Test EC-JPAKE against an old Mbed TLS #9740
Labels
component-test
Test framework and CI scripts
component-tls
enhancement
size-s
Estimated task size: small (~2d)
Comments
gilles-peskine-arm
added
enhancement
component-tls
size-s
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Oct 30, 2024
We no longer have two (only partially distinct) implementations of ECJ-PAKE cipher suites in TLS, now that the non-MBEDTLS_USE_PSA_CRYPTO implementation is being removed. We may want to add this testing back in the future, but we'll have to use an old Mbed TLS instead of a differently-built one. Mbed-TLS#9740 Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Oct 30, 2024
We no longer have two (only partially distinct) implementations of ECJ-PAKE cipher suites in TLS, now that the non-MBEDTLS_USE_PSA_CRYPTO implementation is being removed. We may want to add this testing back in the future, but we'll have to use an old Mbed TLS instead of a differently-built one. Mbed-TLS#9740 Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Oct 30, 2024
We no longer have two (only partially distinct) implementations of ECJ-PAKE cipher suites in TLS, now that the non-MBEDTLS_USE_PSA_CRYPTO implementation is being removed. We may want to add this testing back in the future, but we'll have to use an old Mbed TLS instead of a differently-built one. Mbed-TLS#9740 Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Mbed TLS is the only free implementation of ECJ-PAKE cipher suites in TLS (an expired RFC, but required by Thread) that we know of. As a consequence, we don't have interoperability tests for EC-JPAKE in TLS.
For a while (since #6533), we had two partially different implementations of EC-JPAKE in TLS: with or without
MBEDTLS_USE_PSA_CRYPTO. We did some interoperability testing between these two implementations. In Mbed TLS 4.0, we got rid of the non-PSA code paths, so we are back to not having any interoperability testing.The goal of this issue is to bring back interoperability testing in the form of Mbed TLS 4.0 tested against an old version of Mbed TLS, for example Mbed TLS 2.28.10 or 3.6.2.
Only ECJPAKE is in scope here, however once we have the machinery we may want to extend this to other TLS features that are not in OpenSSL or GnuTLS (the two TLS implementations we do interoperability testing against).
The text was updated successfully, but these errors were encountered: