From 480a9bfb09eedac2d6e5e752d87a39e110d4a133 Mon Sep 17 00:00:00 2001 From: David Horstmann Date: Mon, 21 Sep 2026 17:07:36 +0100 Subject: [PATCH] Fix incorrect check in check_config.h OAEP is for RSA encryption and therefore is not the correct check when we want to test for signatures with PSS. Additionally, we can use RSA PSS when we only have public key support (not key pairs) so check for PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY (which is auto-enabled when we have key pairs enabled anyway). Signed-off-by: David Horstmann --- library/mbedtls_check_config.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/mbedtls_check_config.h b/library/mbedtls_check_config.h index b482771714..9f2a290944 100644 --- a/library/mbedtls_check_config.h +++ b/library/mbedtls_check_config.h @@ -93,7 +93,7 @@ #endif #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \ - ( !defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) || !defined(PSA_WANT_ALG_RSA_OAEP) ) + ( !defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) || !defined(PSA_WANT_ALG_RSA_PSS) ) #error "MBEDTLS_X509_RSASSA_PSS_SUPPORT defined, but not all prerequisites" #endif @@ -114,7 +114,7 @@ #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) #if !( (defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)) && \ defined(MBEDTLS_X509_CRT_PARSE_C) && \ - ( defined(PSA_HAVE_ALG_ECDSA_SIGN) || defined(PSA_WANT_ALG_RSA_OAEP) ) ) + ( defined(PSA_HAVE_ALG_ECDSA_SIGN) || defined(PSA_WANT_ALG_RSA_PSS) ) ) #error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED defined, but not all prerequisites" #endif #endif