5
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_VERIFY_FAIL
+
+PKCS7 Signed Data Verification Fail RIPEMD160 #13
+depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_RIPEMD160
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_VERIFY_FAIL
+
 PKCS7 Signed Data Verification Fail because of different certificate #12
 depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-2.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED

From b1e22ce9d5e51076ad4f433b680c0cfa286c1153 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Mon, 15 Jun 2026 10:14:24 +0200
Subject: [PATCH 08/18] pkcs7: split MD/PK check in
 mbedtls_pkcs7_data_or_hash_verify

Follow the default Mbed TLS coding style and ease debugging (i.e. placing
of breakpoints).

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 library/pkcs7.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/library/pkcs7.c b/library/pkcs7.c
index cd56b4a5b7..b8eb4432b4 100644
--- a/library/pkcs7.c
+++ b/library/pkcs7.c
@@ -669,8 +669,12 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7,
     /* Ensure the MD alg from the PKCS#7 context and signature algorithm from
      * the certificate belong to the list of secure algorithms
      * (i.e. mbedtls_x509_crt_profile_default). */
-    if (mbedtls_x509_profile_check_md_alg(&mbedtls_x509_crt_profile_default, md_alg) ||
-        mbedtls_x509_profile_check_pk_alg(&mbedtls_x509_crt_profile_default, cert->sig_pk)) {
+    ret = mbedtls_x509_profile_check_md_alg(&mbedtls_x509_crt_profile_default, md_alg);
+    if (ret != 0) {
+        return MBEDTLS_ERR_PKCS7_VERIFY_FAIL;
+    }
+    ret = mbedtls_x509_profile_check_pk_alg(&mbedtls_x509_crt_profile_default, cert->sig_pk);
+    if (ret != 0) {
         return MBEDTLS_ERR_PKCS7_VERIFY_FAIL;
     }
 

From dee86762dd63b90ee77e5a5e3d33fc2071aa01e7 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Mon, 15 Jun 2026 10:24:39 +0200
Subject: [PATCH 09/18] pkcs7: replace MBEDTLS_ERR_PKCS7_VERIFY_FAIL with
 MBEDTLS_ERR_PKCS7_VERIFY_FAIL

This also updates test data.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 library/pkcs7.c                    | 4 ++--
 tests/suites/test_suite_pkcs7.data | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/library/pkcs7.c b/library/pkcs7.c
index b8eb4432b4..77361a5994 100644
--- a/library/pkcs7.c
+++ b/library/pkcs7.c
@@ -671,11 +671,11 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7,
      * (i.e. mbedtls_x509_crt_profile_default). */
     ret = mbedtls_x509_profile_check_md_alg(&mbedtls_x509_crt_profile_default, md_alg);
     if (ret != 0) {
-        return MBEDTLS_ERR_PKCS7_VERIFY_FAIL;
+        return MBEDTLS_ERR_PKCS7_INVALID_ALG;
     }
     ret = mbedtls_x509_profile_check_pk_alg(&mbedtls_x509_crt_profile_default, cert->sig_pk);
     if (ret != 0) {
-        return MBEDTLS_ERR_PKCS7_VERIFY_FAIL;
+        return MBEDTLS_ERR_PKCS7_INVALID_ALG;
     }
 
     md_info = mbedtls_md_info_from_type(md_alg);
diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data
index f462f1a629..405f54841f 100644
--- a/tests/suites/test_suite_pkcs7.data
+++ b/tests/suites/test_suite_pkcs7.data
@@ -88,7 +88,7 @@ pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../fra
 
 PKCS7 Signed Data Verification Fail SHA1 #10
 depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256
-pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_VERIFY_FAIL
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
 PKCS7 Signed Data Verification Pass SHA512 #11
 depends_on:MBEDTLS_MD_CAN_SHA512:MBEDTLS_MD_CAN_SHA256
@@ -96,11 +96,11 @@ pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../fra
 
 PKCS7 Signed Data Verification Fail MD5 #12
 depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_MD5
-pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_VERIFY_FAIL
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
 PKCS7 Signed Data Verification Fail RIPEMD160 #13
 depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_RIPEMD160
-pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_VERIFY_FAIL
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
 PKCS7 Signed Data Verification Fail because of different certificate #12
 depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C

From 3d44f0fcc0a1c5e0f32614cbd7f1e0900caf09e7 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Mon, 15 Jun 2026 10:26:11 +0200
Subject: [PATCH 10/18] test_suite_pkcs7: adjust numbering of tests

