Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add TLS 1.2 cipher suite inspection functions #9424

Open
JZimnol opened this issue Jul 25, 2024 · 1 comment
Open

Add TLS 1.2 cipher suite inspection functions #9424

JZimnol opened this issue Jul 25, 2024 · 1 comment
Labels
component-tls enhancement help-wanted This issue is not being actively worked on, but PRs welcome. size-s Estimated task size: small (~2d)

Comments

@JZimnol
Copy link

JZimnol commented Jul 25, 2024

With mbedtls3.6 some changes breaking the public API have been introduced. While some of them can be solved by user's workarounds, some of them are quite necessary for some applications. Apart from changes related to #9223 (e.g. #7075 which disables the VERIFY_NONE/OPTIONAL and may have some workarounds for self-signed certificates like clearing the result flag), some APIs can be reverted to public.

Suggested enhancement

Make the mbedtls_ssl_ciphersuite_uses_psk and mbedtls_ssl_ciphersuite_uses_srv_cert public again (broken public API).

Justification

There is no reason why this API can't be public (probably?).
Mbed TLS needs this because of e.g. the resource-constraint applications. Right now my Team has found a workaround for that (just by implementing this as an static inline in our code) but it would require us to follow the changes in your private code just to be up-to-date all the time.

Usecase

Our application implements the LwM2M Client and we want to be able to filter reported ciphersuites when connecting to the server (according to some security configuration) so not all of them are reported in the Client Hello message. This reduces the data usage of the device.

@gilles-peskine-arm gilles-peskine-arm changed the title Revert some changes introduced with mbedtls3.6 Add TLS 1.2 cipher suite inspection functions Aug 29, 2024
@gilles-peskine-arm
Copy link
Contributor

mbedtls_ssl_ciphersuite_uses_psk and mbedtls_ssl_ciphersuite_uses_srv_cert have never been part of the Mbed TLS API. They've been internal functions since the PolarSSL days.

We can make them public. We'd just need to document and test them.

@gilles-peskine-arm gilles-peskine-arm added enhancement help-wanted This issue is not being actively worked on, but PRs welcome. component-tls size-s Estimated task size: small (~2d) labels Aug 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component-tls enhancement help-wanted This issue is not being actively worked on, but PRs welcome. size-s Estimated task size: small (~2d)
Projects
Status: No status
Development

No branches or pull requests

2 participants