Squashed commit upgrading to mbedtls-2.22.0
Squash merging branch import/mbedtls-2.22.0
5cab03377186 ("mk/clang.mk: define libgcc$(sm)")
3607a5386a72 ("core: mbedtls: enable MBEDTLS_ECDH_LEGACY_CONTEXT")
896c8845bbda ("mbedtls: remove file md_wrap.c from build")
400b2af54fa0 ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage")
777827c7af3d ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
549e4600678e ("libmbedtls: preserve mempool usage on reinit")
02d636083fe2 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W")
d2ac2b3c92bf ("libmbedtls: fix no CRT issue")
f550879d5be2 ("libmbedtls: add interfaces in mbedtls for context memory operation")
219173d807ce ("libmedtls: mpi_miller_rabin: increase count limit")
7930b0b6b5e4 ("libmbedtls: add mbedtls_mpi_init_mempool()")
78af9fdc120f ("libmbedtls: make mbedtls_mpi_mont*() available")
8f7357271cc2 ("libmbedtls: refine mbedtls license header")
c5993878881f ("mbedtls: configure mbedtls to reach for config")
6f9c587783af ("mbedtls: remove default include/mbedtls/config.h")
3d3bd3b12752 ("Import mbedtls-2.22.0")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
diff --git a/lib/libmbedtls/mbedtls/ChangeLog b/lib/libmbedtls/mbedtls/ChangeLog
index 7a27fde..062a1ad 100644
--- a/lib/libmbedtls/mbedtls/ChangeLog
+++ b/lib/libmbedtls/mbedtls/ChangeLog
@@ -1,6 +1,61 @@
mbed TLS ChangeLog (Sorted per branch, date)
-= mbed TLS 2.16.5 branch released 2020-02-20
+= mbed TLS 2.22.0 branch released 2020-04-14
+
+New deprecations
+ * Deprecate MBEDTLS_SSL_HW_RECORD_ACCEL that enables function hooks in the
+ SSL module for hardware acceleration of individual records.
+ * Deprecate mbedtls_ssl_get_max_frag_len() in favour of
+ mbedtls_ssl_get_output_max_frag_len() and
+ mbedtls_ssl_get_input_max_frag_len() to be more precise about which max
+ fragment length is desired.
+
+Security
+ * Fix issue in DTLS handling of new associations with the same parameters
+ (RFC 6347 section 4.2.8): an attacker able to send forged UDP packets to
+ the server could cause it to drop established associations with
+ legitimate clients, resulting in a Denial of Service. This could only
+ happen when MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE was enabled in config.h
+ (which it is by default).
+ * Fix side channel in ECC code that allowed an adversary with access to
+ precise enough timing and memory access information (typically an
+ untrusted operating system attacking a secure enclave) to fully recover
+ an ECDSA private key. Found and reported by Alejandro Cabrera Aldaya,
+ Billy Brumley and Cesar Pereida Garcia. CVE-2020-10932
+ * Fix a potentially remotely exploitable buffer overread in a
+ DTLS client when parsing the Hello Verify Request message.
+
+Features
+ * The new build option MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH automatically
+ resizes the I/O buffers before and after handshakes, reducing the memory
+ consumption during application data transfer.
+
+Bugfix
+ * Fix compilation failure when both MBEDTLS_SSL_PROTO_DTLS and
+ MBEDTLS_SSL_HW_RECORD_ACCEL are enabled.
+ * Remove a spurious check in ssl_parse_client_psk_identity that triggered
+ a warning with some compilers. Fix contributed by irwir in #2856.
+ * Fix a function name in a debug message. Contributed by Ercan Ozturk in
+ #3013.
+
+Changes
+ * Mbed Crypto is no longer a Git submodule. The crypto part of the library
+ is back directly in the present repository.
+ * Split mbedtls_ssl_get_max_frag_len() into
+ mbedtls_ssl_get_output_max_frag_len() and
+ mbedtls_ssl_get_input_max_frag_len() to ensure that a sufficient input
+ buffer is allocated by the server (if MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
+ is defined), regardless of what MFL was configured for it.
