Mbed-TLS/mbedtls-framework
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls-framework.git synced 2026-09-06 18:29:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

library: x509: change order of checks in x509_crt_check_signature()

Browse Source 
Checking that parent PK type is OK is definitely faster than computing
an hash, so invert the checks.

Signed-off-by: Valerio Setti <[email protected]>
This commit is contained in:
Valerio Setti
2025-12-04 16:28:44 +01:00
parent 81a5a0914c
commit 9d1fa1a8d8
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/x509_crt.c
+5 -5
View File
@@ -2108,6 +2108,11 @@ static int x509_crt_check_signature(const mbedtls_x509_crt *child,
psa_algorithm_t hash_alg = mbedtls_md_psa_alg_from_type(child->sig_md);
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
/* Skip expensive computation on obvious mismatch */
if (!mbedtls_pk_can_do(&parent->pk, (mbedtls_pk_type_t) child->sig_pk)) {
return -1;
}
status = psa_hash_compute(hash_alg,
child->tbs.p,
child->tbs.len,
@@ -2118,11 +2123,6 @@ static int x509_crt_check_signature(const mbedtls_x509_crt *child,
return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
}
/* Skip expensive computation on obvious mismatch */
if (!mbedtls_pk_can_do(&parent->pk, (mbedtls_pk_type_t) child->sig_pk)) {
return -1;
}
#if defined(MBEDTLS_ECP_RESTARTABLE)
if (rs_ctx != NULL && child->sig_pk == MBEDTLS_PK_SIGALG_ECDSA) {
return mbedtls_pk_verify_restartable(&parent->pk,