Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2025-12-21 21:36:21 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove SHA-1 as a fallback option

Browse source 
- it's 2020, there shouldn't be too many systems out there where SHA-1 is the
  only available hash option, so its usefulness is limited
- OTOH testing configurations without SHA-2 reveal bugs that are not easy to
  fix in a fully compatible way

So overall, the benefit/cost ratio is not good enough to justify keeping SHA-1
as a fallback option here.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2020-06-18 12:14:34 +02:00
parent 2ebb1e18e9
commit 2df5857dbe
5 changed files with 17 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

26
tests/scripts/all.sh
View file

@ -854,32 +854,6 @@ component_test_no_drbg_no_sha512 () {
# no SSL tests as they all depend on having a DRBG
}
component_test_no_drbg_no_sha2 () {
# this tests the internal ECP DRBG using a KDF based on SHA-1
msg "build: Default minus DRBGs minus SHA-2"
scripts/config.pl unset MBEDTLS_CTR_DRBG_C
scripts/config.pl unset MBEDTLS_HMAC_DRBG_C
scripts/config.pl unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_C # requires a DRBG
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
scripts/config.pl unset MBEDTLS_SHA512_C
scripts/config.pl unset MBEDTLS_SHA256_C
scripts/config.pl unset MBEDTLS_ENTROPY_C # requires SHA-2
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_C # requires Entropy
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA Crypto
scripts/config.pl unset MBEDTLS_PSA_CRYPTO_SE_C # requires PSA Crypto
scripts/config.pl unset MBEDTLS_USE_PSA_CRYPTO # requires PSA Crypto
scripts/config.pl unset MBEDTLS_SSL_PROTO_TLS1_2 # requires SHA-2
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
make
msg "test: Default minus DRBGs minus SHA-2"
make test
# no SSL tests as they all depend on having a DRBG
}
component_test_ecp_no_internal_rng () {
msg "build: Default plus ECP_NO_INTERNAL_RNG minus DRBG modules"
scripts/config.pl set MBEDTLS_ECP_NO_INTERNAL_RNG