From cac52a43c96d2e67811c31a0446c741e1fa99a75 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 13:56:52 +0200 Subject: [PATCH 1/7] library: replace mbedtls_ssl_get_ecp_group_id_from_tls_id All the usages of 'mbedtls_ssl_get_ecp_group_id_from_tls_id' basically reduce to checking if a specific TLS ID is supported or not. Therefore the function is replaced with 'mbedtls_ssl_is_tls_id_supported'. Signed-off-by: Valerio Setti --- library/ssl_client.c | 6 ++---- library/ssl_misc.h | 12 +++++------- library/ssl_tls.c | 6 +++--- library/ssl_tls12_server.c | 23 +++++++++++++++++------ 4 files changed, 27 insertions(+), 20 deletions(-) diff --git a/library/ssl_client.c b/library/ssl_client.c index 354fe9b72b..976e95fa6a 100644 --- a/library/ssl_client.c +++ b/library/ssl_client.c @@ -255,8 +255,7 @@ static int ssl_write_supported_groups_ext(mbedtls_ssl_context *ssl, if (flags & SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_3_FLAG) { #if defined(PSA_WANT_ALG_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list) && - mbedtls_ssl_get_psa_curve_info_from_tls_id( - *group_list, NULL, NULL) == PSA_SUCCESS) { + (mbedtls_ssl_is_tls_id_supported(*group_list))) { propose_group = 1; } #endif @@ -271,8 +270,7 @@ static int ssl_write_supported_groups_ext(mbedtls_ssl_context *ssl, #if defined(MBEDTLS_SSL_TLS1_2_SOME_ECC) if ((flags & SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_2_FLAG) && mbedtls_ssl_tls12_named_group_is_ecdhe(*group_list) && - (mbedtls_ssl_get_ecp_group_id_from_tls_id(*group_list) != - MBEDTLS_ECP_DP_NONE)) { + (mbedtls_ssl_is_tls_id_supported(*group_list))) { propose_group = 1; } #endif /* MBEDTLS_SSL_TLS1_2_SOME_ECC */ diff --git a/library/ssl_misc.h b/library/ssl_misc.h index f0ca823f33..9b4af9f4f3 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -1528,13 +1528,12 @@ int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id, size_t *bits); /** - * \brief Return \c mbedtls_ecp_group_id for the specified TLS ID. + * \brief Tell if a TLS group ID is supported or not. * - * \param tls_id The TLS ID to look for - * \return Proper \c mbedtls_ecp_group_id if the TLS ID is supported, - * or MBEDTLS_ECP_DP_NONE otherwise + * \param tls_id The TLS ID to look for. + * \return 1 if specified TLS ID is supported, 0 otherwise. */ -mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id); +int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id); /** * \brief Return TLS ID for the specified \c mbedtls_ecp_group_id. @@ -2249,8 +2248,7 @@ static inline int mbedtls_ssl_named_group_is_supported(uint16_t named_group) { #if defined(PSA_WANT_ALG_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group)) { - if (mbedtls_ssl_get_ecp_group_id_from_tls_id(named_group) != - MBEDTLS_ECP_DP_NONE) { + if (mbedtls_ssl_is_tls_id_supported(named_group)) { return 1; } } diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 0195576213..5a8bf2d8a6 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5865,15 +5865,15 @@ int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id, return PSA_ERROR_NOT_SUPPORTED; } -mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id) +int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id) { for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) { if (tls_id_match_table[i].tls_id == tls_id) { - return tls_id_match_table[i].ecp_group_id; + return 1; } } - return MBEDTLS_ECP_DP_NONE; + return 0; } uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id) diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 2a825e07b1..28688fb94e 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -219,8 +219,7 @@ static int ssl_parse_supported_groups_ext(mbedtls_ssl_context *ssl, while (list_size > 0 && our_size > 1) { uint16_t curr_tls_id = MBEDTLS_GET_UINT16_BE(p, 0); - if (mbedtls_ssl_get_ecp_group_id_from_tls_id(curr_tls_id) != - MBEDTLS_ECP_DP_NONE) { + if (mbedtls_ssl_is_tls_id_supported(curr_tls_id)) { *curves_tls_id++ = curr_tls_id; our_size--; } @@ -630,12 +629,24 @@ static int ssl_check_key_curve(mbedtls_pk_context *pk, uint16_t *curves_tls_id) { uint16_t *curr_tls_id = curves_tls_id; - mbedtls_ecp_group_id grp_id = mbedtls_pk_get_ec_group_id(pk); - mbedtls_ecp_group_id curr_grp_id; + psa_key_type_t key_type = mbedtls_pk_get_type(pk); + size_t key_bits = mbedtls_pk_get_bitlen(pk); + psa_key_type_t curr_key_type; + size_t curr_key_bits; + psa_status_t status; while (*curr_tls_id != 0) { - curr_grp_id = mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id); - if (curr_grp_id == grp_id) { + status = mbedtls_ssl_get_psa_curve_info_from_tls_id(*curr_tls_id, + &curr_key_type, &curr_key_bits); + if (status != PSA_SUCCESS) { + /* This TLS group ID is not supported. Move to the next one. */ + curr_tls_id++; + continue; + } + /* Check if EC family type and key bits for the current TLS group ID are the + * same as the ones in the provided PK context. */ + if ((PSA_KEY_TYPE_ECC_GET_FAMILY(key_type) == PSA_KEY_TYPE_ECC_GET_FAMILY(curr_key_type)) && + (key_bits == curr_key_bits)) { return 0; } curr_tls_id++; From 8a23cf2f149e1af1464a275494803e87d5fc1b48 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 14:06:31 +0200 Subject: [PATCH 2/7] library: replace mbedtls_ssl_get_tls_id_from_ecp_group_id Instead of retrieving the TLS ID using 'mbedtls_ecp_group_id', which creates a dependency on the (now tf-psa-crypto private) 'ecp.h' header, use PSA info to get the same result. Therefore rename the function as 'mbedtls_ssl_get_tls_id_from_curve_info'. This new function has basically the opposite behavior than 'mbedtls_ssl_get_psa_curve_info_from_tls_id'. Signed-off-by: Valerio Setti --- library/ssl_misc.h | 9 +++++---- library/ssl_tls.c | 8 ++++---- library/ssl_tls12_client.c | 3 +-- library/ssl_tls12_server.c | 3 +-- 4 files changed, 11 insertions(+), 12 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index 9b4af9f4f3..b91b789b7c 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -1536,13 +1536,14 @@ int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id, int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id); /** - * \brief Return TLS ID for the specified \c mbedtls_ecp_group_id. + * \brief Return TLS ID for the specified curve. * - * \param grp_id The \c mbedtls_ecp_group_id ID to look for - * \return Proper TLS ID if the \c mbedtls_ecp_group_id is supported, + * \param family The \c psa_ecc_family_t for the TLS ID to look for. + * \param bits The bit size for the TLS ID to look for. + * \return Proper TLS ID if the specified EC group is supported, * or 0 otherwise */ -uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id); +uint16_t mbedtls_ssl_get_tls_id_from_curve_info(psa_ecc_family_t family, size_t bits); #if defined(MBEDTLS_DEBUG_C) /** diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 5a8bf2d8a6..6650daf625 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5876,11 +5876,11 @@ int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id) return 0; } -uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id) +uint16_t mbedtls_ssl_get_tls_id_from_curve_info(psa_ecc_family_t family, size_t bits) { - for (int i = 0; tls_id_match_table[i].ecp_group_id != MBEDTLS_ECP_DP_NONE; - i++) { - if (tls_id_match_table[i].ecp_group_id == grp_id) { + for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) { + if ((tls_id_match_table[i].psa_family == family) && + (tls_id_match_table[i].bits == bits)) { return tls_id_match_table[i].tls_id; } } diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 8799287a09..c8149087d0 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1934,8 +1934,7 @@ start_processing: MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 3); uint16_t read_tls_id = MBEDTLS_GET_UINT16_BE(p, 1); - uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id( - MBEDTLS_ECP_DP_SECP256R1); + uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_curve_info(PSA_ECC_FAMILY_SECP_R1, 256); if (exp_tls_id == 0) { return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 28688fb94e..6de21b1429 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -2497,8 +2497,7 @@ static int ssl_prepare_server_key_exchange(mbedtls_ssl_context *ssl, * However since we only support secp256r1 for now, we hardcode its * TLS ID here */ - uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id( - MBEDTLS_ECP_DP_SECP256R1); + uint16_t tls_id = mbedtls_ssl_get_tls_id_from_curve_info(PSA_ECC_FAMILY_SECP_R1, 256); if (tls_id == 0) { return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; } From f9dbbec3251f6bf48841f3e1cebc0a0368f47ea8 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 14:18:02 +0200 Subject: [PATCH 3/7] library: ssl: remove mbedtls_ssl_check_curve Its main functionality was to get a TLS ID from 'mbedtls_ecp_group_id' and then call 'mbedtls_ssl_check_curve_tls_id'. The same can be achieved with public PK functions and 'mbedtls_ssl_get_tls_id_from_curve_info', then calling into 'mbedtls_ssl_check_curve_tls_id' as before. Signed-off-by: Valerio Setti --- library/ssl_misc.h | 4 ---- library/ssl_tls.c | 23 ++++++----------------- 2 files changed, 6 insertions(+), 21 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index b91b789b7c..1957d6a4c6 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -1502,10 +1502,6 @@ int mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context *ssl, int md); MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id); -#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) -MBEDTLS_CHECK_RETURN_CRITICAL -int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id); -#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ /** * \brief Return PSA EC info for the specified TLS ID. diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 6650daf625..700adfef45 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5793,22 +5793,6 @@ int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_ return -1; } -#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) -/* - * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id. - */ -int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id) -{ - uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id); - - if (tls_id == 0) { - return -1; - } - - return mbedtls_ssl_check_curve_tls_id(ssl, tls_id); -} -#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ - static const struct { uint16_t tls_id; mbedtls_ecp_group_id ecp_group_id; @@ -8828,7 +8812,12 @@ int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl, defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 && PSA_KEY_TYPE_IS_ECC(mbedtls_pk_get_type(&chain->pk))) { - if (mbedtls_ssl_check_curve(ssl, mbedtls_pk_get_ec_group_id(&chain->pk)) != 0) { + psa_key_type_t key_type = mbedtls_pk_get_type(&chain->pk); + psa_ecc_family_t ec_family = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type); + size_t bits = mbedtls_pk_get_bitlen(&chain->pk); + int tls_id = mbedtls_ssl_get_tls_id_from_curve_info(ec_family, bits); + + if (mbedtls_ssl_check_curve_tls_id(ssl, tls_id) != 0) { MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (EC key curve)")); ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY; if (ret == 0) { From d19ebc8c180d0622ca0d7cde6cf1d148fb2bcd85 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 14:20:24 +0200 Subject: [PATCH 4/7] library: ssl: remove mbedtls_ecp_group_id field from mbedtls_ecp_group_id This field is now completely useless. Signed-off-by: Valerio Setti --- library/ssl_tls.