search

Mbed-TLS / mbedtls

An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
https://www.trustedfirmware.org/projects/mbed-tls/
Other
5.56k stars 2.61k forks source link

Support SHA-256 in ssl_cookie.c #4457

Open gilles-peskine-arm opened 3 years ago

gilles-peskine-arm commented 3 years ago

ssl_cookie.c uses the smallest secure hash available, with SHA-1 as a last resort. In Mbed TLS 3.x, it will become possible to configure SHA-384 and SHA-512 separately, and to configure SHA-256 and SHA-224 separately. https://github.com/ARMmbed/mbedtls/pull/4304 adds the configuration options, with follow-ups yet to come to make all combinations work optimally.

The goal of this task is to ensure that ssl_cookie.c works in all reasonable configurations and uses the desired hash. This definitely includes a SHA-256-only build. Open questions:

mpg commented 2 years ago
  • Do we want to add support for a SHA-512-only build (which is already possible in Mbed TLS 2.x since MBEDTLS_SHA512_NO_SHA384 was added)?

I don't think (D)TLS works with a SHA-512-only build, as no SHA-512 ciphersuites have been defined so far - see IANA registry.

I agree that SHA-384-only and SHA-256-only should be supported.

Do we want to bother with SHA-224 at all?

Probably not. It was chosen because it saved 4 bytes on the wire and it was convenient, but if it stops being as convenient, we should favour simplicity.