coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge 34a8ce1e85e1901b35ee15976ca677ec94145705 into 03e1438089654fb884ac48e0f3cd0049cfe2c102

Browse Source
This commit is contained in:
Paulo Santos 2026-10-27 18:42:00 +00:00 committed by GitHub
commit ffcce24f4c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog.d/fix-pms-ecdh-psa-client-size.txt Normal file
View File

@ -0,0 +1,7 @@
Bugfix
* Fix TLS 1.2 ECDHE handshakes failing in PSA-client-only
(MBEDTLS_PSA_CRYPTO_C disabled) builds when PSK
and ECJPAKE key-exchanges were disabled.
In this scenario ECDHE key agreement failed returning
PSA_ERROR_BUFFER_TOO_SMALL.
Fixes #10757.

4
include/mbedtls/ssl.h
View File

@ -653,13 +653,13 @@ union mbedtls_ssl_premaster_secret {
unsigned char dummy; /* Make the union non-empty even with SSL disabled */
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
unsigned char _pms_ecdh[MBEDTLS_ECP_MAX_BYTES]; /* RFC 4492 5.10 */
unsigned char _pms_ecdh[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE]; /* RFC 4492 5.10 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
unsigned char _pms_psk[4 + 2 * MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 2 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
unsigned char _pms_ecdhe_psk[4 + MBEDTLS_ECP_MAX_BYTES
unsigned char _pms_ecdhe_psk[4 + PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE
+ MBEDTLS_PSK_MAX_LEN]; /* RFC 5489 2 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)