Remove rsa_pss_rsae_sha256 support.
Sign rsa is not thread safe. Remove it from current code.
And a thread-safe version should be re-introduce in future.
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index cea3811..d048698 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -1130,50 +1130,10 @@
break;
#endif /* MBEDTLS_ECDSA_C */
-#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
- case MBEDTLS_SSL_SIG_RSA:
- if( own_key_size <= 2048 &&
- mbedtls_ssl_sig_alg_is_received( ssl,
- MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256 ) )
- {
- md_alg = MBEDTLS_MD_SHA256;
- algorithm = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256;
- }
- else if( own_key_size <= 3072 &&
- mbedtls_ssl_sig_alg_is_received( ssl,
- MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384 ) )
- {
- md_alg = MBEDTLS_MD_SHA384;
- algorithm = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384;
- }
- else if( own_key_size <= 4096 &&
- mbedtls_ssl_sig_alg_is_received( ssl,
- MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512 ) )
- {
- md_alg = MBEDTLS_MD_SHA512;
- algorithm = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512;
- }
- else
- {
- MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown key size: %"
- MBEDTLS_PRINTF_SIZET " bits",
- own_key_size ) );
- break;
- }
-
- if( mbedtls_rsa_set_padding( mbedtls_pk_rsa( *own_key ),
- MBEDTLS_RSA_PKCS_V21,
- md_alg ) != 0 )
- {
- MBEDTLS_SSL_DEBUG_MSG( 1, ( "Set RSA padding Fail" ) );
- return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
- }
- break;
-#endif /* MBEDTLS_RSA_C && MBEDTLS_PKCS1_V21 */
default:
MBEDTLS_SSL_DEBUG_MSG( 1,
( "unkown pk type : %d", signature_type ) );
- return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+ break;
}
if( algorithm == MBEDTLS_TLS1_3_SIG_NONE ||
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 42f97cd..81bdbe4 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -9954,12 +9954,13 @@
run_test "TLS 1.3: Client authentication, rsa_pss_rsae_sha256 - openssl" \
"$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \
"$P_CLI debug_level=4 force_version=tls13 crt_file=data_files/cert_sha256.crt \
- key_file=data_files/server1.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256,rsa_pkcs1_sha256" \
- 0 \
+ key_file=data_files/server1.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256" \
+ 1 \
-c "got a certificate request" \
-c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \
-c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \
- -c "Protocol is TLSv1.3"
+ -c "unkown pk type" \
+ -c "signature algorithm not in received or offered list."
requires_gnutls_tls1_3
requires_gnutls_next_no_ticket
@@ -9971,12 +9972,13 @@
run_test "TLS 1.3: Client authentication, rsa_pss_rsae_sha256 - gnutls" \
"$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \
"$P_CLI debug_level=3 force_version=tls13 crt_file=data_files/server2-sha256.crt \
- key_file=data_files/server2.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256,rsa_pkcs1_sha256" \
- 0 \
+ key_file=data_files/server2.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256" \
+ 1 \
-c "got a certificate request" \
-c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \
-c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \
- -c "Protocol is TLSv1.3"
+ -c "unkown pk type" \
+ -c "signature algorithm not in received or offered list."
requires_openssl_tls1_3
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -9987,13 +9989,14 @@
run_test "TLS 1.3: Client authentication, client alg not in server list - openssl" \
"$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10
-sigalgs ecdsa_secp256r1_sha256" \
- "$P_CLI debug_level=4 force_version=tls13 crt_file=data_files/cert_sha256.crt \
- key_file=data_files/server1.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256" \
+ "$P_CLI debug_level=3 force_version=tls13 crt_file=data_files/ecdsa_secp521r1.crt \
+ key_file=data_files/ecdsa_secp521r1.key sig_algs=ecdsa_secp256r1_sha256,ecdsa_secp521r1_sha512" \
1 \
-c "got a certificate request" \
-c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \
-c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \
- -c "signature algorithm not in received or offered list."
+ -c "signature algorithm not in received or offered list." \
+ -C "unkown pk type"
requires_gnutls_tls1_3
requires_gnutls_next_no_ticket
@@ -10004,13 +10007,14 @@
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
run_test "TLS 1.3: Client authentication, client alg not in server list - gnutls" \
"$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:-SIGN-ALL:+SIGN-ECDSA-SECP256R1-SHA256:%NO_TICKETS" \
- "$P_CLI debug_level=3 force_version=tls13 crt_file=data_files/server2-sha256.crt \
- key_file=data_files/server2.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256" \
+ "$P_CLI debug_level=3 force_version=tls13 crt_file=data_files/ecdsa_secp521r1.crt \
+ key_file=data_files/ecdsa_secp521r1.key sig_algs=ecdsa_secp256r1_sha256,ecdsa_secp521r1_sha512" \
1 \
-c "got a certificate request" \
-c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \
-c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \
- -c "signature algorithm not in received or offered list."
+ -c "signature algorithm not in received or offered list." \
+ -C "unkown pk type"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE