wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-08-10 22:41:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update cert_with_extern_psk references from RFC 8773bis to RFC 9973

Browse Source 
RFC 9973 "TLS 1.3 Extension for Using Certificates with an External
Pre-Shared Key" is now published and obsoletes RFC 8773. The
cert_with_extern_psk implementation was written against the 8773bis
draft that became RFC 9973, so it is already compliant.

Update the textual references in comments, the configure help comment,
the extension codepoint comment, a test comment, and the Doxygen docs.
This is a documentation only change. The WOLFSSL_CERT_WITH_EXTERN_PSK
macro, the --enable-cert-with-extern-psk option, the public API names,
and the extension codepoint 33 (0x0021) are all unchanged, and no logic
is affected. Historical ChangeLog and README entries are left as they
shipped.
This commit is contained in:
Tobias Frauenschläger
2026-07-17 11:04:24 +02:00
parent d0f5bce96b
commit bfdecbc644
6 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
+1 -1
View File
@@ -5490,7 +5490,7 @@ then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PSK_ONE_ID"
fi
# Certificate Authentication with External PSK (RFC 8773bis)
# Certificate Authentication with External PSK (RFC 9973, obsoletes RFC 8773)
AC_ARG_ENABLE([cert-with-extern-psk],
[AS_HELP_STRING([--enable-cert-with-extern-psk],[Enable Certificate Authentication with External PSKs for TLS 1.3 (default: disabled)])],
[ ENABLED_CERT_WITH_EXTERN_PSK=$enableval ],
doc/dox_comments/header_files/ssl.h
+2 -2
View File
@@ -15313,7 +15313,7 @@ void wolfSSL_set_psk_server_tls13_callback(WOLFSSL* ssl,
\ingroup Setup
\brief Enable or disable TLS 1.3 certificate authentication with external
PSK (RFC8773bis) on a context.
PSK (RFC 9973) on a context.
When enabled, wolfSSL advertises and accepts the
`tls_cert_with_extern_psk` extension for TLS 1.3 handshakes using external
@@ -15348,7 +15348,7 @@ int wolfSSL_CTX_set_cert_with_extern_psk(WOLFSSL_CTX* ctx, int state);
\ingroup Setup
\brief Enable or disable TLS 1.3 certificate authentication with external
PSK (RFC8773bis) on a connection.
PSK (RFC 9973) on a connection.
This call applies to a single WOLFSSL object. Any non-zero \p state value
enables the feature and zero disables it.
src/tls.c
+5 -5
View File
@@ -16694,7 +16694,7 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
#endif
#if defined(WOLFSSL_CERT_WITH_EXTERN_PSK)
if (ssl->options.certWithExternPsk) {
/* RFC8773bis requires psk_dhe_ke with cert_with_extern_psk. */
/* RFC 9973 requires psk_dhe_ke with cert_with_extern_psk. */
modes |= 1 << PSK_DHE_KE;
}
#endif
@@ -18753,12 +18753,12 @@ WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
if (msgType == client_hello && isRequest) {
TLSX* pskm;
/* RFC8773bis: CH2 after HRR must keep CH1's extension set. */
/* RFC 9973: CH2 after HRR must keep CH1's extension set. */
if (secondClientHello && !prevHasPskWithCert) {
WOLFSSL_ERROR_VERBOSE(EXT_NOT_ALLOWED);
return EXT_NOT_ALLOWED;
}
/* RFC8773bis: cert_with_extern_psk depends on these extensions. */
/* RFC 9973: cert_with_extern_psk depends on these extensions. */
if (!hasPsk || !hasPskModes || !hasKeyShare || !hasSg ||
!hasSigAlg) {
WOLFSSL_ERROR_VERBOSE(EXT_MISSING);
@@ -18776,7 +18776,7 @@ WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
}
#endif
pskm = TLSX_Find(ssl->extensions, TLSX_PSK_KEY_EXCHANGE_MODES);
/* RFC8773bis requires client support for psk_dhe_ke mode. */
/* RFC 9973 requires client support for psk_dhe_ke mode. */
if (pskm == NULL || (pskm->val & (1 << PSK_DHE_KE)) == 0) {
WOLFSSL_ERROR_VERBOSE(EXT_NOT_ALLOWED);
return EXT_NOT_ALLOWED;
@@ -18792,7 +18792,7 @@ WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
}
else if (msgType == client_hello && isRequest && secondClientHello &&
prevHasPskWithCert) {
/* RFC8773bis: reject dropping the extension in CH2 after HRR. */
/* RFC 9973: reject dropping the extension in CH2 after HRR. */
WOLFSSL_ERROR_VERBOSE(EXT_NOT_ALLOWED);
return EXT_NOT_ALLOWED;
}
src/tls13.c
+5 -5
View File
@@ -6004,12 +6004,12 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
#endif
#ifdef WOLFSSL_CERT_WITH_EXTERN_PSK
if (ssl->options.certWithExternPsk && psk->resumption) {
/* RFC8773bis mode requires external PSK, not ticket resumption. */
/* RFC 9973 mode requires external PSK, not ticket resumption. */
WOLFSSL_ERROR_VERBOSE(PSK_KEY_ERROR);
return PSK_KEY_ERROR;
}
if (ssl->options.certWithExternPsk && ssl->options.shSentKeyShare == 0) {
/* RFC8773bis Sec. 3: cert_with_extern_psk requires psk_dhe_ke;
/* RFC 9973 Sect. 3: cert_with_extern_psk requires psk_dhe_ke;
* a ServerHello without a key_share confirms only psk_ke. */
WOLFSSL_MSG("cert_with_extern_psk: ServerHello missing key_share");
WOLFSSL_ERROR_VERBOSE(EXT_MISSING);
@@ -6556,7 +6556,7 @@ static int DoPreSharedKeys(WOLFSSL* ssl, const byte* input, word32 inputSz,
}
if (ret == WOLFSSL_TICKET_RET_OK) {
#if defined(WOLFSSL_CERT_WITH_EXTERN_PSK) && defined(HAVE_SESSION_TICKET)
/* RFC 8773bis Sect. 5.1: all PSKs listed alongside
/* RFC 9973 Sect. 5.1: all PSKs listed alongside
* tls_cert_with_extern_psk MUST be external PSKs. A successfully
* decrypted session ticket identity is a resumption PSK, so the
* server MUST abort with illegal_parameter regardless of whether
@@ -6881,7 +6881,7 @@ static int CheckPreSharedKeys(WOLFSSL* ssl, const byte* input, word32 helloSz,
extEarlyData = TLSX_Find(ssl->extensions, TLSX_EARLY_DATA);
if (extEarlyData != NULL) {
/* Check if accepting early data and first PSK.
* RFC 8773bis: early_data is not compatible with
* RFC 9973: early_data is not compatible with
* cert_with_extern_psk, so skip key derivation in that case. */
if (ssl->earlyData != no_early_data && first
&& ssl->options.maxEarlyDataSz > 0
@@ -6951,7 +6951,7 @@ static int CheckPreSharedKeys(WOLFSSL* ssl, const byte* input, word32 helloSz,
ssl->options.sendVerify = SEND_CERT;
certExt->resp = 1;
#ifdef WOLFSSL_EARLY_DATA
/* RFC 8773bis: early_data is not compatible with
/* RFC 9973: early_data is not compatible with
* cert_with_extern_psk. TLSX_Parse already rejects the
* combination in the ClientHello, but clear the response flag
* here as a defense-in-depth measure. */
tests/api/test_tls13.c
+1 -1
View File
@@ -1206,7 +1206,7 @@ int test_tls13_cert_with_extern_psk_rejects_resumption(void)
ssl_s = NULL;
/* Step 2: attempt to resume while also offering cert_with_extern_psk.
* RFC 8773bis Sect. 5.1 requires all PSKs offered alongside
* RFC 9973 Sect. 5.1 requires all PSKs offered alongside
* cert_with_extern_psk to be external PSKs. The client MUST therefore
* suppress the resumption ticket identity from the pre_shared_key
* extension. The handshake succeeds as a cert_with_extern_psk handshake
wolfssl/internal.h
+1 -1
View File
@@ -3006,7 +3006,7 @@ typedef struct Options Options;
#define TLSXT_SERVER_CERTIFICATE 0x0014 /* RFC8446 */
#define TLSXT_ENCRYPT_THEN_MAC 0x0016 /* RFC 7366 */
#define TLSXT_EXTENDED_MASTER_SECRET 0x0017 /* HELLO_EXT_EXTMS */
#define TLSXT_CERT_WITH_EXTERN_PSK 0x0021 /* RFC 8773bis */
#define TLSXT_CERT_WITH_EXTERN_PSK 0x0021 /* RFC 9973 */
#define TLSXT_SESSION_TICKET 0x0023
#define TLSXT_PRE_SHARED_KEY 0x0029
#define TLSXT_EARLY_DATA 0x002a