+
+= mbed TLS 2.21.0 branch released 2020-02-20
+
+New deprecations
+ * Deprecate MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO that enables parsing
+ SSLv2 ClientHello messages.
+ * Deprecate MBEDTLS_SSL_PROTO_SSL3 that enables support for SSLv3.
+ * Deprecate for MBEDTLS_PKCS11_C, the wrapper around the pkcs11-helper
+ library which allows TLS authentication to use keys stored in a
+ PKCS#11 token such as a smartcard.
Security
* Fix potential memory overread when performing an ECDSA signature
@@ -15,22 +70,49 @@
Brumley. Reported and fix contributed by Jack Lloyd.
ARMmbed/mbed-crypto#352
+Features
+ * The new build option MBEDTLS_SHA512_NO_SHA384 allows building SHA-512
+ support without SHA-384.
+
+API changes
+ * Change the encoding of key types and curves in the PSA API. The new
+ values are aligned with the upcoming release of the PSA Crypto API
+ specification version 1.0.0. The main change which may break some
+ existing code is that elliptic curve key types no longer encode the
+ exact curve: a psa_ecc_curve_t or psa_key_type_t value only encodes
+ a curve family and the key size determines the exact curve (for example,
+ PSA_ECC_CURVE_SECP_R1 with 256 bits is P256R1). ARMmbed/mbed-crypto#330
+
Bugfix
* Fix an unchecked call to mbedtls_md() in the x509write module.
+ * Fix build failure with MBEDTLS_ZLIB_SUPPORT enabled. Reported by
+ Jack Lloyd in #2859. Fix submitted by jiblime in #2963.
+ * Fix some false-positive uninitialized variable warnings in X.509. Fix
+ contributed by apple-ihack-geek in #2663.
+ * Fix a possible error code mangling in psa_mac_verify_finish() when
+ a cryptographic accelerator fails. ARMmbed/mbed-crypto#345
* Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some
RSA keys that would later be rejected by functions expecting private
keys. Found by Catena cyber using oss-fuzz (issue 20467).
- * Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some
- RSA keys with invalid values by silently fixing those values.
+ * Fix a bug in mbedtls_pk_parse_key() that would cause it to
+ accept some RSA keys with invalid values by silently fixing those values.
-= mbed TLS 2.16.4 branch released 2020-01-15
+= mbed TLS 2.20.0 branch released 2020-01-15
+
+Default behavior changes
+ * The initial seeding of a CTR_DRBG instance makes a second call to the
+ entropy function to obtain entropy for a nonce if the entropy size is less
+ than 3/2 times the key size. In case you want to disable the extra call to
+ grab entropy, you can call mbedtls_ctr_drbg_set_nonce_len() to force the
+ nonce length to 0.
Security
- * Fix side channel vulnerability in ECDSA. Our bignum implementation is not
- constant time/constant trace, so side channel attacks can retrieve the
- blinded value, factor it (as it is smaller than RSA keys and not guaranteed
- to have only large prime factors), and then, by brute force, recover the
- key. Reported by Alejandro Cabrera Aldaya and Billy Brumley.
+ * Enforce that mbedtls_entropy_func() gathers a total of
+ MBEDTLS_ENTROPY_BLOCK_SIZE bytes or more from strong sources. In the
+ default configuration, on a platform with a single entropy source, the
+ entropy module formerly only grabbed 32 bytes, which is good enough for
+ security if the source is genuinely strong, but less than the expected 64
+ bytes (size of the entropy accumulator).
* Zeroize local variables in mbedtls_internal_aes_encrypt() and
mbedtls_internal_aes_decrypt() before exiting the function. The value of
these variables can be used to recover the last round key. To follow best
@@ -39,6 +121,11 @@
Issue reported by Tuba Yavuz, Farhaan Fowze, Ken (Yihang) Bai,
Grant Hernandez, and Kevin Butler (University of Florida) and
Dave Tian (Purdue University).
