yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-22 12:45:39 +01:00
Code Issues Packages Projects Releases Wiki Activity

MD API deprecation: ChangeLog updates

Browse Source 
Use the updated names for the new functions (xxx_ret instead of xxx_ext).

List the new deprecations in the appropriate sections.

Credit the independent report of the misuse of zeroizing to reset a
hash context in entropy.c.
This commit is contained in:
Gilles Peskine 2018-01-22 14:55:20 +01:00
parent 3e28d70813
commit 0a96910e55
1 changed files with 19 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
ChangeLog
View File

@ -40,6 +40,11 @@ New deprecations
(e.g., signing with a public key). (e.g., signing with a public key).
* Direct manipulation of structure fields of RSA contexts is deprecated. * Direct manipulation of structure fields of RSA contexts is deprecated.
Users are advised to use the extended RSA API instead. Users are advised to use the extended RSA API instead.
* Deprecate usage of message digest functions that return void
(mbedtls_<MODULE>_starts, mbedtls_<MODULE>_update,
mbedtls_<MODULE>_finish and mbedtls_<MODULE>_process where <MODULE> is
any of MD2, MD4, MD5, SHA1, SHA256, SHA512) in favor of functions
that can return an error code.
API Changes API Changes
* Extend RSA interface by multiple functions allowing structure- * Extend RSA interface by multiple functions allowing structure-
@ -51,19 +56,14 @@ API Changes
purpose or CRT and/or blinding. purpose or CRT and/or blinding.
* The configuration option MBEDTLS_RSA_ALT can be used to define alternative * The configuration option MBEDTLS_RSA_ALT can be used to define alternative
implementations of the RSA interface declared in rsa.h. implementations of the RSA interface declared in rsa.h.
* The following functions in the MD2, MD4, MD5, SHA1, SHA256 and SHA512 * The following functions in the message digest modules (MD2, MD4, MD5,
modules have been deprecated and replaced as shown below. The new SHA1, SHA256, SHA512) have been deprecated and replaced as shown below.
functions change the return type from void to int to allow returning error The new functions change the return type from void to int to allow
codes when using MBEDTLS_<MODULE>_ALT. returning error codes when using MBEDTLS_<MODULE>_ALT.
mbedtls_<MODULE>_starts() -> mbedtls_<MODULE>_starts_ext() mbedtls_<MODULE>_starts() -> mbedtls_<MODULE>_starts_ret()
mbedtls_<MODULE>_update() -> mbedtls_<MODULE>_update_ext() mbedtls_<MODULE>_update() -> mbedtls_<MODULE>_update_ret()
mbedtls_<MODULE>_finish() -> mbedtls_<MODULE>_finish_ext() mbedtls_<MODULE>_finish() -> mbedtls_<MODULE>_finish_ret()
mbedtls_<MODULE>_process() -> mbedtls_internal_<MODULE>_process() mbedtls_<MODULE>_process() -> mbedtls_internal_<MODULE>_process()
The type of the function pointers in the mbedtls_md_info_t struct have
also been modified taking into account the functions return code. Every
usage of the deprecated functions was updated. Furthermore, the MD return
codes are checked for error after every usage, except in the ssl_tls.c
module.
Bugfix Bugfix
* Fix ssl_parse_record_header() to silently discard invalid DTLS records * Fix ssl_parse_record_header() to silently discard invalid DTLS records
@ -118,8 +118,9 @@ Bugfix
mbedtls_sha512_starts() in the mbedtls_entropy_init() function. mbedtls_sha512_starts() in the mbedtls_entropy_init() function.
* Fix the entropy.c module to ensure that mbedtls_sha256_init() or * Fix the entropy.c module to ensure that mbedtls_sha256_init() or
mbedtls_sha512_init() is called before operating on the relevant context mbedtls_sha512_init() is called before operating on the relevant context
structure. Also, ensure that message digest contexts are freed when structure. Do not assume that zeroizing a context is a correct way to
calling mbedtls_entropy_free(). reset it. Found independently by ccli8 on Github.
* In mbedtls_entropy_free(), properly free the message digest context.
Changes Changes
* Extend cert_write example program by options to set the CRT version * Extend cert_write example program by options to set the CRT version
@ -132,6 +133,10 @@ Changes
* Only run AES-192 self-test if AES-192 is available. Fixes #963. * Only run AES-192 self-test if AES-192 is available. Fixes #963.
* Tighten the RSA PKCS#1 v1.5 signature verification code and remove the * Tighten the RSA PKCS#1 v1.5 signature verification code and remove the
undeclared dependency of the RSA module on the ASN.1 module. undeclared dependency of the RSA module on the ASN.1 module.
* Update all internal usage of deprecated message digest functions to the
new ones with return codes. In particular, this modifies the
mbedtls_md_info_t structure. Propagate errors from these functions
everywhere except some locations in the ssl_tls.c module.
= mbed TLS 2.6.0 branch released 2017-08-10 = mbed TLS 2.6.0 branch released 2017-08-10