Some newly added tests had duplicate numbers with what was already there.
This commit fixes the duplication problem.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 tests/suites/test_suite_pkcs7.data | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data
index 405f54841f..3220d4af45 100644
--- a/tests/suites/test_suite_pkcs7.data
+++ b/tests/suites/test_suite_pkcs7.data
@@ -90,18 +90,18 @@ PKCS7 Signed Data Verification Fail SHA1 #10
 depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
-PKCS7 Signed Data Verification Pass SHA512 #11
-depends_on:MBEDTLS_MD_CAN_SHA512:MBEDTLS_MD_CAN_SHA256
-pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
-
-PKCS7 Signed Data Verification Fail MD5 #12
+PKCS7 Signed Data Verification Fail MD5 #10.1
 depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_MD5
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
-PKCS7 Signed Data Verification Fail RIPEMD160 #13
+PKCS7 Signed Data Verification Fail RIPEMD160 #10.2
 depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_RIPEMD160
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
+PKCS7 Signed Data Verification Pass SHA512 #11
+depends_on:MBEDTLS_MD_CAN_SHA512:MBEDTLS_MD_CAN_SHA256
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
+
 PKCS7 Signed Data Verification Fail because of different certificate #12
 depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-2.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED

From c8390f51aded7eda24fb61f9729f704fc821eb8b Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Mon, 15 Jun 2026 10:34:22 +0200
Subject: [PATCH 11/18] changelog: update documentation for PKCS7 changes

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 ChangeLog.d/pkcs7-reject-weak-hashes.txt | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
index 61cc03affe..a62cca9b96 100644
--- a/ChangeLog.d/pkcs7-reject-weak-hashes.txt
+++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
@@ -1,3 +1,7 @@
 Security
-   * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1) on signature
-     verification.
+   * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
+     SHA3-224) on signature verification.
+
+Features
+   * SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509
+     certificate profile.

From fecdad9b0c2cef100fb0b72a392f71b756983292 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Mon, 15 Jun 2026 10:49:56 +0200
Subject: [PATCH 12/18] pkcs7: update documentation adding a note about
 rejecting weak hash algs

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 include/mbedtls/pkcs7.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/mbedtls/pkcs7.h b/include/mbedtls/pkcs7.h
index e9b482208e..166cc60970 100644
--- a/include/mbedtls/pkcs7.h
+++ b/include/mbedtls/pkcs7.h
@@ -31,6 +31,10 @@
  *    assumed these fields are empty.
  *  - The RFC allows for the signed Data type to contain contentInfo. This
  *    implementation assumes the type is DATA and the content is empty.
+ *  - The RFC doesn't put any constrain on the hash algorithm to be used, but
+ *    this implementation rejects weak hash algorithms (i.e. RIPEMD160, MD5,
+ *    SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms are
+ *    the ones belonging to `mbedtls_x509_crt_profile_default`.
  */
 
 #ifndef MBEDTLS_PKCS7_H
@@ -190,6 +194,9 @@ int mbedtls_pkcs7_parse_der(mbedtls_pkcs7 *pkcs7, const unsigned char *buf,
  * \note           This function internally calculates the hash on the supplied
  *                 plain data for signature verification.
  *
+ * \note           For limitation on the supported hash algorithms, please refer
+ *                 to the note at the top of this document.
+ *
  * \return         0 if the signature verifies, or a negative error code on failure.
  */
 int mbedtls_pkcs7_signed_data_verify(mbedtls_pkcs7 *pkcs7,
@@ -219,6 +226,9 @@ int mbedtls_pkcs7_signed_data_verify(mbedtls_pkcs7 *pkcs7,
  * \note           This function is different from mbedtls_pkcs7_signed_data_verify()
  *                 in that it is directly passed the hash of the data.
  *
+ * \note           For limitation on the supported hash algorithms, please refer
+ *                 to the note at the top of this document.
+ *
  * \return         0 if the signature verifies, or a negative error code on failure.
  */
 int mbedtls_pkcs7_signed_hash_verify(mbedtls_pkcs7 *pkcs7,

From 04aacf1fa5054ae64714d4be52805506496ecb21 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Tue, 16 Jun 2026 11:43:41 +0200
Subject: [PATCH 13/18] tests: pkcs7: adjust test dependencies

