From 36054361c4febf00a7bdbddf043a1c8417ef9f2e Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Tue, 8 Sep 2026 23:42:41 +0200
Subject: [PATCH] crypto_knowledge: improve mechanism to skip testing RSA
 PKCS1v15 with hash algs w/o OID

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 scripts/mbedtls_framework/crypto_knowledge.py | 32 +++++++++++--------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/scripts/mbedtls_framework/crypto_knowledge.py b/scripts/mbedtls_framework/crypto_knowledge.py
index c3a07ffa4..3f01b349e 100644
--- a/scripts/mbedtls_framework/crypto_knowledge.py
+++ b/scripts/mbedtls_framework/crypto_knowledge.py
@@ -241,7 +241,13 @@ class KeyType:
            alg.head == 'STREAM_CIPHER':
             return True
         if self.head == 'RSA' and alg.head.startswith('RSA_'):
-            return alg.is_valid_rsa_alg_with_hash()
+            # There are hash algorithms for which OID is not standardized (or not yet),
+            # so RSA PKCS#1 v1.5 signature is not supported. For the full list of unsupported
+            # hash algorithms please refer to the official PSA API documentation:
+            # https://arm-software.github.io/psa-api/crypto/1.5/api/ops/signature.html#c.PSA_ALG_RSA_PKCS1V15_SIGN
+            if alg.head == 'RSA_PKCS1V15_SIGN':
+                return alg.get_inner_algorithm().has_hash_standardized_oid()
+            return True
         if alg.category == AlgorithmCategory.KEY_AGREEMENT and \
            self.is_public():
             # The PSA API does not use public key objects in key agreement
@@ -492,22 +498,20 @@ class Algorithm:
         'PSA_ALG_ASCON_HASH256',
         'PSA_ALG_SHAKE256_512',
     ])
-    def is_valid_rsa_alg_with_hash(self) -> bool:
-        """Whether the specified combinaton of RSA_PKCS1V15_SIGN() and hash is supported.
-        Rationale: there are hash algorithms for which OID is not standardized (or not yet),
-        so RSA PKCS#1 v1.5 signature is not supported. For the full list of unsupported
-        hash algorithms please refer to the official PSA API documentation:
-        https://arm-software.github.io/psa-api/crypto/1.5/api/ops/signature.html#c.PSA_ALG_RSA_PKCS1V15_SIGN
-        """
-        m = re.match(r'PSA_ALG_RSA_PKCS1V15_SIGN\(\s*(.*)\)\Z', self.expression)
-        if not m:
-            # Nothing to do for RSA_OAEP, RSA_PSS, or RSA_PKCS1V15_CRYPT.
-            return True
-        hash_alg = m.group(1)
-        if hash_alg in self.HASH_ALGS_WITHOUT_OID:
+    def has_hash_standardized_oid(self) -> bool:
+        """Whether the hash algorithm has a standardized OID."""
+        if self.expression in self.HASH_ALGS_WITHOUT_OID:
             return False
         return True
 
+    def get_inner_algorithm(self) -> "Algorithm":
+        """Given an algorithm composed as outer_alg(inner_alg) return inner_alg."""
+        m = re.match(r'\w+\(\s*(.*)\)\Z', self.expression)
+        if not m:
+            return None
+        inner_alg = m.group(1)
+        return Algorithm(inner_alg)
+
     def short_expression(self, level: int = 0) -> str:
         """Abbreviate the expression, keeping it human-readable.