commit 15f1d7f812520c76a7b4ed59b6557a51377b351f
author Ben Taylor <ben.taylor@linaro.org> Thu Jul 10 09:41:09 2025 +0100
committer Ben Taylor <ben.taylor@linaro.org> Thu Sep 11 13:22:40 2025 +0100
tree 5c9541c5d2b243a8c6700538a959a6c0829e41e6
parent 414878aa7fcb72a6581cf9194f516397b0751399

Remove support for static ECDH cipher suites

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

tests/scripts/components-configuration-crypto.sh

diff --git a/tests/scripts/components-configuration-crypto.sh b/tests/scripts/components-configuration-crypto.sh
index be2b040..38a5d85 100644
--- a/tests/scripts/components-configuration-crypto.sh
+++ b/tests/scripts/components-configuration-crypto.sh
@@ -437,7 +437,6 @@
     scripts/config.py unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
     scripts/config.py unset PSA_WANT_ALG_ECDSA
     scripts/config.py set PSA_WANT_ALG_ECDH
-    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
     scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
     scripts/config.py unset MBEDTLS_ECJPAKE_C
     scripts/config.py unset PSA_WANT_ALG_JPAKE
@@ -574,7 +573,6 @@
 
     # Disable things that depend on it
     scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
-    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
 
     # Build
     # -----
@@ -615,8 +613,6 @@
     scripts/config.py unset MBEDTLS_ECDH_C
 
     # Disable things that depend on it
-    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
-    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
     scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
     scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
     scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
@@ -1147,7 +1143,6 @@
     scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT
     # Also disable key exchanges that depend on RSA
     scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
-    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
 
     if [ "$test_target" = "ECC" ]; then
         # When testing ECC only, we disable FFDH support, both from builtin and
@@ -1496,7 +1491,8 @@
     scripts/config.py crypto
 
     # Remove RSA support and its dependencies
-    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
+    scripts/config.py unset MBEDTLS_PKCS1_V15
+    scripts/config.py unset MBEDTLS_PKCS1_V21
     scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
     scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT
 

tests/scripts/depends.py

diff --git a/tests/scripts/depends.py b/tests/scripts/depends.py
index cd91b78..34ecf4c 100755
--- a/tests/scripts/depends.py
+++ b/tests/scripts/depends.py
@@ -280,7 +280,6 @@
 
     'PSA_WANT_ALG_ECDSA': ['PSA_WANT_ALG_DETERMINISTIC_ECDSA',
                            'MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED',
-                           'MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED',
                            'MBEDTLS_ECDSA_C'],
     'PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC': [
         'PSA_WANT_ALG_ECDSA',
@@ -294,7 +293,6 @@
         'MBEDTLS_ECP_RESTARTABLE',
         'MBEDTLS_PK_PARSE_EC_EXTENDED',
         'MBEDTLS_PK_PARSE_EC_COMPRESSED',
-        'MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED',
         'MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED',
         'MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED',
         'MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED',
@@ -313,7 +311,7 @@
         'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT',
         'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT',
         'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE',
-        'MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED'],
+        'MBEDTLS_RSA_C'],
 
     'PSA_WANT_ALG_SHA_224': ['MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED',
                              'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT',