tree 71b06a051e3bb0cdc796e30cf513a6cadd1172d5
parent 22360ee32352ea63b530c27cfb74da09737151dc
author David Brown <david.brown@linaro.org> 1620523300 -0600
committer Kumar Gala <kumar.gala@gmail.com> 1620572362 -0500

modules: mbedtls: Enable PKCS1 v2.1

This Mbed TLS configuration option was being selected based on a
non-existent Kconfig option, and hence would never be defined.  v2.1 of
PKCS1 was published in 2003.  Use of v1.5 has been deprecated since
2016, and should not be used in new or existing designs.

Enable the v2.1 version in any situation where RSA is used for
signatures.  In the future, we should disable v1.5 entirely, but only
after all uses have been determined and possibly corrected.

No significant weaknesses have been found in v1.5, however v2.1 has a
significant security proof.  However, v2.1 does require an entropy
source, which may be an issue in some embedded device situations (which
likely are problematic for other cryptographic reasons).

Signed-off-by: David Brown <david.brown@linaro.org>