coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity
32,840 Commits 183 Branches 286 Tags 220 MiB
Commit Graph

1740 Commits

Author SHA1 Message Date
Manuel Pégourié-Gonnard
7a29052238 Fix side-channel in prime checking/generation 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-22 00:35:55 +02:00
Manuel Pégourié-Gonnard
672705bd00 Add ChangeLog entry for ECC side channel fix 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-05-18 10:45:11 +02:00
Gilles Peskine
30f9444cd0 Merge remote-tracking branch 'mbedtls-3.6' into mbedtls-3.6-restricted 2026-05-06 22:40:58 +02:00
Lars-Ove Karlsson
05890c71c8 Added a changelog entry for IAR unalignment fix. 
Signed-off-by: Lars-Ove Karlsson <lars-ove.karlsson@iar.com>
 2026-04-27 08:38:52 +02:00
Viktor Sokolovskiy
3833db7c7c ssl: narrow TLS 1.2 RSA-PSS handling and add interop coverage 
Narrow TLS 1.2 RSA-PSS handling to the client ServerKeyExchange parse path and add OpenSSL and GnuTLS interoperability tests.

Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
 2026-04-17 19:09:29 +03:00
Manuel Pégourié-Gonnard
00d767aef5 Copy-editing 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-04-13 11:55:07 +02:00
Manuel Pégourié-Gonnard
7e45882dc2 ECDH: add tests for static ECDH with context reuse 
A bug there was fixed in a previous commit, but without complete tests
or a ChangeLog entry. This commit completes the fix.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-04-13 11:23:17 +02:00
Viktor Sokolovskiy
c4738fab06 ssl: accept TLS 1.2 rsa_pss_rsae signature schemes 
Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
(cherry picked from commit c064ba0edb86e44f3c1c8dcaf05b1139407eebd4)
 2026-04-04 20:31:48 +03:00
Manuel Pégourié-Gonnard
89aee1e63a Improve Changelog 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-04-02 09:35:42 +02:00
Gilles Peskine
778ea0af9b Mention the new advice about compiler options in the changelog 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-04-01 10:08:28 +02:00
Manuel Pégourié-Gonnard
070ba17a8a ECDH: Add ChangeLog for legacy buffer overflow 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-03-31 12:38:54 +02:00
Minos Galanakis
69454b4bfe Assemble ChangeLog 
./framework/scripts/assemble_changelog.py

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 21:50:06 +00:00
Gilles Peskine
77b1a22bc3
Merge pull request #1536 from ronald-cron-arm/3.6-context_load_and_session_load_documentation 
3.6 backport: Tighten context/session load and save APIs documentation
 2026-03-26 21:32:09 +01:00
Ronald Cron
86b6812003 Update change log. 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-26 18:25:06 +01:00
Minos Galanakis
860cde63e6 MOufa 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 16:43:03 +00:00
Minos Galanakis
e4c6f6819e Added attribution for ffdh-peerkey-check 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 16:42:23 +00:00
Minos Galanakis
441beaeeac Extended attributions & CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 14:51:36 +00:00
Ronald Cron
f45d735826 Improve change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-26 13:18:10 +01:00
Ronald Cron
e7076b1639 Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-26 13:18:10 +01:00
Minos Galanakis
0205ff782b Added attributions & CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 11:11:12 +00:00
Manuel Pégourié-Gonnard
3746d7bbe0
Merge pull request #1531 from minosgalanakis/bugfix/ccm_finish_boundary_check_3.6_accr 
Added attribution to fix-ccm-finish changelog entry (mbedtls3.6)
 2026-03-26 09:36:56 +01:00
Minos Galanakis
17c19f9782 Added attribution to fix-ccm-finish changelog entry 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-25 16:14:18 +00:00
Manuel Pégourié-Gonnard
38fe3d463e Remove attribution that wasn't agreed on 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-03-25 13:36:01 +01:00
Ronald Cron
707c8c34ec Merge remote-tracking branch 'mbedtls-restricted/mbedtls-3.6-release-sync' into 'mbedtls-restricted/mbedtls-3.6-restricted' 2026-03-23 12:08:25 +01:00
Bence Szépkúti
8530b5e708
Merge pull request #1504 from gilles-peskine-arm/psa-rng-fork-3.6 
Backport 3.6: PSA RNG fork protection
 2026-03-19 17:26:52 +01:00
Gilles Peskine
f6118b40e1
Merge pull request #1492 from minosgalanakis/bugfix/ccm_finish_boundary_check_3.6 
Bugfix/ccm finish boundary check 3.6
 2026-03-17 21:57:28 +01:00
Ronald Cron
c1cd21d854
Merge pull request #1510 from yanesca/1445_fix_signature_algorithm_injection-backport 
Fix signature algorithm injection [3.6 Backport]
 2026-03-17 17:09:51 +01:00
Bence Szépkúti
444d0ac2c1
Merge pull request #10443 from davidhorstmann-arm/verify-result-default-failure-3.6 
[Backport 3.6] Hardening: Make `mbedtls_ssl_get_verify_result()` default to failure
 2026-03-17 12:14:48 +00:00
Manuel Pégourié-Gonnard
b48ddb3f4e
Merge pull request #1485 from gilles-peskine-arm/dev-random-config-3.6 
Backport 3.6: Use /dev/random and make it configurable
 2026-03-17 10:54:46 +01:00
Gilles Peskine
0b93865aed Protect the PSA RNG from duplication on fork 
If a process forks with the PSA subsystem active, the PSA RNG state is
duplicated. This led to the parent process and the child process generating
the same sequence of random numbers.

