Skip to content

TLS "suite B" profile should not include RSA #8221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
mpg opened this issue Sep 18, 2023 · 1 comment · Fixed by #8554
Closed

TLS "suite B" profile should not include RSA #8221

mpg opened this issue Sep 18, 2023 · 1 comment · Fixed by #8554
Assignees
@yanrayw
Labels
bug size-s Estimated task size: small (~2d)

Comments

@mpg
Copy link
Contributor

mpg commented Sep 18, 2023

Summary

The "NSA Suite B" profile for TLS is defined in RFC 5430. One of its defining characteristic is that all the asymmetric crypto is based on elliptic curves - not RSA or FFDH.

However at some point it looks like we ended up adding RSA signatures to ssl_preset_suiteb_sig_algs and ssl_tls12_preset_suiteb_sig_algs in ssl_tls.c. This is wrong and should be fixed.

(Note: the "suite B" profile in X.509 is unaffected.)
@mpg mpg added the bug label Sep 18, 2023
@daverodgman daverodgman added the size-s Estimated task size: small (~2d) label Sep 18, 2023
@daverodgman
Copy link
Contributor

We should also review the rest of the suite B ssl_preset_suiteb_xxx presets to check that they match the RFC.

@yanrayw yanrayw self-assigned this Nov 22, 2023
@yanrayw yanrayw mentioned this issue Nov 22, 2023
Merged
3 tasks
@LiLongNXP LiLongNXP mentioned this issue Aug 8, 2024
Closed
@github-project-automation github-project-automation bot moved this to [3.6] TLS 1.3 misc for LTS in Backlog for Mbed TLS Aug 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@yanrayw yanrayw

Labels
bug size-s Estimated task size: small (~2d)
Projects
Backlog for Mbed TLS
Status: [3.6] TLS 1.3 misc for LTS
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

TLS: remove RSA signature algorithms in suite B profile yanrayw/mbedtls
3 participants
@mpg @daverodgman @yanrayw