support mbedtls as backend #495
Conversation
…ptional (see doc-comment of ptls_aead_context_t)
…s (/usr/local, lib)
…nd still refer to `MBEDTLS_SHA384_C` at least on homebrew
There was a problem hiding this comment.
@huitema Sorry for the delay.
Probably the best way to see the differences would be to run git diff -M10 -w -r cc9364e..7e7d39b.
But my focus has been to minimize the cost of maintaining another backend. I've moved comments to picotls.h, changed tests so that existing ones will be reused, etc.
Comments below explain some of the big changes that I have made.
| ctx->super.do_set_iv = aead_set_iv; | ||
| if (is_enc) { | ||
| ctx->super.do_encrypt = ptls_aead__do_encrypt; | ||
| ctx->super.do_encrypt_v = aead_encrypt_v; |
There was a problem hiding this comment.
The implementation has been simplified by dropping support for streaming encryption (~init -> ~update -> ~final). We only support ptls_aead_encrypt and ptls_aead_encrypt_v.
These changes have led to reduction of states in ptls_mbedtls_aead_context_t.
There was a problem hiding this comment.
Is that something we expect for every AEAD implementation?
|
@huitema Thank you for reviews. This PR has been merged.
I think we can add docs to https://github.com/h2o/picotls/wiki now that this PR has been merged. I can see the docs written in two ways. We can expand https://github.com/h2o/picotls/wiki/Using-picotls as it talks about two backends that we have already. Or, we can create a new document dedicated mbedtls backend. I'm fine either ways, but maybe the latter would be simpler and easier to understand? |
Subsumes #485.