+ * Fix side channel vulnerability in ECDSA. Our bignum implementation is not
+ constant time/constant trace, so side channel attacks can retrieve the
+ blinded value, factor it (as it is smaller than RSA keys and not guaranteed
+ to have only large prime factors), and then, by brute force, recover the
+ key. Reported by Alejandro Cabrera Aldaya and Billy Brumley.
* Fix side channel vulnerability in ECDSA key generation. Obtaining precise
timings on the comparison in the key generation enabled the attacker to
learn leading bits of the ephemeral key used during ECDSA signatures and to
@@ -48,62 +135,159 @@
reported and fix proposed by Johan Uppman Bruce and Christoffer Lauri,
Sectra.
+Features
+ * Key derivation inputs in the PSA API can now either come from a key object
+ or from a buffer regardless of the step type.
+ * The CTR_DRBG module can grab a nonce from the entropy source during the
+ initial seeding. The default nonce length is chosen based on the key size
+ to achieve the security strength defined by NIST SP 800-90A. You can
+ change it with mbedtls_ctr_drbg_set_nonce_len().
+ * Add ENUMERATED tag support to the ASN.1 module. Contributed by
+ msopiha-linaro in ARMmbed/mbed-crypto#307.
+
+API changes
+ * In the PSA API, forbid zero-length keys. To pass a zero-length input to a
+ key derivation function, use a buffer instead (this is now always
+ possible).
+ * Rename psa_asymmetric_sign() to psa_sign_hash() and
+ psa_asymmetric_verify() to psa_verify_hash().
+
Bugfix
- * Remove redundant line for getting the bitlen of a bignum, since the variable
- holding the returned value is overwritten a line after.
- Found by irwir in #2377.
- * Support mbedtls_hmac_drbg_set_entropy_len() and
- mbedtls_ctr_drbg_set_entropy_len() before the DRBG is seeded. Before,
- the initial seeding always reset the entropy length to the compile-time
- default.
+ * Fix an incorrect size in a debugging message. Reported and fix
+ submitted by irwir. Fixes #2717.
+ * Fix an unused variable warning when compiling without DTLS.
+ Reported and fix submitted by irwir. Fixes #2800.
+ * Remove a useless assignment. Reported and fix submitted by irwir.
+ Fixes #2801.
+ * Fix a buffer overflow in the PSA HMAC code when using a long key with an
+ unsupported algorithm. Fixes ARMmbed/mbed-crypto#254.
+ * Fix mbedtls_asn1_get_int to support any number of leading zeros. Credit
+ to OSS-Fuzz for finding a bug in an intermediate version of the fix.
+ * Fix mbedtls_asn1_get_bitstring_null to correctly parse bitstrings of at
+ most 2 bytes.
+ * mbedtls_ctr_drbg_set_entropy_len() and
+ mbedtls_hmac_drbg_set_entropy_len() now work if you call them before
+ mbedtls_ctr_drbg_seed() or mbedtls_hmac_drbg_seed().
Changes
- * Add unit tests for AES-GCM when called through mbedtls_cipher_auth_xxx()
- from the cipher abstraction layer. Fixes #2198.
- * Clarify how the interface of the CTR_DRBG and HMAC modules relates to
- NIST SP 800-90A. In particular CTR_DRBG requires an explicit nonce
- to achieve a 256-bit strength if MBEDTLS_ENTROPY_FORCE_SHA256 is set.
+ * Remove the technical possibility to define custom mbedtls_md_info
+ structures, which was exposed only in an internal header.
+ * psa_close_key(0) and psa_destroy_key(0) now succeed (doing nothing, as
+ before).
+ * Variables containing error codes are now initialized to an error code
+ rather than success, so that coding mistakes or memory corruption tends to
+ cause functions to return this error code rather than a success. There are
+ no known instances where this changes the behavior of the library: this is
+ merely a robustness improvement. ARMmbed/mbed-crypto#323
+ * Remove a useless call to mbedtls_ecp_group_free(). Contributed by
+ Alexander Krizhanovsky in ARMmbed/mbed-crypto#210.
