From 4e057619a95d17626ffeb5385e3b7838ab2d2da2 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 29 May 2026 18:01:16 +0200 Subject: [PATCH 01/14] x509_crt: remove old invalid comment ssl_preset_default_hashes was removed in f0cda410a4bca0f45f66bdbf0714cd0eb2ea4718 but the comment in 'x509_crt.c' wasn't updated. Signed-off-by: Valerio Setti --- library/x509_crt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/library/x509_crt.c b/library/x509_crt.c index 093d733c1c..3938242298 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -87,8 +87,7 @@ typedef struct { * concerns. */ const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default = { - /* Hashes from SHA-256 and above. Note that this selection - * should be aligned with ssl_preset_default_hashes in ssl_tls.c. */ + /* Hashes from SHA-256 and above. */ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) | MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) | MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512), From 24a184ad36df7575dfd2d069f7afb25d6813a690 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 29 May 2026 18:02:59 +0200 Subject: [PATCH 02/14] x509_crt: add SHA3 algs to mbedtls_x509_crt_profile_default Signed-off-by: Valerio Setti --- library/x509_crt.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/library/x509_crt.c b/library/x509_crt.c index 3938242298..e4fedb194a 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -90,7 +90,10 @@ const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default = /* Hashes from SHA-256 and above. */ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) | MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) | - MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512), + MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512) | + MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA3_256) | + MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA3_384) | + MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA3_512), 0xFFFFFFF, /* Any PK alg */ #if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) /* Curves at or above 128-bit security level. Note that this selection From 395bc86df8928dc188fae28d7b6512b61af0e9e2 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 29 May 2026 18:17:52 +0200 Subject: [PATCH 03/14] x509: make profile checking functions internally available Following functions - x509_profile_check_md_alg - x509_profile_check_pk_alg are made non-static and moved to x509_internal.h so that other library files can used them. Signed-off-by: Valerio Setti --- library/x509_crt.c | 26 +++++++++----------------- library/x509_internal.h | 15 +++++++++++++++ 2 files changed, 24 insertions(+), 17 deletions(-) diff --git a/library/x509_crt.c b/library/x509_crt.c index e4fedb194a..a6fcd1b4e6 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -167,12 +167,8 @@ const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_none = (uint32_t) -1, }; -/* - * Check md_alg against profile - * Return 0 if md_alg is acceptable for this profile, -1 otherwise - */ -static int x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile, - mbedtls_md_type_t md_alg) +int mbedtls_x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile, + mbedtls_md_type_t md_alg) { if (md_alg == MBEDTLS_MD_NONE) { return -1; @@ -185,12 +181,8 @@ static int x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile, return -1; } -/* - * Check pk_alg against profile - * Return 0 if pk_alg is acceptable for this profile, -1 otherwise - */ -static int x509_profile_check_pk_alg(const mbedtls_x509_crt_profile *profile, - mbedtls_pk_sigalg_t pk_alg) +int mbedtls_x509_profile_check_pk_alg(const mbedtls_x509_crt_profile *profile, + mbedtls_pk_sigalg_t pk_alg) { if (pk_alg == MBEDTLS_PK_SIGALG_NONE) { return -1; @@ -2050,11 +2042,11 @@ static int x509_crt_verifycrl(mbedtls_x509_crt *crt, mbedtls_x509_crt *ca, /* * Check if CRL is correctly signed by the trusted CA */ - if (x509_profile_check_md_alg(profile, crl_list->sig_md) != 0) { + if (mbedtls_x509_profile_check_md_alg(profile, crl_list->sig_md) != 0) { flags |= MBEDTLS_X509_BADCRL_BAD_MD; } - if (x509_profile_check_pk_alg(profile, crl_list->sig_pk) != 0) { + if (mbedtls_x509_profile_check_pk_alg(profile, crl_list->sig_pk) != 0) { flags |= MBEDTLS_X509_BADCRL_BAD_PK; } @@ -2563,11 +2555,11 @@ static int x509_crt_verify_chain( } /* Check signature algorithm: MD & PK algs */ - if (x509_profile_check_md_alg(profile, child->sig_md) != 0) { + if (mbedtls_x509_profile_check_md_alg(profile, child->sig_md) != 0) { *flags |= MBEDTLS_X509_BADCERT_BAD_MD; } - if (x509_profile_check_pk_alg(profile, child->sig_pk) != 0) { + if (mbedtls_x509_profile_check_pk_alg(profile, child->sig_pk) != 0) { *flags |= MBEDTLS_X509_BADCERT_BAD_PK; } @@ -3075,7 +3067,7 @@ static int x509_crt_verify_restartable_ca_cb(mbedtls_x509_crt *crt, /* Check the type and size of the key */ pk_type = mbedtls_pk_get_type(&crt->pk); - if (x509_profile_check_pk_alg(profile, (mbedtls_pk_sigalg_t) pk_type) != 0) { + if (mbedtls_x509_profile_check_pk_alg(profile, (mbedtls_pk_sigalg_t) pk_type) != 0) { ee_flags |= MBEDTLS_X509_BADCERT_BAD_PK; } diff --git a/library/x509_internal.h b/library/x509_internal.h index fcb996b19d..f68b6593bd 100644 --- a/library/x509_internal.h +++ b/library/x509_internal.h @@ -15,6 +15,7 @@ #include "mbedtls/private_access.h" #include "mbedtls/x509.h" +#include "mbedtls/x509_crt.h" #include "mbedtls/asn1.h" #include "pk_internal.h" // for a lot of things, including in SSL @@ -79,4 +80,18 @@ int mbedtls_x509_info_key_usage(char **buf, size_t *size, int mbedtls_x509_write_set_san_common(mbedtls_asn1_named_data **extensions, const mbedtls_x509_san_list *san_list); +/* + * Check md_alg against profile + * Return 0 if md_alg is acceptable for this profile, -1 otherwise + */ +int mbedtls_x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile, + mbedtls_md_type_t md_alg); + +/* + * Check pk_alg against profile + * Return 0 if pk_alg is acceptable for this profile, -1 otherwise + */ +int mbedtls_x509_profile_check_pk_alg(const mbedtls_x509_crt_profile *profile, + mbedtls_pk_sigalg_t pk_alg); + #endif /* MBEDTLS_X509_INTERNAL_H */ From c25e7654ea6bb1e95743f0ae8e12b957a1cf67a6 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 29 May 2026 18:22:51 +0200 Subject: [PATCH 04/14] pkcs7: fail verification if MD alg or sig_alg are not secure Add a check on mbedtls_pkcs7_data_or_hash_verify() so that the verification fails if the MD alg specified in PKCS7 structure or the signature algorithm specified in the X.509 certificate are not in the list of secure algorithms (i.e. mbedtls_x509_crt_profile_default). Signed-off-by: Valerio Setti --- library/pkcs7.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/library/pkcs7.c b/library/pkcs7.c index 2cc7812bf0..1e952998cc 100644 --- a/library/pkcs7.c +++ b/library/pkcs7.c @@ -665,6 +665,14 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7, return ret; } + /* Ensure the MD alg from the PKCS#7 context and signature algorithm from + * the certificate belong to the list of secure algorithms + * (i.e. mbedtls_x509_crt_profile_default). */ + if (mbedtls_x509_profile_check_md_alg(&mbedtls_x509_crt_profile_default, md_alg) || + mbedtls_x509_profile_check_pk_alg(&mbedtls_x509_crt_profile_default, cert->sig_pk)) { + return MBEDTLS_ERR_PKCS7_VERIFY_FAIL; + } + md_info = mbedtls_md_info_from_type(md_alg); if (md_info == NULL) { return MBEDTLS_ERR_PKCS7_VERIFY_FAIL; From 632c4fce0e7a39bb367163be2964b24e569c0e0b Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 10 Jun 2026 12:03:27 +0200 Subject: [PATCH 05/14] tests: pkcs7: adjust return code in SHA-1 based PKCS7 test Signed-off-by: Valerio Setti --- tests/suites/test_suite_pkcs7.data | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 3e3f7f1d7d..25659c2f29 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -86,9 +86,9 @@ PKCS7 Signed Data Verification Pass SHA256 #9.1 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0 -PKCS7 Signed Data Verification Pass SHA1 #10 +PKCS7 Signed Data Verification Fail SHA1 #10 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY -pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0 +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:PSA_ERROR_INVALID_SIGNATURE PKCS7 Signed Data Verification Pass SHA512 #11 depends_on:PSA_WANT_ALG_SHA_512:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY From 394d8e6a6f6fe41663795d739c7e9e7804392a32 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 10 Jun 2026 16:44:36 +0200 Subject: [PATCH 06/14] changelog: add note for PKCS7 rejecting weak hash algorithms Signed-off-by: Valerio Setti --- ChangeLog.d/pkcs7-reject-weak-hashes.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ChangeLog.d/pkcs7-reject-weak-hashes.txt diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt new file mode 100644 index 0000000000..61cc03affe --- /dev/null +++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt @@ -0,0 +1,3 @@ +Security + * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1) on signature + verification. From 930b87a87ea99b828a0d0111cc0eb2c46dad37a3 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Thu, 11 Jun 2026 17:15:14 +0200 Subject: [PATCH 07/14] tests: pkcs7: add negative tests using MD5 and RIPEMD160 Signed-off-by: Valerio Setti --- tests/suites/test_suite_pkcs7.data | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 25659c2f29..301d95ed44 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -94,6 +94,14 @@ PKCS7 Signed Data Verification Pass SHA512 #11 depends_on:PSA_WANT_ALG_SHA_512:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0 +PKCS7 Signed Data Verification Fail MD5 #12 +depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_MD5:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:PSA_ERROR_INVALID_SIGNATURE + +PKCS7 Signed Data Verification Fail RIPEMD160 #13 +depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_RIPEMD160:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:PSA_ERROR_INVALID_SIGNATURE + PKCS7 Signed Data Verification Fail because of different certificate #12 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-2.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED From 45654b0246251afd681430c617391521fe93382b Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Mon, 15 Jun 2026 10:14:24 +0200 Subject: [PATCH 08/14] pkcs7: split MD/PK check in mbedtls_pkcs7_data_or_hash_verify Follow the default Mbed TLS coding style and ease debugging (i.e. placing of breakpoints). Signed-off-by: Valerio Setti --- library/pkcs7.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/library/pkcs7.c b/library/pkcs7.c index 1e952998cc..885ead6cb1 100644 --- a/library/pkcs7.c +++ b/library/pkcs7.c @@ -668,8 +668,12 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7, /* Ensure the MD alg from the PKCS#7 context and signature algorithm from * the certificate belong to the list of secure algorithms * (i.e. mbedtls_x509_crt_profile_default). */ - if (mbedtls_x509_profile_check_md_alg(&mbedtls_x509_crt_profile_default, md_alg) || - mbedtls_x509_profile_check_pk_alg(&mbedtls_x509_crt_profile_default, cert->sig_pk)) { + ret = mbedtls_x509_profile_check_md_alg(&mbedtls_x509_crt_profile_default, md_alg); + if (ret != 0) { + return MBEDTLS_ERR_PKCS7_VERIFY_FAIL; + } + ret = mbedtls_x509_profile_check_pk_alg(&mbedtls_x509_crt_profile_default, cert->sig_pk); + if (ret != 0) { return MBEDTLS_ERR_PKCS7_VERIFY_FAIL; } From 64d8776ea9b49f278664b3d3db9ab5539e17ca10 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Mon, 15 Jun 2026 10:24:39 +0200 Subject: [PATCH 09/14] pkcs7: replace MBEDTLS_ERR_PKCS7_VERIFY_FAIL with MBEDTLS_ERR_PKCS7_VERIFY_FAIL This also updates test data. Signed-off-by: Valerio Setti --- library/pkcs7.c | 4 ++-- tests/suites/test_suite_pkcs7.data | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/library/pkcs7.c b/library/pkcs7.c index 885ead6cb1..365f7eac64 100644 --- a/library/pkcs7.c +++ b/library/pkcs7.c @@ -670,11 +670,11 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7, * (i.e. mbedtls_x509_crt_profile_default). */ ret = mbedtls_x509_profile_check_md_alg(&mbedtls_x509_crt_profile_default, md_alg); if (ret != 0) { - return MBEDTLS_ERR_PKCS7_VERIFY_FAIL; + return MBEDTLS_ERR_PKCS7_INVALID_ALG; } ret = mbedtls_x509_profile_check_pk_alg(&mbedtls_x509_crt_profile_default, cert->sig_pk); if (ret != 0) { - return MBEDTLS_ERR_PKCS7_VERIFY_FAIL; + return MBEDTLS_ERR_PKCS7_INVALID_ALG; } md_info = mbedtls_md_info_from_type(md_alg); diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 301d95ed44..0cd899fc27 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -88,7 +88,7 @@ pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../fra PKCS7 Signed Data Verification Fail SHA1 #10 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY -pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:PSA_ERROR_INVALID_SIGNATURE +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG PKCS7 Signed Data Verification Pass SHA512 #11 depends_on:PSA_WANT_ALG_SHA_512:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY @@ -96,11 +96,11 @@ pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../fra PKCS7 Signed Data Verification Fail MD5 #12 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_MD5:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY -pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:PSA_ERROR_INVALID_SIGNATURE +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG PKCS7 Signed Data Verification Fail RIPEMD160 #13 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_RIPEMD160:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY -pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:PSA_ERROR_INVALID_SIGNATURE +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG PKCS7 Signed Data Verification Fail because of different certificate #12 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY From 00a2677b1eb0af2cb70c09678281560002c68665 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Mon, 15 Jun 2026 10:26:11 +0200 Subject: [PATCH 10/14] test_suite_pkcs7: adjust numbering of tests Some newly added tests had duplicate numbers with what was already there. This commit fixes the duplication problem. Signed-off-by: Valerio Setti --- tests/suites/test_suite_pkcs7.data | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 0cd899fc27..46d4078fc0 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -90,18 +90,18 @@ PKCS7 Signed Data Verification Fail SHA1 #10 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG -PKCS7 Signed Data Verification Pass SHA512 #11 -depends_on:PSA_WANT_ALG_SHA_512:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY -pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0 - -PKCS7 Signed Data Verification Fail MD5 #12 +PKCS7 Signed Data Verification Fail MD5 #10.1 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_MD5:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG -PKCS7 Signed Data Verification Fail RIPEMD160 #13 +PKCS7 Signed Data Verification Fail RIPEMD160 #10.2 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_RIPEMD160:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG +PKCS7 Signed Data Verification Pass SHA512 #11 +depends_on:PSA_WANT_ALG_SHA_512:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0 + PKCS7 Signed Data Verification Fail because of different certificate #12 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-2.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED From f065e47b18f14fbdb532eb09e2434c4d95c8094c Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Mon, 15 Jun 2026 10:34:22 +0200 Subject: [PATCH 11/14] changelog: update documentation for PKCS7 changes Signed-off-by: Valerio Setti --- ChangeLog.d/pkcs7-reject-weak-hashes.txt | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt index 61cc03affe..a62cca9b96 100644 --- a/ChangeLog.d/pkcs7-reject-weak-hashes.txt +++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt @@ -1,3 +1,7 @@ Security - * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1) on signature - verification. + * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, + SHA3-224) on signature verification. + +Features + * SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509 + certificate profile. From feb2c53009340a8c99083503c66b285a08302ea8 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Mon, 15 Jun 2026 10:49:56 +0200 Subject: [PATCH 12/14] pkcs7: update documentation adding a note about rejecting weak hash algs Signed-off-by: Valerio Setti --- include/mbedtls/pkcs7.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/include/mbedtls/pkcs7.h b/include/mbedtls/pkcs7.h index 957ca53d71..aa9764e19a 100644 --- a/include/mbedtls/pkcs7.h +++ b/include/mbedtls/pkcs7.h @@ -31,6 +31,10 @@ * assumed these fields are empty. * - The RFC allows for the signed Data type to contain contentInfo. This * implementation assumes the type is DATA and the content is empty. + * - The RFC doesn't put any constrain on the hash algorithm to be used, but + * this implementation rejects weak hash algorithms (i.e. RIPEMD160, MD5, + * SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms are + * the ones belonging to `mbedtls_x509_crt_profile_default`. */ #ifndef MBEDTLS_PKCS7_H @@ -190,6 +194,9 @@ int mbedtls_pkcs7_parse_der(mbedtls_pkcs7 *pkcs7, const unsigned char *buf, * \note This function internally calculates the hash on the supplied * plain data for signature verification. * + * \note For limitation on the supported hash algorithms, please refer + * to the note at the top of this document. + * * \return 0 if the signature verifies, or a negative error code on failure. */ int mbedtls_pkcs7_signed_data_verify(mbedtls_pkcs7 *pkcs7, @@ -219,6 +226,9 @@ int mbedtls_pkcs7_signed_data_verify(mbedtls_pkcs7 *pkcs7, * \note This function is different from mbedtls_pkcs7_signed_data_verify() * in that it is directly passed the hash of the data. * + * \note For limitation on the supported hash algorithms, please refer + * to the note at the top of this document. + * * \return 0 if the signature verifies, or a negative error code on failure. */ int mbedtls_pkcs7_signed_hash_verify(mbedtls_pkcs7 *pkcs7, From 869bd519fbac71d0e005b4c2935fc2ce14bc2799 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 16 Jun 2026 11:43:41 +0200 Subject: [PATCH 13/14] tests: pkcs7: adjust test dependencies Newly added tests for RIPEMD160 and MD5 still require SHA-256 for the certificate being used. SHA-1 is instead useless in this case. Signed-off-by: Valerio Setti --- tests/suites/test_suite_pkcs7.data | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 46d4078fc0..86dc4ed844 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -91,11 +91,11 @@ depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VER pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG PKCS7 Signed Data Verification Fail MD5 #10.1 -depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_MD5:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY +depends_on:PSA_WANT_ALG_MD5:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG PKCS7 Signed Data Verification Fail RIPEMD160 #10.2 -depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_RIPEMD160:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY +depends_on:PSA_WANT_ALG_RIPEMD160:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG PKCS7 Signed Data Verification Pass SHA512 #11 From f155d9fefd3d8cc59c7294ca1bcbed7715b0d9ae Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Thu, 11 Jun 2026 17:13:08 +0200 Subject: [PATCH 14/14] framework: update reference Signed-off-by: Valerio Setti --- framework | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/framework b/framework index e0f6275eff..d6dec17adf 160000 --- a/framework +++ b/framework @@ -1 +1 @@ -Subproject commit e0f6275eff2e45e295fdd6b6877de4cbdaddae83 +Subproject commit d6dec17adfb5bf283c6a7a5bb6c451ecdc0b8201