Skip to content

Remove use of pk_can_do() #10505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 6 commits into
base: development
Choose a base branch
from
Open

Remove use of pk_can_do() #10505

wants to merge 6 commits into from

Conversation

@valeriosetti
Copy link
Contributor

@valeriosetti valeriosetti commented Nov 12, 2025 •
edited
Loading

Description

Resolves #10453

Depends on Mbed-TLS/TF-PSA-Crypto#532. The last commit will be updated once this PR will be merged.

PR checklist

  • changelog not required because: no visible change for the end user
  • development PR not required because: it's this one
  • TF-PSA-Crypto PR not required because: no change there
  • framework PR not required
  • 3.6 PR not required because: no backport
  • tests not required because: code behavior is expected to remain the same so already existing tests should be enough to prove that this change is OK.

@valeriosetti
library: ssl: remove duplicate check in ssl_parse_server_key_exchange()
5299b2d 
The check being removed is already done few lines above so there is no
need to repeat it twice.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
@valeriosetti
library: common: add helper to get PSA algorithm from PK sigalg
2aa9630 
Add a simple helper to convert from PK sigalg to PSA algorithm. This is
handy when calling mbedtls_pk_can_do_psa() knowing the PK sigalg and the
used MD type.

This is being added in a separate file because it's meant to be consumed
by both ssl and x509 modules. It was not added to tf-psa-crypto because
this is only needed on the mbedtls repo and doing so reduce interdependencies
between the repos.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
@valeriosetti valeriosetti added needs-ci Needs to pass CI tests needs-preceding-pr Requires another PR to be merged first needs-reviewer This PR needs someone to pick it up for review size-s Estimated task size: small (~2d) priority-high High priority - will be reviewed soon labels Nov 12, 2025
@valeriosetti
library: ssl: replace mbedtls_pk_can_do() with mbedtls_pk_can_do_psa()
6ba8736 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
@valeriosetti
library: x509: change order of checks in x509_crt_check_signature()
e403ff3 
Checking that parent PK type is OK is definitely faster than computing
an hash, so invert the checks.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
@valeriosetti
library: x509: replace mbedtls_pk_can_do() with mbedtls_pk_can_do_psa()
3ddf7fb 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
@valeriosetti
[TEMPORARY] library: future changes for mbedtls_pk_get_type
562619f 
This is a temporary placeholder commit that will be implemented once the
referenced function will be implemented in tf-psa-crypto

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

needs-ci Needs to pass CI tests needs-preceding-pr Requires another PR to be merged first needs-reviewer This PR needs someone to pick it up for review priority-high High priority - will be reviewed soon size-s Estimated task size: small (~2d)

Projects

Roadmap pull requests (new board)
Status: In Development

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Remove use of pk_can_do()

1 participant

@valeriosetti