Newly added tests for RIPEMD160 and MD5 still require SHA-256 for the
certificate being used. SHA-1 is instead useless in this case.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 tests/suites/test_suite_pkcs7.data | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data
index 3220d4af45..fe2eccf214 100644
--- a/tests/suites/test_suite_pkcs7.data
+++ b/tests/suites/test_suite_pkcs7.data
@@ -91,11 +91,11 @@ depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
 PKCS7 Signed Data Verification Fail MD5 #10.1
-depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_MD5
+depends_on:MBEDTLS_MD_CAN_MD5:MBEDTLS_MD_CAN_SHA256
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
 PKCS7 Signed Data Verification Fail RIPEMD160 #10.2
-depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_RIPEMD160
+depends_on:MBEDTLS_MD_CAN_RIPEMD160:MBEDTLS_MD_CAN_SHA256
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
 PKCS7 Signed Data Verification Pass SHA512 #11

From ba1c4a5ae0665a1b135007e9d648e19b936a0bcc Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Thu, 11 Jun 2026 17:13:08 +0200
Subject: [PATCH 14/18] framework: update reference

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 framework | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/framework b/framework
index e0f6275eff..d6dec17adf 160000
--- a/framework
+++ b/framework
@@ -1 +1 @@
-Subproject commit e0f6275eff2e45e295fdd6b6877de4cbdaddae83
+Subproject commit d6dec17adfb5bf283c6a7a5bb6c451ecdc0b8201

From 544721407e88678074b7c0c862b2085d28092bee Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Wed, 10 Jun 2026 15:59:50 +0200
Subject: [PATCH 15/18] pkcs7: add MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES build
 symbol

It allows weak hash algorithms to be used in PKCS7. It's only added in the
LTS branch for backward compatibility, but it's disabled by default because
that's the safest choice.

This commit also updates test data in order to test the new build symbol.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 ChangeLog.d/pkcs7-reject-weak-hashes.txt |  4 +++-
 include/mbedtls/mbedtls_config.h         |  9 +++++++++
 library/pkcs7.c                          |  2 ++
 tests/suites/test_suite_pkcs7.data       | 18 +++++++++++++++---
 4 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
index a62cca9b96..659b0a65c5 100644
--- a/ChangeLog.d/pkcs7-reject-weak-hashes.txt
+++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
@@ -1,6 +1,8 @@
 Security
    * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
-     SHA3-224) on signature verification.
+     SHA3-224) on signature verification. Build symbol
+     MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash
+     algorithms in PKCS7 for backward compatibility purposes.
 
 Features
    * SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509
diff --git a/include/mbedtls/mbedtls_config.h b/include/mbedtls/mbedtls_config.h
index 8fa445a132..f684347519 100644
--- a/include/mbedtls/mbedtls_config.h
+++ b/include/mbedtls/mbedtls_config.h
@@ -3248,6 +3248,15 @@
  */
 #define MBEDTLS_PKCS7_C
 
+/**
+ * \def MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
+ *
+ * Allow weak signature algorithms (RIPEMD160, MD5, SHA-1) in PKCS#7.
+ *
+ * Requires: MBEDTLS_PKCS7_C
+ */
+// #define MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
+
 /**
  * \def MBEDTLS_PKCS12_C
  *
diff --git a/library/pkcs7.c b/library/pkcs7.c
index 77361a5994..0628e40498 100644
--- a/library/pkcs7.c
+++ b/library/pkcs7.c
@@ -666,6 +666,7 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7,
         return ret;
     }
 
+#if !defined(MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES)
     /* Ensure the MD alg from the PKCS#7 context and signature algorithm from
      * the certificate belong to the list of secure algorithms
      * (i.e. mbedtls_x509_crt_profile_default). */
@@ -677,6 +678,7 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7,
     if (ret != 0) {
         return MBEDTLS_ERR_PKCS7_INVALID_ALG;
     }
+#endif /* MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES */
 
     md_info = mbedtls_md_info_from_type(md_alg);
     if (md_info == NULL) {
diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data
index fe2eccf214..951051264c 100644
--- a/tests/suites/test_suite_pkcs7.data
+++ b/tests/suites/test_suite_pkcs7.data
@@ -87,17 +87,29 @@ depends_on:MBEDTLS_MD_CAN_SHA256
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0
 
 PKCS7 Signed Data Verification Fail SHA1 #10
-depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256
+depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
+PKCS7 Signed Data Verification Pass SHA1 #10
+depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
+
 PKCS7 Signed Data Verification Fail MD5 #10.1
-depends_on:MBEDTLS_MD_CAN_MD5:MBEDTLS_MD_CAN_SHA256
+depends_on:MBEDTLS_MD_CAN_MD5:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
+PKCS7 Signed Data Verification Pass MD5 #10.1
+depends_on:MBEDTLS_MD_CAN_MD5:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
+
 PKCS7 Signed Data Verification Fail RIPEMD160 #10.2
-depends_on:MBEDTLS_MD_CAN_RIPEMD160:MBEDTLS_MD_CAN_SHA256
+depends_on:MBEDTLS_MD_CAN_RIPEMD160:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
 
