Merge pull request #710 from ARMmbed/mbedtls-2.23.0r0-pr
Prepare Release Candidate for Mbed TLS 2.23.0
diff --git a/ChangeLog b/ChangeLog
index 062a1ad..32853ce 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,128 @@
mbed TLS ChangeLog (Sorted per branch, date)
+= mbed TLS 2.23.0 branch released 2020-07-01
+
+Default behavior changes
+ * In the experimental PSA secure element interface, change the encoding of
+ key lifetimes to encode a persistence level and the location. Although C
+ prototypes do not effectively change, code calling
+ psa_register_se_driver() must be modified to pass the driver's location
+ instead of the keys' lifetime. If the library is upgraded on an existing
+ device, keys created with the old lifetime value will not be readable or
+ removable through Mbed TLS after the upgrade.
+
+Features
+ * New functions in the error module return constant strings for
+ high- and low-level error codes, complementing mbedtls_strerror()
+ which constructs a string for any error code, including compound
+ ones, but requires a writable buffer. Contributed by Gaurav Aggarwal
+ in #3176.
+ * The new utility programs/ssl/ssl_context_info prints a human-readable
+ dump of an SSL context saved with mbedtls_ssl_context_save().
+ * Add support for midipix, a POSIX layer for Microsoft Windows.
+ * Add new mbedtls_x509_crt_parse_der_with_ext_cb() routine which allows
+ parsing unsupported certificate extensions via user provided callback.
+ Contributed by Nicola Di Lieto <nicola.dilieto@gmail.com> in #3243 as
+ a solution to #3241.
+ * Pass the "certificate policies" extension to the callback supplied to
+ mbedtls_x509_crt_parse_der_with_ext_cb() if it contains unsupported
+ policies (#3419).
+ * Added support to entropy_poll for the kern.arandom syscall supported on
+ some BSD systems. Contributed by Nia Alarie in #3423.
+ * Add support for Windows 2000 in net_sockets. Contributed by opatomic. #3239
+
+Security
+ * Fix a side channel vulnerability in modular exponentiation that could
+ reveal an RSA private key used in a secure enclave. Noticed by Sangho Lee,
+ Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute
+ of Technology); and Marcus Peinado (Microsoft Research). Reported by Raoul
+ Strackx (Fortanix) in #3394.
+ * Fix side channel in mbedtls_ecp_check_pub_priv() and
+ mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a
+ private key that didn't include the uncompressed public key), as well as
+ mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL
+ f_rng argument. An attacker with access to precise enough timing and
+ memory access information (typically an untrusted operating system
+ attacking a secure enclave) could fully recover the ECC private key.
+ Found and reported by Alejandro Cabrera Aldaya and Billy Brumley.
+ * Fix issue in Lucky 13 counter-measure that could make it ineffective when
+ hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT
+ macros). This would cause the original Lucky 13 attack to be possible in
+ those configurations, allowing an active network attacker to recover
+ plaintext after repeated timing measurements under some conditions.
+ Reported and fix suggested by Luc Perneel in #3246.
+
+Bugfix
+ * Fix the Visual Studio Release x64 build configuration for mbedtls itself.
+ Completes a previous fix in Mbed TLS 2.19 that only fixed the build for
+ the example programs. Reported in #1430 and fix contributed by irwir.
+ * Fix undefined behavior in X.509 certificate parsing if the
+ pathLenConstraint basic constraint value is equal to INT_MAX.
+ The actual effect with almost every compiler is the intended
+ behavior, so this is unlikely to be exploitable anywhere. #3192
+ * Fix issue with a detected HW accelerated record error not being exposed
+ due to shadowed variable. Contributed by Sander Visser in #3310.
+ * Avoid NULL pointer dereferencing if mbedtls_ssl_free() is called with a
+ NULL pointer argument. Contributed by Sander Visser in #3312.
+ * Fix potential linker errors on dual world platforms by inlining
+ mbedtls_gcc_group_to_psa(). This allows the pk.c module to link separately
+ from psa_crypto.c. Fixes #3300.
+ * Remove dead code in X.509 certificate parsing. Contributed by irwir in
+ #2855.
+ * Include asn1.h in error.c. Fixes #3328 reported by David Hu.
+ * Fix potential memory leaks in ecp_randomize_jac() and ecp_randomize_mxz()
+ when PRNG function fails. Contributed by Jonas Lejeune in #3318.
+ * Remove unused macros from MSVC projects. Reported in #3297 and fix
+ submitted in #3333 by irwir.
+ * Add additional bounds checks in ssl_write_client_hello() preventing
+ output buffer overflow if the configuration declared a buffer that was
+ too small.
+ * Set _POSIX_C_SOURCE to at least 200112L in C99 code. Reported in #3420 and
+ fix submitted in #3421 by Nia Alarie.
+ * Fix building library/net_sockets.c and the ssl_mail_client program on
+ NetBSD. Contributed by Nia Alarie in #3422.
+ * Fix false positive uninitialised variable reported by cpp-check.
+ Contributed by Sander Visser in #3311.
+ * Update iv and len context pointers manually when reallocating buffers
+ using the MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH feature. This caused issues
+ when receiving a connection with CID, when these fields were shifted
+ in ssl_parse_record_header().
+
+Changes
+ * Fix warnings about signedness issues in format strings. The build is now
+ clean of -Wformat-signedness warnings. Contributed by Kenneth Soerensen
+ in #3153.
