[gnutls-devel] GnuTLS | groups: represent hybrid groups with an array of IDs (!1904)

[Read-only notification of GnuTLS library development activities]

Merge request https://gitlab.com/gnutls/gnutls/-/merge_requests/1904 was reviewed by Daiki Ueno

--
  
Daiki Ueno commented on a discussion on lib/algorithms/groups.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1904#note_2249852268

 > -	  .tls_id = 0x11EB,
 > -	  .next = &group_mlkem768 },
 > +	  .ids = { GNUTLS_GROUP_SECP256R1, GNUTLS_GROUP_EXP_MLKEM768 },

Good idea, I actually included it in the initial version, but removed it given the length is always 2 for now. If we continue using an array, having a NUL terminator would provide more flexibility.

--
  
Daiki Ueno commented on a discussion on lib/algorithms/groups.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1904#note_2249852274

 > +}
 > +
 > +static inline bool group_is_supported(const gnutls_group_entry_st *group)

With a property string, I think it works same as before, e.g., `-GROUP-ALL:+GROUP-X25519-MLKEM768` does enable only the X25519-MLKEM768 group. On the other hand, disabling X25519 now disables X25519-MLKEM768 as well (previously it didn't affect the hybrid group), but I'd say this is rather expected.

--
  
Daiki Ueno commented on a discussion on lib/algorithms/groups.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1904#note_2249852275

 > +		return group_is_supported_standalone(group);
 > +
 > +	for (size_t i = 0; i < NUM_HYBRID_GROUPS; i++) {

It's quite hypothetical, but yes, we could support hybrid groups of more than 2 groups if needed.

--
  
Daiki Ueno commented on a discussion on lib/algorithms.h: https://gitlab.com/gnutls/gnutls/-/merge_requests/1904#note_2249852278

 >  #endif
 >  
 > +#define IS_GROUP_HYBRID(group) ((group)->ids[0] != GNUTLS_GROUP_INVALID)

Because all groups are statically allocated in bss, as part of `supported_groups`?


-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1904
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20241210/725da42a/attachment-0001.html>