netxduo.git/nx_secure/src/nx_secure_process_server_key_exchange.c, branch devUnnamed repository; edit this file 'description' to name the repository.http://cgit.235523.xyz/netxduo.git/atom/nx_secure/src/nx_secure_process_server_key_exchange.c?h=dev2026-05-21T19:23:32ZAdded RSA-PSS signature verification support (TLS 1.3 with RSA cert) (#377)2026-05-21T19:23:32ZEdouard Malotedouard.malot@gmail.com2026-05-21T19:23:32Zurn:sha1:17d3abf227d9be925fd0559366e8ac91a7504e4c
* Add RSA-PSS
* Fix SHA-384/512 transcript hash truncation and add MGF1 bounds check
Address review feedback on RSA-PSS PR:
- Resize handshake_hash buffer from 130 to 162 bytes (64+34+64) in
both nx_secure_tls_process_certificate_verify.c and
nx_secure_tls_send_certificate_verify.c to fit SHA-512 transcript.
- Replace hardcoded 32-byte transcript hash copy with dynamic length
derived from hash_method->nx_crypto_ICV_size_in_bits.
- Add bounds check in _nx_crypto_rsa_pss_mgf1 to reject hash_method
whose output exceeds the local hash_buf size.
* Fix RSA-PSS verify in TLS 1.2 ServerKeyExchange
Extend RSA-PSS support to TLS 1.2 ServerKeyExchange signature verify:
- nx_secure_process_server_key_exchange.c: detect RSA-PSS wire codes
(0x0804/0805/0806) and dispatch to _nx_crypto_rsa_pss_verify after
RSA decrypt; PKCS#1 v1.5 path kept for non-PSS signatures.
- nx_secure_tls_process_clienthello_extensions.c: map RSA-PSS wire
codes to the existing RSA SHA-256/384/512 internal IDs so the
certificate cipher table lookup finds the right hash method.Updated copyright headers and version strings. Removed version history2026-03-06T23:14:18ZFrédéric Desbiensfrederic.desbiens@eclipse-foundation.org2026-03-06T23:14:18Zurn:sha1:ff90b3ffcb84b2c6099ec31ef032b541e1ef5f0aFixed ServerKeyExchange processing for PSK and non-PSK ciphersuites in nx_secure2026-03-06T22:15:20ZFrédéric Desbiensfrederic.desbiens@eclipse-foundation.org2026-03-06T22:15:20Zurn:sha1:4d8e5e7a15ba18e8616713d0c7567d7c3b88c687Fixed ECDHE_PSK cipher suites implementation. (#342)2025-10-01T08:46:36ZFrédéric Desbiensfrederic.desbiens@eclipse-foundation.org2025-10-01T08:46:36Zurn:sha1:582a3604fb3cef42cf53e179697fdd7f47481eb4
* Restored ECC_CIPHERSUITE ifdef code.
* Added ifdefs to exclude PSK code when build options require it.Support for ECDHE_PSK in process server key exchange2025-06-12T18:06:59ZIgor Tomiattiigor.tomiatti@lactec.com.br2025-06-12T18:06:59Zurn:sha1:258898c025ae1bbca1d1b068fdfecad1ebcc01baUpdated version numbers to 6.4.32025-03-18T14:24:08ZFrédéric Desbiensfrederic.desbiens@eclipse-foundation.org2025-03-18T14:24:08Zurn:sha1:c82ea77c4bf3a3e25b6f622e59465998f8c6e738Update copyright.2024-01-29T03:03:49ZBo Chen (from Dev Box)boche@microsoft.com2024-01-29T03:03:49Zurn:sha1:6c6e58cb977dd1c08d2d344624e7d30d15d48d35Release 6.2.1 on 08 Mar 2023. Expand to see details.2023-03-08T08:27:44ZTiejun Zhoutizho@microsoft.com2023-03-08T08:27:44Zurn:sha1:e054d6afd1e52c445512a513bd8c375565b848ea
29eee6fe8 Update function header and version to 6.2.1
e22a02169 Fix compile errors in TLS
3e0a14c1c Fix network driver for regression test.
442f3adfa Fix compiler warnings in NetXDuo
Update on 18 Jan 2023. Expand to see details.2023-01-18T08:40:56ZTiejun Zhoutizho@microsoft.com2023-01-18T08:40:56Zurn:sha1:a34a65efae141f909378a37686e4f9da5ee796c5
5849a60fa Fix compile errors when NX_SECURE_DISABLE_X509 is defined.
775a624ac Remove internal deprecated files.
fa4680237 Clear MQTT password while X509 authentication is selected
5cb6488b4 Add a notice for not released file.
7600d5747 Upgrade to the latest Container Images.
3fdcc4420 [ADU] Add secondary root key and remove testing key.
Release 6.2.02022-10-26T23:42:00ZTiejun Zhoutizho@microsoft.com2022-10-26T23:42:00Zurn:sha1:70e556388ea78bea930921daf24f0bff1980cc7b