Hi Sandrine,

Thanks for the notifying us.

I also gather TF-A moved out of 2.28.x support for MBedTLS. This means it will be left to the LTS if we decide to keep supporting the 2.28.x versions.

For now the lts-v2.8 branch has 2.28.x support(may be we will continue till end of the year depending on the effort involved and requirements from partner(s). ).

The new lts-v2.10 will directly be taking the mainline MBedTLS and hence will be MBedTLS3.x for which this may not be applicable.

--Bipin

-----Original Message----- From: Varun Wadekar vwadekar@nvidia.com Sent: Friday, January 26, 2024 11:13 AM To: Sandrine Bailleux Sandrine.Bailleux@arm.com; tfa-lts@lists.trustedfirmware.org Subject: [TFA-LTS] Re: Mbed TLS 2.28.7 got released

Thanks Sandrine.

The LTS branch follows the mainline, so if these fixes are picked up there, we will merge to the LTS branch.

-----Original Message----- From: Sandrine Bailleux sandrine.bailleux@arm.com Sent: Friday, January 26, 2024 2:50 PM To: tfa-lts@lists.trustedfirmware.org Subject: [TFA-LTS] Mbed TLS 2.28.7 got released

External email: Use caution opening links or attachments

Hi TF-A LTS maintainers,

FYI Mbed TLS project released a minor version with 2 security fixes. See the release notes here: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7

I believe TF-A is not affected by any of these 2 security issues. To the best of my knowledge:

* Private key RSA operations are only used for asymmetric-key decryption. In most cases, TF-A does not decrypt anything, it only verifies boot signatures, which rather involves RSA *public* key operations.

There is the case of the firmware decryption feature (see `ENCRYPT_FW` build option and associated code & doc) but this uses AES-GCM, not RSA.

* TF-A does not modify boot certificates (so no X.509 extensions modifications), it only consumes them.

Best regards, Sandrine IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. _______________________________________________ TF-A LTS mailing list -- tfa-lts@lists.trustedfirmware.org To unsubscribe send an email to tfa-lts-leave@lists.trustedfirmware.org _______________________________________________ TF-A LTS mailing list -- tfa-lts@lists.trustedfirmware.org To unsubscribe send an email to tfa-lts-leave@lists.trustedfirmware.org IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.