Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move MBEDTLS_CIPHER_NULL_CIPHER to TLS and maybe rename #9865

Open
gilles-peskine-arm opened this issue Dec 19, 2024 · 0 comments
Open

Move MBEDTLS_CIPHER_NULL_CIPHER to TLS and maybe rename #9865

gilles-peskine-arm opened this issue Dec 19, 2024 · 0 comments
Assignees
Labels
component-crypto Crypto primitives and low-level interfaces component-tls enhancement

Comments

@gilles-peskine-arm
Copy link
Contributor

MBEDTLS_CIPHER_NULL_CIPHER controls whether null cipher suites are enabled in TLS. For historical reasons due to how null cipher suites were implemented (using functionality from cipher.h), it was a crypto option, and at the time of the repo split, it went into TF-PSA-Crypto. However, it has no useful effect on crypto (it just enables some code in cipher.c which is not reachable from any public API of TF-PSA-Crypto 1.0). But it is still needed in TLS, to control whether null cipher suites are enabled.

The goal of this issue is:

  • Remove MBEDTLS_CIPHER_NULL_CIPHER from the list of selectable options in the TF-PSA-Crypto configuration file.
  • Optionally remove all code and tests guarded by MBEDTLS_CIPHER_NULL_CIPHER. This can wait until after the 1.0 release.
  • Add MBEDTLS_CIPHER_NULL_CIPHER to mbedts_config.h in Mbed TLS.
  • Optionally, rename MBEDTLS_CIPHER_NULL_CIPHER to MBEDTLS_SSL_NULL_CIPHER (name TBD).
  • Make sure that null cipher suites are still tested (if they aren't, outcome analysis should complain).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component-crypto Crypto primitives and low-level interfaces component-tls enhancement
Projects
None yet
Development

No branches or pull requests

2 participants