+PKCS7 Signed Data Verification Pass RIPEMD160 #10.2
+depends_on:MBEDTLS_MD_CAN_RIPEMD160:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
+
 PKCS7 Signed Data Verification Pass SHA512 #11
 depends_on:MBEDTLS_MD_CAN_SHA512:MBEDTLS_MD_CAN_SHA256
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0

From 745fe11c86828aa36b63b4e281317afd66017621 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Thu, 18 Jun 2026 10:19:07 +0200
Subject: [PATCH 16/18] pkcs7: mention MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES in
 pkcs7.h documentation

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 include/mbedtls/pkcs7.h | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/mbedtls/pkcs7.h b/include/mbedtls/pkcs7.h
index 166cc60970..0cea9a0329 100644
--- a/include/mbedtls/pkcs7.h
+++ b/include/mbedtls/pkcs7.h
@@ -32,9 +32,11 @@
  *  - The RFC allows for the signed Data type to contain contentInfo. This
  *    implementation assumes the type is DATA and the content is empty.
  *  - The RFC doesn't put any constrain on the hash algorithm to be used, but
- *    this implementation rejects weak hash algorithms (i.e. RIPEMD160, MD5,
- *    SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms are
- *    the ones belonging to `mbedtls_x509_crt_profile_default`.
+ *    this implementation by default rejects weak hash algorithms (i.e. RIPEMD160,
+ *    MD5, SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms
+ *    are the ones belonging to `mbedtls_x509_crt_profile_default`.
+ *    MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to remove the limitation
+ *    on weak hash algorithms.
  */
 
 #ifndef MBEDTLS_PKCS7_H

From f3a69ab32a6bf65d22f3bd0a8f94e935bdc254f4 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Thu, 18 Jun 2026 17:48:24 +0200
Subject: [PATCH 17/18] pkcs7: improve documentation and changelog for
 MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 ChangeLog.d/pkcs7-reject-weak-hashes.txt | 2 +-
 include/mbedtls/pkcs7.h                  | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
index 659b0a65c5..ce3f295db1 100644
--- a/ChangeLog.d/pkcs7-reject-weak-hashes.txt
+++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
@@ -1,6 +1,6 @@
 Security
    * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
-     SHA3-224) on signature verification. Build symbol
+     SHA3-224) on signature verification. The new configuration option
      MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash
      algorithms in PKCS7 for backward compatibility purposes.
 
diff --git a/include/mbedtls/pkcs7.h b/include/mbedtls/pkcs7.h
index 0cea9a0329..d9398db9b8 100644
--- a/include/mbedtls/pkcs7.h
+++ b/include/mbedtls/pkcs7.h
@@ -34,9 +34,9 @@
  *  - The RFC doesn't put any constrain on the hash algorithm to be used, but
  *    this implementation by default rejects weak hash algorithms (i.e. RIPEMD160,
  *    MD5, SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms
- *    are the ones belonging to `mbedtls_x509_crt_profile_default`.
- *    MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to remove the limitation
- *    on weak hash algorithms.
+ *    are the ones belonging to ::mbedtls_x509_crt_profile_default.
+ *    #MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to accept all
+ *    supported hash algorithms.
  */
 
 #ifndef MBEDTLS_PKCS7_H

From 16415a66b4f1669a459441eaee5421b28d0c0d7c Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Thu, 18 Jun 2026 17:55:38 +0200
Subject: [PATCH 18/18] pkcs7: do not mention PK algorithms in the
 documentation

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 include/mbedtls/pkcs7.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/mbedtls/pkcs7.h b/include/mbedtls/pkcs7.h
index d9398db9b8..5e58580412 100644
--- a/include/mbedtls/pkcs7.h
+++ b/include/mbedtls/pkcs7.h
@@ -33,7 +33,7 @@
  *    implementation assumes the type is DATA and the content is empty.
  *  - The RFC doesn't put any constrain on the hash algorithm to be used, but
  *    this implementation by default rejects weak hash algorithms (i.e. RIPEMD160,
- *    MD5, SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms
+ *    MD5, SHA-1, SHA-224, SHA3-224). In general accepted hash algorithms
  *    are the ones belonging to ::mbedtls_x509_crt_profile_default.
  *    #MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to accept all
  *    supported hash algorithms.