Skip to content

Commit

Permalink
doc: update doc
Browse files Browse the repository at this point in the history
  • Loading branch information
Taowyoo committed Jun 27, 2023
1 parent 37cb8b7 commit 5d41796
Showing 1 changed file with 9 additions and 7 deletions.
16 changes: 9 additions & 7 deletions 3.X-migration-guide.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# Overview of changes in 3.X mbedtls

- Update vendor `mbedtls` code from version `2.28.3` to a commit at development version: [0b3de6fce](https://github.com/Mbed-TLS/mbedtls/commit/0b3de6fce)
- Please checkout C `mbedtls` migration guide for 3.X here [3.0-migration-guide.md](https://github.com/fortanix/rust-mbedtls/blob/yx/upgrade-mbedtls/mbedtls-sys/vendor/docs/3.0-migration-guide.md) to
- The vendor code at this commit includes the **TLS server side version negotiation** which implements the requirements for [rfc844 4.2.1](https://www.rfc-editor.org/rfc/rfc8446#section-4.2.1)
- This is a temporary approach at current time point since upstream has not released major version ( `3.5.0` ) that contains the **Server Side Version Negotiation**, we need to upgrade to `3.5.0` once it's released, its estimated release date is 2023-09-30, Ref: https://github.com/orgs/Mbed-TLS/
- Please checkout C `mbedtls` [3.0-migration-guide.md](https://github.com/fortanix/rust-mbedtls/blob/yx/upgrade-mbedtls/mbedtls-sys/vendor/docs/3.0-migration-guide.md) for more info
- The vendor code at this commit includes the **TLS server side version negotiation** which implements [rfc844 4.2.1](https://www.rfc-editor.org/rfc/rfc8446#section-4.2.1)
- This is a temporary approach at current time point since upstream has not released major version ( `3.5.0` ) that contains the **Server Side Version Negotiation**, we need to upgrade to `3.5.0` once it's released, its estimated release date is 2023-09-30, Ref: https://github.com/orgs/Mbed-TLS/
projects/1#column-19402885
- Update the build code for `mbedtls-sys-auto` crate to sync up with vendor code change:
- Changes in C DEFINE's for configuration
Expand Down Expand Up @@ -31,7 +31,9 @@

**Upstream changes:**

- :boom: Upgrade vendor `mbeldtls` code to `3.5.0-alpha.1+0b3de6f`, which is at commit in developent branch: [0b3de6fce](https://github.com/Mbed-TLS/mbedtls/commit/0b3de6fce) : this is needed to be able to use a functional complete TLS 1.3 stack implementation. Here I use the pre-release version value since upstream has not release `3.5.0` yet, see: https://doc.rust-lang.org/cargo/reference/semver.html
- :boom: Upgrade vendor `mbeldtls` code to version `3.5.0-alpha.1+0b3de6f`, it means we are using upstream code at commit [0b3de6fce](https://github.com/Mbed-TLS/mbedtls/commit/0b3de6fce): this is needed because it contains the server side version negotiation features which is necessary in a functional complete TLS 1.3 stack.

Note: Here we use a pre-release version since upstream has not release `3.5.0` yet. Ref: https://doc.rust-lang.org/cargo/reference/semver.html

**Changes on our side:**

Expand Down Expand Up @@ -118,10 +120,10 @@ Following changes are made according to [3.0-migration-guide.md](https://github.
- Add prefix `private_` to some fields of `mbedtls` types under `mbedtls/src/cipher/raw`
- :boom: Removed and added some options in `Error`, `CipherType`, `CipherMode` and `CipherSuite` to sync with changes in `mbedtls` 3.X
- :boom: `mbedtls/src/pk/ec.rs` : User need to provide a RNG callback for function `EcPoint::mul`, this originally is not a hard requirement, but in C `mbedtls` 3.X this become a hard requirement for blinding to defend side channel attack.
- :boom: `mbedtls/hash` :
- :boom: `mbedtls/hash` :
- `Md2` and `Md4` are removed since they are no longer supported in `mbedtls` 3.X
- fn `pbkdf_pkcs12` is removed since `pkcs12` is removed
- :boom: `mbedtls/pk/mod.rs` :
- fn `pbkdf_pkcs12` is removed since `pkcs12` is removed
- :boom: `mbedtls/pk/mod.rs` :
- Remove `CustomPk`
- User need to provide a RNG callback for `Pk::from_private_key`, this originally is not a hard requirement, but in C `mbedtls` 3.X this become a hard requirement for blinding to defend side channel attack.
- :boom: `mbedtls/src/ssl/ciphersuites.rs`: Rename `TlsCipherSuite` to `Tls12CipherSuite`, and add enum: `Tls13CipherSuite`, `IanaTlsNamedGroup`, `TLS13SignatureAlgorithms`: these are introduced by TLS 1.3
Expand Down

0 comments on commit 5d41796

Please sign in to comment.