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 700adfef45..036007fc7d 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5795,39 +5795,38 @@ int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_ static const struct { uint16_t tls_id; - mbedtls_ecp_group_id ecp_group_id; psa_ecc_family_t psa_family; uint16_t bits; } tls_id_match_table[] = { #if defined(PSA_WANT_ECC_SECP_R1_521) - { 25, MBEDTLS_ECP_DP_SECP521R1, PSA_ECC_FAMILY_SECP_R1, 521 }, + { 25, PSA_ECC_FAMILY_SECP_R1, 521 }, #endif #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) - { 28, MBEDTLS_ECP_DP_BP512R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 512 }, + { 28, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 512 }, #endif #if defined(PSA_WANT_ECC_SECP_R1_384) - { 24, MBEDTLS_ECP_DP_SECP384R1, PSA_ECC_FAMILY_SECP_R1, 384 }, + { 24, PSA_ECC_FAMILY_SECP_R1, 384 }, #endif #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) - { 27, MBEDTLS_ECP_DP_BP384R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 384 }, + { 27, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 384 }, #endif #if defined(PSA_WANT_ECC_SECP_R1_256) - { 23, MBEDTLS_ECP_DP_SECP256R1, PSA_ECC_FAMILY_SECP_R1, 256 }, + { 23, PSA_ECC_FAMILY_SECP_R1, 256 }, #endif #if defined(PSA_WANT_ECC_SECP_K1_256) - { 22, MBEDTLS_ECP_DP_SECP256K1, PSA_ECC_FAMILY_SECP_K1, 256 }, + { 22, PSA_ECC_FAMILY_SECP_K1, 256 }, #endif #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) - { 26, MBEDTLS_ECP_DP_BP256R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 256 }, + { 26, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 256 }, #endif #if defined(PSA_WANT_ECC_MONTGOMERY_255) - { 29, MBEDTLS_ECP_DP_CURVE25519, PSA_ECC_FAMILY_MONTGOMERY, 255 }, + { 29, PSA_ECC_FAMILY_MONTGOMERY, 255 }, #endif #if defined(PSA_WANT_ECC_MONTGOMERY_448) - { 30, MBEDTLS_ECP_DP_CURVE448, PSA_ECC_FAMILY_MONTGOMERY, 448 }, + { 30, PSA_ECC_FAMILY_MONTGOMERY, 448 }, #endif - { 0, MBEDTLS_ECP_DP_NONE, 0, 0 }, + { 0, 0, 0 }, }; int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id, From b1c673471f1a816b22e938667977cd39acabd81b Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 14:21:08 +0200 Subject: [PATCH 5/7] tests: ssl_helpers: update TEST_AVAILABLE_ECC and TEST_UNAVAILABLE_ECC Align to recent changes in TLS group ID related functions: - 'mbedtls_ssl_get_ecp_group_id_from_tls_id' renamed to 'mbedtls_ssl_is_tls_id_supported'. - 'mbedtls_ssl_get_tls_id_from_ecp_group_id' renamed to 'mbedtls_ssl_get_tls_id_from_ecp_group_id'. Signed-off-by: Valerio Setti --- tests/include/test/ssl_helpers.h | 26 +++++++++----------- tests/suites/test_suite_ssl.function | 36 ++++++++++++++-------------- 2 files changed, 29 insertions(+), 33 deletions(-) diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h index 21965b0c9a..aa664b07da 100644 --- a/tests/include/test/ssl_helpers.h +++ b/tests/include/test/ssl_helpers.h @@ -727,23 +727,19 @@ int mbedtls_test_get_tls13_ticket( mbedtls_ssl_set_hs_ecjpake_password(&ssl, pwd_string, pwd_len); \ TEST_EQUAL(ret, exp_ret_val) -#define TEST_AVAILABLE_ECC(tls_id_, group_id_, psa_family_, psa_bits_) \ - TEST_EQUAL(mbedtls_ssl_get_ecp_group_id_from_tls_id(tls_id_), \ - group_id_); \ - TEST_EQUAL(mbedtls_ssl_get_tls_id_from_ecp_group_id(group_id_), \ - tls_id_); \ - TEST_EQUAL(mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id_, \ - &psa_type, &psa_bits), PSA_SUCCESS); \ - TEST_EQUAL(psa_family_, PSA_KEY_TYPE_ECC_GET_FAMILY(psa_type)); \ +#define TEST_AVAILABLE_ECC(tls_id_, psa_family_, psa_bits_) \ + TEST_EQUAL(mbedtls_ssl_is_tls_id_supported(tls_id_), 1); \ + TEST_EQUAL(mbedtls_ssl_get_tls_id_from_curve_info(psa_family_, psa_bits_), tls_id_); \ + TEST_EQUAL(mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id_, \ + &psa_type, &psa_bits), PSA_SUCCESS); \ + TEST_EQUAL(psa_family_, PSA_KEY_TYPE_ECC_GET_FAMILY(psa_type)); \ TEST_EQUAL(psa_bits_, psa_bits); -#define TEST_UNAVAILABLE_ECC(tls_id_, group_id_, psa_family_, psa_bits_) \ - TEST_EQUAL(mbedtls_ssl_get_ecp_group_id_from_tls_id(tls_id_), \ - MBEDTLS_ECP_DP_NONE); \ - TEST_EQUAL(mbedtls_ssl_get_tls_id_from_ecp_group_id(group_id_), \ - 0); \ - TEST_EQUAL(mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id_, \ - &psa_type, &psa_bits), \ +#define TEST_UNAVAILABLE_ECC(tls_id_, psa_family_, psa_bits_) \ + TEST_EQUAL(mbedtls_ssl_is_tls_id_supported(tls_id_), 0); \ + TEST_EQUAL(mbedtls_ssl_get_tls_id_from_curve_info(psa_family_, psa_bits_), 0); \ + TEST_EQUAL(mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id_, \ + &psa_type, &psa_bits), \ PSA_ERROR_NOT_SUPPORTED); /** diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index c1cf9bab86..8cf30463f7 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4570,49 +4570,49 @@ void elliptic_curve_get_properties() MD_OR_USE_PSA_INIT(); #if defined(PSA_WANT_ECC_SECP_R1_521) - TEST_AVAILABLE_ECC(25, MBEDTLS_ECP_DP_SECP521R1, PSA_ECC_FAMILY_SECP_R1, 521); + TEST_AVAILABLE_ECC(25, PSA_ECC_FAMILY_SECP_R1, 521); #else - TEST_UNAVAILABLE_ECC(25, MBEDTLS_ECP_DP_SECP521R1, PSA_ECC_FAMILY_SECP_R1, 521); + TEST_UNAVAILABLE_ECC(25, PSA_ECC_FAMILY_SECP_R1, 521); #endif #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) - TEST_AVAILABLE_ECC(28, MBEDTLS_ECP_DP_BP512R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 512); + TEST_AVAILABLE_ECC(28, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 512); #else - TEST_UNAVAILABLE_ECC(28, MBEDTLS_ECP_DP_BP512R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 512); + TEST_UNAVAILABLE_ECC(28, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 512); #endif #if defined(PSA_WANT_ECC_SECP_R1_384) - TEST_AVAILABLE_ECC(24, MBEDTLS_ECP_DP_SECP384R1, PSA_ECC_FAMILY_SECP_R1, 384); + TEST_AVAILABLE_ECC(24, PSA_ECC_FAMILY_SECP_R1, 384); #else - TEST_UNAVAILABLE_ECC(24, MBEDTLS_ECP_DP_SECP384R1, PSA_ECC_FAMILY_SECP_R1, 384); + TEST_UNAVAILABLE_ECC(24, PSA_ECC_FAMILY_SECP_R1, 384); #endif #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) - TEST_AVAILABLE_ECC(27, MBEDTLS_ECP_DP_BP384R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 384); + TEST_AVAILABLE_ECC(27, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 384); #else - TEST_UNAVAILABLE_ECC(27, MBEDTLS_ECP_DP_BP384R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 384); + TEST_UNAVAILABLE_ECC(27, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 384); #endif #if defined(PSA_WANT_ECC_SECP_R1_256) - TEST_AVAILABLE_ECC(23, MBEDTLS_ECP_DP_SECP256R1, PSA_ECC_FAMILY_SECP_R1, 256); + TEST_AVAILABLE_ECC(23, PSA_ECC_FAMILY_SECP_R1, 256); #else - TEST_UNAVAILABLE_ECC(23, MBEDTLS_ECP_DP_SECP256R1, PSA_ECC_FAMILY_SECP_R1, 256); + TEST_UNAVAILABLE_ECC(23, PSA_ECC_FAMILY_SECP_R1, 256); #endif #if defined(PSA_WANT_ECC_SECP_K1_256) - TEST_AVAILABLE_ECC(22, MBEDTLS_ECP_DP_SECP256K1, PSA_ECC_FAMILY_SECP_K1, 256); + TEST_AVAILABLE_ECC(22, PSA_ECC_FAMILY_SECP_K1, 256); #else - TEST_UNAVAILABLE_ECC(22, MBEDTLS_ECP_DP_SECP256K1, PSA_ECC_FAMILY_SECP_K1, 256); + TEST_UNAVAILABLE_ECC(22, PSA_ECC_FAMILY_SECP_K1, 256); #endif #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) - TEST_AVAILABLE_ECC(26, MBEDTLS_ECP_DP_BP256R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 256); + TEST_AVAILABLE_ECC(26, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 256); #else - TEST_UNAVAILABLE_ECC(26, MBEDTLS_ECP_DP_BP256R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 256); + TEST_UNAVAILABLE_ECC(26, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 256); #endif #if defined(PSA_WANT_ECC_MONTGOMERY_255) - TEST_AVAILABLE_ECC(29, MBEDTLS_ECP_DP_CURVE25519, PSA_ECC_FAMILY_MONTGOMERY, 255); + TEST_AVAILABLE_ECC(29, PSA_ECC_FAMILY_MONTGOMERY, 255); #else - TEST_UNAVAILABLE_ECC(29, MBEDTLS_ECP_DP_CURVE25519, PSA_ECC_FAMILY_MONTGOMERY, 255); + TEST_UNAVAILABLE_ECC(29, PSA_ECC_FAMILY_MONTGOMERY, 255); #endif #if defined(PSA_WANT_ECC_MONTGOMERY_448) - TEST_AVAILABLE_ECC(30, MBEDTLS_ECP_DP_CURVE448, PSA_ECC_FAMILY_MONTGOMERY, 448); + TEST_AVAILABLE_ECC(30, PSA_ECC_FAMILY_MONTGOMERY, 448); #else - TEST_UNAVAILABLE_ECC(30, MBEDTLS_ECP_DP_CURVE448, PSA_ECC_FAMILY_MONTGOMERY, 448); + TEST_UNAVAILABLE_ECC(30, PSA_ECC_FAMILY_MONTGOMERY, 448); #endif goto exit; exit: From 41dd79e72c8221c890c83ea3e6a9d7de3da9998b Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 14:41:42 +0200 Subject: [PATCH 6/7] library: ssl: remove usage of MBEDTLS_ECP_DP_MAX