From 512e6bbc69429b52424db5e6cf202687d4df0f07 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 14:18:02 +0200 Subject: [PATCH] library: ssl: remove mbedtls_ssl_check_curve Its main functionality was to get a TLS ID from 'mbedtls_ecp_group_id' and then call 'mbedtls_ssl_check_curve_tls_id'. The same can be achieved with public PK functions and 'mbedtls_ssl_get_tls_id_from_curve_info', then calling into 'mbedtls_ssl_check_curve_tls_id' as before. Signed-off-by: Valerio Setti --- library/ssl_misc.h | 4 ---- library/ssl_tls.c | 23 ++++++----------------- 2 files changed, 6 insertions(+), 21 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index b91b789b7c..1957d6a4c6 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -1502,10 +1502,6 @@ int mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context *ssl, int md); MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id); -#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) -MBEDTLS_CHECK_RETURN_CRITICAL -int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id); -#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ /** * \brief Return PSA EC info for the specified TLS ID. diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 6650daf625..700adfef45 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5793,22 +5793,6 @@ int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_ return -1; } -#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) -/* - * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id. - */ -int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id) -{ - uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id); - - if (tls_id == 0) { - return -1; - } - - return mbedtls_ssl_check_curve_tls_id(ssl, tls_id); -} -#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ - static const struct { uint16_t tls_id; mbedtls_ecp_group_id ecp_group_id; @@ -8828,7 +8812,12 @@ int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl, defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 && PSA_KEY_TYPE_IS_ECC(mbedtls_pk_get_type(&chain->pk))) { - if (mbedtls_ssl_check_curve(ssl, mbedtls_pk_get_ec_group_id(&chain->pk)) != 0) { + psa_key_type_t key_type = mbedtls_pk_get_type(&chain->pk); + psa_ecc_family_t ec_family = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type); + size_t bits = mbedtls_pk_get_bitlen(&chain->pk); + int tls_id = mbedtls_ssl_get_tls_id_from_curve_info(ec_family, bits); + + if (mbedtls_ssl_check_curve_tls_id(ssl, tls_id) != 0) { MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (EC key curve)")); ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY; if (ret == 0) {