+ * Speed up PBKDF2 by caching the digest calculation. Contributed by Jack
+ Lloyd and Fortanix Inc in ARMmbed/mbed-crypto#277.
+ * Small performance improvement of mbedtls_mpi_div_mpi(). Contributed by
+ Alexander Krizhanovsky in ARMmbed/mbed-crypto#308.
-= mbed TLS 2.16.3 branch released 2019-09-06
+= mbed TLS 2.19.1 branch released 2019-09-16
+
+Features
+ * Declare include headers as PUBLIC to propagate to CMake project consumers
+ Contributed by Zachary J. Fields in PR #2949.
+ * Add nss_keylog to ssl_client2 and ssl_server2, enabling easier analysis of
+ TLS sessions with tools like Wireshark.
+
+API Changes
+ * Make client_random and server_random const in
+ mbedtls_ssl_export_keys_ext_t, so that the key exporter is discouraged
+ from modifying the client/server hello.
+
+Bugfix
+ * Fix some false-positive uninitialized variable warnings in crypto. Fix
+ contributed by apple-ihack-geek in #2663.
+
+= mbed TLS 2.19.0 branch released 2019-09-06
Security
* Fix a missing error detection in ECJPAKE. This could have caused a
predictable shared secret if a hardware accelerator failed and the other
side of the key exchange had a similar bug.
- * The deterministic ECDSA calculation reused the scheme's HMAC-DRBG to
- implement blinding. Because of this for the same key and message the same
- blinding value was generated. This reduced the effectiveness of the
- countermeasure and leaked information about the private key through side
- channels. Reported by Jack Lloyd.
* When writing a private EC key, use a constant size for the private
value, as specified in RFC 5915. Previously, the value was written
as an ASN.1 INTEGER, which caused the size of the key to leak
about 1 bit of information on average and could cause the value to be
1 byte too large for the output buffer.
+ * The deterministic ECDSA calculation reused the scheme's HMAC-DRBG to
+ implement blinding. Because of this for the same key and message the same
+ blinding value was generated. This reduced the effectiveness of the
+ countermeasure and leaked information about the private key through side
+ channels. Reported by Jack Lloyd.
+
+Features
+ * Add new API functions mbedtls_ssl_session_save() and
+ mbedtls_ssl_session_load() to allow serializing a session, for example to
+ store it in non-volatile storage, and later using it for TLS session
+ resumption.
+ * Add a new API function mbedtls_ssl_check_record() to allow checking that
+ an incoming record is valid, authentic and has not been seen before. This
+ feature can be used alongside Connection ID and SSL context serialisation.
+ The feature is enabled at compile-time by MBEDTLS_SSL_RECORD_CHECKING
+ option.
+ * New implementation of X25519 (ECDH using Curve25519) from Project Everest
+ (https://project-everest.github.io/). It can be enabled at compile time
+ with MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED. This implementation is formally
+ verified and significantly faster, but is only supported on x86 platforms
+ (32-bit and 64-bit) using GCC, Clang or Visual Studio. Contributed by
+ Christoph Wintersteiger from Microsoft Research.
+ * Add mbedtls_net_close(), enabling the building of forking servers where
+ the parent process closes the client socket and continue accepting, and
+ the child process closes the listening socket and handles the client
+ socket. Contributed by Robert Larsen in #2803.
API Changes
+ * Add DER-encoded test CRTs to library/certs.c, allowing
+ the example programs ssl_server2 and ssl_client2 to be run
+ if MBEDTLS_FS_IO and MBEDTLS_PEM_PARSE_C are unset. Fixes #2254.
+ * The HAVEGE state type now uses uint32_t elements instead of int.
+ * The functions mbedtls_ecp_curve_list() and mbedtls_ecp_grp_id_list() now
+ list all curves for which at least one of ECDH or ECDSA is supported, not
+ just curves for which both are supported. Call mbedtls_ecdsa_can_do() or
+ mbedtls_ecdh_can_do() on each result to check whether each algorithm is
+ supported.
