Deprecate Mbed Crypto #395

2020-04-22T13:25:17-05:00

gilles-peskine-arm commented

2020-04-22 13:25:17 -05:00

(Migrated from github.com)

Mbed Crypto is no longer being updated, but this is not visible on https://github.com/ARMmbed/mbed-crypto. In this pull request, I update the readme to let people know to use Mbed TLS instead.

To ease the transition, I propose to have a short transition period during which we fix the security issues in Mbed Crypto, and building the library is still possible but shows a warning. After this transition period, we'll make a last patch to cause the library to fail to build.

To verify what security fixes needed to be backported:

git log --decorate --name-status upstream-public/pr/3085..mbedtls-2.22.0 -- library ':!library/ssl_*' ':!library/x509*'

I saw only one relevant commit.

Mbed Crypto is no longer being updated, but this is not visible on https://github.com/ARMmbed/mbed-crypto. In this pull request, I update the readme to let people know to use Mbed TLS instead. To ease the transition, I propose to have a short transition period during which we fix the security issues in Mbed Crypto, and building the library is still possible but shows a warning. After this transition period, we'll make a last patch to cause the library to fail to build. To verify what security fixes needed to be backported: ``` git log --decorate --name-status upstream-public/pr/3085..mbedtls-2.22.0 -- library ':!library/ssl_*' ':!library/x509*' ``` I saw only one relevant commit.

yanesca commented

2020-04-23 03:54:18 -05:00

(Migrated from github.com)

I have confirmed that all currently available security fixes have been backported, checked spelling and I am happy with the transition period and how it is implemented and documented.

I have only one minor question: In README.md we are asking for feedback on the API to be mailed to mbed-crypto@arm.com. Is this address still live and being monitored? We also mention that opening an issue on this repository is an other way to give feedback. Will these issues continue to be monitored in the future?

I have confirmed that all currently available security fixes have been backported, checked spelling and I am happy with the transition period and how it is implemented and documented. I have only one minor question: In `README.md` we are asking for feedback on the API to be mailed to mbed-crypto@arm.com. Is this address still live and being monitored? We also mention that opening an issue on this repository is an other way to give feedback. Will these issues continue to be monitored in the future?

danh-arm (Migrated from github.com) requested changes

2020-04-23 04:57:19 -05:00

danh-arm (Migrated from github.com) left a comment

Just minor comments. The intent of the change looks good to me.

README.md

					
				@ -16,85 +31,5 @@ The design goals of the PSA cryptography API include:

				* The interface to algorithms is generic, favoring algorithm agility.

As @yanesca said, we should not say "open an issue on our Github repository". We should refer to the psa-crypto mailing list. Actually, we have the same issue on development.

The reference mbed-crypto@arm.com is fine though (that's still active)

As @yanesca said, we should not say "open an issue on our Github repository". We should refer to the psa-crypto mailing list. Actually, we have the same issue on development. The reference mbed-crypto@arm.com is fine though (that's still active)

tests/scripts/all.sh