+ * Fix minor performance issue in operations on Curve25519 caused by using a
+ suboptimal modular reduction in one place. Found and fix contributed by
+ Aurelien Jarno in #3209.
+ * Combine identical cases in switch statements in md.c. Contributed
+ by irwir in #3208.
+ * Simplify a bounds check in ssl_write_certificate_request(). Contributed
+ by irwir in #3150.
+ * Unify the example programs termination to call mbedtls_exit() instead of
+ using a return command. This has been done to enable customization of the
+ behavior in bare metal environments.
+ * Fix mbedtls_x509_dn_gets to escape non-ASCII characters as "?".
+ Contributed by Koh M. Nakagawa in #3326.
+ * Use FindPython3 when cmake version >= 3.15.0
+ * Abort the ClientHello writing function as soon as some extension doesn't
+ fit into the record buffer. Previously, such extensions were silently
+ dropped. As a consequence, the TLS handshake now fails when the output
+ buffer is not large enough to hold the ClientHello.
+ * The unit tests now rely on header files in tests/include/test and source
+ files in tests/src. When building with make or cmake, the files in
+ tests/src are compiled and the resulting object linked into each test
+ executable.
+ * The ECP module, enabled by `MBEDTLS_ECP_C`, now depends on
+ `MBEDTLS_CTR_DRBG_C` or `MBEDTLS_HMAC_DRBG_C` for some side-channel
+ coutermeasures. If side channels are not a concern, this dependency can
+ be avoided by enabling the new option `MBEDTLS_ECP_NO_INTERNAL_RNG`.
+ * Align MSVC error flag with GCC and Clang. Contributed by Carlos Gomes
+ Martinho. #3147
+ * Remove superfluous assignment in mbedtls_ssl_parse_certificate(). Reported
+ in #3182 and fix submitted by irwir. #3217
+ * Fix typo in XTS tests. Reported and fix submitted by Kxuan. #3319
+
= mbed TLS 2.22.0 branch released 2020-04-14
New deprecations
diff --git a/ChangeLog.d/bugfix.txt b/ChangeLog.d/bugfix.txt
deleted file mode 100644
index 922bd31..0000000
--- a/ChangeLog.d/bugfix.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Bugfix
- * Fix the Visual Studio Release x64 build configuration for mbedtls itself.
- Completes a previous fix in Mbed TLS 2.19 that only fixed the build for
- the example programs. Reported in #1430 and fix contributed by irwir.
diff --git a/ChangeLog.d/bugfix_PR2855.txt b/ChangeLog.d/bugfix_PR2855.txt
deleted file mode 100644
index 6e29710..0000000
--- a/ChangeLog.d/bugfix_PR2855.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-Bugfix
- * Remove dead code in X.509 certificate parsing. Contributed by irwir in #2855.
diff --git a/ChangeLog.d/bugfix_PR3333.txt b/ChangeLog.d/bugfix_PR3333.txt
deleted file mode 100644
index 90766ac..0000000
--- a/ChangeLog.d/bugfix_PR3333.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-Bugfix
- * Remove unused macros from MSVC projects. Reported in #3297 and fix submitted in #3333 by irwir.
diff --git a/ChangeLog.d/bugfix_PR3405 b/ChangeLog.d/bugfix_PR3405
deleted file mode 100644
index 73c57c0..0000000
--- a/ChangeLog.d/bugfix_PR3405
+++ /dev/null
@@ -1,5 +0,0 @@
-Bugfix
- * Update iv and len context pointers manually when reallocating buffers
- using the MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH feature. This caused issues
- when receiving a connection with CID, when these fields were shifted
- in ssl_parse_record_header().
diff --git a/ChangeLog.d/bugfix_PR3421.txt b/ChangeLog.d/bugfix_PR3421.txt
deleted file mode 100644
index b52dee0..0000000
--- a/ChangeLog.d/bugfix_PR3421.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-Bugfix
- * Set _POSIX_C_SOURCE to at least 200112L in C99 code. Reported in #3420 and fix submitted in #3421 by Nia Alarie.
diff --git a/ChangeLog.d/bugfix_PR3422.txt b/ChangeLog.d/bugfix_PR3422.txt
deleted file mode 100644
index dfe152c..0000000
--- a/ChangeLog.d/bugfix_PR3422.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-Bugfix
- * Fix building library/net_sockets.c and the ssl_mail_client program on NetBSD. Contributed by Nia Alarie in #3422.
diff --git a/ChangeLog.d/error-asn1.txt b/ChangeLog.d/error-asn1.txt
deleted file mode 100644
index c165696..0000000
--- a/ChangeLog.d/error-asn1.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-Bugfix
- * Include asn1.h in error.c. Fixes #3328 reported by David Hu.
diff --git a/ChangeLog.d/error_const.txt b/ChangeLog.d/error_const.txt
deleted file mode 100644
index e0086b7..0000000
--- a/ChangeLog.d/error_const.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-Features
- * New functions in the error module return constant strings for
- high- and low-level error codes, complementing mbedtls_strerror()
- which constructs a string for any error code, including compound
- ones, but requires a writable buffer. Contributed by Gaurav Aggarwal
- in #3176.