* The new function mbedtls_ecdsa_sign_det_ext() is similar to
mbedtls_ecdsa_sign_det() but allows passing an external RNG for the
purpose of blinding.
+New deprecations
+ * Deprecate mbedtls_ecdsa_sign_det() in favor of a functions that can take an
+ RNG function as an input.
+ * Calling mbedtls_ecdsa_write_signature() with NULL as the f_rng argument
+ is now deprecated.
+
Bugfix
+ * Fix missing bounds checks in X.509 parsing functions that could
+ lead to successful parsing of ill-formed X.509 CRTs. Fixes #2437.
+ * Fix multiple X.509 functions previously returning ASN.1 low-level error
+ codes to always wrap these codes into X.509 high level error codes before
+ returning. Fixes #2431.
* Fix to allow building test suites with any warning that detects unused
functions. Fixes #1628.
* Fix typo in net_would_block(). Fixes #528 reported by github-monoculture.
* Remove redundant include file in timing.c. Fixes #2640 reported by irwir.
+ * Fix build failure when building with mingw on Windows by including
+ stdarg.h where needed. Fixes #2656.
* Fix Visual Studio Release x64 build configuration by inheriting
PlatformToolset from the project configuration. Fixes #1430 reported by
irwir.
* Enable Suite B with subset of ECP curves. Make sure the code compiles even
if some curves are not defined. Fixes #1591 reported by dbedev.
* Fix misuse of signed arithmetic in the HAVEGE module. #2598
+ * Avoid use of statically sized stack buffers for certificate writing.
+ This previously limited the maximum size of DER encoded certificates
+ in mbedtls_x509write_crt_der() to 2Kb. Reported by soccerGB in #2631.
+ * Fix partial zeroing in x509_get_other_name. Found and fixed by ekse, #2716.
* Update test certificates that were about to expire. Reported by
Bernhard M. Wiedemann in #2357.
* Fix the build on ARMv5TE in ARM mode to not use assembly instructions
that are only available in Thumb mode. Fix contributed by Aurelien Jarno
in #2169.
- * Fix undefined memset(NULL) call in test_suite_nist_kw.
- * Make NV seed test support MBEDTLS_ENTROPY_FORCE_SHA256.
* Fix propagation of restart contexts in restartable EC operations.
This could previously lead to segmentation faults in builds using an
address-sanitizer and enabling but not using MBEDTLS_ECP_RESTARTABLE.
@@ -112,35 +296,77 @@
* Improve code clarity in x509_crt module, removing false-positive
uninitialized variable warnings on some recent toolchains (GCC8, etc).
Discovered and fixed by Andy Gross (Linaro), #2392.
- * Zero length buffer check for undefined behavior in
- mbedtls_platform_zeroize(). Fixes ARMmbed/mbed-crypto#49.
* Fix bug in endianness conversion in bignum module. This lead to
functionally incorrect code on bigendian systems which don't have
__BYTE_ORDER__ defined. Reported by Brendan Shanks. Fixes #2622.
Changes
+ * Replace multiple uses of MD2 by SHA-256 in X.509 test suite. Fixes #821.
* Make it easier to define MBEDTLS_PARAM_FAILED as assert (which config.h
suggests). #2671
* Make `make clean` clean all programs always. Fixes #1862.
+ * Add a Dockerfile and helper scripts (all-in-docker.sh, basic-in-docker.sh,
+ docker-env.sh) to simplify running test suites on a Linux host. Contributed
+ by Peter Kolbus (Garmin).
+ * Add `reproducible` option to `ssl_client2` and `ssl_server2` to enable
+ test runs without variability. Contributed by Philippe Antoine (Catena
+ cyber) in #2681.
+ * Extended .gitignore to ignore Visual Studio artifacts. Fixed by ConfusedSushi.
+ * Adds fuzz targets, especially for continuous fuzzing with OSS-Fuzz.
+ Contributed by Philippe Antoine (Catena cyber).
