mirror of
https://github.com/godotengine/godot.git
synced 2026-07-24 08:06:02 -04:00
Fabio Alessandrelli
1aa93a7ab0
Here be dragons! mbedTLS 4.1 is the new LTS branch (supported until at least March 2029). Since mbedTLS 4, the library have been split into a separate TF-PSA-Crypto repository, with mbedTLS only acting as an X.509 and TLS library (TF-PSA-Crypto is still bundled in mbedTLS releases). The TF-PSA-Crypto library is the reference implementation for the PSA Cryptography API, an attempt by ARM to standardize cryptographic APIs. While I commend the attempt, the usual "new standard" meme applies. This commit refactor the CryptoCore and mbedtls module code to use the PSA API, using mbedTLS proper for TLS, X.509, base64 and RSA/EC parsing. There are some quirks/changes due to this: - **breaking change** The `AESContext::get_iv_state` function now always returns and empty PackedByteArray since extracting the IV state from a PSA cipher operation is not currently possible. - The CryptoCore random generation function now has an implicit global lock due to the underlying `psa_generate_random` usage. - The PSA Crypto API is very opinionated when it comes to key usage and does not allow to change usage after a key is imported. For this reason `CryptoKey`s need to be reimported with the correct usage flags before performing different cryptographic operations. The current implementation does so transparently sacrificing some performance for simplicity (and compatibility). This commit drops compatibility with the mbedTLS 2.8 branch (EOL since the end of 2024), but retain compatibility with the mbedTLS 3.6 branch (expected EOL March 2027).