diff --git a/ChangeLog.d/fix-ecp-mul-memory-leak.txt b/ChangeLog.d/fix-ecp-mul-memory-leak.txt
deleted file mode 100644
index e82cadc..0000000
--- a/ChangeLog.d/fix-ecp-mul-memory-leak.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Bugfix
- * Fix potential memory leaks in ecp_randomize_jac() and ecp_randomize_mxz()
- when PRNG function fails. Contributed by Jonas Lejeune in #3318.
diff --git a/ChangeLog.d/fix-ecp_double_add_mxz.txt b/ChangeLog.d/fix-ecp_double_add_mxz.txt
deleted file mode 100644
index 91531b2..0000000
--- a/ChangeLog.d/fix-ecp_double_add_mxz.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Changes
- * Fix minor performance issue in operations on Curve25519 caused by using a
- suboptimal modular reduction in one place. Found and fix contributed by
- Aurelien Jarno in #3209.
diff --git a/ChangeLog.d/fix-gcc-format-signedness-warnings.txt b/ChangeLog.d/fix-gcc-format-signedness-warnings.txt
deleted file mode 100644
index 2d22b94..0000000
--- a/ChangeLog.d/fix-gcc-format-signedness-warnings.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Changes
- * Fix warnings about signedness issues in format strings. The build is now
- clean of -Wformat-signedness warnings. Contributed by Kenneth Soerensen
- in #3153.
diff --git a/ChangeLog.d/fix-masked-hw-record-init-error.txt b/ChangeLog.d/fix-masked-hw-record-init-error.txt
deleted file mode 100644
index 2ef80da..0000000
--- a/ChangeLog.d/fix-masked-hw-record-init-error.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Bugfix
- * Fix issue with a detected HW accelerated record error not being exposed
- due to shadowed variable. Contributed by Sander Visser in #3310.
diff --git a/ChangeLog.d/fix-null-ptr-deref-in-mbedtls_ssl_free.txt b/ChangeLog.d/fix-null-ptr-deref-in-mbedtls_ssl_free.txt
deleted file mode 100644
index e631f4d..0000000
--- a/ChangeLog.d/fix-null-ptr-deref-in-mbedtls_ssl_free.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Bugfix
- * Avoid NULL pointer dereferencing if mbedtls_ssl_free() is called with a
- NULL pointer argument. Contributed by Sander Visser in #3312.
diff --git a/ChangeLog.d/fix-print-non-ascii-string-in-mbedtls_x509_dn_gets.txt b/ChangeLog.d/fix-print-non-ascii-string-in-mbedtls_x509_dn_gets.txt
deleted file mode 100644
index 6be1e5b..0000000
--- a/ChangeLog.d/fix-print-non-ascii-string-in-mbedtls_x509_dn_gets.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Changes
- * Fix mbedtls_x509_dn_gets to escape non-ASCII characters as "?".
- Contributed by Koh M. Nakagawa in #3326.
diff --git a/ChangeLog.d/inline-mbedtls_gcc_group_to_psa.txt b/ChangeLog.d/inline-mbedtls_gcc_group_to_psa.txt
deleted file mode 100644
index d0bd1dc..0000000
--- a/ChangeLog.d/inline-mbedtls_gcc_group_to_psa.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Bugfix
- * Fix potential linker errors on dual world platforms by inlining
- mbedtls_gcc_group_to_psa(). This allows the pk.c module to link separately
- from psa_crypto.c. Fixes #3300.
diff --git a/ChangeLog.d/max_pathlen.txt b/ChangeLog.d/max_pathlen.txt
deleted file mode 100644
index 08f9c65..0000000
--- a/ChangeLog.d/max_pathlen.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Bugfix
- * Fix undefined behavior in X.509 certificate parsing if the
- pathLenConstraint basic constraint value is equal to INT_MAX.
- The actual effect with almost every compiler is the intended
- behavior, so this is unlikely to be exploitable anywhere. #3192
diff --git a/ChangeLog.d/md_switch.txt b/ChangeLog.d/md_switch.txt
deleted file mode 100644
index a4d369b..0000000
--- a/ChangeLog.d/md_switch.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Changes
- * Combine identical cases in switch statements in md.c. Contributed
- by irwir in #3208.
diff --git a/ChangeLog.d/midipix-support.txt b/ChangeLog.d/midipix-support.txt
deleted file mode 100644
index 53599ab..0000000
--- a/ChangeLog.d/midipix-support.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-Features
- * Add support for midipix, a POSIX layer for Microsoft Windows.
diff --git a/ChangeLog.d/montmul-cmp-branch.txt b/ChangeLog.d/montmul-cmp-branch.txt
deleted file mode 100644
index 5994518..0000000
--- a/ChangeLog.d/montmul-cmp-branch.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-Security
- * Fix a side channel vulnerability in modular exponentiation that could
- reveal an RSA private key used in a secure enclave. Noticed by Sangho Lee,
- Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute
- of Technology); and Marcus Peinado (Microsoft Research). Reported by Raoul
- Strackx (Fortanix) in #3394.
diff --git a/ChangeLog.d/new-mbedtls_x509_crt_parse_der_with_ext_cb_routine.txt b/ChangeLog.d/new-mbedtls_x509_crt_parse_der_with_ext_cb_routine.txt
deleted file mode 100644
index fdea746..0000000
--- a/ChangeLog.d/new-mbedtls_x509_crt_parse_der_with_ext_cb_routine.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Features
- * Add new mbedtls_x509_crt_parse_der_with_ext_cb() routine which allows
- parsing unsupported certificate extensions via user provided callback.
