From 7ccaf56b4295d799fa3507a46a663d558ea7247f Mon Sep 17 00:00:00 2001 From: dsugisawa-mixi Date: Sun, 13 Sep 2026 17:22:33 +0900 Subject: [PATCH] Do not pin the DTLS key policy to SHA-256 on Mbed TLS 4 The PSA key generated for the ephemeral DTLS certificate permits exactly one hash, but the hash used for CertificateVerify is not ours to choose -- it comes out of the peer's CertificateRequest. Against Cloudflare Calls the negotiated ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 and the CertificateRequest offers sha256, sha384, sha512 and ed25519. Mbed TLS picks SHA-384, hands PSA a 48-byte hash, and the key policy rejects it: ssl_tls12_client.c:2745: mbedtls_pk_sign_restartable() returned -135 (-0x0087) dtls_srtp.c 665 failed! mbedtls_ssl_handshake returned -0x0087 -135 is PSA_ERROR_INVALID_ARGUMENT. It fails late enough to be confusing: the master secret is exported and both SRTP sessions are created before the handshake gives up. PSA_ALG_ANY_HASH in a key policy is what PSA provides for this case, the hash being chosen per-operation by the protocol. The Mbed TLS 3 path has no such restriction -- mbedtls_ecp_gen_key produces a plain key that can sign under any hash -- so only the 4.x branch is affected. Verified against Cloudflare Calls with mbedtls v4.1.0: the CertificateVerify hash is still SHA-384, and the handshake now completes. --- src/dtls_srtp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/dtls_srtp.c b/src/dtls_srtp.c index 8f2ed91e..c5362b15 100644 --- a/src/dtls_srtp.c +++ b/src/dtls_srtp.c @@ -71,11 +71,11 @@ static int dtls_srtp_generate_keypair(DtlsSrtp* dtls_srtp) { psa_set_key_usage_flags(&attr, PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_VERIFY_HASH); #if CONFIG_DTLS_USE_ECDSA - psa_set_key_algorithm(&attr, MBEDTLS_PK_ALG_ECDSA(PSA_ALG_SHA_256)); + psa_set_key_algorithm(&attr, MBEDTLS_PK_ALG_ECDSA(PSA_ALG_ANY_HASH)); psa_set_key_type(&attr, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)); psa_set_key_bits(&attr, 256); #else - psa_set_key_algorithm(&attr, PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256)); + psa_set_key_algorithm(&attr, PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH)); psa_set_key_type(&attr, PSA_KEY_TYPE_RSA_KEY_PAIR); psa_set_key_bits(&attr, RSA_KEY_LENGTH); #endif