diff options
| author | Frédéric Desbiens <[email protected]> | 2026-06-08 10:03:52 +0200 |
|---|---|---|
| committer | GitHub <[email protected]> | 2026-06-08 10:03:52 +0200 |
| commit | 1a0e9e43a03e37ddecfb6b49e9b078d6e1803d05 (patch) | |
| tree | c60ec41b4ff4fd2d7566c505cbdd423ceddd65f3 /nx_secure/src/nx_secure_tls_send_certificate_verify.c | |
| parent | 8b6e03ac30ab688bec02c69d42f2304b7f72a202 (diff) | |
| parent | 4d88828b06d164a5b7e82152395a92254abcd6e4 (diff) | |
Merge pull request #391 from eclipse-threadx/devv6.5.1.202602_reldev
Merging changes for the v.6.5.1.202602 release
Diffstat (limited to 'nx_secure/src/nx_secure_tls_send_certificate_verify.c')
| -rw-r--r-- | nx_secure/src/nx_secure_tls_send_certificate_verify.c | 21 |
1 files changed, 12 insertions, 9 deletions
diff --git a/nx_secure/src/nx_secure_tls_send_certificate_verify.c b/nx_secure/src/nx_secure_tls_send_certificate_verify.c index c022250a..35c10355 100644 --- a/nx_secure/src/nx_secure_tls_send_certificate_verify.c +++ b/nx_secure/src/nx_secure_tls_send_certificate_verify.c @@ -28,7 +28,7 @@ #endif /* NX_SECURE_ENABLE_DTLS */ #ifndef NX_SECURE_DISABLE_X509 -static UCHAR handshake_hash[64 + 34 + 32]; /* We concatenate MD5 and SHA-1 hashes into this buffer, OR SHA-256. */ +static UCHAR handshake_hash[64 + 34 + 64]; /* We concatenate MD5 and SHA-1 hashes into this buffer, OR SHA-256/384/512. */ static UCHAR _nx_secure_padded_signature[600]; #if (NX_SECURE_TLS_TLS_1_2_ENABLED) @@ -241,19 +241,22 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; NX_SECURE_MEMCPY(&handshake_hash[64], server_context, 34); /* Use case of memcpy is verified. */ } - /* Copy in transcript hash. */ - NX_SECURE_MEMCPY(&handshake_hash[64 + 34], transcript_hash, 32); /* Use case of memcpy is verified. */ - - handshake_hash_length = 130; - - - /* Generate a hash of the data we just produced. */ - /* Use SHA-256 for now... */ + /* Determine hash method and transcript hash length before copying. + hash_method drives the transcript hash size: 32 (SHA-256), 48 (SHA-384), 64 (SHA-512). */ hash_method = crypto_methods -> nx_secure_x509_hash_method; metadata = tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch; metadata_size = tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch_size; + { + UINT transcript_hash_len = (UINT)(hash_method -> nx_crypto_ICV_size_in_bits >> 3); + + /* Copy in transcript hash — length depends on negotiated hash algorithm. */ + NX_SECURE_MEMCPY(&handshake_hash[64 + 34], transcript_hash, transcript_hash_len); /* Use case of memcpy is verified. */ + + handshake_hash_length = 64u + 34u + transcript_hash_len; + } + if (hash_method -> nx_crypto_init) { |