- Contributed by Nicola Di Lieto <nicola.dilieto@gmail.com> in #3243 as
- a solution to #3241.
diff --git a/ChangeLog.d/pass-unsupported-policies-to-callback.txt b/ChangeLog.d/pass-unsupported-policies-to-callback.txt
deleted file mode 100644
index d139b4c..0000000
--- a/ChangeLog.d/pass-unsupported-policies-to-callback.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Features
- * Pass the "certificate policies" extension to the callback supplied to
- mbedtls_x509_crt_parse_der_with_ext_cb() if it contains unsupported
- policies (#3419).
diff --git a/ChangeLog.d/psa-lifetime-locations.txt b/ChangeLog.d/psa-lifetime-locations.txt
deleted file mode 100644
index 6ac02bc..0000000
--- a/ChangeLog.d/psa-lifetime-locations.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-Default behavior changes
- * In the experimental PSA secure element interface, change the encoding of
- key lifetimes to encode a persistence level and the location. Although C
- prototypes do not effectively change, code calling
- psa_register_se_driver() must be modified to pass the driver's location
- instead of the keys' lifetime. If the library is upgraded on an existing
- device, keys created with the old lifetime value will not be readable or
- removable through Mbed TLS after the upgrade.
diff --git a/ChangeLog.d/ssl_context_info.txt b/ChangeLog.d/ssl_context_info.txt
deleted file mode 100644
index 6a15061..0000000
--- a/ChangeLog.d/ssl_context_info.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Features
- * The new utility programs/ssl/ssl_context_info prints a human-readable
- dump of an SSL context saved with mbedtls_ssl_context_save().
diff --git a/ChangeLog.d/ssl_write_certificate_request.txt b/ChangeLog.d/ssl_write_certificate_request.txt
deleted file mode 100644
index 2d3067a..0000000
--- a/ChangeLog.d/ssl_write_certificate_request.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Changes
- * Simplify a bounds check in ssl_write_certificate_request(). Contributed
- by irwir in #3150.
diff --git a/ChangeLog.d/sysctl-arnd-support.txt b/ChangeLog.d/sysctl-arnd-support.txt
deleted file mode 100644
index 14ad674..0000000
--- a/ChangeLog.d/sysctl-arnd-support.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-Features
- * Added support to entropy_poll for the kern.arandom syscall supported on some BSD systems. Contributed by Nia Alarie in #3423.
diff --git a/ChangeLog.d/tests-common-code.txt b/ChangeLog.d/tests-common-code.txt
deleted file mode 100644
index 0af2da5..0000000
--- a/ChangeLog.d/tests-common-code.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Changes
- * The unit tests now rely on header files in tests/include/test and source
- files in tests/src. When building with make or cmake, the files in
- tests/src are compiled and the resulting object linked into each test
- executable.
diff --git a/ChangeLog.d/unified-exit-in-examples.txt b/ChangeLog.d/unified-exit-in-examples.txt
deleted file mode 100644
index 3ef9798..0000000
--- a/ChangeLog.d/unified-exit-in-examples.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Changes
- * Unify the example programs termination to call mbedtls_exit() instead of
- using a return command. This has been done to enable customization of the
- behavior in bare metal environments.
diff --git a/ChangeLog.d/uniformize_bounds_checks.txt b/ChangeLog.d/uniformize_bounds_checks.txt
deleted file mode 100644
index 210ab10..0000000
--- a/ChangeLog.d/uniformize_bounds_checks.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-Bugfix
- * Add additional bounds checks in ssl_write_client_hello() preventing
- output buffer overflow if the configuration declared a buffer that was
- too small.
-Changes
- * Abort the ClientHello writing function as soon as some extension doesn't
- fit into the record buffer. Previously, such extensions were silently
- dropped. As a consequence, the TLS handshake now fails when the output
- buffer is not large enough to hold the ClientHello.
diff --git a/ChangeLog.d/use-find-python3-cmake.txt b/ChangeLog.d/use-find-python3-cmake.txt
deleted file mode 100644
index 36a5171..0000000
--- a/ChangeLog.d/use-find-python3-cmake.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-Changes
- * Use FindPython3 when cmake version >= 3.15.0
diff --git a/doxygen/input/doc_mainpage.h b/doxygen/input/doc_mainpage.h
index 749d5c1..27a840a 100644
--- a/doxygen/input/doc_mainpage.h
+++ b/doxygen/input/doc_mainpage.h
@@ -24,7 +24,7 @@
*/
/**
- * @mainpage mbed TLS v2.22.0 source code documentation
+ * @mainpage mbed TLS v2.23.0 source code documentation
*
* This documentation describes the internal structure of mbed TLS. It was
* automatically generated from specially formatted comment blocks in
diff --git a/doxygen/mbedtls.doxyfile b/doxygen/mbedtls.doxyfile
index 418318d..e89021a 100644
--- a/doxygen/mbedtls.doxyfile
+++ b/doxygen/mbedtls.doxyfile
@@ -28,7 +28,7 @@
# identify the project. Note that if you do not use Doxywizard you need
# to put quotes around the project name if it contains spaces.
-PROJECT_NAME = "mbed TLS v2.22.0"
+PROJECT_NAME = "mbed TLS v2.23.0"
