From 4008c7f811a6ce2c4090aeceef531dc9463c34eb Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Thu, 18 Jun 2026 10:19:07 +0200 Subject: [PATCH] pkcs7: mention MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES in pkcs7.h documentation Signed-off-by: Valerio Setti --- include/mbedtls/pkcs7.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/include/mbedtls/pkcs7.h b/include/mbedtls/pkcs7.h index aa9764e19a..ab569da2e6 100644 --- a/include/mbedtls/pkcs7.h +++ b/include/mbedtls/pkcs7.h @@ -32,9 +32,11 @@ * - The RFC allows for the signed Data type to contain contentInfo. This * implementation assumes the type is DATA and the content is empty. * - The RFC doesn't put any constrain on the hash algorithm to be used, but - * this implementation rejects weak hash algorithms (i.e. RIPEMD160, MD5, - * SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms are - * the ones belonging to `mbedtls_x509_crt_profile_default`. + * this implementation by default rejects weak hash algorithms (i.e. RIPEMD160, + * MD5, SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms + * are the ones belonging to `mbedtls_x509_crt_profile_default`. + * MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to remove the limitation + * on weak hash algorithms. */ #ifndef MBEDTLS_PKCS7_H