MBEDTLS_ECP_DP_MAX is defined in 'ecp.h' which is a tf-psa-crypto private header. Instead of relying on that value define a new function named 'mbedtls_ssl_get_supported_tls_id_count' which returns the number of entries in 'tls_id_match_table'. Rationale: it does not have too much sense to allocate an array for TLS IDs which is larger than the list of supported TLS IDs in the current build. Signed-off-by: Valerio Setti --- library/ssl_misc.h | 9 +++++++++ library/ssl_tls.c | 5 +++++ library/ssl_tls12_server.c | 4 ++-- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index 1957d6a4c6..ecd3e6cc07 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -1541,6 +1541,15 @@ int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id); */ uint16_t mbedtls_ssl_get_tls_id_from_curve_info(psa_ecc_family_t family, size_t bits); +/** + * \brief Return the number of supported TLS group IDs + 1. + * + * \return Number of supported TLS group IDs in \c tls_id_match_table + 1. + * In other words the returned value concides with the array length + * of \c tls_id_match_table. + */ +size_t mbedtls_ssl_get_supported_tls_id_count(void); + #if defined(MBEDTLS_DEBUG_C) /** * \brief Return EC's name for the specified TLS ID. diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 036007fc7d..d47d4d6a3d 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5871,6 +5871,11 @@ uint16_t mbedtls_ssl_get_tls_id_from_curve_info(psa_ecc_family_t family, size_t return 0; } +size_t mbedtls_ssl_get_supported_tls_id_count(void) +{ + return ARRAY_LENGTH(tls_id_match_table); +} + #if defined(MBEDTLS_DEBUG_C) mbedtls_ssl_iana_tls_group_info_t mbedtls_ssl_iana_tls_group_info[] = MBEDTLS_SSL_IANA_TLS_GROUPS_INFO; diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 6de21b1429..cb0d0e5126 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -202,8 +202,8 @@ static int ssl_parse_supported_groups_ext(mbedtls_ssl_context *ssl, /* Don't allow our peer to make us allocate too much memory, * and leave room for a final 0 */ our_size = list_size / 2 + 1; - if (our_size > MBEDTLS_ECP_DP_MAX) { - our_size = MBEDTLS_ECP_DP_MAX; + if (our_size > mbedtls_ssl_get_supported_tls_id_count()) { + our_size = mbedtls_ssl_get_supported_tls_id_count(); } if ((curves_tls_id = mbedtls_calloc(our_size, From c824263361e05fd95e8fde1772c036b708f81313 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Thu, 30 Jul 2026 10:23:02 +0200 Subject: [PATCH 7/7] library: ssl_tls: replace wrong usage of mbedtls_pk_get_type with mbedtls_pk_get_key_type The intent on these lines was to get 'psa_key_type_t' for which 'mbedtls_pk_get_key_type' should clearly be used, not 'mbedtls_pk_get_type'. Signed-off-by: Valerio Setti --- library/ssl_tls.c | 4 ++-- library/ssl_tls12_server.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index d47d4d6a3d..b5267c32ee 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -8815,8 +8815,8 @@ int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl, #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 && - PSA_KEY_TYPE_IS_ECC(mbedtls_pk_get_type(&chain->pk))) { - psa_key_type_t key_type = mbedtls_pk_get_type(&chain->pk); + PSA_KEY_TYPE_IS_ECC(mbedtls_pk_get_key_type(&chain->pk))) { + psa_key_type_t key_type = mbedtls_pk_get_key_type(&chain->pk); psa_ecc_family_t ec_family = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type); size_t bits = mbedtls_pk_get_bitlen(&chain->pk); int tls_id = mbedtls_ssl_get_tls_id_from_curve_info(ec_family, bits); diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index cb0d0e5126..b02ae505ef 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -629,7 +629,7 @@ static int ssl_check_key_curve(mbedtls_pk_context *pk, uint16_t *curves_tls_id) { uint16_t *curr_tls_id = curves_tls_id; - psa_key_type_t key_type = mbedtls_pk_get_type(pk); + psa_key_type_t key_type = mbedtls_pk_get_key_type(pk); size_t key_bits = mbedtls_pk_get_bitlen(pk); psa_key_type_t curr_key_type; size_t curr_key_bits;