# The PROJECT_NUMBER tag can be used to enter a project or revision number.
# This could be handy for archiving the generated documentation or
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index e2e45ac..f2148a8 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -156,6 +156,14 @@
#error "MBEDTLS_ECP_C defined, but not all prerequisites"
#endif
+#if defined(MBEDTLS_ECP_C) && !( \
+ defined(MBEDTLS_ECP_ALT) || \
+ defined(MBEDTLS_CTR_DRBG_C) || \
+ defined(MBEDTLS_HMAC_DRBG_C) || \
+ defined(MBEDTLS_ECP_NO_INTERNAL_RNG))
+#error "MBEDTLS_ECP_C requires a DRBG module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used"
+#endif
+
#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)
#error "MBEDTLS_PK_PARSE_C defined, but not all prerequesites"
#endif
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 60a3aee..e00c546 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -782,6 +782,28 @@
#define MBEDTLS_ECP_NIST_OPTIM
/**
+ * \def MBEDTLS_ECP_NO_INTERNAL_RNG
+ *
+ * When this option is disabled, mbedtls_ecp_mul() will make use of an
+ * internal RNG when called with a NULL \c f_rng argument, in order to protect
+ * against some side-channel attacks.
+ *
+ * This protection introduces a dependency of the ECP module on one of the
+ * DRBG modules. For very constrained implementations that don't require this
+ * protection (for example, because you're only doing signature verification,
+ * so not manipulating any secret, or because local/physical side-channel
+ * attacks are outside your threat model), it might be desirable to get rid of
+ * that dependency.
+ *
+ * \warning Enabling this option makes some uses of ECP vulnerable to some
+ * side-channel attacks. Only enable it if you know that's not a problem for
+ * your use case.
+ *
+ * Uncomment this macro to disable some counter-measures in ECP.
+ */
+//#define MBEDTLS_ECP_NO_INTERNAL_RNG
+
+/**
* \def MBEDTLS_ECP_RESTARTABLE
*
* Enable "non-blocking" ECC operations that can return early and be resumed.
diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h
index 4c05b4f..875e1f8 100644
--- a/include/mbedtls/ecp.h
+++ b/include/mbedtls/ecp.h
@@ -846,6 +846,9 @@
* intermediate results to prevent potential timing attacks
* targeting these results. We recommend always providing
* a non-NULL \p f_rng. The overhead is negligible.
+ * Note: unless #MBEDTLS_ECP_NO_INTERNAL_RNG is defined, when
+ * \p f_rng is NULL, an internal RNG (seeded from the value
+ * of \p m) will be used instead.
*
* \param grp The ECP group to use.
* This must be initialized and have group parameters
diff --git a/include/mbedtls/md.h b/include/mbedtls/md.h
index 0b0ec91..7e70778 100644
--- a/include/mbedtls/md.h
+++ b/include/mbedtls/md.h
@@ -104,6 +104,8 @@
* \brief This function returns the list of digests supported by the
* generic digest module.
*
+ * \note The list starts with the strongest available hashes.
+ *
* \return A statically allocated array of digests. Each element
* in the returned list is an integer belonging to the
* message-digest enumeration #mbedtls_md_type_t.
diff --git a/include/mbedtls/version.h b/include/mbedtls/version.h
index b89e36e..0ae4d22 100644
--- a/include/mbedtls/version.h
+++ b/include/mbedtls/version.h
@@ -39,7 +39,7 @@
* Major, Minor, Patchlevel
*/
#define MBEDTLS_VERSION_MAJOR 2
-#define MBEDTLS_VERSION_MINOR 22
+#define MBEDTLS_VERSION_MINOR 23
#define MBEDTLS_VERSION_PATCH 0
/**
@@ -47,9 +47,9 @@
* MMNNPP00
* Major version | Minor version | Patch version
*/
-#define MBEDTLS_VERSION_NUMBER 0x02160000
-#define MBEDTLS_VERSION_STRING "2.22.0"
-#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.22.0"
+#define MBEDTLS_VERSION_NUMBER 0x02170000
+#define MBEDTLS_VERSION_STRING "2.23.0"
+#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.23.0"
#if defined(MBEDTLS_VERSION_C)
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index f6a186f..05196e8 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -181,19 +181,19 @@
if(USE_SHARED_MBEDTLS_LIBRARY)
add_library(mbedcrypto SHARED ${src_crypto})
- set_target_properties(mbedcrypto PROPERTIES VERSION 2.22.0 SOVERSION 4)
+ set_target_properties(mbedcrypto PROPERTIES VERSION 2.23.0 SOVERSION 5)
target_link_libraries(mbedcrypto ${libs})
target_include_directories(mbedcrypto
PUBLIC ${MBEDTLS_DIR}/include/)
add_library(mbedx509 SHARED ${src_x509})
- set_target_properties(mbedx509 PROPERTIES VERSION 2.22.0 SOVERSION 1)
+ set_target_properties(mbedx509 PROPERTIES VERSION 2.23.0 SOVERSION 1)
target_link_libraries(mbedx509 ${libs} mbedcrypto)
target_include_directories(mbedx509
PUBLIC ${MBEDTLS_DIR}/include/)
add_library(mbedtls SHARED ${src_tls})
- set_target_properties(mbedtls PROPERTIES VERSION 2.22.0 SOVERSION 13)
+ set_target_properties(mbedtls PROPERTIES VERSION 2.23.0 SOVERSION 13)
target_link_libraries(mbedtls ${libs} mbedx509)
target_include_directories(mbedtls
PUBLIC ${MBEDTLS_DIR}/include/)
diff --git a/library/Makefile b/library/Makefile
index dbdd3b6..87ea56d 100644
--- a/library/Makefile
+++ b/library/Makefile
@@ -37,7 +37,7 @@
SOEXT_TLS=so.13
SOEXT_X509=so.1
-SOEXT_CRYPTO=so.4
+SOEXT_CRYPTO=so.5
# Set AR_DASH= (empty string) to use an ar implementation that does not accept
# the - prefix for command line options (e.g. llvm-ar)
diff --git a/library/ecp.c b/library/ecp.c
index 9522edf..7b20516 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -105,6 +105,16 @@
#include "mbedtls/ecp_internal.h"
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+#if defined(MBEDTLS_HMAC_DRBG_C)
+#include "mbedtls/hmac_drbg.h"
+#elif defined(MBEDTLS_CTR_DRBG_C)
+#include "mbedtls/ctr_drbg.h"
+#else
+#error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
+#endif
+#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
+
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
!defined(inline) && !defined(__cplusplus)
#define inline __inline
@@ -118,6 +128,144 @@
static unsigned long add_count, dbl_count, mul_count;
#endif
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+/*
+ * Currently ecp_mul() takes a RNG function as an argument, used for
+ * side-channel protection, but it can be NULL. The initial reasoning was
+ * that people will pass non-NULL RNG when they care about side-channels, but
+ * unfortunately we have some APIs that call ecp_mul() with a NULL RNG, with
+ * no opportunity for the user to do anything about it.
