Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-29 20:13:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1635 from valeriosetti/issue1569-backport-3.6

Browse Source 
[backport 3.6] TLS 1.3 certificate chain signature algorithm policy gap
This commit is contained in:
Ronald Cron
2026-05-29 13:34:52 +02:00
committed by GitHub
parent e3aaf2e614 b9c8c9c427
commit 14ff18114f
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog.d/security-issue1569.txt
+4
View File
@@ -0,0 +1,4 @@
Security
* Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that
this function only sets signature algorithms that are enforced during
TLS key exchange and not on certificate verification.
include/mbedtls/ssl.h
+7 -2
View File
@@ -3594,7 +3594,7 @@ int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf, size_t len,
*
* \note The restrictions are enforced for all certificates in the
* chain. However, signatures in the handshake are not covered
* by this setting but by \b mbedtls_ssl_conf_sig_hashes().
* by this setting but by \c mbedtls_ssl_conf_sig_hashes().
*
* \param conf SSL configuration
* \param profile Profile to use
@@ -4075,7 +4075,12 @@ void MBEDTLS_DEPRECATED mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config *conf,
#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
/**
* \brief Configure allowed signature algorithms for use in TLS
* \brief Configure allowed signature algorithms for use in TLS key
* exchange.
*
* \note This only covers signature algorithms used in the key
* exchange. To also enforce restrictions in certificate verification
* refer to \c mbedtls_ssl_conf_cert_profile().
*
* \param conf The SSL configuration to use.
* \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms,