Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport 3.6: Fix discussions of MBEDTLS_USE_PSA_CRYPTO in standalone documentation #9823

Merged
merged 2 commits into from
Jan 2, 2025
Merged

Backport 3.6: Fix discussions of MBEDTLS_USE_PSA_CRYPTO in standalone documentation #9823

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d78d695
FFDH in TLS: it's only a limitation for TLS 1.2, not TLS 1.3
gilles-peskine-arm Dec 4, 2024
4f65e1f
Distinguish between MBEDTLS_PSA_CRYPTO_C and MBEDTLS_PSA_CRYPTO_CLIENT
gilles-peskine-arm Dec 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/architecture/psa-migration/strategy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,9 @@ Compile-time options
We currently have a few compile-time options that are relevant to the migration:

- `MBEDTLS_PSA_CRYPTO_C` - enabled by default, controls the presence of the PSA
Crypto APIs.
Crypto APIs with their implementations. (Builds with only
`MBEDTLS_PSA_CRYPTO_CLIENT`, where PSA crypto APIs are present but
implemented via third-party code, are out of scope of this document.)
- `MBEDTLS_USE_PSA_CRYPTO` - disabled by default (enabled in "full" config),
controls usage of PSA Crypto APIs to perform operations in X.509 and TLS
(G1 above), as well as the availability of some new APIs (G2 above).
Expand Down
6 changes: 4 additions & 2 deletions docs/driver-only-builds.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,9 +278,11 @@ The same holds for the associated algorithm:
removing builtin support (i.e. `MBEDTLS_DHM_C`).

Note that the PSA API only supports FFDH with RFC 7919 groups, whereas the
Mbed TLS legacy API supports custom groups. As a consequence, the TLS layer
of Mbed TLS only supports DHE cipher suites if built-in FFDH
Mbed TLS legacy API supports custom groups. As a consequence, the TLS 1.2
layer of Mbed TLS only supports DHE cipher suites if built-in FFDH
(`MBEDTLS_DHM_C`) is present, even when `MBEDTLS_USE_PSA_CRYPTO` is enabled.
(The TLS 1.3 layer uses PSA, and this is not a limitation because the
protocol does not allow custom FFDH groups.)

RSA
---
Expand Down