yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-23 05:55:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

Document more precisely what goes into the default profile

Browse Source 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2021-06-07 21:24:26 +02:00
parent 62da8ac37a
commit 0ecd719edf
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
include/mbedtls/x509_crt.h
View File

@ -263,12 +263,21 @@ typedef void mbedtls_x509_crt_restart_ctx;
/** /**
* Default security profile. Should provide a good balance between security * Default security profile. Should provide a good balance between security
* and compatibility with current deployments. * and compatibility with current deployments.
*
* This profile permits:
* - SHA2 hashes.
* - All supported elliptic curves.
* - RSA with 2048 bits and above.
*
* New minor versions of Mbed TLS may extend this profile, for example if
* new curves are added to the library. New minor versions of Mbed TLS will
* not reduce this profile unless serious security concerns require it.
*/ */
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default; extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default;
/** /**
* Expected next default profile. Recommended for new deployments. * Expected next default profile. Recommended for new deployments.
* Currently targets a 128-bit security level, except for RSA-2048. * Currently targets a 128-bit security level, except for allowing RSA-2048.
*/ */
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next; extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next;

5
library/x509_crt.c
View File

@ -91,9 +91,8 @@ typedef struct {
*/ */
#define X509_MAX_VERIFY_CHAIN_SIZE ( MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2 ) #define X509_MAX_VERIFY_CHAIN_SIZE ( MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2 )
/* /* Default profile. Do not remove items unless there are serious security
* Default profile * concerns. */
*/
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default = const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default =
{ {
#if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES) #if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES)