| Age | Commit message (Collapse) | Author |
|---|
|
* Add RSA-PSS
* Fix SHA-384/512 transcript hash truncation and add MGF1 bounds check
Address review feedback on RSA-PSS PR:
- Resize handshake_hash buffer from 130 to 162 bytes (64+34+64) in
both nx_secure_tls_process_certificate_verify.c and
nx_secure_tls_send_certificate_verify.c to fit SHA-512 transcript.
- Replace hardcoded 32-byte transcript hash copy with dynamic length
derived from hash_method->nx_crypto_ICV_size_in_bits.
- Add bounds check in _nx_crypto_rsa_pss_mgf1 to reject hash_method
whose output exceeds the local hash_buf size.
* Fix RSA-PSS verify in TLS 1.2 ServerKeyExchange
Extend RSA-PSS support to TLS 1.2 ServerKeyExchange signature verify:
- nx_secure_process_server_key_exchange.c: detect RSA-PSS wire codes
(0x0804/0805/0806) and dispatch to _nx_crypto_rsa_pss_verify after
RSA decrypt; PKCS#1 v1.5 path kept for non-PSS signatures.
- nx_secure_tls_process_clienthello_extensions.c: map RSA-PSS wire
codes to the existing RSA SHA-256/384/512 internal IDs so the
certificate cipher table lookup finds the right hash method.
|
|
|
|
Fix length checking in supported version extension, add test
|
|
|
|
The check is in the function
_nx_secure_tls_process_clienthello_psk_extension and was reported
as a vulnerability.
|
|
|
|
|
|
29eee6fe8 Update function header and version to 6.2.1
e22a02169 Fix compile errors in TLS
3e0a14c1c Fix network driver for regression test.
442f3adfa Fix compiler warnings in NetXDuo
|
|
5849a60fa Fix compile errors when NX_SECURE_DISABLE_X509 is defined.
775a624ac Remove internal deprecated files.
fa4680237 Clear MQTT password while X509 authentication is selected
5cb6488b4 Add a notice for not released file.
7600d5747 Upgrade to the latest Container Images.
3fdcc4420 [ADU] Add secondary root key and remove testing key.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
