Skip to content

Commit 375cc45

Browse files
author
Ben Taylor
committed
Remove support for static ECDH cipher suites
Signed-off-by: Ben Taylor <[email protected]>
1 parent 04c4d9c commit 375cc45

16 files changed

+11
-618
lines changed

‎docs/architecture/tls13-support.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -118,8 +118,6 @@ Support description
118118
| MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED | n/a |
119119
| MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED | n/a |
120120
| MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED | n/a |
121-
| MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED | n/a |
122-
| MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED | n/a |
123121
| MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED | n/a |
124122
| | |
125123
| MBEDTLS_PSA_CRYPTO_C | no (1) |

‎docs/proposed/config-split.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -392,8 +392,6 @@ PSA_WANT_\* macros as in current `crypto_config.h`.
392392
#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
393393
#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
394394
#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
395-
#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
396-
#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
397395
//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
398396
#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
399397
#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED

‎include/mbedtls/check_config.h‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -56,19 +56,6 @@
5656
#endif /* not all curves accelerated */
5757
#endif /* some curve accelerated */
5858

59-
#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) && \
60-
( !defined(MBEDTLS_CAN_ECDH) || \
61-
!defined(PSA_HAVE_ALG_ECDSA_SIGN) || \
62-
!defined(MBEDTLS_X509_CRT_PARSE_C) )
63-
#error "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED defined, but not all prerequisites"
64-
#endif
65-
66-
#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
67-
( !defined(MBEDTLS_CAN_ECDH) || !defined(MBEDTLS_RSA_C) || \
68-
!defined(MBEDTLS_X509_CRT_PARSE_C) )
69-
#error "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED defined, but not all prerequisites"
70-
#endif
71-
7259
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) && \
7360
!defined(MBEDTLS_CAN_ECDH)
7461
#error "MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED defined, but not all prerequisites"
@@ -151,8 +138,6 @@
151138
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
152139
!(defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
153140
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
154-
defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
155-
defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \
156141
defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
157142
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
158143
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) )

‎include/mbedtls/config_adjust_ssl.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,6 @@
6565
#undef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
6666
#undef MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
6767
#undef MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
68-
#undef MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
69-
#undef MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
7068
#undef MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
7169
#endif
7270

‎include/mbedtls/mbedtls_config.h‎

Lines changed: 0 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -273,54 +273,6 @@
273273
*/
274274
#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
275275

276-
/**
277-
* \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
278-
*
279-
* Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS.
280-
*
281-
* Requires: MBEDTLS_ECDH_C or PSA_WANT_ALG_ECDH
282-
* MBEDTLS_ECDSA_C or PSA_WANT_ALG_ECDSA
283-
* MBEDTLS_X509_CRT_PARSE_C
284-
*
285-
* This enables the following ciphersuites (if other requisites are
286-
* enabled as well):
287-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
288-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
289-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
290-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
291-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
292-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
293-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
294-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
295-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
296-
* MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
297-
*/
298-
#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
299-
300-
/**
301-
* \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
302-
*
303-
* Enable the ECDH-RSA based ciphersuite modes in SSL / TLS.
304-
*
305-
* Requires: MBEDTLS_ECDH_C or PSA_WANT_ALG_ECDH
306-
* MBEDTLS_RSA_C
307-
* MBEDTLS_X509_CRT_PARSE_C
308-
*
309-
* This enables the following ciphersuites (if other requisites are
310-
* enabled as well):
311-
* MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
312-
* MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
313-
* MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
314-
* MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
315-
* MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
316-
* MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
317-
* MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
318-
* MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
319-
* MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
320-
* MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
321-
*/
322-
#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
323-
324276
/**
325277
* \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
326278
*

‎include/mbedtls/ssl.h‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -684,9 +684,7 @@
684684
union mbedtls_ssl_premaster_secret {
685685
unsigned char dummy; /* Make the union non-empty even with SSL disabled */
686686
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
687-
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
688-
defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
689-
defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
687+
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
690688
unsigned char _pms_ecdh[MBEDTLS_ECP_MAX_BYTES]; /* RFC 4492 5.10 */
691689
#endif
692690
#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)

‎include/mbedtls/ssl_ciphersuites.h‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -163,16 +163,12 @@ typedef enum {
163163
MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA,
164164
MBEDTLS_KEY_EXCHANGE_PSK,
165165
MBEDTLS_KEY_EXCHANGE_ECDHE_PSK,
166-
MBEDTLS_KEY_EXCHANGE_ECDH_RSA,
167-
MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA,
168166
MBEDTLS_KEY_EXCHANGE_ECJPAKE,
169167
} mbedtls_key_exchange_type_t;
170168

171169
/* Key exchanges using a certificate */
172170
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
173-
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
174-
defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
175-
defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
171+
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
176172
#define MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED
177173
#endif
178174

@@ -220,12 +216,6 @@ typedef enum {
220216
#define MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED
221217
#endif
222218

223-
/* Key exchanges using ECDH */
224-
#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
225-
defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
226-
#define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED
227-
#endif
228-
229219
/* Key exchanges that don't involve ephemeral keys */
230220
#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
231221
defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED)

0 commit comments

Comments
 (0)