diff options
| author | Frédéric Desbiens <[email protected]> | 2026-06-08 10:03:52 +0200 |
|---|---|---|
| committer | GitHub <[email protected]> | 2026-06-08 10:03:52 +0200 |
| commit | 1a0e9e43a03e37ddecfb6b49e9b078d6e1803d05 (patch) | |
| tree | c60ec41b4ff4fd2d7566c505cbdd423ceddd65f3 /nx_secure/src/nx_secure_tls_send_clienthello_extensions.c | |
| parent | 8b6e03ac30ab688bec02c69d42f2304b7f72a202 (diff) | |
| parent | 4d88828b06d164a5b7e82152395a92254abcd6e4 (diff) | |
Merge pull request #391 from eclipse-threadx/devv6.5.1.202602_reldev
Merging changes for the v.6.5.1.202602 release
Diffstat (limited to 'nx_secure/src/nx_secure_tls_send_clienthello_extensions.c')
| -rw-r--r-- | nx_secure/src/nx_secure_tls_send_clienthello_extensions.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/nx_secure/src/nx_secure_tls_send_clienthello_extensions.c b/nx_secure/src/nx_secure_tls_send_clienthello_extensions.c index 0c9ce53b..08364122 100644 --- a/nx_secure/src/nx_secure_tls_send_clienthello_extensions.c +++ b/nx_secure/src/nx_secure_tls_send_clienthello_extensions.c @@ -451,6 +451,28 @@ UCHAR sig_algo = 0; } } + /* TLS 1.3 requires RSA-PSS instead of PKCS#1 v1.5 (RFC 8446 §4.2.3). + Map RSA + SHA-256/384/512 to rsa_pss_rsae_sha256/384/512 (0x0804/0805/0806). */ + if (tls_session -> nx_secure_tls_1_3 && + sig_algo == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA) + { + switch (hash_algo) + { + case NX_SECURE_TLS_HASH_ALGORITHM_SHA256: + *signature_algorithm = 0x0804u; /* rsa_pss_rsae_sha256 */ + break; + case NX_SECURE_TLS_HASH_ALGORITHM_SHA384: + *signature_algorithm = 0x0805u; /* rsa_pss_rsae_sha384 */ + break; + case NX_SECURE_TLS_HASH_ALGORITHM_SHA512: + *signature_algorithm = 0x0806u; /* rsa_pss_rsae_sha512 */ + break; + default: + *signature_algorithm = 0; + } + return; + } + /* In TLS 1.3, the signing curve is constrained. */ if (tls_session -> nx_secure_tls_1_3 && (named_curve != 0) && |