Hi Maren,

The TLS 1.3 specification defines only 3 ECDSA algorithms: ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384 and ecdsa_secp521_sha512, we only support these in Mbed TLS. Unfortunately, there are no config options that would make Brainpool curves work with TLS 1.3.

I am sorry, but at the moment we don’t have any plans about adding Brainpool curve support for TLS 1.3.

Best regards,

Janos

From: Maren Konrad via mbed-tls <mbed-tls@lists.trustedfirmware.org>
Date: Tuesday, 12 November 2024 at 11:51
To: mbed-tls@lists.trustedfirmware.org <mbed-tls@lists.trustedfirmware.org>
Subject: [mbed-tls] TLS 1.3 and brainpool curves

Dear MbedTLS maintainers,

we are already using MBedTLS, however, we recently enabled TLS 1.3 and
found that our certificates doesn't work anymore, because they are
brainpoolP256r1 (https://datatracker.ietf.org/doc/html/rfc8734). So the
question would be, if I missed any configuration to enable the usage of
brainpool curves (which are working for TLS 1.2) or if there are any
plans, that these are getting supported by MBedTLS 3.6.x?

Best regards,

Maren Konrad