Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-09-09 11:49:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

pkcs7: add MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES build symbol

Browse Source 
It allows weak hash algorithms to be used in PKCS7. It's only added in the
LTS branch for backward compatibility, but it's disabled by default because
that's the safest choice.

This commit also updates test data in order to test the new build symbol.

Signed-off-by: Valerio Setti <[email protected]>
This commit is contained in:
Valerio Setti
2026-06-22 11:55:14 +02:00
parent ba1c4a5ae0
commit 544721407e
4 changed files with 29 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog.d/pkcs7-reject-weak-hashes.txt
+3 -1
View File
@@ -1,6 +1,8 @@
Security
* PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
SHA3-224) on signature verification.
SHA3-224) on signature verification. Build symbol
MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash
algorithms in PKCS7 for backward compatibility purposes.
Features
* SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509
include/mbedtls/mbedtls_config.h
+9
View File
@@ -3248,6 +3248,15 @@
*/
#define MBEDTLS_PKCS7_C
/**
* \def MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
*
* Allow weak signature algorithms (RIPEMD160, MD5, SHA-1) in PKCS#7.
*
* Requires: MBEDTLS_PKCS7_C
*/
// #define MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
/**
* \def MBEDTLS_PKCS12_C
*
library/pkcs7.c
+2
View File
@@ -666,6 +666,7 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7,
return ret;
}
#if !defined(MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES)
/* Ensure the MD alg from the PKCS#7 context and signature algorithm from
* the certificate belong to the list of secure algorithms
* (i.e. mbedtls_x509_crt_profile_default). */
@@ -677,6 +678,7 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7,
if (ret != 0) {
return MBEDTLS_ERR_PKCS7_INVALID_ALG;
}
#endif /* MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES */
md_info = mbedtls_md_info_from_type(md_alg);
if (md_info == NULL) {
tests/suites/test_suite_pkcs7.data
+15 -3
View File
@@ -87,17 +87,29 @@ depends_on:MBEDTLS_MD_CAN_SHA256
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0
PKCS7 Signed Data Verification Fail SHA1 #10
depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256
depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
PKCS7 Signed Data Verification Pass SHA1 #10
depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
PKCS7 Signed Data Verification Fail MD5 #10.1
depends_on:MBEDTLS_MD_CAN_MD5:MBEDTLS_MD_CAN_SHA256
depends_on:MBEDTLS_MD_CAN_MD5:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
PKCS7 Signed Data Verification Pass MD5 #10.1
depends_on:MBEDTLS_MD_CAN_MD5:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
PKCS7 Signed Data Verification Fail RIPEMD160 #10.2
depends_on:MBEDTLS_MD_CAN_RIPEMD160:MBEDTLS_MD_CAN_SHA256
depends_on:MBEDTLS_MD_CAN_RIPEMD160:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
PKCS7 Signed Data Verification Pass RIPEMD160 #10.2
depends_on:MBEDTLS_MD_CAN_RIPEMD160:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
PKCS7 Signed Data Verification Pass SHA512 #11
depends_on:MBEDTLS_MD_CAN_SHA512:MBEDTLS_MD_CAN_SHA256
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0