Deprecate mbedtls_asn1_write_algorithm_identifier #605

New issue

Open

opened 2023-07-20 02:57:09 -05:00 by gilles-peskine-arm · 2 comments

gilles-peskine-arm commented

2023-07-20 02:57:09 -05:00

(Migrated from github.com)

After https://github.com/Mbed-TLS/mbedtls/pull/7788, we are no longer using mbedtls_asn1_write_algorithm_identifier, only mbedtls_asn1_write_algorithm_identifier_ext. I think this makes sense in general: the behavior of mbedtls_asn1_write_algorithm_identifier is specific to RSA-only code and can't be used by code that supports ECC (or DSA). So I think we should deprecate mbedtls_asn1_write_algorithm_identifier.

Note that this means that mbedtls_asn1_write_algorithm_identifier_ext should be tested independently of mbedtls_asn1_write_algorithm_identifier. This should have been the case anyway, but it currently isn't.

Note: I'm not sure if the interface of mbedtls_asn1_write_algorithm_identifier_ext really makes sense. We could just require the caller to write the null parameter before calling writing the function, just like the caller has to write any other parameter before calling the function. As I write, we can still change that because mbedtls_asn1_write_algorithm_identifier_ext was added after the last release, but we have to do it before the 3.5 release or else we're stuck until 4.0.

After https://github.com/Mbed-TLS/mbedtls/pull/7788, we are no longer using `mbedtls_asn1_write_algorithm_identifier`, only `mbedtls_asn1_write_algorithm_identifier_ext`. I think this makes sense in general: the behavior of `mbedtls_asn1_write_algorithm_identifier` is specific to RSA-only code and can't be used by code that supports ECC (or DSA). So I think we should deprecate `mbedtls_asn1_write_algorithm_identifier`. Note that this means that `mbedtls_asn1_write_algorithm_identifier_ext` should be tested independently of `mbedtls_asn1_write_algorithm_identifier`. This should have been the case anyway, but it currently isn't. Note: I'm not sure if the interface of `mbedtls_asn1_write_algorithm_identifier_ext` really makes sense. We could just require the caller to write the null parameter before calling writing the function, just like the caller has to write any other parameter before calling the function. As I write, we can still change that because `mbedtls_asn1_write_algorithm_identifier_ext` was added after the last release, but we have to do it before the 3.5 release or else we're stuck until 4.0.

gilles-peskine-arm commented

2024-08-08 11:25:56 -05:00

(Migrated from github.com)

Now that we've released the last 3.x minor release, all that's left is to remove mbedtls_asn1_write_algorithm_identifier. We need to adapt the tests to test mbedtls_asn1_write_algorithm_identifier_ext.

Changing the interface of mbedtls_asn1_write_algorithm_identifier_ext as described in the issue is an optional improvement which we may do at the same time we adjust the tests.

Now that we've released the last 3.x minor release, all that's left is to remove `mbedtls_asn1_write_algorithm_identifier`. We need to adapt the tests to test `mbedtls_asn1_write_algorithm_identifier_ext`. Changing the interface of `mbedtls_asn1_write_algorithm_identifier_ext` as described in the issue is an optional improvement which we may do at the same time we adjust the tests.

gilles-peskine-arm commented

2025-12-11 12:45:18 -06:00

(Migrated from github.com)

We missed the boat for TF-PSA-Crypto 1.0 too. It's still relevant, and we can do it in some later 1.x release.

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto#605

No description provided.

Rows
Columns