From f3a69ab32a6bf65d22f3bd0a8f94e935bdc254f4 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Thu, 18 Jun 2026 17:48:24 +0200 Subject: [PATCH] pkcs7: improve documentation and changelog for MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES Signed-off-by: Valerio Setti --- ChangeLog.d/pkcs7-reject-weak-hashes.txt | 2 +- include/mbedtls/pkcs7.h | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt index 659b0a65c5..ce3f295db1 100644 --- a/ChangeLog.d/pkcs7-reject-weak-hashes.txt +++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt @@ -1,6 +1,6 @@ Security * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, - SHA3-224) on signature verification. Build symbol + SHA3-224) on signature verification. The new configuration option MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash algorithms in PKCS7 for backward compatibility purposes. diff --git a/include/mbedtls/pkcs7.h b/include/mbedtls/pkcs7.h index 0cea9a0329..d9398db9b8 100644 --- a/include/mbedtls/pkcs7.h +++ b/include/mbedtls/pkcs7.h @@ -34,9 +34,9 @@ * - The RFC doesn't put any constrain on the hash algorithm to be used, but * this implementation by default rejects weak hash algorithms (i.e. RIPEMD160, * MD5, SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms - * are the ones belonging to `mbedtls_x509_crt_profile_default`. - * MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to remove the limitation - * on weak hash algorithms. + * are the ones belonging to ::mbedtls_x509_crt_profile_default. + * #MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to accept all + * supported hash algorithms. */ #ifndef MBEDTLS_PKCS7_H