+ *
+ * The obvious strategies for addressing that include:
+ * - change those APIs so that they take RNG arguments;
+ * - require a global RNG to be available to all crypto modules.
+ *
+ * Unfortunately those would break compatibility. So what we do instead is
+ * have our own internal DRBG instance, seeded from the secret scalar.
+ *
+ * The following is a light-weight abstraction layer for doing that with
+ * HMAC_DRBG (first choice) or CTR_DRBG.
+ */
+
+#if defined(MBEDTLS_HMAC_DRBG_C)
+
+/* DRBG context type */
+typedef mbedtls_hmac_drbg_context ecp_drbg_context;
+
+/* DRBG context init */
+static inline void ecp_drbg_init( ecp_drbg_context *ctx )
+{
+ mbedtls_hmac_drbg_init( ctx );
+}
+
+/* DRBG context free */
+static inline void ecp_drbg_free( ecp_drbg_context *ctx )
+{
+ mbedtls_hmac_drbg_free( ctx );
+}
+
+/* DRBG function */
+static inline int ecp_drbg_random( void *p_rng,
+ unsigned char *output, size_t output_len )
+{
+ return( mbedtls_hmac_drbg_random( p_rng, output, output_len ) );
+}
+
+/* DRBG context seeding */
+static int ecp_drbg_seed( ecp_drbg_context *ctx,
+ const mbedtls_mpi *secret, size_t secret_len )
+{
+ int ret;
+ unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES];
+ /* The list starts with strong hashes */
+ const mbedtls_md_type_t md_type = mbedtls_md_list()[0];
+ const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_type );
+
+ if( secret_len > MBEDTLS_ECP_MAX_BYTES )
+ {
+ ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
+ goto cleanup;
+ }
+
+ MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret,
+ secret_bytes, secret_len ) );
+
+ ret = mbedtls_hmac_drbg_seed_buf( ctx, md_info, secret_bytes, secret_len );
+
+cleanup:
+ mbedtls_platform_zeroize( secret_bytes, secret_len );
+
+ return( ret );
+}
+
+#elif defined(MBEDTLS_CTR_DRBG_C)
+
+/* DRBG context type */
+typedef mbedtls_ctr_drbg_context ecp_drbg_context;
+
+/* DRBG context init */
+static inline void ecp_drbg_init( ecp_drbg_context *ctx )
+{
+ mbedtls_ctr_drbg_init( ctx );
+}
+
+/* DRBG context free */
+static inline void ecp_drbg_free( ecp_drbg_context *ctx )
+{
+ mbedtls_ctr_drbg_free( ctx );
+}
+
+/* DRBG function */
+static inline int ecp_drbg_random( void *p_rng,
+ unsigned char *output, size_t output_len )
+{
+ return( mbedtls_ctr_drbg_random( p_rng, output, output_len ) );
+}
+
+/*
+ * Since CTR_DRBG doesn't have a seed_buf() function the way HMAC_DRBG does,
+ * we need to pass an entropy function when seeding. So we use a dummy
+ * function for that, and pass the actual entropy as customisation string.
+ * (During seeding of CTR_DRBG the entropy input and customisation string are
+ * concatenated before being used to update the secret state.)
+ */
+static int ecp_ctr_drbg_null_entropy(void *ctx, unsigned char *out, size_t len)
+{
+ (void) ctx;
+ memset( out, 0, len );
+ return( 0 );
+}
+
+/* DRBG context seeding */
+static int ecp_drbg_seed( ecp_drbg_context *ctx,
+ const mbedtls_mpi *secret, size_t secret_len )
+{
+ int ret;
+ unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES];
+
+ if( secret_len > MBEDTLS_ECP_MAX_BYTES )
+ {
+ ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
+ goto cleanup;
+ }
+
+ MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret,
+ secret_bytes, secret_len ) );
+
+ ret = mbedtls_ctr_drbg_seed( ctx, ecp_ctr_drbg_null_entropy, NULL,
+ secret_bytes, secret_len );
+
+cleanup:
+ mbedtls_platform_zeroize( secret_bytes, secret_len );
+
+ return( ret );
+}
+
+#else
+#error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid."