Fix this by forcing a reseed if the value of `getpid()` changes. This is the
same technique used in OpenSSL ≥1.1.1d.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-16 17:50:06 +01:00
Bence Szépkúti
c5f0f738ed
Merge pull request #1497 from gilles-peskine-arm/psa-rng-reseed-3.6 
Backport 3.6: API to reseed the PSA RNG
 2026-03-16 13:53:53 +01:00
Janos Follath
238976c73a sig_algs: add ChangeLog 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2026-03-16 12:38:20 +00:00
Manuel Pégourié-Gonnard
0d48c34169
Merge pull request #1490 from ronald-cron-arm/tls12-2nd-client-hello-3.6 
Backport 3.6: Fix TLS 1.2 client hello after HRR
 2026-03-16 10:58:44 +01:00
Manuel Pégourié-Gonnard
2d0aa97f81
Merge pull request #1501 from mpg/restricted-ffdh-peerkey-checks 
[Backport 3.6] FFDH peer key checks
 2026-03-13 12:44:30 +01:00
Manuel Pégourié-Gonnard
01b04ab723
Merge pull request #1489 from davidhorstmann-arm/fix-psa-ffdh-buffer-overflow-3.6 
[Backport 3.6] Fix buffer overflow in FFDH public key export
 2026-03-13 09:56:43 +01:00
Manuel Pégourié-Gonnard
e24f1e5c2c
Merge pull request #10609 from mpg/pk-psa-large-stack-buffers 
[3.6] PK: avoid large stack buffers in "to/from PSA" functions
 2026-03-13 08:53:48 +00:00
Gilles Peskine
7cf7a85008 Add missing parenthetical remark 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 10:31:58 +01:00
Ronald Cron
0be90b44e2 Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-10 19:26:14 +01:00
Ronald Cron
828e3817ac
Merge pull request #10623 from ronald-cron-arm/dtls-client-hello-defragmentation-3.6 
Backport 3.6: Add support for (D)TLS 1.2 client hello defragmentation
 2026-03-10 14:46:41 +00:00
David Horstmann
97c4e3f69b Add missing full stop in ChangeLog entry 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:09:56 +00:00
David Horstmann
23e688b3ab Add credit to the ChangeLog entry 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
1ecd0c1ea6 Simplify ChangeLog entry 
Improve readability of the ChangeLog by including only the strictly
necessary information.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
a749c3a5f8 Add ChangeLog entry for FFDH buffer overflow fix 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
Gilles Peskine
fc38b65561 Add advice to reseed the RNG if the application is cloned 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-09 18:06:38 +01:00
Manuel Pégourié-Gonnard
4704b6b4bd
Merge pull request #1488 from davidhorstmann-arm/fix-null-pointer-dereference-3.6 
[Backport 3.6] Fix null pointer dereference in `mbedtls_x509_string_to_names()`
 2026-03-09 12:42:56 +01:00
Gilles Peskine
8f8b70aff1 Merge remote-tracking branch 'mbedtls-3.6' into merge-3.6-restricted-20260309 2026-03-08 20:26:08 +01:00
Minos Galanakis
e54d769fe8 Updated Changelog 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-05 14:20:15 +00:00
Manuel Pégourié-Gonnard
35aec41600 Add Changelog entry for FFDH missing peerkey check 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-03-05 13:07:23 +01:00
Gilles Peskine
7147da8783 Update attribution to conform to contributor's request 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-05 12:11:08 +01:00
Gilles Peskine
a863415205 New API psa_random_set_prediction_resistance() 
Let applications configure prediction resistance at runtime.

Prediction resistance is always considered disabled when there is no actual
entropy source, only a nonvolatile seed.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00