Revert switch to EC handshake algorithm (aws#1680)

* Revert "ESP32 specific mirror of PR aws#1668 (aws#1670)" This reverts commit 2887e50. * Revert "Switch to using ECDHE-ECDSA Algorithm for TLS Handshake (aws#1668)" This reverts commit 35f399c.
yuhui-zheng · Feb 13, 2020 · 4c066b1 · 4c066b1
1 parent 9e8e131
commit 4c066b1
Show file tree

Hide file tree

Showing 6 changed files with 13 additions and 27 deletions.
diff --git a/libraries/3rdparty/mbedtls/include/mbedtls/config.h b/libraries/3rdparty/mbedtls/include/mbedtls/config.h
@@ -939,7 +939,7 @@
  *      MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  *      MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA
  */
-//#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED

diff --git a/libraries/freertos_plus/standard/tls/src/iot_tls.c b/libraries/freertos_plus/standard/tls/src/iot_tls.c
@@ -759,8 +759,8 @@ BaseType_t TLS_Connect( void * pvContext )
         if( 0 == xResult )
         {
             xResult = mbedtls_x509_crt_parse( &pxCtx->xMbedX509CA,
-                                              ( const unsigned char * ) tlsATS3_ROOT_CERTIFICATE_PEM,
-                                              tlsATS3_ROOT_CERTIFICATE_LENGTH );
+                                              ( const unsigned char * ) tlsATS1_ROOT_CERTIFICATE_PEM,
+                                              tlsATS1_ROOT_CERTIFICATE_LENGTH );
 
             if( 0 == xResult )
             {

diff --git a/vendors/espressif/boards/esp32/aws_demos/sdkconfig b/vendors/espressif/boards/esp32/aws_demos/sdkconfig
@@ -575,13 +575,13 @@ CONFIG_MBEDTLS_TLS_ENABLED=y
 # TLS Key Exchange Methods
 #
 CONFIG_MBEDTLS_PSK_MODES=
-CONFIG_MBEDTLS_KEY_EXCHANGE_RSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA=n
+CONFIG_MBEDTLS_KEY_EXCHANGE_RSA=y
+CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA=y
 CONFIG_MBEDTLS_KEY_EXCHANGE_ELLIPTIC_CURVE=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA=n
+CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA=y
 CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA=n
+CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA=y
+CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA=y
 CONFIG_MBEDTLS_SSL_RENEGOTIATION=y
 CONFIG_MBEDTLS_SSL_PROTO_SSL3=
 CONFIG_MBEDTLS_SSL_PROTO_TLS1=y

diff --git a/vendors/espressif/boards/esp32/aws_demos/sdkconfig.defaults b/vendors/espressif/boards/esp32/aws_demos/sdkconfig.defaults
@@ -17,13 +17,6 @@ CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=8192
 CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=4096
 CONFIG_MBEDTLS_CMAC_C=y
 CONFIG_MBEDTLS_ECP_RESTARTABLE=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_RSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_ELLIPTIC_CURVE=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA=n
 CONFIG_BT_ENABLED=y
 CONFIG_BLUEDROID_ENABLED=
 CONFIG_NIMBLE_ENABLED=y

diff --git a/vendors/espressif/boards/esp32/aws_tests/sdkconfig b/vendors/espressif/boards/esp32/aws_tests/sdkconfig
@@ -573,13 +573,13 @@ CONFIG_MBEDTLS_TLS_ENABLED=y
 # TLS Key Exchange Methods
 #
 CONFIG_MBEDTLS_PSK_MODES=
-CONFIG_MBEDTLS_KEY_EXCHANGE_RSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA=n
+CONFIG_MBEDTLS_KEY_EXCHANGE_RSA=y
+CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA=y
 CONFIG_MBEDTLS_KEY_EXCHANGE_ELLIPTIC_CURVE=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA=n
+CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA=y
 CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA=n
+CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA=y
+CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA=y
 CONFIG_MBEDTLS_SSL_RENEGOTIATION=y
 CONFIG_MBEDTLS_SSL_PROTO_SSL3=
 CONFIG_MBEDTLS_SSL_PROTO_TLS1=y

diff --git a/vendors/espressif/boards/esp32/aws_tests/sdkconfig.defaults b/vendors/espressif/boards/esp32/aws_tests/sdkconfig.defaults
@@ -17,13 +17,6 @@ CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=8192
 CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=4096
 CONFIG_MBEDTLS_CMAC_C=y
 CONFIG_MBEDTLS_ECP_RESTARTABLE=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_RSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_ELLIPTIC_CURVE=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA=n
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA=n
 CONFIG_BT_ENABLED=y
 CONFIG_BLUEDROID_ENABLED=
 CONFIG_NIMBLE_ENABLED=y