Allow hardcoding single signature hash at compile-time
This commit introduces the option MBEDTLS_SSL_CONF_SINGLE_HASH
which can be used to register a single supported signature hash
algorithm at compile time. It replaces the runtime configuration
API mbedtls_ssl_conf_sig_hashes() which allows to register a _list_
of supported signature hash algorithms.
In contrast to other options used to hardcode configuration options,
MBEDTLS_SSL_CONF_SINGLE_HASH isn't a numeric option, but instead it's
only relevant if it's defined or not. To actually set the single
supported hash algorithm that should be supported, numeric options
MBEDTLS_SSL_CONF_SINGLE_HASH_TLS_ID
MBEDTLS_SSL_CONF_SINGLE_HASH_MD_ID
must both be defined and provide the TLS ID and the Mbed TLS internal
ID and the chosen hash algorithm, respectively.
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 0f9ab0e..a41182c 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -1078,7 +1078,9 @@
#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
+#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
const int *sig_hashes; /*!< allowed signature hashes */
+#endif /* !MBEDTLS_SSL_CONF_SINGLE_SIG_HASH */
#endif
#if defined(MBEDTLS_ECP_C)
@@ -2863,6 +2865,10 @@
* \note This list should be ordered by decreasing preference
* (preferred hash first).
*
+ * \note On highly constrained systems, the support for a single
+ * fixed signature hash algorithm can be configured at compile
+ * time through the option MBEDTLS_SSL_CONF_SINGLE_SIG_HASH.
+ *
* \param conf SSL configuration
* \param hashes Ordered list of allowed signature hashes,
* terminated by \c MBEDTLS_MD_NONE.