+#endif /* DRBG modules */
+#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
+
#if defined(MBEDTLS_ECP_RESTARTABLE)
/*
* Maximum number of "basic operations" to be done in a row.
@@ -165,6 +313,10 @@
ecp_rsm_comb_core, /* ecp_mul_comb_core() */
ecp_rsm_final_norm, /* do the final normalization */
} state;
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ ecp_drbg_context drbg_ctx;
+ unsigned char drbg_seeded;
+#endif
};
/*
@@ -177,6 +329,10 @@
ctx->T = NULL;
ctx->T_size = 0;
ctx->state = ecp_rsm_init;
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ ecp_drbg_init( &ctx->drbg_ctx );
+ ctx->drbg_seeded = 0;
+#endif
}
/*
@@ -198,6 +354,10 @@
mbedtls_free( ctx->T );
}
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ ecp_drbg_free( &ctx->drbg_ctx );
+#endif
+
ecp_restart_rsm_init( ctx );
}
@@ -1897,7 +2057,9 @@
i = d;
MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, T_size, x[i] ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 1 ) );
+#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
if( f_rng != 0 )
+#endif
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
}
@@ -2018,6 +2180,7 @@
rs_ctx->rsm->state = ecp_rsm_final_norm;
final_norm:
+ MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
#endif
/*
* Knowledge of the jacobian coordinates may leak the last few bits of the
@@ -2030,10 +2193,11 @@
*
* Avoid the leak by randomizing coordinates before we normalize them.
*/
+#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
if( f_rng != 0 )
+#endif
MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, RR, f_rng, p_rng ) );
- MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, RR ) );
#if defined(MBEDTLS_ECP_RESTARTABLE)
@@ -2104,11 +2268,44 @@
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
unsigned char w, p_eq_g, i;
size_t d;
- unsigned char T_size, T_ok;
- mbedtls_ecp_point *T;
+ unsigned char T_size = 0, T_ok = 0;
+ mbedtls_ecp_point *T = NULL;
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ ecp_drbg_context drbg_ctx;
+
+ ecp_drbg_init( &drbg_ctx );
+#endif
ECP_RS_ENTER( rsm );
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ if( f_rng == NULL )
+ {
+ /* Adjust pointers */
+ f_rng = &ecp_drbg_random;
+#if defined(MBEDTLS_ECP_RESTARTABLE)
+ if( rs_ctx != NULL && rs_ctx->rsm != NULL )
+ p_rng = &rs_ctx->rsm->drbg_ctx;
+ else
+#endif
+ p_rng = &drbg_ctx;
+
+ /* Initialize internal DRBG if necessary */
+#if defined(MBEDTLS_ECP_RESTARTABLE)
+ if( rs_ctx == NULL || rs_ctx->rsm == NULL ||
+ rs_ctx->rsm->drbg_seeded == 0 )
+#endif
+ {
+ const size_t m_len = ( grp->nbits + 7 ) / 8;
+ MBEDTLS_MPI_CHK( ecp_drbg_seed( p_rng, m, m_len ) );
+ }
+#if defined(MBEDTLS_ECP_RESTARTABLE)
+ if( rs_ctx != NULL && rs_ctx->rsm != NULL )
+ rs_ctx->rsm->drbg_seeded = 1;
+#endif
+ }
+#endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */
+
/* Is P the base point ? */
#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
p_eq_g = ( mbedtls_mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 &&
@@ -2180,6 +2377,10 @@
cleanup:
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ ecp_drbg_free( &drbg_ctx );
+#endif
+
/* does T belong to the group? */
if( T == grp->T )
T = NULL;
@@ -2370,9 +2571,23 @@
unsigned char b;
mbedtls_ecp_point RP;
mbedtls_mpi PX;
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ ecp_drbg_context drbg_ctx;
+ ecp_drbg_init( &drbg_ctx );
+#endif
mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX );
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ if( f_rng == NULL )
+ {
+ const size_t m_len = ( grp->nbits + 7 ) / 8;
+ MBEDTLS_MPI_CHK( ecp_drbg_seed( &drbg_ctx, m, m_len ) );
+ f_rng = &ecp_drbg_random;
+ p_rng = &drbg_ctx;
+ }
+#endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */
+
/* Save PX and read from P before writing to R, in case P == R */
MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &PX, &P->X ) );
MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &RP, P ) );
@@ -2386,7 +2601,9 @@
MOD_ADD( RP.X );
/* Randomize coordinates of the starting point */
+#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
if( f_rng != NULL )
+#endif
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
/* Loop invariant: R = result so far, RP = R + P */
@@ -2419,12 +2636,18 @@
*
* Avoid the leak by randomizing coordinates before we normalize them.
*/
+#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
if( f_rng != NULL )
+#endif
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, R, f_rng, p_rng ) );
MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) );
cleanup:
+#if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ ecp_drbg_free( &drbg_ctx );
+#endif
+
mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX );
return( ret );
diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index ae8d076..7fc4bf0 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -1578,6 +1578,8 @@
* linking an extra division function in some builds).
