Updated mbedTLS certificate chain validity check #21741
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pullapprove
bot
requested review from
andy31415,
anush-apple,
arkq,
Byungjoo-Lee,
bzbarsky-apple,
carol-apple,
chrisdecenzo,
chshu,
chulspro,
Damian-Nordic,
dhrishi,
electrocucaracha,
franck-apple,
gjc13,
harimau-qirex,
harsha-rajendran,
hawk248,
isiu-apple,
jelderton,
jepenven-silabs,
jmartinez-silabs,
jtung-apple,
kghost,
kpschoedel,
lazarkov,
LuDuda,
mlepage-google and
msandstedt
pullapprove
bot
requested review from
vijs,
vivien-apple,
wbschiller,
woody-apple,
xylophone21,
yufengwangca and
yunhanw-google
|
PR #21741: Size comparison from 7a981fd to eda34c5 Increases (4 builds for cc13x2_26x2, cyw30739, esp32)
Decreases (3 builds for cc13x2_26x2, linux, telink)
Full report (32 builds for bl602, cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
woody-apple
approved these changes
Aug 9, 2022
emargolis
force-pushed
the
emargolis/feature/update-mbedtls-callback-implementation
branch
from
5fdd2c6 to
65e2245
Compare
|
PR #21741: Size comparison from abc83fd to 65e2245 Increases (4 builds for bl602, cc13x2_26x2, esp32, telink)
Decreases (3 builds for cc13x2_26x2, linux, telink)
Full report (32 builds for bl602, cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
woody-apple
force-pushed
the
emargolis/feature/update-mbedtls-callback-implementation
branch
from
65e2245 to
e7ff106
Compare
|
PR #21741: Size comparison from 397d642 to e7ff106 Increases (3 builds for cc13x2_26x2, esp32)
Decreases (10 builds for bl602, cc13x2_26x2, cyw30739, linux, telink)
Full report (43 builds for bl602, cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
tcarmelveilleux
approved these changes
Aug 10, 2022
- Updated mbedTLS callback function to implement Matter cautom certificate chain
validity logic.
- Implemented the same changes in the TinyCrypt library.
- Removed IsCertificateValidAtIssuance() checks from the DefaultDeviceAttestationVerifier.cpp
because these checks are now performed by the ValidateCertificateChain() function.
- Added new negative test cases.
emargolis
force-pushed
the
emargolis/feature/update-mbedtls-callback-implementation
branch
from
6b2b5a1 to
fff0eab
Compare
|
PR #21741: Size comparison from 0d64c0b to fff0eab Increases (7 builds for bl602, cc13x2_26x2, cyw30739, esp32, telink)
Decreases (6 builds for cc13x2_26x2, esp32, linux)
Full report (43 builds for bl602, cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
isiu-apple
pushed a commit
to isiu-apple/connectedhomeip
that referenced
this pull request
Sep 16, 2022
- Updated mbedTLS callback function to implement Matter cautom certificate chain
validity logic.
- Implemented the same changes in the TinyCrypt library.
- Removed IsCertificateValidAtIssuance() checks from the DefaultDeviceAttestationVerifier.cpp
because these checks are now performed by the ValidateCertificateChain() function.
- Added new negative test cases.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
PR #21531 Updated Attestation certificates time validity logic to match the spec.
As a result of that change the ValidateCertificateChain() function in the OpenSSL is performing these custom checks. The goal of this PR is to update mbedTLS implementation to do the same.
Ticket: #21621
Change overview
validity logic.
because these checks are now performed by the ValidateCertificateChain() function.
Testing
added new test cases. and existing tests