commit 7ab7f2b1845e91112a1e44c3e65967704450cf38
author Jerry Yu <jerry.h.yu@arm.com> Thu Jun 16 19:07:10 2022 +0800
committer Jerry Yu <jerry.h.yu@arm.com> Wed Jun 29 16:13:44 2022 +0800
tree 4f00aafead31f52145cfb9d9549ae84f047892df
parent 08524c55f97c40b24f9ec81acd6d62789b270a54

Remove pkcs1 from certificate_verify

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>

library/ssl_misc.h

diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index bea84c3..3b01db1 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -2028,7 +2028,9 @@
 
 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
 
-#if 0 && defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C)
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
+    defined(MBEDTLS_PKCS1_V15) && \
+    defined(MBEDTLS_RSA_C)
 
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256:
@@ -2051,7 +2053,9 @@
             break;
 #endif /* MBEDTLS_SHA512_C */
 
-#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
+          MBEDTLS_PKCS1_V15 &&
+          MBEDTLS_RSA_C */
 
             default:
                 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
@@ -2149,7 +2153,7 @@
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
     {
-        return( mbedtls_ssl_tls13_sig_alg_is_supported( sig_alg ) );
+       return( mbedtls_ssl_tls13_sig_alg_is_supported( sig_alg ) );
     }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
     ((void) ssl);

library/ssl_tls13_generic.c

diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index 3ab6cc2..3d5baa2 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -864,6 +864,12 @@
     *algorithm = MBEDTLS_TLS1_3_SIG_NONE;
     for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE ; sig_alg++ )
     {
+        if( *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256 ||
+            *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384 ||
+            *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512 )
+        {
+            continue;
+        }
         if( mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg) &&
             mbedtls_ssl_tls13_sig_alg_is_available_for_pk(
                                               ssl, *sig_alg, own_key ) )