*/
size_t j, extra_run = 0;
+ /* This size is enough to server either as input to
+ * md_process() or as output to md_finish() */
unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
/*
@@ -1633,10 +1635,15 @@
ssl_read_memory( data + rec->data_len, padlen );
mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
- /* Call mbedtls_md_process at least once due to cache attacks
- * that observe whether md_process() was called of not */
+ /* Dummy calls to compression function.
+ * Call mbedtls_md_process at least once due to cache attacks
+ * that observe whether md_process() was called of not.
+ * Respect the usual start-(process|update)-finish sequence for
+ * the sake of hardware accelerators that might require it. */
+ mbedtls_md_starts( &transform->md_ctx_dec );
for( j = 0; j < extra_run + 1; j++ )
mbedtls_md_process( &transform->md_ctx_dec, tmp );
+ mbedtls_md_finish( &transform->md_ctx_dec, tmp );
mbedtls_md_hmac_reset( &transform->md_ctx_dec );
diff --git a/library/version_features.c b/library/version_features.c
index adc61a1..16a0cd0 100644
--- a/library/version_features.c
+++ b/library/version_features.c
@@ -354,6 +354,9 @@
#if defined(MBEDTLS_ECP_NIST_OPTIM)
"MBEDTLS_ECP_NIST_OPTIM",
#endif /* MBEDTLS_ECP_NIST_OPTIM */
+#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ "MBEDTLS_ECP_NO_INTERNAL_RNG",
+#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
#if defined(MBEDTLS_ECP_RESTARTABLE)
"MBEDTLS_ECP_RESTARTABLE",
#endif /* MBEDTLS_ECP_RESTARTABLE */
diff --git a/programs/test/query_config.c b/programs/test/query_config.c
index 062dce6..98b065b 100644
--- a/programs/test/query_config.c
+++ b/programs/test/query_config.c
@@ -986,6 +986,14 @@
}
#endif /* MBEDTLS_ECP_NIST_OPTIM */
+#if defined(MBEDTLS_ECP_NO_INTERNAL_RNG)
+ if( strcmp( "MBEDTLS_ECP_NO_INTERNAL_RNG", config ) == 0 )
+ {
+ MACRO_EXPANSION_TO_STR( MBEDTLS_ECP_NO_INTERNAL_RNG );
+ return( 0 );
+ }
+#endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */
+
#if defined(MBEDTLS_ECP_RESTARTABLE)
if( strcmp( "MBEDTLS_ECP_RESTARTABLE", config ) == 0 )
{
diff --git a/scripts/config.py b/scripts/config.py
index 7f94587..3d297dc 100755
--- a/scripts/config.py
+++ b/scripts/config.py
@@ -173,6 +173,7 @@
'MBEDTLS_DEPRECATED_REMOVED', # conflicts with deprecated options
'MBEDTLS_DEPRECATED_WARNING', # conflicts with deprecated options
'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED', # influences the use of ECDH in TLS
+ 'MBEDTLS_ECP_NO_INTERNAL_RNG', # removes a feature
'MBEDTLS_ECP_RESTARTABLE', # incompatible with USE_PSA_CRYPTO
'MBEDTLS_ENTROPY_FORCE_SHA256', # interacts with CTR_DRBG_128_BIT_KEY
'MBEDTLS_HAVE_SSE2', # hardware dependency
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 01f5910..9a70438 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -929,6 +929,43 @@
# so there's little value in running those lengthy tests here.
}
+component_test_ecp_no_internal_rng () {
+ msg "build: Default plus ECP_NO_INTERNAL_RNG minus DRBG modules"
+ scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
+ scripts/config.py unset MBEDTLS_CTR_DRBG_C
+ scripts/config.py unset MBEDTLS_HMAC_DRBG_C
+ scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
+ scripts/config.py unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
+ scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
+
+ CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
+ make
+
+ msg "test: ECP_NO_INTERNAL_RNG, no DRBG module"
+ make test
+
+ # no SSL tests as they all depend on having a DRBG
+}
+
+component_test_ecp_restartable_no_internal_rng () {
+ msg "build: Default plus ECP_RESTARTABLE and ECP_NO_INTERNAL_RNG, no DRBG"
+ scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG
+ scripts/config.py set MBEDTLS_ECP_RESTARTABLE
+ scripts/config.py unset MBEDTLS_CTR_DRBG_C
+ scripts/config.py unset MBEDTLS_HMAC_DRBG_C
+ scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
+ scripts/config.py unset MBEDTLS_PSA_CRYPTO_C # requires CTR_DRBG
+ scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
+
+ CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
+ make
+
+ msg "test: ECP_RESTARTABLE and ECP_NO_INTERNAL_RNG, no DRBG module"
+ make test
+
+ # no SSL tests as they all depend on having a DRBG
+}
+
component_test_new_ecdh_context () {
msg "build: new ECDH context (ASan build)" # ~ 6 min
scripts/config.py unset MBEDTLS_ECDH_LEGACY_CONTEXT
diff --git a/tests/suites/test_suite_version.data b/tests/suites/test_suite_version.data
index 5dc81d3..846ebb7 100644
--- a/tests/suites/test_suite_version.data
+++ b/tests/suites/test_suite_version.data
@@ -1,8 +1,8 @@
Check compiletime library version
-check_compiletime_version:"2.22.0"
+check_compiletime_version:"2.23.0"
Check runtime library version
-check_runtime_version:"2.22.0"
+check_runtime_version:"2.23.0"
Check for MBEDTLS_VERSION_C
check_feature:"MBEDTLS_VERSION_C":0