+ * Remove the crypto part of the library from Mbed TLS. The crypto
+ code and tests are now only available via Mbed Crypto, which
+ Mbed TLS references as a Git submodule.
-= mbed TLS 2.16.2 branch released 2019-06-11
-
-Security
- * Make mbedtls_ecdh_get_params return an error if the second key
- belongs to a different group from the first. Before, if an application
- passed keys that belonged to different group, the first key's data was
- interpreted according to the second group, which could lead to either
- an error or a meaningless output from mbedtls_ecdh_get_params. In the
- latter case, this could expose at most 5 bits of the private key.
+= mbed TLS 2.18.1 branch released 2019-07-12
Bugfix
- * Server's RSA certificate in certs.c was SHA-1 signed. In the default
- mbedTLS configuration only SHA-2 signed certificates are accepted.
- This certificate is used in the demo server programs, which lead the
- client programs to fail at the peer's certificate verification
- due to an unacceptable hash signature. The certificate has been
- updated to one that is SHA-256 signed. Fix contributed by
- Illya Gerasymchuk.
+ * Fix build failure when building with mingw on Windows by including
+ stdarg.h where needed. Fixes #2656.
+
+Changes
+ * Enable building of Mbed TLS as a CMake subproject. Suggested and fixed by
+ Ashley Duncan in #2609.
+
+= mbed TLS 2.18.0 branch released 2019-06-11
+
+Features
+ * Add the Any Policy certificate policy oid, as defined in
+ rfc 5280 section 4.2.1.4.
+ * It is now possible to use NIST key wrap mode via the mbedtls_cipher API.
+ Contributed by Jack Lloyd and Fortanix Inc.
+ * Add the Wi-SUN Field Area Network (FAN) device extended key usage.
+ * Add the oid certificate policy x509 extension.
+ * It is now possible to perform RSA PKCS v1.5 signatures with RIPEMD-160 digest.
+ Contributed by Jack Lloyd and Fortanix Inc.
+ * Extend the MBEDTLS_SSL_EXPORT_KEYS to export the handshake randbytes,
+ and the used tls-prf.
+ * Add public API for tls-prf function, according to requested enum.
+ * Add support for parsing otherName entries in the Subject Alternative Name
+ X.509 certificate extension, specifically type hardware module name,
+ as defined in RFC 4108 section 5.
+ * Add support for parsing certificate policies extension, as defined in
+ RFC 5280 section 4.2.1.4. Currently, only the "Any Policy" policy is
+ supported.
+ * List all SAN types in the subject_alt_names field of the certificate.
+ Resolves #459.
+ * Add support for draft-05 of the Connection ID extension, as specified
+ in https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05.
+ The Connection ID extension allows to keep DTLS connections beyond the
+ lifetime of the underlying transport by adding a connection identifier
+ to the DTLS record header. This identifier can be used to associated an
+ incoming record with the correct connection data even after the peer has
+ changed its IP or port. The feature is enabled at compile-time by setting
+ MBEDTLS_SSL_DTLS_CONNECTION_ID (disabled by default), and at run-time
+ through the new APIs mbedtls_ssl_conf_cid() and mbedtls_ssl_set_cid().
+
+
+API Changes
+ * Extend the MBEDTLS_SSL_EXPORT_KEYS to export the handshake randbytes,
+ and the used tls-prf.
+ * Add public API for tls-prf function, according to requested enum.
+
+Bugfix
* Fix private key DER output in the key_app_writer example. File contents
were shifted by one byte, creating an invalid ASN.1 tag. Fixed by
Christian Walther in #2239.
@@ -155,22 +381,26 @@
GCM and CCM were not affected. Fixed by Jack Lloyd.
* Fix incorrect default port number in ssl_mail_client example's usage.
Found and fixed by irwir. #2337
+ * Add psa_util.h to test/cpp_dummy_build to fix build_default_make_gcc_and_cxx.
+ Fixed by Peter Kolbus (Garmin). #2579
* Add missing parentheses around parameters in the definition of the
public macro MBEDTLS_X509_ID_FLAG. This could lead to invalid evaluation
in case operators binding less strongly than subtraction were used
for the parameter.
