coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

pkcs7: improve documentation and changelog for MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES

Browse Source 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
This commit is contained in:
Valerio Setti 2026-06-18 17:48:24 +02:00
parent 4008c7f811
commit dfa6a1441e
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog.d/pkcs7-reject-weak-hashes.txt
View File

@ -1,6 +1,6 @@
Security
* PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
SHA3-224) on signature verification. Build symbol
SHA3-224) on signature verification. The new configuration option
MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash
algorithms in PKCS7 for backward compatibility purposes.

6
include/mbedtls/pkcs7.h
View File

@ -34,9 +34,9 @@
* - The RFC doesn't put any constrain on the hash algorithm to be used, but
* this implementation by default rejects weak hash algorithms (i.e. RIPEMD160,
* MD5, SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms
* are the ones belonging to `mbedtls_x509_crt_profile_default`.
* MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to remove the limitation
* on weak hash algorithms.
* are the ones belonging to ::mbedtls_x509_crt_profile_default.
* #MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to accept all
* supported hash algorithms.
*/
#ifndef MBEDTLS_PKCS7_H