Skip to content

Commit 6023154

Browse files
tomi-fontanangl
tomi-font
authored and
anangl
committed
nrf_security: remove CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
Key exchanges/ciphersuites using RSA encryption have been removed starting with Mbed TLS 4.0. Replace them with other ciphersuites. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
1 parent 26bdffe commit 6023154

12 files changed

Lines changed: 6 additions & 15 deletions

File tree

‎samples/cellular/nrf_cloud_multi_service/boards/native_sim.conf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,6 @@ CONFIG_MBEDTLS_PEM_PARSE_C=y
109109
CONFIG_MBEDTLS_PEM_WRITE_C=y
110110
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED=y
111111
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED=y
112-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
113112
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y
114113
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=y
115114

‎samples/net/aws_iot/boards/native_sim.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ CONFIG_MBEDTLS_HEAP_SIZE=40000
3333
CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=7168
3434
CONFIG_MBEDTLS_PEM_PARSE_C=y
3535
CONFIG_MBEDTLS_PEM_WRITE_C=y
36-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
36+
CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
3737

3838
# DNS
3939
CONFIG_DNS_RESOLVER=y

‎samples/net/azure_iot_hub/boards/native_sim.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ CONFIG_MBEDTLS_HEAP_SIZE=40000
3636
CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=7168
3737
CONFIG_MBEDTLS_PEM_PARSE_C=y
3838
CONFIG_MBEDTLS_PEM_WRITE_C=y
39-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
39+
CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
4040

4141
# DNS
4242
CONFIG_DNS_RESOLVER=y

‎samples/net/download/boards/native_sim.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ CONFIG_MBEDTLS_HEAP_SIZE=40000
3434
CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=7168
3535
CONFIG_MBEDTLS_PEM_PARSE_C=y
3636
CONFIG_MBEDTLS_PEM_WRITE_C=y
37-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
37+
CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
3838

3939
# DNS
4040
CONFIG_DNS_RESOLVER=y

‎samples/net/http_server/overlay-tls-nrf91.conf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@ CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=y
5252
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y
5353

5454
# Enable RSA
55-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
5655
CONFIG_MBEDTLS_PKCS1_V15=y
5756
CONFIG_MBEDTLS_MPI_MAX_SIZE=512
5857
CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=y

‎samples/net/https_client/boards/native_sim.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ CONFIG_MBEDTLS_HEAP_SIZE=40000
2727
CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=7168
2828
CONFIG_MBEDTLS_PEM_PARSE_C=y
2929
CONFIG_MBEDTLS_PEM_WRITE_C=y
30-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
30+
CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
3131

3232
# DNS
3333
CONFIG_DNS_RESOLVER=y

‎samples/net/mqtt/overlay-tls-native_sim.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ CONFIG_MBEDTLS_HEAP_SIZE=120000
2424
CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=16384
2525
CONFIG_MBEDTLS_PEM_PARSE_C=y
2626
CONFIG_MBEDTLS_PEM_WRITE_C=y
27-
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
27+
CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
2828

2929
# NET Sockets
3030
CONFIG_NET_SOCKETS_SOCKOPT_TLS=y

‎samples/net/udp/boards/native_sim.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ CONFIG_NET_TCP=y
99
CONFIG_NET_UDP=y
1010
CONFIG_NET_SOCKETS=y
1111
CONFIG_POSIX_API=y
12+
CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
1213
CONFIG_NET_SOCKETS_SOCKOPT_TLS=y
1314
CONFIG_NET_PKT_RX_COUNT=32
1415
CONFIG_NET_PKT_TX_COUNT=32

‎subsys/nrf_security/Kconfig.tls‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -430,11 +430,6 @@ config MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
430430
depends on MBEDTLS_HAS_CIPHER_MODE_CIPHERSUITE_REQUIREMENTS && \
431431
MBEDTLS_HAS_RSA_CIPHERSUITE_REQUIREMENTS
432432

433-
config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
434-
bool "RSA"
435-
default y if !OPENTHREAD
436-
depends on MBEDTLS_HAS_RSA_CIPHERSUITE_REQUIREMENTS
437-
438433
config MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
439434
bool "DHE RSA"
440435
default y if !OPENTHREAD

‎subsys/nrf_security/cmake/legacy_crypto_config.cmake‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,6 @@ kconfig_check_and_set_base(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
176176
kconfig_check_and_set_base(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
177177
kconfig_check_and_set_base(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
178178
kconfig_check_and_set_base(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
179-
kconfig_check_and_set_base(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
180179
kconfig_check_and_set_base(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
181180
kconfig_check_and_set_base(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED)
182181
kconfig_check_and_set_base(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)

0 commit comments

Comments
 (0)