* Add a check for MBEDTLS_X509_CRL_PARSE_C in ssl_server2, guarding the crl
sni entry parameter. Reported by inestlerode in #560.
- * Add DER-encoded test CRTs to library/certs.c, allowing
- the example programs ssl_server2 and ssl_client2 to be run
- if MBEDTLS_FS_IO and MBEDTLS_PEM_PARSE_C are unset. Fixes #2254.
- * Fix missing bounds checks in X.509 parsing functions that could
- lead to successful parsing of ill-formed X.509 CRTs. Fixes #2437.
- * Fix multiple X.509 functions previously returning ASN.1 low-level error
- codes to always wrap these codes into X.509 high level error codes before
- returning. Fixes #2431.
+ * Set the next sequence of the subject_alt_name to NULL when deleting
+ sequence on failure. Found and fix suggested by Philippe Antoine.
+ Credit to OSS-Fuzz.
Changes
+ * Server's RSA certificate in certs.c was SHA-1 signed. In the default
+ mbedTLS configuration only SHA-2 signed certificates are accepted.
+ This certificate is used in the demo server programs, which lead the
+ client programs to fail at the peer's certificate verification
+ due to an unacceptable hash signature. The certificate has been
+ updated to one that is SHA-256 signed. Fix contributed by
+ Illya Gerasymchuk.
* Return from various debugging routines immediately if the
provided SSL context is unset.
* Remove dead code from bignum.c in the default configuration.
@@ -179,15 +409,39 @@
Contributed by Peter Kolbus (Garmin).
* Change wording in the `mbedtls_ssl_conf_max_frag_len()`'s documentation to
improve clarity. Fixes #2258.
- * Replace multiple uses of MD2 by SHA-256 in X.509 test suite. Fixes #821.
-= mbed TLS 2.16.1 branch released 2019-03-19
+= mbed TLS 2.17.0 branch released 2019-03-19
Features
+ * Add a new X.509 API call `mbedtls_x509_parse_der_nocopy()`
+ which allows copy-less parsing of DER encoded X.509 CRTs,
+ at the cost of additional lifetime constraints on the input
+ buffer, but at the benefit of reduced RAM consumption.
+ * Add a new function mbedtls_asn1_write_named_bitstring() to write ASN.1
+ named bitstring in DER as required by RFC 5280 Appendix B.
* Add MBEDTLS_REMOVE_3DES_CIPHERSUITES to allow removing 3DES ciphersuites
from the default list (enabled by default). See
https://sweet32.info/SWEET32_CCS16.pdf.
+API Changes
+ * Add a new X.509 API call `mbedtls_x509_parse_der_nocopy()`.
+ See the Features section for more information.
+ * Allow to opt in to the removal the API mbedtls_ssl_get_peer_cert()
+ for the benefit of saving RAM, by disabling the new compile-time
+ option MBEDTLS_SSL_KEEP_PEER_CERTIFICATE (enabled by default for
+ API stability). Disabling this option makes mbedtls_ssl_get_peer_cert()
+ always return NULL, and removes the peer_cert field from the
+ mbedtls_ssl_session structure which otherwise stores the peer's
+ certificate.
+
+Security
+ * Make mbedtls_ecdh_get_params return an error if the second key
+ belongs to a different group from the first. Before, if an application
+ passed keys that belonged to different group, the first key's data was
+ interpreted according to the second group, which could lead to either
+ an error or a meaningless output from mbedtls_ecdh_get_params. In the
+ latter case, this could expose at most 5 bits of the private key.
+
Bugfix
* Fix a compilation issue with mbedtls_ecp_restart_ctx not being defined
when MBEDTLS_ECP_ALT is defined. Reported by jwhui. Fixes #2242.
@@ -197,19 +451,14 @@
previously lead to a stack overflow on constrained targets.
* Add `MBEDTLS_SELF_TEST` for the mbedtls_self_test functions
in the header files, which missed the precompilation check. #971
- * Fix clobber list in MIPS assembly for large integer multiplication.
- Previously, this could lead to functionally incorrect assembly being
- produced by some optimizing compilers, showing up as failures in
- e.g. RSA or ECC signature operations. Reported in #1722, fix suggested
- by Aurelien Jarno and submitted by Jeffrey Martin.
+ * Fix returning the value 1 when mbedtls_ecdsa_genkey failed.
+ * Remove a duplicate #include in a sample program. Fixed by Masashi Honma #2326.
+ * Remove the mbedtls namespacing from the header file, to fix a "file not found"
+ build error. Fixed by Haijun Gu #2319.
* Fix signed-to-unsigned integer conversion warning
in X.509 module. Fixes #2212.
* Reduce stack usage of `mpi_write_hlp()` by eliminating recursion.
Fixes #2190.
- * Remove a duplicate #include in a sample program. Fixed by Masashi Honma #2326.
- * Remove the mbedtls namespacing from the header file, to fix a "file not found"
- build error. Fixed by Haijun Gu #2319.
- * Fix returning the value 1 when mbedtls_ecdsa_genkey failed.
* Fix false failure in all.sh when backup files exist in include/mbedtls
(e.g. config.h.bak). Fixed by Peter Kolbus (Garmin) #2407.
* Ensure that unused bits are zero when writing ASN.1 bitstrings when using
@@ -220,15 +469,26 @@
leading content octet. Fixes #1610.
Changes
+ * Reduce RAM consumption during session renegotiation by not storing
+ the peer CRT chain and session ticket twice.
* Include configuration file in all header files that use configuration,
instead of relying on other header files that they include.
Inserted as an enhancement for #1371
* Add support for alternative CSR headers, as used by Microsoft and defined
in RFC 7468. Found by Michael Ernst. Fixes #767.
- * Fix configuration queries in ssl-opt.h. #2030
- * Ensure that ssl-opt.h can be run in OS X. #2029
+ * Correct many misspellings. Fixed by MisterDA #2371.
+ * Provide an abstraction of vsnprintf to allow alternative implementations
+ for platforms that don't provide it. Based on contributions by Joris Aerts
+ and Nathaniel Wesley Filardo.
+ * Fix clobber list in MIPS assembly for large integer multiplication.
+ Previously, this could lead to functionally incorrect assembly being
+ produced by some optimizing compilers, showing up as failures in
+ e.g. RSA or ECC signature operations. Reported in #1722, fix suggested
+ by Aurelien Jarno and submitted by Jeffrey Martin.
* Reduce the complexity of the timing tests. They were assuming more than the
underlying OS actually guarantees.
+ * Fix configuration queries in ssl-opt.h. #2030
+ * Ensure that ssl-opt.h can be run in OS X. #2029
* Re-enable certain interoperability tests in ssl-opt.sh which had previously
been disabled for lack of a sufficiently recent version of GnuTLS on the CI.
* Ciphersuites based on 3DES now have the lowest priority by default when
@@ -291,6 +551,24 @@
* Clarify documentation of mbedtls_ssl_set_own_cert() regarding the absence
of check for certificate/key matching. Reported by Attila Molnar, #507.
+ = mbed TLS 2.15.1 branch released 2018-11-30
+
+ Changes
+ * Update the Mbed Crypto submodule to version 0.1.0b2.
+
+ = mbed TLS 2.15.0 branch released 2018-11-23
+
+ Features
+ * Add an experimental build option, USE_CRYPTO_SUBMODULE, to enable use of
+ Mbed Crypto as the source of the cryptography implementation.
+ * Add an experimental configuration option, MBEDTLS_PSA_CRYPTO_C, to enable
+ the PSA Crypto API from Mbed Crypto when additionally used with the
+ USE_CRYPTO_SUBMODULE build option.
+
+ Changes
+ * Add unit tests for AES-GCM when called through mbedtls_cipher_auth_xxx()
+ from the cipher abstraction layer. Fixes #2198.
+
= mbed TLS 2.14.1 branch released 2018-11-30
Security